On 5 January 2018, at about 1600 Western Standard Time[1] the pilot of a Cessna 172M, aircraft registered VH-TUX (TUX) operated by Goldfields Air Services conducted a forced landing into scrubland about 72 km south-south-west of Kalgoorlie Airport, Western Australia. The pilot and one fire spotter were uninjured. The aircraft sustained minor damage.
On 4 January 2018, TUX returned to service following repairs due to significant damage sustained during a storm in January 2017. The repairs involved a bulk strip of the engine, and replacement of the propeller and both wings.
On the morning of 5 January 2018, the pilot returned from a flight in another Cessna 172 around the Kalgoorlie area. The pilot’s next scheduled flight was to conduct fire-spotting operations in the Lake Johnstone area to the south-west of Kalgoorlie (Figure 1).
Figure 1: Location of Kalgoorlie – Boulder airport and overlay of flight paths to fire fronts
Source: Hema- Australia map, flight path overlay by Goldfields Air Services. Annotated by ATSB
The pilot anticipated fire-spotting operations would typically run for two to three hours. The pilot was familiar with TUX and had flown it on numerous occasions over a period of about 18 months prior to its repair and return to service.
At about 1100, the pilot performed a daily inspection and checked the aircraft’s maintenance release. This was the first revenue flight following the repairs and the pilot noted two previous entries from when the aircraft was signed out by the Chief Pilot for check flights prior to its return to service. Apart from the installation of a new propeller, the pilot reported that the aircraft appeared largely unchanged.
During the daily inspection, the pilot dipped the right-hand tank noting the fuel dipstick was graduated in fractions (1/4, 1/2, 3/4 and F) rather than decimal increments in litres as it was when the pilot had flown TUX prior to its return to service. For this flight, the calibration of the dipstick was not important as the pilot had decided to take a full fuel load due to there being only one other person on-board. The pilot recorded a total fuel quantity of 180 litres on board at the start of the flight.
After refuelling, the pilot met with the fire spotter to discuss the flight. During this briefing, the fire spotter identified a second fire front located north-east of Fraser Range that would also require an inspection. The pilot reported that they planned the flight using the OzRunways, electronic flight bag application however, the flight planning requirements detailed in the operations manual were not conducted.
At about 1217, TUX departed Kalgoorlie aerodrome heading east-south-east for the first leg. The aircraft climbed to a cruising altitude of 7,500 ft above mean sea level and continued to a location 232 km from Kalgoorlie. At this location, the pilot descended TUX to between 500 and 1,000 ft above ground level to inspect an active fire front. The pilot circled at that location for approximately 20 minutes before departing to the second location.
The second location was approximately 289 km south-west from the first. The pilot departed the first location and climbed to a cruising altitude of 8,500 ft. Upon arrival at the second location the pilot again descended TUX to between 500 and 1,000 ft above ground level, spending approximately 15 minutes inspecting the second fire front.
The pilot departed the second fire front, climbing to 7,500 ft for the final leg of the flight northward toward the Kalgoorlie aerodrome. At about 1555 at 7,500 ft, the engine speed began to steadily reduce toward idle. The pilot switched between fuel tanks and adjusted the mixture and throttle settings. This resulted in the engine speed momentarily increasing before returning to idle.
The aircraft was about 72 km from Kalgoorlie aerodrome over scrubland. The pilot noticed a dirt road (Burra Rock Road) to the north-west of his current track and prepared TUX and the fire spotter for a forced landing on the road. The pilot made a MAYDAY[2] call at about 5,000 ft and shortly after activated the Emergency Locator Transmitter (ELT).
As TUX descended below 2,000 ft, the pilot realised the aircraft glide range would be insufficient to land on the road. The pilot identified an area of less dense scrub and landed TUX, coming to a stop approximately 30 m from the Burra Rock Road with minimal damage. Both pilot and fire spotter exited the aircraft with no injury. The pilot was unable to make contact by VHF radio[3] or mobile phone at the landing site so they walked about 1 km to Burra Rock Main Dam where mobile phone reception was possible.
At about 1600, the Australian Maritime Safety Authority contacted the operator and requested their assistance to undertake a search and rescue flight to the ELT location. Shortly after, the search aircraft arrived at the location and held overhead until emergency services attended the site at about 1700.
Fuel management
Fuel system
The Cessna 172M utilises a gravity feed fuel system from a fuel tank mounted in each wing. Both wings on TUX had been replaced during the recent repairs, with wings from another Cessna 172M. However, the replacement wings were fitted with smaller capacity tanks, which reduced the useable fuel capacity from the original 182 litres to 144 litres. A fuel gauge calibration check was performed on 21 December 2017 and a fuel calibration placard was affixed to the centre of the instrument panel. Fuel quantity labels were also placed adjacent to the fuel filler caps indicating the respective tank’s fuel capacity (Figure 2).
Figure 2: Fuel placard and label installed on VH-TUX
Source: Goldfields Air Services
A hand written entry dated 22 December 2017 adjacent section 1.3 Fuel in the Pilots Operating Handbook recorded ‘Wings replaced, fuel capacity 144 litres, Refer PenYan Supplement[4] for fuel consumption data.’
Accurate fuel determination
Prior to the fire spotting flight in TUX, the pilot dipped the right tank which indicated about 3/4 full on the dipstick. The pilot did not dip the left tank, as the intention was to fill the tanks before departing for the flight. The pilot uploaded a total of 45.9 litres of fuel between the two tanks. The pilot stated the fuel quantity uploaded was consistent with his expectation, based on previous experience with TUX, to fill the tanks on this aircraft.
The pilot did note that the dipstick was graduated in quarters, rather than in decimal increments (litres). He considered that these markings when used to determine the fuel quantity remaining was not optimal as it potentially made it more difficult for a pilot to check actual fuel (in litres) remaining in the aircraft, if departing with less than full tanks (Figure 3).
Because TUX had just returned to line following evaluation flights post repair, no Trip Sheet[5] was available in the aircraft to indicate recent fuel usage history. The pilot raised a new Trip Sheet and recorded a fuel upload of 46 litres and that the total fuel on board at start-up was 180 litres.
Figure 3: Fuel dip sticks from Cessna aircraft TUX and CAL
Image of fuel dipsticks from the incident aircraft VH-TUX (left) and the aircraft VH-CAL (right) flown by the pilot earlier on the morning of 5 January 2018. Source: Goldfields Air Services, annotated by ATSB
Flight planning
The pilot checked weather conditions for the flight which were ideal (CAVOK)[6] for the rest of the day. To determine the time available at each location, the planned flight paths to the fire front locations were calculated using the OzRunways application and Jeppesen circular slide rule. Based on previous experience in flying TUX, the pilot determined that with full fuel tanks, there was a flight time of 4 hours available from when they took off, which would give about 15‑20 minutes at each fire location for the inspections. The pilot’s methods for planning the flight were inconsistent with the operator’s standard operating procedures and instructions.
In-flight fuel management
The cruise sections of the flight were undertaken at 2,500 RPM, to run the engine in following the rebuild. The pilot climbed to 7,500 and 8,500 ft and leaned the mixture. The pilot had noted the departure time and estimated time of arrival to ensure the flight could be completed within the calculated fuel endurance. The pilot periodically checked the fuel gauges[7] during the flight, which were indicating a steady decrease as the flight progressed. As TUX approached the second fire front located in the Lake Johnston area, the pilot noticed the gauges were indicating lower than he would have expected but discounted the lower than expected indication on the basis of his calculated fuel endurance.
The pilot reported that he had one fuel gauge indicating around 5 US gallons and the other around 2 US gallons when the engine reduced to idle and ceased producing power. The pilot did not recall which gauge provided the respective indications.
Operator’s report
The operator conducted their own investigation of the occurrence circumstances. Their investigation report listed a number of applicable standard operational procedures that specified the minimum requirements for pre-flight preparation, planning and in-flight fuel management for the intended operation type. These procedures required a pilot to ensure the documentation of flight plans, weather briefings and other information prior to departure. With the exception of the Trim and Trip sheets, there was no evidence of a documented flight plan, weather information, or a navigation log completed by the pilot.
The operator utilised flight planning software, which contained the approved performance data for each aircraft, including fuel consumption. As part of their internal investigation, post‑incident flight planning calculations were undertaken using this software as well as the actual fuel consumption during the occurrence flight. Those calculations indicated that TUX did not have the available fuel capacity, even if fitted with the original larger fuel tanks, to complete the intended flight with the operator‑required fixed fuel reserve of 45 minutes[8].
Aircraft inspection
On 6 January 2018, the operator’s maintenance personnel inspected and commenced recovery of TUX from the landing site. The aircraft was powered-up and the gauge for the left wing tank was observed to indicate a reading equating to approximately 10 litres of fuel in the tank. There was no record in the operator’s report of the indication on the right tank gauge. The fuel was drained from the wing tanks and fuel system strainer yielding about 200 mL in total (around 25 mL from the tanks and 150 mL from the fuel strainer).
On 9 January 2018 following the recovery of TUX, the operator’s maintenance personnel reconnected the fuel gauges and found both gauges indicated empty. Although the wing was not fitted to the fuselage, 30 litres of fuel was added and drained from the left wing tank to check the correspondence of indications on the left tank gauge. With fuel added, the gauge indicated just under the half-full mark. After draining the fuel, while tapping the wing to simulate normal vibrations during flight, the gauge returned to indicate just below empty. Although this test did not take into account unusable fuel, the operator considered these indications were within expectation for the quantity of fuel added, and the fuel transmitter was found to operate smoothly across the full range checked.
On the 12 January 2018 the engine of TUX was started with no roughness at idle evident. After warming, the engine was accelerated up to maximum ground RPM. The engine accelerated smoothly with no abnormal sounds and oil pressure and exhaust gas temperature indicated a normal reading.
Operator communication with pilots
The operator’s chief pilot communicated to line pilots either verbally, by e-mail, or through the Alerts feature of the operator’s Air Maestro Safety Management System software. The Air Maestro system was primarily used to formally disseminate information related to scheduling, rosters, safety reports and new operational alerts or notifications. The operator acknowledged an omission occurred in the dissemination of information, which resulted in no operational alert/notification being published on Air Maestro in relation to the change in the useable fuel capacity or upgraded engine for TUX.
The aircraft was equipped with a folder containing the maintenance release, the manufacturer’s pilot operating handbook, weight and balance data and aircraft supplements. The pilot’s operating handbook for TUX included handwritten amendments by the chief pilot in the fuel section. The amendments were dated 22 December 2017, recording the aircraft wings had been replaced and the fuel capacity of 144 litres. Reference was also included to refer to the Pen Yan flight manual supplement for fuel consumption data associated with the newly‑installed engine.
Safety analysis
While the pilot conducted his pre-flight planning activity, it was not consistent with the regulatory requirements for flight planning and preparation, or the operator’s electronic flight bag administration and in-flight fuel management procedures. Consequently, the pilot did not identify that, even if it had been fitted with the original larger fuel tanks, the aircraft had insufficient endurance to safely conduct the flight.
The pilot’s pre-flight planning was based on the expectation that the aircraft’s endurance would be 4 hours after departing Kalgoorlie. This was consistent with the pilot’s belief that the useable fuel capacity and fuel consumption of TUX was unchanged from the 182 litres available when the pilot operated the aircraft before its removal from line in January 2017. The pilot did not detect the change to the flight manual or the fuel tank capacity displayed on the cockpit fuel calibration card or tank placards installed following the installation of the new wings and calibration of the fuel system. Additionally, because this was the first flight of TUX following return to service, there was no available information available from a Trip Sheet, to provide an indication to the pilot that the fuel capacity had reduced.
During the fight, the pilot observed a steady decrease in the indications on the fuel gauge. Although the indications appeared lower than expected at the second fire front location, the pilot discounted the accuracy of the indications. The pilot’s in-flight fuel management was likely also based on the expectation of the aircraft’s endurance, rather than crosschecking the expected fuel burn against the fuel burn achieved during flight at the 30-minute intervals required under the operator’s standard operating procedures.
The change to the aircraft’s total fuel tank capacity (and corresponding reduction in the aircraft’s endurance) was not formally published in the operators Air Maestro Safety Management System to alert line pilots of the significant modification to the aircraft prior to its return to line on the 5 January 2018.
The absence of information alerting pilots to the change in the aircraft’s endurance and the pilot’s pre-flight fuel management planning (based on an expectation), meant that there was insufficient fuel available for the intended flight. Furthermore, pilot’s in‑flight fuel management resulted in the aircraft exhausting its useable fuel supply about 3 hours and 38 minutes into the flight with the aircraft about 72 km from the intended landing point.
When the engine began to reduce power, the pilot’s experience from instructing student pilots on the protocols for an engine restart and practice forced landings likely aided in managing workload during the emergency and led to the successful forced landing.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The pilot's fuel management practices resulted in a complete loss of engine power due to fuel exhaustion that led to a forced landing in scrubland.
The aircraft's reduced fuel capacity was not adequately communicated to the pilot in accordance with the operator’s standard practices.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Goldfield Air Service conducted an internal review to:-
determine incidence of deviation within the pilot group from the implementation of standard operating procedures
examine the operator’s change management plan to determine, at an organisational level, why the effect of the changes to the aircraft configuration were not fully captured and broadcast to all operating crews.
Safety message
Fuel starvation and exhaustion events continue to be reported to the ATSB. It is therefore important for pilots to continue to educate themselves on the risks and controls associated with fuel management.
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 13 January 2018, the International Balloon Flight Company (Australia) prepared to conduct morning scenic charter flights in the Hunter Valley, New South Wales, utilising four of the operator’s balloons. The operator stated that on the evening of 12 January 2018 he reviewed several weather websites to assess the conditions the following morning. The weather websites reportedly indicated light surface winds with a sharp increase in surface wind speed from 1100 Eastern Daylight‑saving Time.[1] He stated he made a further check at 0330 on 13 January 2018, which showed the weather conditions were unchanged. Based on the assessed conditions, a decision was made to continue with the morning’s four simultaneous balloon flights. The operator reported that the forecast surface winds were light at the planned launch time of about 0540.
The four pilots and the ground crew met at a location about 7 km north of Cessnock. They assessed the local conditions and decided on the take-off and landing site. The balloon ground crews launched a piball[2] at the meeting location and surface winds were assessed as being about 5 kt.[3] As it ascended, the piball initially went in a northerly direction and then veered to steady on a heading of about 140° T. Based on the local assessment, the pilots decided to take off from the most northerly take-off site, at Whittingham, which was of a similar elevation to the meeting location. The intended landing site was in a paddock, 19 km to the south-east near Rothbury (Figure 1).
Figure 1: Take-off site, intended and actual flight paths and landing sites
Source: Google earth, modified by the ATSB
The crew and passengers then travelled to the launch site. At the launch site, the ground crew inflated another piball and reportedly observed similar conditions to the meeting site. Each of the four balloon pilots then conducted a safety briefing with their passengers. The briefings included the passengers’ positions in the basket and a demonstration of the brace landing position, in accordance with the operator’s procedures.
At 0540, a Kavanagh B-425 balloon registered VH-OKX, with 15 passengers and one pilot onboard, lifted off in conditions that were reported to be a light north-westerly wind, at about 5 kt. The operator’s other balloons launched soon after OKX.
OKX maintained 40 ft above ground level (AGL) for about 5 minutes, then climbed to about 2,500 ft AGL. The balloon was then carried in an east-south-easterly direction over undulating country in the general direction of Maitland. The pilot stated the wind direction changed and the speed increased at about 0600, which was significantly earlier than he expected.
The balloon pilots communicated with each other regarding the wind speed and decided to land at the first suitable site. The predetermined landing areas were no longer available to them, as the wind change had taken them further east than they had planned. The area selected was a large open field that was not one of their normal landing areas.
The pilot of OKX reported that the balloon descended gradually over the next 15 to 20 minutes, and the balloon’s speed increased. He briefed the passengers for landing and advised them to rest their backs on the basket padding and hold on to the internal grab handles as per their previous briefing. The passengers maintained that position for the duration of the landing. The balloon approached the landing site about 4 km south of Greta, with a ground speed of about 20 kt.
As the balloon descended into the centre of the clearing (several feet above the surface), the pilot turned off the gas to the burners and opened the envelope deflation system. The balloon landed lightly with the basket upright, then the basket laid over onto its side and was dragged across the field by the balloon envelope acting as a sail in the wind.
The pilot stated that following the landing, the balloon changed direction slightly and was dragged about 40 m towards a large bush in the centre of the field. The basket subsequently contacted the bush, lifted up rapidly on its right side and landed back down heavily. It was then dragged a further 50-60 m before coming to rest (Figure 2). Due to the significant ground impact forces, one passenger was seriously injured, and three others sustained minor injuries. All four passengers were taken to hospital for examination, with three being discharged on the same day.
Figure 2: Landing site terrain with the deflated balloon, basket and the bush it contacted
Source: Australian Broadcasting Corporation with annotation by ATSB
Two of the other three company balloons were landed in the same open area, laid over and dragged for a short distance with no occupant injuries or damage. The third balloon continued flying for about half an hour and landed safely, but the balloon’s envelope was damaged by contact with foliage.
Other occurrences
A search of the ATSB occurrence database found that over the period from January 2007 to January 2018 there were 46 other balloon inadvertent hard landings, contact with obstacles or collision with terrain. Most occurrences were reported to be associated with changing weather conditions.
Weather forecasts
The operator stated he reviewed several weather websites to obtain weather models for the intended flight on 13 January 2018. Bureau of Meteorology (BoM) forecasts were reportedly reviewed, but as the forecasts were for the general area, the operator stated that he preferred local weather models for specific areas. He stated that these models indicated surface winds of 7 kt at 0500 and 5-6 kt at 0800, with a sharp increase at 1100. He advised that he knew the upper winds were stronger but was confident with the weather model.
In discussing preparation for flight, the Aeronautical Information Publication (AIP) ENR 1 – GENERAL RULES AND PROCEDURES, Section 1.10 ‑ FLIGHT PLANNING, paragraph 1 ‑ FLIGHT PLAN PREPARATION, sub‑paragraph 1.1 stated:
Before beginning a flight, a pilot in command must study all available information appropriate to the intended operation and, in the case of flights away from the vicinity of an aerodrome…must make a careful study of:
a. current weather reports and forecasts for the route to be flown and the aerodromes to be used;
…
Further, sub‑paragraph 1.2.1 required that:
Forecast information must include:
…
b. one of the following:
(i) flight forecast; or
(ii) GAF [graphical area forecast[4]] (at or below A100)…
…
c. wind and temperature forecast
For a flight to a destination for which a prescribed approach procedure does not exist, the minimum requirement is a GAF.
The BoM graphical area forecast (GAF) valid for the intended flight indicated broken cloud and isolated showers with severe turbulence forecast below 7,000 ft from 0400 on 13 January 2018. Additionally, a forecast for moderate turbulence that affected the intended flight area had been in place since 0000 on 13 January 2018.
The grid point wind and temperature (GPWT)[5] forecast (Table 1) indicated wind speeds that were consistent with the forecast severe turbulence. At 0200, the GPWT forecast indicated a steady increase in wind speed from 1,000 ‑ 5,000 ft. At 0500, the wind speed was forecast to significantly increase with altitude. The air temperature was forecast to remain steady at about 30°C at 2,000 ft and below.
Table 1: The grid point wind and temperature forecast at 0200 and 0500 EDT, 13 January 2018
An inflated balloon envelope displaces a proportionate volume of air and in the process creates lift equivalent to the weight of the displaced air. For a balloon to start rising, its buoyancy needs to be increased by heating the air within the envelope with a gas-powered burner(s). Heating decreases the air density within the envelope such that the balloon’s mass becomes relatively less than the lift created by the displaced air. To descend, the pilot allows the air in the envelope to cool naturally. For a given air temperature/density within the balloon envelope, buoyancy is reduced by increased altitude, increased outside air temperature and increased humidity.
In stable flight, a balloon flies at the same speed and direction as the wind at that altitude. A degree of directional control is achieved by climbing or descending to levels with the desired wind direction.
Safety analysis
Weather conditions on the day of the incident
The operator advised that they relied on weather models for the local area and that when the balloons launched at about 0540, the surface temperature was 22°C. The pilot of OKX stated that at about 0600, and 2,500 ft, some 20 minutes after the balloons launched, the air temperature measured from the balloon basket increased to 29°C. The operator assessed that, as a consequence, the sudden increase in temperature near the surface penetrated an inversion layer. He further concluded that situation resulted in the mixing of wind layers above and below the balloon, resulting in turbulence, and a rapid change in wind speed and direction.
However, a review of the GPWT and GAF forecasts for the area indicated that the air temperature was forecast to be about 30°C, at 2000 ft, at the time of the flight. The temperature was consistent with the balloon pilot’s observed air temperature, when OKX was at 2,500 ft. Further, the GPWT forecast at 0200 and 0500 showed winds speeds increasing over time and with altitude. Based on the forecast conditions, the ATSB concluded that the encountered turbulence was probably the result of mechanical effects associated with strong winds rather than the result of penetrating an inversion layer.
More significantly, a review of the forecast weather conditions, consistent with the AIP requirements, would have identified the likelihood of the flight encountering strong winds and severe turbulence. In that context, the ATSB considers that the exposure of the pilots and passengers to hazardous weather conditions during the flight, and the injuries sustained during the landing, were avoidable.
Layover landings in strong winds
In light winds, the basket normally remains upright on landing. However, in winds greater than about 10 kt, layover landings can occur. During these landings the basket tips onto its side and is dragged until the balloon envelope deflates. The baskets are designed to withstand these type of events and have padding and grab handles on the inside of the basket for occupant protection and support. Layover landings, although undesirable, are not unusual and should not significantly increase risk, provided they are prepared for and executed appropriately in a suitable landing area.
OKX landed at a ground speed of about 20 kt. At that speed the pilot needed an approximate clearing of about 200 m to land the balloon safely, allowing for a significant stopping distance. Based on the safe landings executed by two other company balloons, the clearing selected was suitable with the exception of the large bush that was struck by the basket.
As the basket landed, the balloon envelope started to drag the basket (on its side) across the terrain (Figure 2). Between the vent outlet and top of the balloon, a 5‑6 m bubble of hot air remained, and the balloon envelope started to act like a sail, further dragging the basket. This also changed the direction of the basket and it was dragged towards a bush. The right-hand side of the basket struck the bush, bouncing it forcefully back into the air. It subsequently came down on one corner and was dragged a further 50-60 m before coming to rest.
The landing site was largely cleared and the pilot had landed the balloon with clear ground in the direction of travel. However, the direction of drag changed, which resulted in the collision with the bush. When the basket collided with the bush and became airborne, the subsequent ground impact resulted in four injuries.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Shortly after take-off, the balloon experienced strong winds and turbulent conditions, as predicted in the Bureau of Meteorology graphical area forecast and grid point winds and temperature forecast. Consequently, the balloon deviated from its intended flight path and landing area. Due to the adverse conditions, the pilot decided to land at the first suitable site, which was a clearing that was unfamiliar to him.
Due to the wind conditions, the balloon landed with a significant forward velocity and was dragged for a considerable distance on its side by the balloon’s partially deflated envelope. As the basket was being dragged, it struck a large bush, forcing it upwards before impacting the ground with considerable force that resulted in injuries to four of the passengers.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following operator safety actions in response to this occurrence.
Operator actions
The operator advised the ATSB that the following lessons were learnt from this occurrence:
Future flights at Whittingham will need another weather check to be carried out at a more elevated location to gain a better perspective of surface winds and temperature changes.
Pressure dropping to 1,000 hPa and below is an indication of changing weather conditions and should be taken into strong consideration when making a decision to fly.
The area south of Greta was the first large open area to land. Another very large landing area at a lower elevation has been identified for use should there be another weather event.
Elderly passengers will be positioned in compartments with more people to restrict the potential for flail‑type injuries.
Safety message
This accident highlights the importance of studying all available weather information when preparing for a flight. In this instance the aviation‑specific products generated by the Bureau of Meteorology clearly identified the presence of weather that was hazardous to balloon operations.
About this report
Decisions regarding whether to conduct an investigation, and the scope of an investigation, are based on many factors, including the level of safety benefit likely to be obtained from an investigation. For this occurrence, a limited-scope, fact-gathering investigation was conducted in order to produce a short summary report, and allow for greater industry awareness of potential safety issues and possible safety actions.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 10 January 2018, a Queensland Rail (QR) Citytrain suburban passenger train (TP43) was en route to Brisbane Domestic Airport, Queensland, with a scheduled crew change at Bowen Hills. While the train was stopped at Bowen Hills, the departure signal (ME25) at the northern end of No.2 platform was displaying a yellow aspect, which meant that at that time the next signal (ME45) was displaying a red aspect (stop indication).
After departing the platform, TP43 exceeded its limit of authority by passing signal ME45, which was still displaying a red aspect (stop indication). After receiving a signal passed at danger (SPAD) alarm, the network control officer broadcast an emergency stop command to the driver of TP43. The train was stopped 220 m past signal ME45, and 126 m prior to a conflict point. At the time that TP43 came to a stop, another suburban passenger train had just cleared the conflict point.
What the ATSB found
When approaching signal ME45, the driver of TP43 probably read through to another signal for an adjacent line that was displaying a green aspect, which they incorrectly believed was signal ME45.
The Citytrain rail network was fitted with an automatic warning system (AWS) that provided a driver with an audible and visual alarm when approaching a restricted signal. If the driver did not acknowledge the alarm, the AWS would generate a penalty brake application. Although the driver of TP43 acknowledged the AWS alarm on approach to signal ME45, this was almost certainly an automatic response, and did not result in the driver effectively checking the aspect of the signal. Therefore, the signal’s red aspect was not detected.
The AWS provided the same alarm for all restricted signals (that is, double yellow, yellow, flashing yellow and red aspects). The potential for habituation, and the absence of a higher priority alert when approaching a signal displaying a red aspect, reduced the effectiveness of the AWS to prevent SPADs. This placed substantial reliance on procedural or administrative controls to prevent SPADs, which are fundamentally limited in their effectiveness.
The ATSB found that QR’s administration of the train driver maintenance of competency (MOC) process provided limited assurance that its Citytrain train drivers met relevant competency requirements. It should be noted that the ATSB is not suggesting that Citytrain drivers were not competent; rather, the application of the process for assessing competency had significant limitations in assuring the drivers’ competency. Nevertheless, following this occurrence, the driver of train TP43, who was very experienced, was found not to meet the relevant competency requirements even though their previous MOC assessments showed no indications of any problems.
The ATSB also found that QR’s management oversight of the Citytrain driver MOC process did not include planned assurance activities or regular and effective auditing of how the MOC assessments were being conducted, even after there were multiple indications that the process could have been undermined by not being conducted as designed.
In addition to the safety issues associated with the AWS and the MOC process, the ATSB also identified safety issues with QR’s implementation of risk triggered commentary driving (RTCD) and the limited use of recorded data to determine driver compliance with key operational rules that had been designed to minimise the risk of SPADs on the Citytrain network.
What has been done as a result
QR has undertaken a range of actions to change the design and implementation of its train driver MOC process, and it has also undertaken a number of oversight activities focussing on the MOC process. In addition, it has undertaken a range of activities to improve the implementation and consistency of the application of RTCD, and the use of event recorders to monitor driver compliance with key operational rules.
There is limited potential to effectively redesign the AWS to reduce SPAD risk. However, QR is in the process of introducing the European Train Control System (ETCS) in parts of the south-east Queensland network, and this system, where and when it is implemented, will provide more sophisticated engineering controls for detecting potential SPADs and managing their risk.
Safety message
This investigation has highlighted the importance for rail organisations to have an assurance system in place that effectively monitors and reviews processes for maintaining and assessing the competence of rail safety workers. In addition, assurance activities must be suitably designed and implemented as designed, to ensure that they appropriately evaluate the controls that manage risk.
The rate that individual drivers pass a signal at danger is extremely low. Efforts to ensure reliable driver performance are necessary but need to be considered in the context that human error cannot be eliminated entirely. This occurrence has highlighted the importance for suburban passenger rail networks to have sophisticated engineering controls in place to detect potential or actual SPADs and manage their risk.
Even though SPADs are rare events for most drivers, the role of driver performance in minimising the risk of SPADs is obviously still critically important. This investigation provides an opportunity for train drivers to reflect on the need for crosschecking signal information, particularly at locations where there is potential for a signal read-through.
The occurrence
Overview
On 10 January 2018, Queensland Rail (QR) electric suburban passenger train, designation TP43, was en route from Varsity Lakes to Brisbane Domestic Airport, Queensland. Shortly after departing Bowen Hills station, the train passed signal ME45 while it was displaying a red aspect (or stop indication). The network control officer (NCO) made an emergency call to the driver, who stopped the train.
Events prior to departing Bowen Hills
At about 1036,[1] TP43 approached Bowen Hills station, where a scheduled crew change (driver and guard) was to take place at No.2 platform.
Just prior to the arrival of the train at Bowen Hills, the incoming driver [2] was waiting on the platform. This driver noticed that the departure signal (ME25) at the northern end of No.2 platform was displaying a yellow aspect (Figure 1). To a driver, a yellow aspect is an indication to proceed with caution and expect the next signal to be displaying a red aspect. In this case, the next signal was ME45, located about 390 m beyond the platform.
Figure 1: Signal ME25 showing a yellow aspect as TP43 arrived at Bowen Hills
The image taken from the front-of-train camera as TP43 stopped at Bowen Hills No.2 platform. The signal displayed a yellow aspect, which the driver recalled seeing prior to the arrival of the train.
Source: Queensland Rail annotated by the ATSB
At 1036:42, the train arrived at the platform. The outgoing driver[3] activated the door release for passengers and placed the direction controller to neutral and the brake controller to full service in accordance with the QR ‘start on yellow’ (SOY) procedure. After exiting the driving cab, the outgoing driver had a brief discussion with the incoming driver, but they did not discuss the aspect indication in the departure signal.
At 1036:53, the incoming driver entered the driving cab. The driver recalled being surprised when sitting down as the driver’s seat quickly descended to the bottom of its range and jarred their back.
At 1037:04, the guard gave rightaway,[4] indicating that platform duties were complete, and passengers were clear of the train. The driver recalled that this occurred just after they had jarred their back. The driver stated that they elected not to adjust the seat at the platform, as this would take about 10–15 seconds and delay the departure of the train. Instead, the driver chose to continue to the next station (Albion) where they could adjust the seat during the scheduled dwell time at that platform. Although the seat was at its lowest level, the driver’s view of the track and signals was not impeded.
At 1037:13, the driver moved the direction controller from neutral to forward, released the brake controller to the off position, and simultaneously pressed the ‘door closed’ button. At 1037:17, the driver reapplied the train’s brake as the door light ‘tile’ on the driving console had not extinguished, meaning the train doors had not closed.[5]
At 1037:24, the door light tile extinguished, and the driver again released the train brake, applied traction power, and departed the platform. The driver could not recall checking the aspect indication in signal ME25 prior to leaving the platform; they stated that they probably had not checked it due to the distraction associated with the seat. Closed-circuit television (CCTV) footage from the platform showed signal ME25 was displaying a yellow aspect as the train departed.
Events after departing Bowen Hills
At 1037:35, the driver shut off traction effort to the train when it reached the speed board limit of 25 km/h. As the train coasted towards the 30 km/h speed board for a sweeping right curve, the train speed reached 29 km/h. The driver later recalled that, as the train traversed the sweeping right curve, they saw a green aspect in a signal and thought that was signal ME45 (Figure 2). However, CCTV footage from the front-of-train camera showed the aspect in signal ME45 was displaying a red aspect, while signal ME37 (relevant to the adjacent running line) was displaying a green aspect indication.
As the driving cab of the train exited the sweeping right curve, it was 175 m from signal ME45, and from the driving cab there was a clear and unrestricted view of the signal. As the train cleared the neutral section,[6] less than 150 m prior to the signal, the driver applied low traction effort to gradually increase the train’s speed.
Figure 2: Location of signal ME25, signal ME45 and related information
The image shows the route of TP43 (in red) on the down suburban line and the colour light aspects displayed in signals ME25 (yellow) and ME45 (red). It also shows the relevant speed boards (yellow circles) and the potential conflict point with train TR50 on the up main line (in green).
Source: Queensland Rail, annotated by the ATSB
At 1038:04, the leading car of the train passed over the automatic warning system[7] (AWS) magnet for signal ME45, which was located 79.5 m prior to the signal (Figure 3). The in-cab AWS equipment generated an audible and visual alarm, to warn the driver the train was approaching a restricted signal (in this case a stop indication in signal ME45).
At 1038:05, the driver acknowledged the AWS alarm by pressing and releasing the AWS acknowledgement button. In a subsequent interview, the driver could not recall acknowledging the AWS alarm. The train speed at this time was about 30 km/h, which was compliant with the designated speed board.[8]
Figure 3: AWS magnet and signal ME45 displaying a red (stop) aspect
The front-of-train image from TP43 shows the AWS magnet, and signal ME45, which was displaying red aspect (stop) indication. The AWS magnet was located 79.5 m from signal ME45.
Source: Queensland Rail, annotated by the ATSB
Signal passed at danger
At 1038:14, QR’s universal traffic control[9] (UTC) system detected that TP43 had exceeded its limit of authority by passing signal ME45. With low traction power still applied, the train speed was about 35 km/h and increasing.
At 1038:17, after a system re-check, the UTC generated a signal passed at danger (SPAD) alarm at QR’s rail management centre (RMC), alerting the NCO of the occurrence.
At 1038:26, the NCO first issued an emergency stop command via the train radio to the driver of TP43, followed by additional stop commands. At that point, the train’s speed was 41 km/h. The driver commenced braking at 1038:32 and came to a stop at 1038:42, about 126 m short of a crossover[10] that was occupied by another suburban passenger train (TR50) as TP43 was braking to stop (Figure 2).
During the associated communications, the NCO asked the driver; ‘just got an alarm to suggest you have passed signal ME45 at danger’. The driver replied by saying:
…halfway off Bowen Hills [referring to the yellow aspect in signal ME25] the next one was green [referring to signal ME45].
These communications support that the driver of TP43 had sighted a green aspect and believed at the time that this green aspect was related to signal ME45.
As of 10 January 2018, Brisbane suburban and interurban passenger services were operated under the Citytrain brand of Queensland Rail (QR) (see organisational structure Figure 4). The Citytrain rail network extended south to Varsity Lakes on the Gold Coast, north to the Sunshine Coast, and west to Rosewood.
There were about 240 electric suburban passenger train units that made up the Citytrain fleet. All Citytrain electric suburban trains were crewed by a driver and guard. The train service delivery (TSD) operations section of Citytrain employed about 600 drivers and 500 guards to service more than 7,500 weekly train journeys over the rail network.
The TSD operations section also included 20 train operations inspectors (TOIs), who were experienced train drivers that performed a range of roles, which included providing train crew with technical and non-technical mentoring and coaching, monitoring of on-time running, providing operational support and response to day-to-day operations, and incident investigation. They also conducted competency assessments of train crew for various purposes.
The Citytrain TSD training section had a training manager, support staff, tutor drivers and tutor guards. Tutor drivers were experienced train drivers who were qualified to conduct driver training and assessments. Overall, 49 tutor drivers and 23 tutor guards were employed for training and assessment purposes. The role of the manager was to oversee TSD training and its legislative requirements. The training manager had a small number of support staff to provide administrative assistance and compliance monitoring. As required, the TSD training section received support from QR’s learning and development team.
Figure 4: Simplified organisation structure of QR Citytrain
Train information
TP43 was an electric suburban passenger service operated by QR Citytrain and timetabled to travel between Varsity Lakes (Gold Coast) and Brisbane Domestic Airport. The train was on schedule when it arrived at Bowen Hills station at 1036.
TP43 consisted of an interurban multiple unit (IMU168) and a suburban multiple unit (SMU285), with the IMU168 unit leading. Overall, the train was 144 m long and weighed 254.78 t.
The multiple units that worked TP43 operated as designed and there were no reported or recorded faults that influenced their serviceability. Both units were fitted with event recorders and front-of-train cameras. These systems operated effectively during the occurrence sequence, and relevant information from these systems are included in the report where relevant.
Network and signalling information
Train safeworking system and signalling
The train safeworking system in the Brisbane suburban network was remote controlled signalling (RCS). The system included procedures, colour light signals and power operated points, controlled by a local fail-safe interlocking, which was supervised by a universal traffic control (UTC) system located at QR’s rail management centre (RMC).
By operating the UTC, network control officers (NCOs) were able to safely route trains over a wide area of railway, aided by safeguards built into the system. These safeguards prevented a signal being cleared if it allowed a conflicting path to be set.
Various indications were displayed on the UTC workstation monitors for the information of the NCO. These indications included the location of all trains, points, signals, and some types of alarms. A signal passed at danger (SPAD) auditory and visual alarm, in most cases, was generated if a train passed a signal displaying a stop indication and in addition, the NCO received a visual alert.
The signalling system within the Brisbane suburban network had intrinsic safeguards to mitigate the risk of SPADs and reduce the potential for train-to-train collisions. This included signal aspect sequencing, which was designed to keep safe separation between trains providing the train driver operated the train according to the aspects displayed in the signals.
In addition, a safety feature known as ‘overlap’ reduced the risk of a train-to-train collision should a train exceed its limit of authority by passing a stop signal. This feature provided a safety margin distance on the departure side of the signal. The overlap varied in distance depending on factors like maximum track speed.
Signal ME45 information
Signal ME45 was a controlled signal operated from QR’s RMC. It was located at 3.877 km[11] on the down suburban line between Bowen Hills and Albion stations.
The signal was a four-aspect colour light signal, capable of displaying green, double yellow, yellow or red aspects and was fitted with light emitting diodes (LEDs). Figure 5 provides information about the function of the different aspects. More generally, the term ‘proceed’ was associated with a signal displaying a green aspect, and the term ‘restricted’ was used to refer to a signal displaying a double yellow, single yellow, flashing yellow or red aspect.
Figure 5: Four-aspect colour light signal indications
The image shows the indications displayed by a four-aspect colour light signal and their authority. Although not displayed in this image, a flashing yellow aspect meant ‘special caution’ - proceed to the next STOP signal at a speed not exceeding 40 km/h.
Source: Queensland Rail
On 10 January 2018, during the period leading up to the SPAD occurrence, signal ME45 operated as designed. It was displaying a red aspect (stop) indication because another suburban passenger train (TR50) was occupying a conflicting track section.
According to QR’s 2017 signalling statistics, trains that approached signal ME45 encountered a red aspect (or stop indication) 0.9 per cent of the time. The rate was lower in January 2017 (0.5 per cent) relative to other months.
Signal ME45 was located about 390 m north of Bowen Hills station, but could not be seen from the platform due to a sweeping right curve and a road overpass (Figure 2). From the driving cab, the signal could first be sighted from about 230 m but there was restricted viewing due to the overpass pillars and overhead line equipment masts.
Immediately prior to first sighting signal ME45, there was the potential for a driver to ‘read-through’ to another signal.[12]This occurred when the viewing angle from the driving cab, as a train traversed the sweeping right curve, brought signal ME37 into view momentarily before signal ME45 came into view (Figure 2). Signal ME37 applied to the down main line, two tracks left of the up suburban line.
As trains exited the sweeping right curve and entered the straight section of track (about 175 m from signal ME45), there was clear and unobstructed vision of ME45. This complied with QR’s sighting distance requirement of 135 m at this type of location (as outlined in QR standard MD-10-95, Signalling positioning principles).
At the time of the occurrence, signal ME37 was displaying a green aspect. The driver of TP43 stated in interview that they sighted a green signal as the train traversed the sweeping right curve, and they subsequently believed this was probably signal ME37 rather than ME45.
Signal ME45 SPAD history
In March 1996, a suburban passenger train (1195) passed signal ME45 which was displaying a stop indication and then collided with a freight train (C760). Although the SPAD generated an alarm in the network control centre, the controller was not in a position to respond to the situation and transmit an emergency stop command to the driver of the passenger train. The collision derailed both trains and a number of passengers were injured. The SPAD was attributed to driver inattention/distraction.
Between January 1996 and January 2018 there were 10 SPAD occurrences at signal ME45 , including the collision in March 1996 and the occurrence on 10 January 2018. According to QR records, at least five of the 10 SPAD occurrences happened following a driver changeover at Bowen Hills, which included the 10 January 2018 occurrence.
In June 2013, signal ME45 was classified as a multi-SPAD signal because of two SPAD occurrences within a 3-year period, and it was included on QR’s monthly multi-SPAD and blackspot report. QR’s SPAD Prevention Working Group assessed it to be high risk because of the high traffic junction the signal protected. Accordingly, the working group requested the QR signal sighting committee conduct a review of signal ME45.
The signal sighting committee completed its review in August 2013. It identified the potential for a ‘read-through’ scenario with signal ME37. To mitigate the risk, the committee recommended that the incandescent aspects in signal ME45 be upgraded to the brighter LEDs. In addition, it recommended that the stopping mark at Bowen Hills No.2 platform be relocated to a position where drivers had a better view of signal ME25 when their trains were stopped at the platform.
These recommendations were completed by June 2014. In addition to upgrading ME45 to LEDs, the incandescent aspects in signal ME37 were also upgraded to LEDs in accordance with MD‑10‑95.[1] Signal ME45 was included in QR’s April 2016 multi-SPAD and blackspot report, and at that time it was noted: ‘Assessment of circumstances has highlighted no obvious engineering solutions. Continue to Monitor’. It was then removed from the monthly report in May 2016.
The current driver route map for the area was last updated in October 2016. It included signal ME45 as a ‘Black Spot/Multi SPAD signal’.
Conflict between train TP43 and TR50
The NCO’s emergency stop command to the driver of TP43 was initiated at 1038:26, 12 seconds after the train had passed signal ME45 and 9 seconds after the SPAD alarm was generated. In that time, the train had travelled about 130 m. Simultaneously, suburban passenger train TR50 was traversing the crossover from the down main line to up main line (see Figure 2 for conflicting train paths).
The driver of TP43 responded to the emergency call and brought the train to a stop 220 m past signal ME45 and 126 m prior to the conflict point. At the time that TP43 came to a stop (1038:42), TR50 had just cleared the conflict point. The NCO’s intervention therefore significantly reduced the risk of a train-to-train collision.
To determine the potential for a collision without the NCO’s intervention, the ATSB carried out rudimentary calculations based on known facts, speed board locations and time and distance travelled. It was established that had the driver of TP43 maintained a speed of 41 km/h (the speed at the time of the NCOs emergency stop command) and complied with the designated speed boards, TR50 would have cleared the conflict point about 13 seconds prior to the arrival of TP43, or 90 m clear of the conflict point prior to the arrival of TP43.
Automatic warning system
QR’s Citytrain suburban rail network was fitted with an automatic warning system (AWS). According to the QR standard MD-10-119 (Automatic warning system (AWS) operations manual), AWS was designed to:
provide an in-cab visible and audible indication of the aspect displayed in the next signalprompt and warn the rail traffic driver of a RESTRICTED signal aspect displayed in the next signa
stop the rail traffic if the rail traffic driver fails to acknowledge the AWS alarm of a RESTRICTED signal aspect
AWS is an advisory system and not a control system.
The setting of rail traffic speed remains with the rail driver, but the AWS is designed to apply the brake when the rail traffic driver does not acknowledge a restrictive aspect…
The system recognised two states:
clear (the signal aspect was green): inside the driver’s cab, the AWS indicator provided a black visual display and an audible sound (a short series of beeps) to indicate the signal aspect was green. The alert was designed to prompt the driver to check the aspect displayed in the signal. No further action was required from the driver.
restricted (the signal aspect was either double yellow, single yellow, flashing yellow or red): inside the driver’s cab, the AWS indicator provided a yellow and black (sunflower) visual display and an audible warning alarm. In response, the driver was required to check the aspect displayed in the signal, and then acknowledge the alarm by pressing and releasing the AWS acknowledge button on the driver’s console. If the driver did not acknowledge the alarm within 3 seconds, the AWS would generate a penalty brake application.[14]
The AWS provided the same aural and visual indication for every type of restricted signal (that is, double yellow aspects, single yellow aspect, flashing yellow aspect and red aspect).
The AWS was originally introduced into railway systems in the United Kingdom. The Brisbane suburban rail network commissioned the use of the AWS in 1979 with the introduction of electrification.
The ATSB recently published reports on three SPAD occurrences in the Brisbane suburban network where drivers acknowledged an AWS alarm but did not recognise that the associated signal was displaying a red aspect (RO-2017-010,[15]RO-2017-012[16] and RO-2017-015[17] In the case of RO-2017-012 and RO-2017-015, the drivers did not recall acknowledging the AWS alert. The same situation also occurred with the SPAD occurrence on 10 January 2018.
Citytrain driving procedures
Safe driving procedures
The QR suburban rail network had limited engineering or technical controls in place to detect potential or actual SPADs and manage their risk (see Use of engineering-based risk controls); consequently it heavily relied on front line staff to manage risk through their compliance with procedures.
QR procedure MD-11-72 (TSD professional driving – Safe driving) outlined rules for train drivers to apply ‘to mitigate the incidence of Signals Passed at Danger (SPAD) and other adverse operational safety events’. The procedure stated:
Safe Driving focuses on planning, prioritising, communicating and taking appropriate positive actions. The methods of Safe Driving are important defences against the risk of error and are intended to reduce errors and mitigate risk in the event of errors occurring…
The technique shall be incorporated into all aspects of day to day driving, driver training, driver monitoring, assessment, accreditation and reaccreditation programs. The principle of the driving method is based around thinking safety, behaving and acting proactively and positively in all situations which could arise. Safe driving is mandatory.
The procedure included several specific rules to mitigate the risk of SPADs, including the start on yellow (SOY) rule from platforms, procedures for approaching different types of signals, the ‘75%’ rule and the ’20 / 20’ rule. Other relevant procedures for mitigating the risk of SPADs, such as risk triggered commentary driving (RTCD), were published in other documents.
Start on yellow (SOY)
As applicable to an electric suburban train at a station platform, the SOY rule stated:
When the platform departure signal is displaying a single yellow / flashing yellow aspect or, where there is no departure signal and the signal prior to the platform was displaying a single yellow / flashing yellow aspect, then the RTD [rail traffic driver] must:
When stopped at the platform, fully apply the… brakes and place the direction controller… into the neutral position
When starting on a yellow / flashing yellow, minimum traction power applied so as not to e-xceed 75% road speed, maximum 40kph or if a lower speed is indicated the lower speed applies.
The ‘starting on a single yellow aspect’ rule provided additional details. It stated:
Scan for the departure signal or check the AWS indicator (where fitted) if there is no departure signal.
Confirm signal aspect and location of next signal
Place the direction controller… into forward position
Release the brakes when satisfied all doors are closed (after the door open tile light extinguishes…)
Implement and maintain RTCD, calling signals and actions aloud
Apply and maintain the 75% speed rule
Maintain situation awareness and vigilance through scanning, crosschecking and continued RTCD…
Approaching signals
Procedure MD-11-72 outlined the following procedures for signals indicating red, yellow and green aspects.
Approaching a green aspect
Confirm signal aspect Check AWS response (where fitted) The train may be operated under normal circumstances…
Approaching a single yellow aspect
Confirm the signal aspect Confirm the signal applies to your track Initiate or maintain RTCD, calling signals and actions aloud Confirm and acknowledge the AWS alarm (where fitted) Apply or maintain the 75% Speed Rule Maintain situation awareness and vigilance through scanning, crosschecking and continued RTCD Confirm the location of the next (Red) signal…
Approaching a red aspect
Confirm the signal aspect Confirm the signal applies to your track Maintain RTCD, calling signals and actions aloud Apply the 20 / 20 rule Maintain situation awareness and vigilance through scanning, crosschecking and continued RTCD
Note: IMU160 / SMU260 class not to exceed 30kph when within150 metres of a red stop signal unless a lower speed is indicated in which case the lower speed applies
Related to approaching a yellow aspect was the 75% rule, which stated:
A train must be travelling at or below 75% of designated track speed when passing a double yellow / single yellow aspect signal.
Normal driving could be resumed upon sighting and confirming a green aspect.
Related to approaching a red aspect was the 20 / 20 rule, which stated:
Reduce the speed of the Rail Traffic to pass over the Automatic Warning System (AWS) transponder (Magnet) for a red signal at a speed no great than 20kph. When stopping at a red signal, target at a stopping point 20 metres before the signal.
Risk triggered commentary driving
QR procedure MD-13-165 (TSD professional driving – risk triggered commentary driving [RTCD]) outlined QR’s requirements for RTCD. It described the technique as follows:
At a basic level, RTCD involves RTDs acknowledging the aspect of the restricted signal, and intended actions, by speaking aloud. By applying RTCD, RTDs can listen to their thoughts and the subsequent actions they are planning to apply. This allows RTDs to ‘sense check’ what they should do next.
RTCD is required to be applied continuously from the acknowledgement of the restricted audible alarm on the Automatic Warning System (AWS) until the action that must be taken is actually performed. This is because information may not be retained if the message is not repeated within 10 to 20 seconds.
Procedure MD-13-165 further stated:
Primarily, RTCD has been developed to manage risks while running on restricted signals. Other applications may include managing adverse conditions, managing operational risks (level crossings, signal in advance cannot be sighted, etc. The application of RTCD:
Encourages RTDs to verbalise the positive actions they will apply
Helps RTDs manage distractions by keeping the mind focused on operational priorities such as signals, safeworking and train management
Is to be applied when RTDs are exposed to restricted signal indications, and is recommended for use when exposed to degraded working, fatigue and during other identified operational risk factors
Assists RTDs to detect and manage threats and prevent errors
Supports RTDs in minimising SPAD and other operational risks
Reinforces route competence and maintains optimum cognitive function during times of low workload or potential fatigue
The procedure emphasised that RTCD was not simply announcing the signal. It also provided some examples of suggested word strings. More specifically, it stated:
RTCD is not just repeating what RTDs see, but also the required action they will need to take to the next signal.
Examples are:
“… Single Yellow located…reduce speed not exceeding 75% of road speed, which is….”
“Departing on single yellow aspect, not exceeding 75% track speed (50% on IMU160 / SMU260 class) and scanning for next signal which is located….” Target 20kph over AWS Magnet.
The procedure also emphasised the following:
It is a mandatory requirement that RTCD be verbalised aloud, including when a second person is in the operating cab, e.g. Train Operations Inspector (TOI), Tutor Driver...
It is important to note that the trigger for applying RTCD is the sound of the restricted audible alarm on the AWS.
When nominating restricted road speed, the RTD must state the intended speed, e.g. ‘75% of 100km which is 75 km’…
Adjusting the driver seat
QR procedure MD-11-282 (TSD professional driving – Train management train units) outlined some additional procedures relevant to drivers of electric trains. The procedure for adjusting the driver’s seat stated:
On entering a driving cab, and before moving the train, it is important that the RTD’s seat be personally adjusted so that all relevant controls are in comfortable reach and can be operated safety. …[outgoing] RTC [rail traffic crew] to inform relieving [incoming] RTC the seat may require adjusting…
Rightaway procedures
For a suburban train at a station platform, the guard was required to provide a rightaway signal to the driver when station duties were complete, and all people were clear of the train. In addition, the guard had to ensure that the departure signal was not indicating a red aspect. If these conditions were met, the guard would blow the whistle and provide the rightaway signal to the driver, which was indicated by two bells. The driver was then required to follow the documented steps in procedure MD-11-282:
After receiving Rightaway and before moving, the RTD shall:
Check the indication of the departure signal
Move the direction controller into the forward position (if not already in the forward position)
Press the door closing button
Sound the city horn
Wait for the ‘doors open’ tile to extinguish
Scan before you go”
Ensure headlight is on (if applicable)
Train driver information
Qualifications and experience
The driver of train TP43 was a permanent full-time employee of QR. The driver’s personal records showed that they gained driver qualification in 1983. At the time of the 10 January 2018 SPAD occurrence, the driver was qualified to operate the rolling stock that worked TP43, and route competent to travel over the down suburban line between Bowen Hills and Albion, which included the location of signal ME45. The driver reported having frequently travelled over the route and being familiar with the signal.
According to QR records, the driver was last assessed as competent in line with QR’s driver maintenance of competency (MOC) process in February 2017, which was still current at the time of the SPAD.
QR advised that the driver was last involved in a SPAD occurrence in June 2006.
Medical information and recent history
Medical records provided by QR showed that the driver underwent a medical assessment (rail category 1 – high-level safety worker) on 13 February 2017 and was assessed as fit for duty. The fitness certificate was valid for a 12-month period and was still current as of 10 January 2018.
The driver’s duty times for the day of the occurrence (10 January 2018) and the previous 4 days are shown in Table 1.
Table 1: Actual duty times for the driver during 6–10 January 2018
Date
Work activity
Duty start
Duty end
Duty time
Time free (off duty)
6 Jan 2018
Day off
7 Jan 2018
Day off
8 Jan 2018
Train driving, various routes
0404
1231
8.5 hours
16.5 hours
9 Jan 2018
Train driving, various routes
0500
1400
9.0 hours
14 hours
10 Jan 2018
Train driving, various routes
0357
1320
9.4 hours
The driver stated that they normally set their alarm at home about 75 minutes prior to sign-on time and they normally obtained 5–6 hours sleep prior to an early start. The driver recalled that their sleep on the night of 9 January (and the previous two nights) was consistent with this normal practice.
On 10 January, the driver signed on for duty at 0357 at Mayne depot, and considered themself fit for work. They conducted some driving duties and then had a rest break (including a meal) at Bowen Hills from 0911 until 1036, the arrival time of train TP43. The driver stated that they felt alert when taking over the train.
Following the SPAD occurrence, the driver undertook a mandatory drug and alcohol test, which produced negative results (that is, no drugs or alcohol detected).
The driver stated that they had nothing on their mind in the period leading up to the SPAD except work-related tasks. They were not in conversation with the guard or using a mobile phone at the time of the occurrence. A review of information on the driver’s phone indicated that they were not involved in any phone calls or sending or receiving text messages at the time of the occurrence. The driver reported that they were thinking about ‘the route ahead to the airport and where the signals were located’.
Maintenance of competency assessment results
QR train drivers on the Citytrain network were required to complete a MOC assessment every 18 months. The MOC included a written assessment and a practical on-track assessment (see Citytrain driver maintenance of competency process for further details about the MOC).
The ATSB requested the driver’s most recent MOC assessment (February 2017) as part of the investigation process. While analysing the written assessment, the ATSB identified a number of irregularities. On three separate occasions, questions were answered out of order. For instance, the answer to question No.34 was recorded under question No.31. In addition, answers to questions that required detailed responses matched almost word-for-word with the MOC written assessment marking guide. The driver obtained 97 per cent correct answers on the first attempt and made the necessary corrections, including the answers to questions that were out of order, to attain 100 per cent. No development plan was recorded.
The irregularities identified in the driver’s written assessment prompted the ATSB to request all MOC assessments undertaken by the driver since the introduction of the MOC process in 2008. Between 2008 and 2017, the driver participated in six MOC assessments and, on the first attempt, achieved 100, 100, 100, 98, 99 and 97 per cent respectively on the written assessments. Of the driver’s six practical MOC assessments, five recorded perfect results (with no gaps identified in driving performance) and the other recorded near perfect results.
On closer examination, the driver’s previous three written MOC assessments prior to 2017 showed similar word-for-word answers compared to the assessor’s MOC marking guide. There were also other identified anomalies, such as incorrect answers marked correct.
In addition, anomalies were identified with the driver’s performance on elements of risk triggered commentary driving (RTCD) in the MOC assessments. More specifically:
According to QR training records, the driver of TP43 attended RTCD training in December 2012. The driver could not recall doing this training.
The written MOC assessment included specific questions in relation to safe driving procedures and RTCD. No problems were noted with the driver’s responses to these questions on their three written assessments after 2012 (in 2013, 2014 and 2017). The practical MOC assessments in 2013, 2014 and 2017 included documented evidence of the driver correctly applying RTCD.
During interview, the driver stated that they were not applying RTCD at the time of the SPAD occurrence. The driver also did not recall RTCD being covered in the MOC, and they did not use RTCD as a normal practice, either during normal driving or when participating in MOC assessments. The driver further stated that they had never called signal indications to others who were travelling in the driving cab and would not have called signals to the assessor while undertaking a practical MOC assessment. According to QR standard MD-10-109 (Observance of Signals Manual), calling signals to others in the driving cab was a mandatory requirement.
Operational improvement plan
Following the SPAD occurrence on 10 January 2018, the driver participated in a post-incident on‑track observations session that was administered by a train operations inspector (TOI). The purpose of the session was to assess the driver’s performance against safe driving procedures and make recommendations towards an operational improvement plan (OIP). Throughout the observation session, the TOI identified and recorded multiple deficiencies with the driver’s performance, some of which included:
not calling signals to the other person in the driving cab
not using RTCD when travelling on restricted signals
not applying the start on yellow (SOY) rule at station platforms
not complying with other safe driving procedures.
In summary, the TOI’s report stated the driver:
… needs to be brought up to speed on RTCD and professional driving…needs to address bad habits … developed in driving style.
The driver was allocated an OIP following the observation session, which involved participating in practical on-track coaching and mentoring sessions. The driver participated in 11 individual coaching and mentoring sessions, which were administered by various TOIs. On each occasion, the TOIs identified deficiencies in many areas of driving performance. With specific relevance to SPAD mitigation procedures, these included:
not applying the SOY rule on multiple occasions
not applying the 75% speed rule on approach to restricted signals
not applying the 20 / 20 rule on approach to a red (stop) signal
not applying RTCD on multiple occasions.
On the eighth session, the monitoring TOI provided a report on the driver’s performance. The report stated the driver:
…. is making an effort to get things correct. On occasions, [the driver] forgets the order of RTCD, especially when running on a series of restricted signals. [The driver] gets confused and frustrated so by the time … completes the spiel … is almost past the signal…
The report also noted that the driver was having difficulty completing some other driving-related tasks that would routinely be covered during MOC assessments. In addition, it stated the driver:
…. is an old driver that has been driving the same way for some 32 years…is obviously making an effort to learn all the things required…, however it will take more time and more coaching.
On the eleventh and final session, the same TOI deemed the driver ‘not competent’ and provided an updated appraisal on the driver’s performance. The report stated:
…driving has greatly improved from last time… [The driver] uses RTCD without prompting although … sometimes still gets the order of things incorrect. [The driver] is a bit slow commencing RTCD so by the time … says all the info … is almost on top of the next signal.
Following this last session, the driver chose (supported by QR management) to relinquish the position of train driver and subsequently took up the position of trainee guard.
Citytrain driver maintenance of competency process
Overview of maintenance of competency process
QR as a rail operator was to ensure that rail safety workers such as drivers were competent. Up until 2008, train drivers were required to undertake re-accreditation training every 3 years to maintain their safeworking accreditation. This involved group training over 5 days in a classroom environment. A TOI administered the training and assessment process.
In 2008, QR replaced the safeworking re-accreditation training program with the driver MOC process. The purpose of the MOC was to assess the skills and knowledge of drivers and identify any performance gaps and (if required) implement remedial action to ensure drivers met the required level of competency. Recently qualified drivers would undertake their first MOC after 12 months, and existing drivers would undertake a MOC assessment every 18 months. Tutor drivers normally administered the driver MOC process, and TOIs were also appropriately qualified to administer the process.
The MOC process involved each driver completing a written assessment (over 1 day) then a practical assessment (over 1 day) with a nominated assessor. The MOC process was undertaken one-on-one; the driver undertook the assessment while the assessor (tutor driver or TOI) administered the activities.
The MOC was initially designed to subject drivers to events, situations, and scenarios that they would rarely encounter under normal operating conditions as well as various regulatory requirements. Over time, the subject material within the written and practical components increased due to findings from investigations, changes to legislation and procedures, and for other operational reasons.
In April 2013, version 2.0 of the MOC was released, which contained significant modifications to the format and content of the MOC assessment. The format then remained basically the same up to and including version 8.1 (July 2016), with minor changes in versions associated with changes in terminology, updates to legislation or procedures, or similar reasons.
In September 2017 (version 9.0), the MOC was reviewed and updated in line with the Rail Safety National Law and regulatory requirements, and various other modifications were made. This involved changing the wording of several questions.
In 2018, QR used the MOC assessment for existing drivers to upgrade their train driving qualifications to a Certificate IV. In 2018, 252 (current) Citytrain drivers progressed from Certificate III in train driving to Certificate IV in train driving as a result of the successful completion of their written and practical MOC assessments.
Written MOC assessment
Version 2.0 of the written MOC assessment contained about 300 questions and covered a range of topics. In general, the questions related to train operations, signals, safeworking, responding to various emergency and abnormal situations and a variety of general safety topics. It also included a number of scenarios. The structure and format of the assessment questions varied. Some questions required selection of the correct answer from a list, where others required short answers, and some required a more detailed response.
Since version 2.0, the instructions for the written MOC assessment was contained in the written paper itself (used by the participant) and the associated marking guide (used by the assessor). The instructions stated that if the driver was unsuccessful in more than 10 per cent of the questions, they would be entitled to one retest (of the whole written assessment), which had to be completed on another day. If they were unsuccessful in some questions (but less than 10 per cent), the participant was required to research the correct answers and then make corrections, with the participant writing the correct answers in red pen on the paper.
The participant had to achieve 100 per cent on the written assessment before advancing to the on-track practical component.
The assessors’ written MOC marking guide provided further instructions for the assessors. As of May 2014, the marking guide’s instructions stated:[18]
The Participant is to complete all written questions without assistance... Assessors are only required to assist where the Participant requires further clarification of the questions.
If the Participant appears to struggle with writing responses, or self-identifies Language, Literacy and Numeracy (LLN) issues, the Assessor is to offer assistance where possible.
This can be done by reading each question, writing down the Participant’s answers, reading back the answers and asking the Participant to confirm response.
In addition, the marking guide provided generic answers to questions as required and more detailed answers to questions that required a specific answer. Overall, the purpose of the marking guide was to aid the assessors throughout the assessment process and to provide guidance when marking a participant’s written responses.
In September 2017, the instructions in the written MOC paper and marking guide were supplemented by instruction MD-17-406 (Rail traffic driver maintenance of competency assessment process). This instruction stated that for the written MOC, the participant was to complete the assessment in blue pen, the assessor was to use black pen and any corrections (by the participant) were to be undertaken in red pen. The instruction also included the following:
Under no circumstances is a learner [participant] to view or be provided access to the marking guides…
During [written] assessment if the learner requests assistance the assessor may provide guidance but must not provide answers or breach the code of conduct.
Similar guidance was provided to tutors in a series of emails in 2016–2017 (see 2016 investigations into conduct of MOCs and 2017 correspondence to tutors).
Practical MOC assessment
The practical MOC assessment involved a holistic assessment of the drivers’ on-track performance. This included observing a suite of activities including train management, safe driving, route knowledge, train preparation, train testing, shunting, and train amalgamation and division. It also included a train simulator component that assessed unusual scenarios and emergency situations. In addition, the drivers were assessed on their ability to apply risk mitigation controls to manage the risks associated with the work environment.
The assessors were required to collect and record both direct and indirect evidence while they observed a driver’s on-track performance. Where observations about a specific aspect were not possible, due to unavailability or safety issues, an appropriate question or scenario was to be provided to the driver and written in the evidence section of the assessment report, complete with the answer supplied by the driver.
Following the assessment, and once all the evidence was evaluated, the assessor made a judgement on whether the driver was competent or not yet competent. If the driver was assessed as competent, they would return to normal duties. However, if they were assessed as not yet competent, relevant management personnel were advised accordingly.
If a driver was deemed not yet competent in either the written or practical components of the MOC assessment, the assessor was required to complete a development plan for the driver documenting any outstanding performance or acknowledgement gaps.
Training and assessment qualifications
QR was an enterprise registered training organisation (RTO), which meant it could deliver internal training and assessment to provide national qualifications to its drivers and guards.
Assessors, who administered training and assessment for QR, had to have vocational competencies at least to the level being delivered and assessed, and hold current industry skills relevant to the training and assessment being provided. In addition, they had to have current knowledge and skills in vocational training and assessment, which included holding a certificate IV in training and assessment.
The QR specification MD-13-591 (Registered training organisation – Governance and administration) stated that:
The aim of assessment is to determine whether the learner [participant] has achieved the learning outcomes. Therefore, the completed assessment is evidence a person has the skills and knowledge that match the requirements associated with the learning course. It is very important that assessment evidence is clear and complete to the extent to be admissible in a court of law.
Assessments in Queensland Rail have been developed to follow the ‘Principles of Assessment’ and ‘Rules of Evidence’ and to ensure trainers and assessors can easily follow these principles and rules.
Principles of Assessment:
Validity – that the assessment assesses what it claims to assess Reliability – that the assessment instruments will be able to be used consistently and have clearly defined marking guides Fairness – that the assessment process has clear and easily understood information for the learner, and that the learner has the opportunity to identify when he/she is ready to be assessed Flexibility – that the learner’s individual needs are considered.
Rules of Evidence:
Validity – the evidence gathered through assessment clearly aligns to whatever the assessment is supposed to assess and supports the assessor’s decision on competency Sufficiency – the evidence gathered shows how all aspects of competency were assessed Currency – the evidence demonstrates the learner’s current level of skills and knowledge Authenticity – the evidence is, or relates to the learner’s own demonstration of skills and knowledge.
Tutor drivers conducted the training for trainee drivers as well as administered the 12-month MOC assessments for recent drivers[19] and the 18-month MOC assessments for existing drivers.[20]As trainers and assessors, tutor drivers possessed the relevant vocational competencies and qualifications to administer training and assessment for Citytrain drivers. The tutors were members of QR’s accredited trainer and assessor association (ATAA), which assisted QR in meeting its learning needs and obligations as an enterprise RTO.
The ATAA framework set out the expectations of the assessors who delivered training and assessment outcomes for nationally recognised training. The ATAA provided a framework that underpinned the registration requirements of the RTO and set benchmarks for training and assessment delivery.
With the introduction of the revised driver MOC (version 9.0) in September 2017, a formal instruction MD-17-406 (Rail Traffic Driver Maintenance of Competency Assessment Process) was issued to tutor drivers. The instruction contained expanded requirements and guidance on the MOC process, supplementing the information already contained in the MOC materials and marking guides. The instruction was accompanied by formal training for all tutor drivers and TOIs who delivered MOC assessments. The training provided information on how to gather and record evidence associated with the on-track practical component of the MOC and how to administer the written MOC assessment.
Review of drivers’ MOC assessments and results
Due to the discrepancies identified with the 10 January 2018 SPAD driver’s MOC results, the ATSB requested additional MOC assessments for analysis. This included MOC assessments for a sample of drivers who had experienced SPADs, all the MOC assessments undertaken in November 2017 and a small sample of MOC assessments undertaken in June 2018.
The majority of the MOCs provided by QR were from 2017–18. Most of the MOC assessments were administered by tutor drivers, with a few conducted by TOIs. The ATSB conducted a detailed analysis of 38 of these MOCs undertaken on existing drivers.
The results of the written MOC assessments ranged between 95–100 per cent on their first attempt, with all drivers successfully achieving competency after corrections.
A detailed examination of the written MOC assessments showed widespread irregularities or anomalies with nearly all of the assessments analysed. These included:
almost all cases with word-for-word or almost identical answers to that of the assessor’s MOC marking guide for questions requiring a detailed response
three cases where answers to questions were out of order on the assessment paper (that is, a correct answer was provided but written next to the wrong question)
five cases of an obvious spelling error in the assessor’s MOC marking guide being reproduced by drivers in their written response (that is, the incorrect word ‘collusion’ being used instead of the correct word ‘collision’)[21]
several cases where answers that were incorrect (compared to the marking guide) were marked correct by the assessors.
The analysis of the on-track practical MOC assessments also indicated potential concerns regarding the integrity of the process. Almost all of the assessments reviewed showed perfect results, with a few showing negligible gaps in driving performances. In addition, the assessors generally recorded minimal contextual evidence on which to base assessment decisions for justifying their appraisal of a driver’s on-track performance.
None of the MOC assessments in the analysed sample showed performance, skills, or knowledge gaps on completion, and therefore there were no recorded development plans for the drivers.
The ATSB also conducted a brief analysis of a number of other MOCs, which appeared to be consistent with those from the sample that was analysed in detail.
MOC results of drivers with SPAD performance issues
During the period 2015–2018, there were eight Citytrain drivers who either were demoted, had their employment terminated or took a voluntary reduction from the role of driver to guard because of multiple SPAD occurrences. This count did not include the driver involved in the 10 January 2018 SPAD occurrence.
Two of the eight drivers were recent drivers, with just over 12 months experience after spending more than 1 year in the trainee driver training program. The other six existing drivers had various years of experience. One of the existing drivers had been involved in eight SPAD occurrences between 1999 and 2016, and one of the recent drivers was involved in three SPAD occurrences in less than 12 months.
At the request of the ATSB (and in addition to previous driver MOC assessment requests), QR provided the most recent MOC assessments undertaken by each of the eight drivers (prior to their SPAD occurrence). However, QR could not locate one of the driver’s written MOC assessments, but the driver’s on-track practical assessment was available.[22]
A review of their written MOC assessments showed results ranging from 95–100 per cent on their first attempts, with all the drivers achieving competency after corrections. Overall, the MOCs were similar in nature to the other samples analysed by the ATSB. There were many multiple word-for-word answers on questions requiring a detailed response that were close or identical to that of the assessor’s MOC marking guide. In addition, seven of the eight drivers recorded faultless on‑track practical assessments. All drivers progressed through the MOC process as competent. None of the eight drivers had any details recorded in development plans.
After their most recent SPAD occurrences, three of the eight drivers participated in individual OIPs and subsequent coaching and mentoring sessions. According to QR documentation, these drivers were assessed as not competent on multiple occasions due to numerous issues. These findings were inconsistent with the results recorded in their MOC assessments prior to their recent SPAD occurrence, and notably similar to the assessment findings of the driver involved in the SPAD occurrence at signal ME45 on 10 January 2018.
Processes to monitor knowledge and performance gaps
Although the driver MOC assessment had a formal section (MOC assessment report) for the assessor to record knowledge or performance gaps, this section was rarely populated. The ATSB’s analysis of driver MOC assessments did not identify any assessment where the assessor recorded knowledge or performance gaps.
In about 2008, Citytrain TSD developed a compliance monitoring database. The database provided a section for assessors to comment on a driver’s MOC assessment or monitoring session and include information regarding future areas of focus or record development plans based on the results of the driver’s monitoring session or MOC. An assessor could then review these comments prior to conducting the next assessment on that driver.
In August 2014, QR conducted a second line assurance activity (audit) that examined aspects related to SPAD controls. The audit noted that the TSD compliance monitoring database had been abolished, therefore TOIs were unable to review focus areas identified in previous monitoring sessions prior to undertaking a new session.
At the time of the 2014 audit, TSD management advised the auditor that each monitoring session was conducted as if the driver was competent. Any identified issues in the previous session would be corrected by coaching, until the driver was considered competent. The audit report noted that TOIs on occasions communicated driver performance issues verbally or by email to other assessors, as they were no longer able to review focus areas in the database. The audit report did not specifically discuss the use of the database for MOC sessions.
In 2019 QR advised the ATSB that the compliance monitoring database ‘was decommissioned by previous Queensland Rail management about 5 years before and information from the database is no longer accessible’.
Management oversight of the maintenance of competency process
Overview of risk management and assurance processes
QR had documented standards and procedures for risk management and assurance. The standard MD-11-1338 (Risk management) stated:
Risk management embodies an organisational culture of prudent risk-taking within Queensland Rail. It is the process of identifying, assessing and responding to risks, and communicating the outcomes of these processes to the appropriate parties in a timely manner…
Risk management is a responsibility of all and should be considered as part of how Queensland Rail does business. Managing risk effectively requires people at all levels in the organisation to have specific accountabilities, authorities, delegations and appropriate competence to establish, apply and maintain the risk management framework as a basis for good decision making. It is important to have complete and current risk information available as this information assists in ensuring informed decisions around both strategic direction and operational objectives.
Risk management is not a stand-alone discipline and requires integration with existing business processes such as business planning, assurance and Internal Audit, in order to provide the greatest benefits…
For risk management to be effective, controls must be regularly monitored and reviewed. Controls must be monitored to ensure that they continue to perform as intended and continue to modify the risk in the manner and to the extent assumed in the risk assessment.
In the section on monitoring and reviewing, the standard stated:
Assurance is a process that provides a level of confidence that objectives are achieved within an acceptable level of risk.
Assurance is a planned and deliberate activity, should be continuous and dynamic and primarily conducted by those with day-to-day responsibility for the relevant risk management activity.
All managers are responsible for ensuring that controls are designed to address risks. The design of risk controls will involve considering and recording when, by what means and how control and assurance activities take place…
Queensland Rail applies three levels of assurance to ensure there is an appropriate balance between control and assurance activities refer to the Assurance Standard MD-16-24 and Assurance Procedure MD-12-27.
QR standard MD-16-24 (Assurance) expanded on the monitor and review concepts. It stated that in order for risk management to be effective, QR should comply with a set of assurance principles, which included:
Assurance is an integral part of all organisational processes. Assurance is not a stand-alone activity that is separate from the main activities and processes of the organisation.
Assurance is risk-based. Assurance should be weighted to risk and control effectiveness. The importance of this is highlighted by following an integrated risk and assurance approach. Ultimately assurance is part of risk management…
Assurance activities are aimed at obtaining reasonable assurance, rather than absolute assurance over Queensland Rail internal performance of controls.
Assurance is systematic, structured and timely. A systematic, timely and structured approach to assurance contributes to efficiency and to consistent, comparable and reliable results…
Assurance is a continuous process that facilitates unceasing improvement. It consists of assurance providers and management incorporating consistent and systematic processes in their day-to-day activities to monitor and assess control effectiveness…
Assurance activities are interdependent and inter-related. All previous and planned assurance activities form an integrated whole and contribute to the application of the Three Lines of Defence Assurance Model.
The three lines of defence model was summarised in a diagram, as shown in Figure 6.
Figure 6: QR’s three lines of defence assurance model
Source: Queensland Rail
The procedure MD-12-27 (Assurance) stated that:
First line assurance activities are essential management activities that shall be incorporated into existing business processes and systems when they are being designed and updated as the processes and systems are being implemented.
The general objective of first line assurance activities is to verify that the controls are operating effectively and as intended. The scope and complexity of each management assurance activity are determined based upon a sound understanding of the risk and controls, control effectiveness and risk tolerances. The time and resources to be allocated shall be commensurate to the level of risk.
Where practicable or required by legal and regulatory compliance obligations, first line assurance planning will be undertaken. First line assurance planning focuses on the risks and controls each Leader has accountability and / or responsibility for and applies to different Leader...
With regard to second and third line activities, the assurance procedure stated:
An integrated assurance plan focussing on second and third line assurance providers must be consolidated and reviewed annually (Risk, Insurance and Compliance) through an assurance mapping exercise to provide a holistic view of all assurance activities in relation to the corporate risk hierarchy.
The assurance procedure also stated that the planning of second and third line activities would be based on many matters. These included:
The relevant Key Operating Risks (KOR) and Event Risks (ER) of the Corporate Risk Hierarchy, their linked risks and key controls and the risk tolerance levels.
Findings, conclusions and status of actions from previous management reviews.
Findings, conclusions and status of actions from previous second line and third line assurance activities (including investigations) impacting the risks and controls.
Assurance activities performed by other managers with the Group, Function and other Functions…
A review of the Citytrain TSD master assurance schedules[23] between 2012 and 10 January 2018 identified numerous scheduled assurance activities. Some of these activities examined MOC assessments, with this examination generally limited to assuring management that drivers had completed the MOC process within the timeframe allocated.
During the investigation, QR was asked to provide copies of all reviews, audits, assessments or investigations conducted into the MOC or the MOC process between 2012 and 2018. In addition, a review activity in 2011, which provided information on the MOC process, was also requested. Relevant activities are presented in the following sections in chronological order.
2011 SPAD management study (independent review)
In 2011, QR contracted a consultancy firm to undertake an independent review of SPAD events in the Roma Street rail precinct of Brisbane. As part of its activities, the review evaluated the Citytrain driver MOC process. The report submitted to QR stated:
It is recognised by both the train service delivery (TSD) …. and the train crew that this assessment [MOC] process is deficient…
Drivers feel that this test is impossible to fail, probably because any deficiencies identified by the [assessor] early in the assessment process are developed (hopefully) to a competent level within the MOC process… Drivers also view it as a paper-filling exercise rather than skill assessment and maintenance.
Both drivers and TMIOs [assessors] raised the questionnaire [written assessment] as an issue. The same questionnaire is used at each assessment, which means a large area of their knowledge is never retested. This is certainly contrary to best practice, which recommends the use of a (large) pool of questions from which a questionnaire containing a set number of questions is randomly generated.
The review recorded that historically drivers were required to re-train every 3 years to maintain their safeworking reaccreditation, and were taken off driving duties and rostered to classroom training to facilitate this process. Drivers felt the previous process was much more effective at maintaining and assessing their skill and knowledge levels.
The review outlined many recommendations. Relating to the driver competency assessment processes, recommendations included:
consider how to implement best a practice competency management system
review the effectiveness of coaching training for tutor drivers
consider how assessment questionnaires can be less predictable and examine broader areas of drivers’ knowledge.
According to the report, QR advised that there were plans under development within the compliance office to evaluate and validate the assessment tools and to update the assessment process. ‘This will be become a 5 day, off-road reskilling and assessment process based on adult learning principles and making full use of the simulator’. As far as could be determined, minimal (if any) changes were made to the MOC process following this review.
2014 audit of SPAD prevention measures
In May 2014, a second line assurance activity examining SPAD prevention strategies included an examination of the extent to which current drivers had completed a MOC and also met relevant route competency requirements. No problems were identified.
2015 investigation into distribution of written MOC marking guide
In October 2014, a QR driver who had obtained a copy of the ‘driver maintenance of competency (MOC) written assessment marking guide’ emailed the document to several other drivers and another person they thought was a driver. The latter recipient, however, was a member of the public who resided in New South Wales. In January 2015, that person advised QR that the document held questions and answers to an assessment.
Initially, QR referred this matter to the Queensland Crime and Corruption Commission (CCC) for investigation. QR’s correspondence to the CCC suggested concern as it was possible that some 300 drivers may have had access to the document, but the precise number, at that time, was unknown. The correspondence stated that:
… in distributing/viewing the Marking Guide could have resulted in a number of Locomotive Drivers being deemed competent who may not be competent. This means there may be Locomotive Drivers undertaking driving duties without sufficient training or understanding, which is a significant risk to the safety of passengers travelling with Queensland Rail.
After evaluating the material, the CCC referred the matter back to QR for investigation. In early February 2015, QR convened an investigation into this matter. The investigation determined that the drivers who had obtained the marking guide were using it as a ‘study guide’ and there was no evidence that they used the document during their MOC assessments. However, correspondence associated with the QR investigation indicated that some staff had previously been caught using a mobile phone during the MOC process which had images of answers.
In April 2015, the internal investigation identified deficiencies with QR’s processes relating to security of information and document security classification and, as such, issued the following recommendations:
The marking guide should be reclassified from ‘official’ to ‘confidential’.
The ‘audience’ category in the marking guide should be amended from ’All rail traffic crew recent employees’ [TSD Employees] to ’Tutor Driver / Assessors’.
It should be noted that the ‘audience’ category in the assessor’s marking guide was changed to ‘tutor drivers’ in September 2017 (version 9.0) in accordance with the recommendation. However, the classification from ‘official’ to ‘confidential’ was not changed. There were considerations to change the MOC questions and process, however this did not occur and did not form part of the recommendations.
2015 audit of competency accreditation and SPAD management controls
In May 2015, a second line assurance activity examined QR’s driver competency accreditation program (to ensure drivers were appropriately trained and accredited), as well as the effectiveness of SPAD investigation processes and the processes for post-SPAD management of drivers.
In terms of training and MOC processes, the audit reviewed documentation associated with six trainee drivers, six recent drivers and six existing drivers. Although various inconsistencies with the monitoring of recent drivers were noted (compared to stated requirements or ‘best practice’), they had all completed a MOC within 18 months of graduation as required. The six existing drivers also had completed a MOC within the previous 18 months as required.
2015 audit of the MOC process
In November 2015, a second line assurance activity was conducted into the train crew MOC process. The purpose of the activity was to determine if TSD was compliant with protocols related to the:
completion of the train crew MOC prior to the due date
removal of the relevant train crew qualification if the MOC was not completed by the due date
implementation of a performance plan for train crew who were unsuccessful in their attempt at the MOC.
The audit reviewed 34 driver and 34 guard MOC assessments. It identified that all assessments were conducted within the relevant timeframes except for two drivers and two guards who were on leave when their MOC assessments were due. The audit recorded that the qualifications of both drivers were removed and reinstated after completing the assessment. However, the required process was not completely followed for the two guards.
The audit noted that none of the drivers or guards had been found to be ‘not yet competent’ through the MOC process. Four drivers (and 10 guards) had documented development plans whereas 12 other drivers (and two guards) had gaps identified by the auditor that were not documented in a development plan. The auditor also noted that of the 14 crew that had development plans, none of the MOCs had complied with the requirement to have the driver or guard undertake the unsuccessful questions on a separate day to the original assessment. In addition, most of the associated MOCs did not have the relevant answers corrected in red pen, which was also a compliance requirement.
During the audit process, the auditor identified that some answers to questions within the written MOC assessment matched word-for-word with the answers documented in the assessor’s MOC marking guide. To confirm this finding, the auditor chose at random a question from each MOC assessment (driver and guard) that required a lengthy response. The auditor then checked the responses provided by the participants against the answers in the relevant marking guides. The auditor found that 14 of the drivers (41 per cent) and 13 of the guards (38 per cent) provided an answer that matched word-for-word with the answer in the assessor’s marking guide. The extent to which the other responses were substantially similar was not noted.
As this finding was outside the scope of the audit, the auditor recorded it as an observation rather than a finding. The audit report, including two recommendations about other matters, was forwarded to the relevant TSD managers.
2016 advice to tutors
In January 2016, the TSD training manager determined that written correspondence was necessary to notify tutor drivers about accountabilities when undertaking training and assessment. After consulting with senior management, the training manager’s resultant email to the tutor drivers stated:
In the context of our business group, examples of unacceptable behaviours include, (but are not limited to):
Providing crews with marking guides to assist them in completing written or practical assessments
Signing crews off in a set competency or qualification without conducting adequate assessment activities
Intentionally arriving late and/or leaving early for rostered activities, without prior approval
Please note that any examples of the above behaviours will be considered a breach of code of conduct obligations…
The email was re-forwarded to tutor drivers by a team leader in June 2016, in association with a reminder about attendance requirements.
2016 investigations into conduct of MOCs
On 23 August 2016, a TSD manager reported an incident to the QR human resources (HR) section relating to a driver who was allegedly in possession of the assessor’s MOC marking guide while undertaking a written MOC assessment. The tutor driver administering the assessment was not in the room with the driver at the time. After interviewing the driver and the tutor driver involved, the manager who witnessed the event cancelled the driver’s MOC and referred the matter to HR for investigation.
In early September 2016, a TSD compliance officer, conducting a ‘front-line’ audit process, identified a guard’s written MOC assessment with word-for-word answers to that of the assessor’s MOC marking guide. This was reported to a manager who subsequently referred the matter to TSD senior management and HR. The manager noted that the tutor guard involved in the MOC assessment stated that their procedure was to:
…engage the participant in discourse over the subject matter, and when the individual articulated a correct response, …read the answer in the MOC to ensure a ‘word perfect’ response.
The manager concluded that the tutor needed retraining, and that:
In response to this incident, I have instigated an immediate change to the written MOC assessment and marking guide, and will be releasing an urgent communication to all tutor staff notifying them of their responsibilities in conducting assessments with qualified staff.
On 23 September 2016, correspondence was sent to the tutor group advising that identified word-for-word responses from written MOC marking guides had been identified in train crew assessments.
Also in September 2016, the HR investigation into the 23 August 2016 event concluded that the tutor had left the marking guide with the driver, and noted that a number of the driver’s answers were word-for-word matches with the marking guide. It recommended that the tutor driver be provided a ‘communication of expectations’ in regards to their obligations as a tutor driver.
The HR investigation also concluded that no outcome should be issued to the driver because:
We have not substantiated that the driver used the assessor’s marking guide during his MOC assessment. The evidence is based on one witness account, which essentially is one person’s word against the other.
Management have disclosed that any other employee’s MOC assessment would also be word for word…
We have identified that there are clear issues with the process and how the MOC assessments are conducted generally. Specifically, each tutor requires different levels of information and at times tutors will read out the answer for the driver or guard who is undertaking the assessment.
The business has not implemented the recommendations that were made last year [2015] following a similar case.
In terms of the third dot point, the HR officer later clarified with the training manager that some tutors required a high level of detail and others only required a few words for an answer. In addition, some tutors allowed the driver/guard to verbally give an answer and then, if that was close enough to the answer in the marking guide, allow the driver/guard to note down the answer from the guide.
In terms of the second dot point, the ATSB was subsequently advised that this comment was based on meetings with train crew management, which led the HR officer to form a view that it was common practice for tutors to verbally verify answers and then, once answers had been provided, to let the drivers copy the answer from the marking guide.
Following further correspondence within QR, the HR section made the following recommendations to TSD in December 2016:
Review the entire Maintenance of Competency training process and determine if the current process is the best and most suitable way to train our drivers and guards.
Develop clear instructions for Tutor Drivers and Guards on how to undertake the process.
Send out a clear communication to all Tutors, Guards and Drivers on what is expected during the entire assessment process and potential outcomes should the process be breached.
Ensure all Tutors are trained correctly and consistently in how to undertake the MOC assessment process.
As noted in Citytrain driver maintenance of competency process, in September 2017 version 9.0 of the MOC included rewording of several questions, and a written instruction (MD-17-406) was issued to supplement the instructions in the MOC paper and marking guide. However, a review of relevant documentation identified no significant changes to the MOC process prior to the 10 January 2018 SPAD occurrence at ME45.
2017 correspondence to tutors
In 2017, a manager sent a series of emails to tutors regarding maintaining the security of assessment materials.
In February 2017, an email stated that:
Maintaining the integrity of TSD training is critical to ensure that only those trainees who are deemed as competent by a qualified Assessor become qualified drivers and guards for Queensland Rail.
An important part of this obligation is ensuring the security of assessment materials.
Please ensure you:
Do not share assessment materials with those who are not authorised…
Ensure assessment materials are secure at all times.
Please be reminded of our obligations under the Queensland Rail code of conduct…
In June 2017, another email with the same content and additional dot points was disseminated to the tutor group. These included:
Do not leave materials on desks, in communal areas or anywhere a trainee may access…
Marking guides are for Tutors ONLY and must never be provided to a trainee.
Another email in June 2017 noted that security of assessment materials had been tightened ‘as concerns have been raised that these resources may have been provided to people outside of the TSD training area’.
Instruction MD-17-406 (Rail Traffic Driver Maintenance of Competency Assessment Process), issued to tutor drivers in September 2017, included the following statements:
Under no circumstances is a learner [participant] to view or be provided access to the marking guide…
During the assessment if the learner requests assistance the assessor may provide guidance but must not provide answers or breach the code of conduct.
Additional information related to the MOC process
Regulatory oversight activities
Prior to 30 June 2017, the Department of Transport and Main Roads (DTMR) was the Queensland rail regulator.[24] Its function, in part, was to ensure accredited rail transport operators[25]had the competence and capacity to carry out particular railway operations safely. To facilitate this outcome, DTMR evaluated rail compliance through audits and compliance inspections.
Between June 2012 and June 2017, DTMR directed a number of regulatory audits / compliance inspections relevant to QR’s (Citytrain) driver maintenance of competency process:
In May 2012, DTMR conducted an audit to determine compliance of QR's safeworking and maintenance of competency training for Citytrain drivers in the Brisbane suburban area.
During July–September 2013, DTMR facilitated a compliance inspection to determine if Brisbane-based category one driver route competence was assessed against competency element 14 (direction of travel) for all tracks relating to MD-10-199 Safeworking Training.
Between December 2016 and June 2017, DTMR conducted an audit to determine if the requirements contained in QR’s safety management system were being adhered to for ensuring the competence of rail safety workers who carried out rail safety work was assessed and recorded with the focus on 32 TSD Citytrain trainee drivers who were currently progressing through the assessment of the competence process.
A review of the findings recorded only minor discrepancies with the Citytrain driver MOC process and nothing that related to assessment irregularities.
Although DTMR recorded that rail traffic crew competency for QR as an important aspect of operational risk, there was no specific audit or oversight activity that examined in detail the integrity of the MOC process.
Commission of Inquiry into train crewing practices
In the course of this investigation, the ATSB reviewed the findings from the Queensland Rail Train Crewing Practices Commission of Inquiry initiated in November 2016, with the final report completed in January 2017. The independent inquiry was initiated by the Queensland Government as a result of Citytrain train crew shortages and subsequent suburban train cancellations with the introduction of the Redcliffe rail corridor.
One of the relevant underlying issues the inquiry identified for the reduction in qualified train drivers was ‘Management decisions to reduce training staff and halt driver training intakes between February 2014 and February 2015’. The report also noted that the shortfall between supply and demand of drivers was not widely understood in the organisation, partly associated with the TSD team being ‘focussed on short-term operations’ and it did not ‘sufficiently recognise or escalate longer-term issues’.
In addition, the report noted that in 2012–13 QR initiated a voluntary redundancy program, which resulted in eight tutor drivers and 10 TOIs leaving the organisation, and that ‘reductions in training programs and tutors was a contributing factor to the undersupply of train crew’. The inquiry also identified that QR had significant challenges with the implementation of risk management processes, in particular in relation to each of the three lines of defence.
Additional information from training managers
The ATSB interviewed several personnel who served in the role of TSD training manager or provided specialist support to the manager during the period from 2015 to 2018. These personnel all stated that the driver MOC was an assessment designed to appraise the drivers’ skills and knowledge in accordance with enterprise, legislative and regulatory requirements. They further stated that the assessor’s MOC marking guide highlighted the fact that it was an assessment. In addition, correspondence, in the form of multiple emails relayed to the tutor group, emphasised that the MOC was an assessment not a coaching session.
All of the managers interviewed stated that the TSD training section was short-staffed in their time as manager, which presented challenges due to the high number of drivers, guards, trainees and tutors in TSD.
From late 2013 until June 2015, there was no training manager in TSD. The responsibilities of the training manager were merged with those of the manager TSD operations during this period. In June 2015, a training manager was appointed to the role. This manager stated that at that time there were only three support staff in the training team: a compliance officer, training officer and a team leader.
The manager also recalled that their initial task was to correct legacy issues resulting from the absence of a training manager. Initially, the focus was on responding to regulatory requirements such as expired train crew competencies, derogations near to elapse and ‘issues that were broken’. In addition, there was a need to increase the driver and guard numbers due to identified crew shortages in Citytrain. This limited the availability of training staff to undertake assurance audits.
However, the manager recalled utilising staff to undertake periodic compliance checks on the train crew MOC process. They noted that on at least one occasion, a compliance officer noted that answers to questions in a written MOC assessment were word-for-word with the assessor’s MOC marking guide (see 2016 investigations into conduct of MOCs).
Additional information from tutor drivers
The ATSB interviewed nine Citytrain tutor drivers, all of which had at least 7 years’ experience as a tutor. Many of these tutors stated that they believed the MOC was and/or should be a process to ensure that, at the end of the assessment, the driver was competent. However, some noted that in recent times management had deemed that it was an assessment of competency rather than a process to maintain competency. Some tutors also noted that drivers were not provided time or specific guidance material to prepare for a MOC, and therefore treating the process as only an assessment was an unrealistic expectation.
There was significant variation amongst the tutors with regard to how the driver MOC process was administered, particularly in terms of the written assessment. Two of the tutors indicated that they would verbally read the question to the driver then discuss it with the driver before the driver wrote their answer. Others indicated that the driver would read and answer the questions in writing on their own, with the tutor either waiting in the same room or just outside, providing assistance as required. However, the amount of this assistance appeared to vary significantly, with some tutors saying that they would only help the driver by rephrasing the question to make it clearer, whereas others indicated they would also discuss scenarios and/or use a whiteboard to provide information to help the driver understand what the question was ‘looking for’. None of the tutors stated that they provided the marking guide to the drivers or provided the actual answers to any of the questions.
All of the tutors advised that drivers would need assistance with some of the questions. Some indicated that this was because the content of the questions was information that was rarely encountered in the drivers’ day-to-day work. Although several tutors noted that a number of the questions were not relevant to the role of a train driver, some of these tutors noted that this problem had been addressed in a recent version of the MOC.
Most of the tutors also noted that some of the questions were worded ambiguously, causing difficulty for the drivers in identifying the correct response. It was further noted that the ordering of questions was sometimes misleading, resulting in drivers being confused as to the intent of some questions. Some tutors reported having provided feedback about poorly worded questions, but this feedback was rarely responded to, which deterred them from further reporting suggested changes. Correspondence regarding the MOC reviewed by the ATSB included examples where tutors provided concerns regarding MOC questions and feedback was provided to the tutors.
None of the tutors interviewed stated that they had conducted a MOC in which the driver was found to be ‘not yet competent’, with some indicating that they had always managed to coach the driver up to the required standard. Many of the tutors noted that they were dealing with qualified drivers who already knew the information required, but just needed some assistance with understanding the intent of the questions. The tutors advised that the duration of the MOC assessment would vary depending on the driver and other factors, and that fitting it within 2 days was often difficult but usually achieved, with some MOCs requiring a 3rd day.
Additional information from drivers
During the course of this investigation and other recent investigations, the ATSB interviewed a number of drivers about training and assessment and the MOC process. Most of the drivers interviewed stated that they were not provided with the assessor’s written MOC marking guide when completing the written assessment. They advised that they were coached or assisted (to various degrees) in answering some of the questions by the assessor.
Some drivers noted that some of the questions were poorly written, which made them difficult to answer. Another common complaint was that in most cases a MOC assessment was scheduled at short notice, which meant there was no time to study for the assessment.
A trainee driver stated that, while under assessment conditions, the assessor would vacate the room and leave the assessor’s marking guide in clear view of the participants. The trainee driver further stated that in their experience it was the culture within TSD to be provided with answers to assessment questions or be assisted in some way. The trainee driver stated that, when they were working as a guard, on two occasions the assessor’s MOC marking guide was made available to them during a MOC assessment. They also recalled being directed to rephrase the answers to questions when completing the written assessment, so the answers were not word-for-word with the assessor’s marking guide. In addition, they were instructed to get some answers wrong in order to disguise audit attention.
One experienced driver who was interviewed stated that during their last MOC assessment they were provided with the assessor’s written MOC marking guide at the start of the assessment and told to use it if required. The driver stated that 50 per cent of the time they referred to the marking guide to answer the questions. The driver indicated that ‘no driver would pass the MOC assessment in its current form’ without assistance. The driver further suggested that some of the questions in the written MOC assessment were not applicable to a driver’s role and questioned their relevance.
Implementation of risk triggered commentary driving (RTCD)
Introduction of RTCD
In 2005, Arriva Trains Wales, a rail operator in the UK, and railway consultancy business Halcrow developed risk triggered commentary driving (RTCD) after Arriva experienced a significant number of SPAD occurrences.
In 2008–09, Queensland Rail (QR) introduced RTCD for Citytrain train service delivery (TSD) drivers with assistance from Halcrow. Initially, RTCD was recommended as a self-regulated tool, which allowed drivers to personalise and/or individualise their verbal rehearsals and allow flexibility on its application. However, after a sharp increase in the number of SPAD occurrences midway through 2011, TSD management mandated the application of RTCD. Other business functions within QR that had implemented RTCD continued using it as a recommended (but not mandatory) technique.
The ATSB requested documentation and supporting evidence from QR on how it facilitated the management of change with the decision to mandate RTCD within Citytrain TSD. In response, QR was not able to provide documentation to demonstrate that a risk management approach was followed in accordance with its internal management of change process. There was also no documented evidence available to establish if literature reviews, risk assessments or consultation with stakeholders was considered or undertaken as part of the change process.
2013 review of RTCD application
In mid-2013, relevant QR executive management sponsored a working group to review SPAD controls due to over-represented SPAD numbers in the Brisbane inner-city. RTCD was one aspect examined by the SPAD Prevention Working Group.
In November 2013, the working group produced a recommendation paper. The paper noted that QR Citytrain was the only Australian passenger rail operator to have mandated the use of RTCD for its drivers. In addition, the paper noted there was no conclusive evidence to determine the efficacy of mandating RTCD. The working group conducted literature reviews and consulted with subject matter experts on the topic, which culminated in a recommendation paper.
The working group presented the ‘RTCD review recommendation paper’ to Citytrain senior management. The paper reviewed relevant literature relating to the technique and how it was applied, with the focus on whether the technique should be mandated. It noted that, under the model proposed by Halcrow, RTCD was based on the following principles:
RTCD is recommended, but not mandatory, using a system where the driver speaks the aspect of the signal/indication/hazard and the specific action that needs to be taken.
If the driver does not want to speak the instructions recommend that the driver uses a technique that is acceptable to them – such as quietly “muttering” this to themselves or silently repeating it back.
It is applied during situations which introduce increased risk – such as driving on restricted signals, departing a platform on restricted signals and the signal ahead cannot be seen, when certain degraded conditions apply; and
Other essential tasks required of the driver will take priority over RTCD in certain circumstances (e.g. answering the emergency intercom, completing Safeworking forms, and other high workload situations).
The review paper also noted there ‘was no empirical study identified that researched the application of RTCD in the rail environment’. It also noted that there were no studies in any industry that either recommended or advised against mandating verbalisation or RTCD.
The paper referred to a 2008 fact sheet produced by the UK Rail Safety and Standards Board (RSSB). The fact sheet stated that the RSSB human factors team noted that using RTCD had both positive and negative effects for drivers:
Benefits included providing a tool to help them evaluate their next actions and helping them remain alert and able to remember key information.
Negative aspects included the potential for excessive workload and distraction from driving, particularly when drivers were learning the technique or having difficulty articulating what they are thinking, and sustained use leading to the technique being applied automatically without drivers thinking about what was said.
The RSSB fact sheet stated that RTCD could be of great benefit to some drivers, but also noted it should be stopped under high workload conditions or if a driver felt that it was ‘taking away from their driving performance’.
The SPAD Prevention Working Group’s review paper also stated that:
Stakeholders advised the current RTCD training materials and delivery are inadequate and require immediate review.
It was suggested that training inconsistencies [variations on the training delivery of RTCD] are likely due to personal preferences regarding risk from individual instructors [tutor drivers], which confuses the end users [drivers].
Two of the paper’s recommendations included:
3. Based on RTCD literature, industry research and application, the use of RTCD should be highly recommended to RTDs as one effective risk management control, but its application not be mandated.
4. Queensland Rail (suggested lead – TSD with Learning and Development input) review the current procedures and training materials for RTCD and delivery of training for Rail Traffic Drivers to ensure it aligns with the agreed definition and is appropriate for the function.
Appendix ‘A’ of the review paper provided minutes from a review meeting. The minutes noted there was currently no means to effectively monitor the use of RTCD in driver only operations. They also stated that participants had different views about whether the technique should be mandatory, but that all agreed there were problems with consistency in the understanding, delivery and assessment of RTCD.
Appendix ‘B’ of the review paper allowed stakeholders to provide their comments in relation to the recommendations. Human factors specialists involved in the review agreed that RTCD was a helpful tool for drivers to manage risk, but they opposed the mandatory application of RTCD. One HF specialist indicated that their resistance to the mandatory application was based on the impacts of workload.
Representatives from Citytrain TSD training stated that no strong evidence had been presented against mandating the technique and the technique should remain mandatory. TSD compliance personnel noted that most SPADs involved problems with situational awareness and RTCD was designed to help situational awareness. They also noted that post SPAD briefings with drivers had shown that no SPAD had occurred while a driver was using the technique, although this claim was subsequently disputed and some examples were provided of SPADs that had occurred with drivers reporting they had been using the technique.
Following the review, Citytrain senior management decided to maintain RTCD as a mandatory technique.
August 2015 audit that examined RTCD
In August 2015, QR conducted a second line assurance activity to determine the effectiveness of the implementation and monitoring, by Citytrain, of the 75% rule and RTCD.
The auditor documented the following observations regarding RTCD:
Discussions with two tutor drivers and review of comments in monitoring records indicate that the application of RTCD is inconsistent; while calling the signal [aspect] is complied with, calling the [drivers] action is inconsistently applied and reinforced. The two tutor drivers advised their understanding was that it was only compulsory to verbalise RTCD when a second person was in the cab. Inconsistent application of RTCD by trainers and assessors does not meet mandatory requirements outlined in the TSD Professional Driving – RTCD instruction…
Review of monitoring materials and discussions with TOIs indicate inconsistent enforcement of RTCD with each employing different levels of compliance and record keeping…
The auditor also recorded irregularities with the effectiveness of the change management process with the updated release of MD-13-165 (TSD Professional Driving – Risk Triggered Commentary Driving, version 1.0, July 2013). As TSD management had mandated the application of RTCD, there was a requirement to communicate the procedure to drivers, trainers, monitoring officers and assessors with a consistent framework for the understanding, delivery, application and assessment of RTCD. In addition, the auditor noted that a review of monitoring documents and discussions with tutor drivers and TOIs had identified a variance in the comprehension of RTCD requirements, indicating communications had not been effective.
The auditor also noted limitations with the MOC written assessment questions related to RTCD, with no questions emphasising the importance of calling the required action as well as the signal, and one question potentially indicating that RTCD was only required if a second person was in the cab.[26]
The auditor noted there was no method of verifying compliance with RTCD. However, during post-SPAD interviews with drivers involved in 13 SPADs, none reported using RTCD at the time of the SPAD.
The assurance activity report concluded there was inconsistent understanding of RTCD mandatory requirements across rail traffic crew, and it recommended:
Distribute clear, concise communication to all Rail Traffic Crew [drivers, tutor drivers and TOIs] regarding mandatory requirements of Risk Triggered Commentary Driving to eliminate current inconsistencies and misunderstanding.
Interviews with tutor drivers and drivers regarding RTCD
Following the SPAD occurrence on 10 January 2018, the ATSB interviewed a sample of tutor drivers and drivers about their understanding of RTCD and how it was applied.
During the interviews, the following information emerged:
There was wide variation amongst interviewees as to the purpose of RTCD, although most understood it to be an attempt to improve awareness of hazards and risks.
A number of interviewees reported a belief that ‘internal’ RTCD was sufficient for experienced drivers; that is talking the hazards and risks as well as actions non-verbally to themselves rather than speaking them aloud as documented in the procedure.
There was confusion in relation to the mandatory application of RTCD. Most of the interviewees understood that it was mandatory for all risks identified by the driver to be spoken aloud, not just for restricted signals as documented in the procedure.
A number of interviewees confused RTCD with cross calling all signals when there was more than one person in the driving cab.[27]
Knowledge of the verbal phrasing and order of the phrasing of RTCD requirements was inconsistent within the interview group. Some believed there were mandatory phrases that a driver must use, while others reported that it did not matter about the phrase or order as long as the key information was verbalised.
The interviews indicated there was a widespread misunderstanding of the requirements of RTCD amongst drivers and tutor drivers. One tutor driver reported having copied the appropriate passages from the RTCD procedure and using this to assist in discussions with numerous colleagues who misunderstood the practice.
In addition, a driver who had recently completed driver training advised that there was a lack of standardisation within the tutor driver group on the delivery of RTCD. Some tutors required the driver to verbally call all signals, hazards, speed boards, level crossings and speed reductions while continuing to recall and repeat new information as it developed. Other tutor drivers wanted the verbal recall (word phrasing) of information in a particular way, while others were not so particular.
The recent driver stated that, after being in the driver-training program for more than 12 months, they had only recently learnt that RTCD was only mandatory when encountering restricted signals. They mentioned that this was not emphasised in driver training. The recent driver also recalled the case of a trainee driver who went straight past a platform because they were so busy using RTCD and calling the road[28] they forgot to stop.
Additional information
The QR investigation report into the 10 January 2018 SPAD at signal ME45, noted that the analysis of SPAD occurrences during 2017 found that RTCD was not utilised in at least 67 per cent of the occurrences. The report also noted that not all investigation reports had noted whether or not RTCD was being used. In addition, the report noted that there were currently no methods available for monitoring compliance with RTCD when drivers were alone in the cab.
SPAD risk management processes
General information
The occurrence of SPADs is a significant, ongoing problem for most rolling stock operators. Although most SPADs result in negligible safety consequences, a small proportion result in collisions, derailments or other accidents with significant adverse consequences.
A wide variety of factors can contribute to SPADs, as indicated in Figure 7, taken from the Rail Industry Safety and Standards Board (RISSB) SPAD Risk Management Guideline.
Figure 7: Types of factors that can contribute to SPADs
Source: RISSB SPAD Risk Management Guideline
In order to minimise the risk of SPAD occurrences, it is widely recognised that a rolling stock operator needs to utilise a range of processes and controls as part of an overall SPAD risk management framework.
Queensland Rail (QR) had been actively monitoring and managing the risk of SPAD occurrences for many years using a variety of processes, controls, and programs. In addition to its other risk management and assurance processes, it had specified requirements in its SPAD Risk Management Standard (MD-10-89), SPAD Risk Management Procedure (MD-13-362), TSD SPAD Risk Management Instruction (MD-13-446), and a variety of other associated documents.
More specifically, QR’s processes and controls for managing the risk of SPAD occurrences included (but were not limited to):
ensuring signals and related infrastructure met relevant design requirements
ensuring drivers were provided with relevant training and met relevant competency requirements
reporting, recording and investigation of SPADs
reviewing any signals and related infrastructure that has been involved in a SPAD
post SPAD management of drivers involved in a SPAD
analysis and classification of SPAD information
communication of SPAD information and lessons learned.
SPAD prevention activities were also developed, facilitated and promoted by various cross-sectional groups within QR. For example, in March 2013, the SPAD Prevention Common Outcome Group was initiated to direct and deliver progressive improvement in the management of SPADs. Prior to this time, the SPAD Prevention Working Group performed a similar role. In October 2017, QR convened the SPAD Prevention Taskforce.
SPAD management activities were subject to first line and second line assurance activities on a regular basis.
Overview of QR SPAD statistics
In the period from July 2012 to March 2019, QR recorded 287 SPADs. This equated to an average SPAD rate of 42.5 SPADs per year (or 3.5 per month). Most (75 per cent) of these occurred within the Citytrain rail network.
For all of QR, during the financial years 2015–16, 2016–17 and 2017–18, there were 40, 35 and 43 SPAD occurrences, respectively. As shown in Figure 8, the SPADs per million train kilometres trendline decreased over the period from July 2012 to March 2019. For the years 2015–16, 2016–17 and 2017–18, it was 2.16, 1.93 and 2.35 SPADs per million train kilometres, respectively. For Citytrain, the rates were similar, with 2.11 SPADs per million train kilometres over the 2 years 2016–18.
Figure 8: QR SPADs and SPADs per million train kilometres from July 2012 to March 2019
Source: Queensland Rail
For all of QR, the annual rate of red signals approached per SPAD[29]for 2015–16, 2016–17 and 2017–18 was 31,700, 34,900 and 26,800, respectively. For Citytrain, the rates were similar, with 31,000 red signals approached per SPAD over the 2 years 2016–18.
For all of QR, during the period from July 2012 to March 2019, there were:
154 driver misjudged SPADs (that is, the driver attempted to stop the train but failed to stop before passing the signal)
93 completely missed SPADs (that is, no attempt was made to bring the train to a stop before the signal and the train proceeded into the next section or block without the necessary authority; the driver did not realise the train had passed the signal until they were notified by train control or a more serious event occurred)
13 starting against signal SPADs (that is, a stationary train started at and proceeded beyond the signal)
27 other SPADs (that is, any authority exceeded that is not classifiable under one of the above subcategories).
QR considers ‘completely missed’ and ‘start against signal’ as the most significant SPADs, as generally the drivers involved have acknowledged the AWS alarm immediately prior to passing the red (stop) signal and continued to operate the train unaware it had exceeded its limit of authority. These two SPAD categories were associated with 106 occurrences, which represents about 37 per cent of the total SPADs during the period from June 2012 to March 2019. For Citytrain over the same period, the rate was similar (34 per cent).
Use of engineering controls
Because most (but not all) SPADs involve driver errors, it is widely agreed that various types of engineering or technical controls are usually the most effective in preventing SPADs, reducing the likelihood of SPADs and/or minimising the consequences of SPADs.
QR advised that engineering controls on the Citytrain network to reduce the risk of SPADs included the design of the signals themselves, signal aspect sequencing (and the cues that provides to the driver), overlaps, track design and routing. In addition, other risk controls to reduce the exposure to potential SPADs included timetabling.
The Citytrain network also included engineering controls that provided various alerting functions to minimise the risk of SPADs. These included the automatic warning system (AWS), which provided various advisory information to drivers on their approach to a signal (Automatic warning system).
In addition, although QR’s universal train control (UTC) system did not prevent SPAD occurrences, in most cases the system provided a SPAD alarm at the network control officer’s (NCO’s) workstation if a train passed a ‘controlled’[30] signal. Therefore, the system had the potential to mitigate the consequences of a SPAD occurrence by the NCO broadcasting an emergency stop command to the driver (as was the case with the 10 January 2018 SPAD at signal ME45). However, ‘non-controlled’[31] signals located on the QR suburban rail network did not generate a SPAD alarm on the UTC system.
There are also other engineering controls available that can play a more active role in detecting potential or actual SPADs and managing their risk. Some examples of such systems used by other Australian infrastructure and rolling stock managers include:
Automatic train protection (ATP): involves the installation of technology on the trains themselves and the tracks (trackside). The ATP technology transmits information from the trackside equipment to the train that supervises train speed, target speed, and enforces braking when necessary to prevent derailments and SPAD occurrences.
Signal train stops: a train stop system involves a trip cock on the vehicle and a trip arm located trackside which, directly initiates an emergency brake application from the trip cock coming into contact with the trip arm. The trip arm is located adjacent to the signal, and the lever arm elevates when the signal is displaying a red aspect and returns horizontal when the signal clears.
As noted by the RISSB SPAD Risk Management Guideline:
Reducing the SPAD consequence can dramatically reduce overall risk and largely involves the use of technical solutions, such as Automatic Train Protection (ATP), positive train control or other enhanced train separation. Ultimately, these are the most effective means of reducing SPAD risk, however, it is recognised that they may not provide the optimum solution because:
Technical solutions often come at a high cost – the balance of costs and benefits need to be considered to determine the best use of resources;
Problems with interoperability – systems may not be compatible or standardised between RTOs [rail transport operators] or across the rolling stock fleet. Many networks carry mixed traffic including metropolitan passenger trains, regional passenger trains and freight trains, each with their own type of rolling stock and train protection systems. There are additional problems of interoperability given the variation in network rules across state boundaries;
Compatibility with legacy systems – rail infrastructure can vary greatly even across the same network. This may be due to variance in asset age and/or variability in adopted standards;
Potential for de-skilling – some technical solutions may reduce the efficiency of route knowledge or inadvertently impact the manner in which routes are navigated.
Although QR had considered introducing ATP on the Citytrain network at various times, it had not been introduced prior to the 10 January 2018 SPAD occurrence.
In 2016, the Queensland Government agreed to fund the introduction of the European Train Control System (ECTS). A ‘Building Queensland’ cost benefit analysis summary released in May 2016 stated:
In February 2016, the Queensland Government requested that Building Queensland lead the development of a Business Case for the European Train Control System (ETCS) – Inner City project, in conjunction with the Department of Transport and Main Roads and Queensland Rail.
The ETCS – Inner City Project delivers a complete overhaul of the inner-city rail signalling and communications system with new, state-of-the-art equipment.
ETCS Level 2 is a new generation of train protection and control for the rail network in SEQ, providing automated train protection and communications-based signalling.
Geographically, the scope of the project has been identified as the area of the network between Northgate and Milton stations. This area encompasses the key area of the network through which all trains must pass, and includes Roma Street, Central, Fortitude Valley and Bowen Hills stations.
Lineside signals would be progressively removed from the network as they would no longer be required. To support ETCS L2, the project replaces and upgrades a number of existing signalling and telecommunications systems that are nearing end-of-life and are due for replacement.
Monitoring of driver performance
Introduction
In addition to the use of the maintenance of competency (MOC) assessments for existing drivers, QR also had a number of other planned and unplanned methods to monitor driver compliance with procedures and rules to minimise the risk of SPADs.
In-cab performance monitoring
An observation of the Citytrain TSD master assurance schedule (July 2013 to June 2016) showed evidence of planned monthly first line assurance activities where TOIs were scheduled to conduct compliance audits on driver performance. However, there was no evidence to determine the extent these activities were conducted as planned. The assurance schedule for July 2017 to June 2018 showed no planned evidence of such line assurance activities.
Recent driver monitoring
Recent driver monitoring was another method used by QR Citytrain to assess driver compliance. This involved a TOI riding with and observing the driver’s performance and providing feedback at specified intervals.
QR originally introduced this process due to the over representation of SPAD occurrences by drivers with less than 2 years’ driving experience. Initially, these monitoring sessions were scheduled at the 1, 3, 6, 9,12,15,18 and 24-month intervals after driver qualification was gained. However, an internal audit in May 2015 identified anomalies with this process where monitoring sessions occurred outside of the specified times and on some occasions did not occur at all. The practitioner undertaking the audit was advised by Citytrain management that:
…the requirements set out in the abovementioned monitoring program are an example of ‘best practice’ and are ‘nice to have’ but they are not mandated. Therefore, drivers who are delayed in obtaining their milestone monitoring are not deemed ‘incompetent’ and this does not have any impact on our safety accreditation with the regulator.
In April 2016, Citytrain TSD management revised the recent driver monitoring schedules and changed them to 2, 6, 12, 18 and 24-month intervals after the initial driver qualification was gained.
Post SPAD coaching and mentoring sessions
Following a SPAD occurrence, a TOI evaluated the involved driver’s on-track performance and documented areas for improvement. Normally this would be followed up with detailed coaching and mentoring sessions, also administered by a TOI. The results of the coaching and mentoring sessions were recorded in a database for retrieval as required.
Use of event recorder data
The RISSB SPAD Risk Management Guideline included guidance regarding ‘good practice’ relating to various SPAD management processes. Under a section on developing and maintaining staff competence, it stated:
Include, within the assessment cycle, programmed assessment events such as practical rides, unannounced monitoring through, for example, on-train data recorder analysis, random monitoring of safety critical communications, monitoring from stations and yards, monitoring using CCTV etc
QR personnel reported that, prior to the 10 January 2018 SPAD occurrence at ME45, event recorders were not systematically used to evaluate driver compliance against rules and procedures, other than when investigating specific incidents and for a planned project to analyse driver behaviour in 2015. That 2015 project involved the comprehensive analysis of driver behaviour by the use of event recorders and front-of-train CCTV. To ensure the validly of the analysis, the event recorder and CCTV were calibrated for the purpose of accuracy. This enabled the analyst to see what the driver was viewing while the event recorder displayed inputs generated by the actions of the driver.
Although this was a protracted undertaking, this process provided the organisation with a comprehensive understanding of driver behaviour, risk exposure and the benefit of knowing the data was reliable if required for strategic use. In addition, the data could also be used to crosscheck other evidence gained from audits and assurance activities to form the basis for good strategic decision-making. It also provided a benchmark to evaluate future safety performance if strategic initiatives were introduced after the initial data collection.
Although the outcome of the project was well received by QR, there was no proposal to maintain the analysis of driver behaviour through the examination of event recorders.
QR advised the ATSB that it had not subsequently introduced any other program to review event recorder data to monitor driver performance prior to the 10 January 2018 SPAD. However, the SPAD Prevention Taskforce established in 2017 identified the use of proactive event recorder analysis as one of its critical SPAD prevention initiatives. After a period of planning, baseline data collection commenced in April 2018.
QR personnel involved in the analysis advised that the data collection was based on four SPAD mitigation rules (Citytrain driving procedures):
75% rule
‘start on yellow’ (SOY) rule
stopped at red rule
20 / 20 rule.
As of March 2019, QR was still collecting baseline data. Data for the periods from September 2018 to March 2019 indicated compliance rates as follows:
87 per cent for the 75% rule
55 per cent for the SOY rule
92 per cent for the stopped at red rule
99 per cent for the 20 / 20 rule.
QR personnel advised that the data collection process did not use front-of-train CCTV footage as part of the analysis. Accordingly, there were assumptions made regarding some aspects of these analyses (in terms of what signal aspects a driver was exposed to in some cases).
Soon after departing Bowen Hills station, suburban passenger train TP43 was approaching signal ME45 on the down suburban line. The signal was displaying a red aspect (or stop indication), but the train continued past the signal, gradually accelerating.
There were no problems associated with the operation of the train or the serviceability of the train, and the signal functioned as designed. The immediate reason for the signal passed at danger (SPAD) was that the driver perceived the signal was displaying a green aspect and drove according to that belief.
Such a ‘completely missed’ SPAD can have very serious consequences as there were limited risk controls or defences in place on the Queensland Rail (QR) Citytrain rail network to recover from the situation. In this case, the network control officer (NCO) promptly responded to the SPAD alarm and alerted the driver of TP43, who stopped the train. Had the NCO not issued the stop instruction, there was potential for a collision with another suburban train.
The safety analysis will initially discuss the most likely factors that contributed to the driver’s misperception of the signal. It will then discuss some of the key risk controls that QR had in place to minimise the risk of such SPADs. In particular, the analysis will discuss:
the automatic warning system (AWS)
risk triggered commentary driving (RTCD)
the maintenance of competency (MOC) process
the oversight of the MOC process
other means of monitoring driver performance.
Potential factors associated with the SPAD
Overview
Train driving is a specialised task that is acquired through comprehensive training; it involves conducting routine, frequently practiced tasks in a largely automatic manner (at a skill-based level) with occasional conscious checks on performance. In addition, it relies on well-developed safeworking and route knowledge, particularly the location of signals and the sequence in which they function. Instead of simply responding to each signal in isolation (as is largely the case with road vehicle drivers), train drivers are required to anticipate the state of future signals based on the signal aspect indications of the preceding signals and other relevant information.
As stated by Stanton and Walker (2011):
Assuming that the individual has the correct route knowledge for operating the train, their schema will enable them to anticipate events (such as the signals and signs they expect to see and routes they expect to take), search for confirmatory evidence (such as looking at the signal aspect, trackside objects, routing information, speed indicators and notes), direct a course of action (such as braking and accelerating) and continually check that the outcome is as expected (such as the slowing down or the speeding up of the train).
Accordingly, most of the driver errors associated with SPADs occur at the skill-based level of performance, and such errors are generally known as slips or lapses (Reason 1990). As noted by a recent UK Rail Safety and Standards Board (RSSB) report (Gibson 2016):
The dominant driver error types that are causal or contributory to SPADs can be grouped together as slips or lapses, and are cases where the driver had the correct intention, but their performance based on that intention did not go as planned (for example forgetting to implement routine signal observation tasks or misperceiving signal aspects). These slips or lapses are primarily related to observing and acting on caution and stop aspects and are causal or contributory in 70% of SPAD incidents. Key mechanisms underpinning these errors include attention (for example distraction) and expectation (for example, a caution signal is perceived to be green rather than at caution because it is usually at green in the driver’s experience).
In this case, the driver misperceived signal ME45 to be displaying a green aspect as the train traversed the sweeping right curve prior to the signal. When traversing the curve, the driver would have first sighted signal ME37 (which was displaying a green aspect) just before sighting signal ME45 (which was displaying a red aspect). Therefore, based on the available evidence, the driver probably read through to the other signal (ME37) and mistook it for ME45, and subsequently assessed that ME45 was displaying a green aspect.
Expectancy
Expectations are based on past experience and other sources of information. They strongly influence where a person will search for information and what they will search for (Wickens and McCarley 2008), and they also influence the perception of information (Wickens and others 2013). In simple terms, people are more likely to see what they expect to see, and less likely to see what they do not expect to see.
Exactly what the driver was expecting when the train departed Bowen Hills and on approach to signal ME45 could not be determined, as the manner in which a train is driven after departing Bowen Hills is not significantly different when the departure signal is at yellow compared to when it is at green. However, a read-through error when approaching signal ME45 (and assessing the signal to be green) would be consistent with the driver expecting that signal ME45 was not displaying a red aspect.
In this case, the driver of TP43 was very familiar with the route, and statistics provided by QR showed that drivers rarely (less than 1 per cent of the time) encountered a red aspect at signal ME45. This context would generally create an expectation, in the absence of other information, that the signal would not normally be displaying a red aspect.
Prior to boarding the train, the driver noted that the departure signal (ME25) was displaying a yellow aspect. This meant that, at that time, signal ME45 would have been displaying a red aspect, and the driver should have expected that signal ME45 would be at red. It is also noted that, when contacted by the NCO after passing ME45, the driver was able to recall that the departure signal was at yellow. However, their ability to recall that signal after being stopped by a controller does not necessarily mean they had a high level of awareness of that signal (and therefore the likely status of ME45) when approaching ME45.
A number of factors could have reduced the driver’s awareness of the status of the departure signal, and affected their expectancy of the status of signal ME45 when approaching that signal:
The signal aspect of ME25 was not discussed during the changeover with the outgoing driver.
After boarding the train, the driver’s attention was distracted due to problems with their seat (see also next section).
The driver could not recall checking or sighting the departure signal after boarding the train, and they reported they probably did not check the signal. Based on the available information, it would appear very unlikely that the driver did check the signal.
The driver did not apply risk triggered commentary driving (RTCD) as a general practice, or specifically on this occasion, in response to the restricted signal prior to departing Bowen Hills.
Drivers often encounter situations where the signals ahead of a train stopped at a platform upgrades prior to them leaving the platform. Similarly, as noted by Punzet and others (2018), ‘In some situations and under certain conditions, a strong route knowledge can be detrimental as it can lead to habituation and incorrect assumptions. For example, if a signal in a particular location is often or always on amber (indicating the next signal may be on red), but the next signal is actually green by the time the train approaches it, a train driver may become habituated to the fact that the second signal is always green and so may assume it is green on every approach.’
At least five of the 10 SPAD occurrences at signal ME45 since 1996 involved drivers who had just boarded the train following a changeover at Bowen Hills. During this period, it is likely that significantly more than half the trains passing through signal ME45 did not have a driver change at Bowen Hills. Therefore, this data indicates that the process of boarding a train may increase the likelihood of a driver not fully recognising the significance of a yellow departure signal, and other expectancies may have more influence on their performance than the status of the departure signal.
Drivers who board a train at Bowen Hills when signal ME45 is displaying a red aspect only receive cues from signal ME25 (displaying a yellow aspect), whereas drivers that do not change at Bowen Hills would receive a double yellow aspect at the signal prior to ME25 as well as the yellow aspect in ME25.
Based on the available evidence, the ATSB concluded that the driver was probably not expecting to see a red aspect when approaching ME45, even though they had identified that the departure signal was displaying a yellow aspect prior to boarding the train.
The driver had opportunities to maintain or reinforce their awareness of the status of the departure signal prior to departing the station and on approach to signal ME45. In particular, not consciously checking the departure signal, either before or after receiving the ‘rightaway’ from the guard, removed a critically important opportunity. However, the extent that this action by itself would have prevented the subsequent error could not be determined, due to the number of other potential factors involved.
Distraction
Research has shown that distraction or diverted attention involving the driver is commonly associated with SPADs (Naweed and Rainbird 2013). Distractions can arise from task-related activities (both inside and outside the locomotive cab), activities unrelated to the task or internal thoughts (Regan and others 2011).
In this case, the primary potential distraction the driver experienced after boarding the train was the seat descending to its lowest position. Associated with this distraction, it is very likely that the driver did not check/sight signal ME25 prior to departing the station.
The driver reported that they did not adjust the seat’s position prior to departing the station, or during the approach to signal ME45, instead intending to fix the adjustment at the next station. Regardless of whether the driver was attempting to adjust the seat after departing the station, there was still the significant potential for distraction associated with a jarred back and being in an unusually low seating position during this period.
After exiting the sweeping right curve, the driver would have had 175 m of clear unobstructed view of signal ME45. During the 25–27 seconds it took to travel this distance, the driver did not detect that the signal was displaying a red aspect. The extent to which the driver looked at the signal during this period could not be determined. However, if the driver had already decided that the signal was displaying a green aspect, they may not have noticed the red aspect even if they looked at the signal. A substantial body of research has shown that when a person’s attention is focussed on another task, they often do not detect an unexpected object or event, even sometimes when it is salient and the person is looking directly at it (Chabris and Simons 2010). In this case, in addition to aspects associated with the seat, the driver’s attention would have been focussed, at least to some extent, on the signals after ME45.
Summary
The investigation considered a variety of other explanations for why the driver perceived the signal aspect of ME45 to be green. However, there was no evidence to indicate the driver had a medical or vision problem, and there was no indication that sun glare or other factors were affecting the visibility of the signal.
Other than the seat, there appeared to be no other sources of distraction. Some research has indicated that time pressure associated with dwell times at stations can be a source of distraction for drivers (Naweed 2013). In this case, the driver indicated that they would rather not fix the problem with the seat at Bowen Hills and extend the station dwell time. Instead they chose to adjust the seat at the next station (Albion) during that station dwell time, therefore not delaying the train. However, there was insufficient evidence to conclude that concerns regarding on-time running was affecting the driver’s attention.
On the day of the SPAD, the driver had commenced a third early start shift in succession. However, there was sufficient rest opportunity between shifts for the driver to be fit for duty and they had a significant rest break just prior to boarding the train. There was no indication that the SPAD resulted from a delayed response time or not sighting a signal at all, which would be more likely associated with fatigue. Overall, there was insufficient evidence to conclude that the driver was experiencing a significant level of fatigue at the time of the SPAD.
Due to the skill-based nature of train driving, it is not always possible for drivers to have a full recollection of events and their thought processes, and therefore it is not always possible to determine the immediate reasons why a SPAD occurred. In this case, when approaching signal ME45, the driver probably read through to another signal displaying a green aspect, which they misidentified as signal ME45. Expectancies of the usual indications of ME45 and distraction associated with the seat position probably contributed to this error and the driver’s ability to detect this error.
Effectiveness of the automatic warning system
The Citytrain network had an automatic warning system (AWS) in place to provide drivers with a visual indication and aural alarm if an upcoming signal aspect applicable to the path of the train was ‘restricted’ (that is, any colour other than green).
In this case, the driver of TP43 promptly responded to the aural alarm for signal ME45 by acknowledging the AWS reset button, but they did not recall doing so. The alarm also appeared to have no influence on the driver’s misperception that the signal was displaying a green aspect. The extent to which the AWS resulted in the driver checking the signal indication could not be determined, but as previously noted any such check may not have been effective depending on the driver’s focus of attention and expectancy at the time.
Although the AWS reduces the likelihood of SPADs in some situations, it is widely acknowledged that its design is fundamentally limited, and it does not eliminate SPADs. More specifically, because the system provides the same visual and aural alarm for all restricted signals (including those with a double yellow, yellow, flashing yellow or red aspect), the significance of approaching a red aspect (stop) indication is substantially diminished.
Research has indicated that a significant number of drivers in many rail networks have reported that they have ‘automatically’ acknowledged the AWS alarm at a restricted signal (McLeod and others 2005, Naweed and others 2015). That is, they have acknowledged the alarm without recognising that it had occurred. This is known to occur in situations where drivers frequently encounter restricted signals with yellow or double yellow aspects. Some research has shown that at times drivers respond so fast to an AWS alert that it appears to be done proactively in anticipation of the alert rather than reactively in response to the alert (Stanton and Walker 2011).
The inner-city part of Citytrain’s network runs at near full capacity during peak periods, with trains closely following other trains. This means that drivers frequently encounter restricted signals. For that reason, it is understandable how drivers can become conditioned to cancelling the AWS alarm as a habitual, automatic and/or reflexive reaction.
With almost all ‘completely missed’ SPAD occurrences, the drivers have automatically responded and cancelled the AWS alarm without recognising the situation. In many cases, the drivers have not even been aware that they have cancelled the alarm, therefore nullifying the driver-signal relationship. This was almost certainly the case with the 10 January SPAD occurrence, and a significant number of other SPAD occurrences on the Citytrain network.
In summary, the AWS was not a highly effective risk control because it provided the same audible alarm and visual indication on the approach to all restricted signals. The potential for habituation and the absence of a higher priority alert when approaching a red aspect (stop indication) reduced the effectiveness of the AWS to prevent SPADs.
The Citytrain network had various engineering controls in place to reduce the potential likelihood of a SPAD (such as track design, signal design or signal aspect sequencing) or reduce the consequences of a SPAD (such as overlaps). However, there were limited engineering controls in place to detect potential or actual SPADs and manage their risk. Citytrain had SPAD alarms within its universal traffic control (UTC) system that provided an alert if a train passed a signal displaying a red aspect, but this only applied to controlled signals. Such a system also required the NCO to interpret the situation and then issue an emergency stop command to the driver, a process that involved a short time delay and would not always be successful.
Given the limitations of the AWS and UTC SPAD alarms, Citytrain had to place substantially more reliance on driver performance and associated administrative controls to minimise the risk of SPADs compared to rail networks that had additional or more sophisticated engineering controls in place to detect potential or actual SPADs and manage their risk. Accordingly, Citytrain had specified operational procedures and rules for drivers to use to minimise the risk of SPADs. In addition, it had introduced a range of processes and controls to maximise the use of these rules, such as training its drivers, routinely assessing driver performance (using the maintenance of competency process), implementing risk triggered commentary driving, investigating SPADs, and assessing and managing the performance of drivers involved in a SPAD .
Although procedural and administrative risk controls will always be necessary, it is important to recognise that the use of such controls will always be fundamentally limited in their effectiveness compared to well-designed engineering controls for detecting potential or actual SPADs and managing their risk (see also Other processes for monitoring compliance with operational rules). The future implementation of the European Train Control System (ECTS) to the Citytrain network should play a significant role in managing SPAD risk at locations where it is fitted.
Implementation of risk triggered commentary driving (RTCD)
To assist with reducing the frequency of SPADs, QR introduced risk triggered commentary driving (RTCD) in 2008–2009, and subsequently Citytrain made it a mandatory requirement for its drivers in 2011 for situations where they were approaching a restricted signal. The justification for RTCD was to reduce driver distraction/inattention by getting drivers to speak aloud the signal aspect and their required actions while travelling on restricted signals.
In this case, the driver of TP43 reported that they did not apply RTCD. If the driver had applied RTCD in accordance with the operator’s procedures when departing Bowen Hills (starting on a yellow aspect), it is possible this may have facilitated an expectation that signal ME45 would be displaying a red aspect. However, the extent that this would have overcome other expectations is unclear. In addition, having (incorrectly) perceived signal ME45 was displaying a green aspect, there was no requirement for the driver to continue RTCD. Overall, it is difficult to conclude that in this case applying RTCD would have prevented the SPAD.
The application of RTCD when approaching a restricted signal will potentially have benefits for many drivers in many situations. However, there were some problems with the way the technique was implemented within Citytrain that limited its potential effectiveness. These problems included:
The technique was made mandatory (for restricted signals) in Citytrain without any explicit acknowledgement that its application in some cases actually increased risk. Human factors specialists in the UK Rail Standards and Safety Board and QR noted that in high workload situations the use of the technique would be problematic.
Unfortunately, in the rail environment there has been very little formal research that has examined RTCD. Although research into road vehicle drivers has shown some benefits with using different forms of verbal commentary (Young and others 2014), research has also shown that producing a verbal commentary can decrease concurrent hazard perception in road vehicle drivers (Young and others 2017) and adversely affect the performance of airline pilots in high workload situations (Earl and others 2017). Potential problems with workload and distraction when using the technique in high workload situations were also raised by human factors specialists external to and within QR prior to the Citytrain decision to mandate the technique. Not clearly recognising and managing such limitations when implementing RTCD increased the likelihood that the technique would not be perceived as useful by drivers.
The changes implemented in 2011 did not effectively ensure that tutor drivers, and therefore drivers, had a consistent understanding of when the technique was required to be used and how it should be applied. The SPAD Prevention Working Group in 2013 and a QR audit report in 2015 noted this problem. This problem was also evident in late 2018 when the ATSB interviewed a sample of tutor drivers and drivers. In general, there appeared to be a common belief that RTCD was mandatory under all conditions (rather than just for restricted signals). Such beliefs would likely lead to reduced perceptions of its practicability or usefulness and detract from its application when it was most relevant.
There was limited information to confirm that the practical on-track MOC assessments were effectively being used to assess driver competence and/or compliance with the RTCD procedure. The driver involved in the 10 January 2018 SPAD reported that they did not use RTCD, including during MOC assessments, yet no problems were identified with their RTCD performance during multiple MOC assessments.
Other than actually observing a driver apply RTCD during a practical MOC assessment or an in-cab monitoring activity, there was no formal method to establish if the technique was actually being applied on a routine basis. Conducting observations of its use is problematic, as it may not reflect normal operations. However, some form of anonymous or de-identified survey of drivers could have been undertaken to assess reported usage of the technique and perceptions of its usefulness. Without some form of measurement, QR and Citytrain had a limited understanding of the technique’s usage rate or effectiveness.
During SPAD investigations, QR had asked drivers whether they were applying RTCD at the time of the SPAD, and in most cases the drivers reported it was not being used. Although such a result could be interpreted as indicating the technique was effective (if it was being used), any firm conclusions about effectiveness would be tenuous without having data about how often the technique was actually being used correctly. The data from SPAD investigations may simply be indicating that the technique was rarely being used in general.
In summary, based on the available evidence, Citytrain did not implement RTCD in a manner likely to maximise its potential benefits and minimise its potential limitations or risks. This was mainly due to change management limitations associated with introducing the technique as a mandatory risk control, limited processes in place to evaluate its utilisation and effectiveness, and ineffective risk management associated with not detecting and rectifying identifiable shortfalls with some drivers’ understanding of the technique and how it should be applied.
Application of the maintenance of competency process
Train drivers perform a safety-critical role, both in terms of minimising the risk of SPADs but also in terms of minimising the risk of many other types of safety-related occurrences. Therefore, a train driver’s performance needs to be systematically assessed at regular intervals to ensure they are competent to perform their role. This is also a regulatory requirement.
Accordingly, QR had invested significant resources into designing its MOC process to ensure it assessed a wide range of knowledge and skills required by its drivers. In addition, it was investing significant resources into administering MOC assessments, by allocating a tutor driver to conduct a 2-day MOC assessment with each driver every 18 months.
Even though significant resources had been applied to the design and administration of QR’s Citytrain driver MOC process, the ATSB’s review of a number of MOC assessments and related evidence identified a number of anomalies or limitations. These included:
There was evidence that, at least on some occasions, drivers had access to a copy of the assessor’s written MOC marking guide when completing the written MOC assessment. This was stated in some reports from witnesses and drivers. It was also indicated by the way answers were presented in some written MOC assessments, with word-for-word answers from the marking guide. This included a spelling error in the assessor’s marking guide which was reproduced in some of the drivers’ MOC assessments, and also answers to questions written out of order.
There were numerous other occasions when answers requiring a detailed response in the written MOC assessment matched word-for-word the answers from the assessor’s marking guide. The extent to which this occurred was inconsistent with how a sample of tutors described their process for administering the written MOC assessment, with most saying that the drivers would write down their initial answer first before being provided the answer from the marking guide.
It is likely that at least in some cases drivers were providing their initial answers to the written MOC questions verbally, and then tutors provided the correct answer from the marking guide for the driver to write down, resulting in word-for-word answers. This practice was inconsistent with the MOC instructions and the general rules of evidence for assessments (in terms of authenticity).
The guidance material for assessors and Citytrain training managers stated that the MOC was an assessment of competency; however many of the tutor drivers who administered MOC assessments suggested it should be considered more as an opportunity to train or coach drivers. In other words, many tutor drivers regarded the MOC as a means to ensure competency rather than a means of assessing competency. Despite various communications from management to the tutors in 2016–2017, it did not appear that these different perspectives were effectively resolved, with many written MOC assessments appearing to involve significant coaching.
There were significant variations in how tutors were administering the MOC. Although some variation is natural when dealing with a large pool of assessors and a long assessment process, significant variation appeared to create the potential for some tutors to use their judgement to shortcut the assessment process for some items if they did not believe the items were important.
Based on the available documentation, drivers were achieving very high levels of success on all the assessments, with very few indications of areas where initial responses or performance could be improved. Such results were unrealistic for such a large written assessment. Such results also meant that topics that drivers had some difficulty with were not being formally noted in development plans, or for identifying areas of focus for future assessment.
There was no systematic process for recording questions that drivers were having difficulty with across all the MOC assessments. This limited the potential for Citytrain to identify and evaluate questions to see if they needed rewording or if broader education or communication strategies were required across the driver cohort.
The driver involved in the 10 January 2018 SPAD achieved perfect or near-perfect results in their previous written and practical MOC assessments prior to the SPAD. However, the results of the driver’s post-SPAD coaching and mentoring sessions indicated that they had developed some driving habits over an extended period that were inconsistent with Citytrain procedures and guidance. It was very likely the non-compliance issues had become characteristic and well entrenched, as the driver had difficulty readjusting to QR’s driving procedures even with the aid of 11 coaching and mentoring sessions. This pattern was consistent with a driver who was learning the required procedures and techniques, rather than a driver who had recorded near faultless written and practical MOC results over a period of 10 years. A similar pattern was subsequently identified with three other experienced drivers who had been involved in SPAD occurrences.
As noted in the previous section, the driver involved in the 10 January 2018 SPAD reported that they did not use RTCD, yet no problems were identified with their RTCD performance during multiple MOC written and practical assessments.
All of the drivers’ on-track practical MOC assessments analysed by the ATSB showed faultless or near perfect results. It is not likely that these results could have been achieved by all. The on-track practical MOC assessment was performed over an entire day, which encompassed a wide range of activities that provided many hundreds of opportunities for error. It is reasonable to expect that tutor drivers noted errors or other problems in many if not most of these MOC assessments, and potentially discussed these with the drivers, but no details were recorded in the MOC assessments.
Overall, these limitations resulted in a situation where Citytrain’s administration of the MOC process provided limited assurance that the drivers who undertook the MOC assessments met relevant competency requirements. Many of the driver MOC assessments were being completed in a manner that was inconsistent with the specified instructions. In such cases where there are routine deviations from a defined procedure or process, it becomes difficult for those involved to determine what aspects of the specified instructions are essential or important.
It should be noted that the ATSB is not suggesting that QR’s Citytrain drivers were not competent; rather, the application of the process for assessing competency had significant limitations in assuring the drivers’ competency. It is very likely that most of the Citytrain drivers possessed the skills, knowledge and aptitude to demonstrate competency at the time the assessments were conducted. However, the limitations with the process meant that some drivers would be assessed as competent when they could not meet all the relevant requirements. As indicated above, this was found to have occurred on multiple occasions.
In the case of the driver involved in the 10 January 2018 SPAD, it is apparent that the MOC assessments administered prior to the SPAD were not effective in identifying problems with the driver’s knowledge and skills that probably existed at the times those assessments were conducted. However, based on the available evidence, the ATSB was unable to conclude that the main limitations in the driver’s ongoing performance, identified after the SPAD, were related to the specific actions involved in the SPAD occurrence sequence. Nevertheless, the problems associated with the administration of the MOC process across the driver cohort was a significant safety issue with the potential to contribute to other safety occurrences.
It is likely that the limitations in the MOC process evolved due to a combination of many factors. The high number of questions (up to 300) in the written MOC assessment placed pressure on both the drivers undertaking the assessment and the tutor drivers administering the assessment. This was exacerbated by the absence of a dedicated period of retraining prior to the administration of a written MOC, and limited, tailored guidance material for drivers to review prior to undertaking the assessment. There were also perceptions that a number of the questions on the written MOC were not relevant the drivers’ role, although the ATSB’s review of the MOC assessments indicated that the majority of the MOC questions had relevance. In addition, there was limited oversight of the tutors within TSD training due to the nature of the organisational structure and the nature of the one-on-one assessments of the drivers.
Overall, these types of factors contributed to the differences in perception about the purpose of the MOC process and/or how it should be administered between those who designed the MOC and the training managers compared to the tutor drivers and drivers. In addition, the ATSB noted that there was significant pressure on the Citytrain TSD training section during the years prior to 2018 associated with ensuring that sufficient numbers of new drivers were trained, at the same time that the MOCs for existing drivers were being conducted.
Oversight of the maintenance of competency process
Regardless of the exact reasons for it, there was a significant problem occurring with the administration of driver MOC assessments and the overall level of assurance being provided by the MOC process. Accordingly, the ATSB examined the extent to which QR and Citytrain had identified and was attempting to assess and address the problem.
The MOC was a necessary and important component of QR’s safety management system and obviously a very important risk control used by QR to manage risk. In addition, the MOC was particularly important in Citytrain’s management of SPADs, given the suburban network was carrying a large number of passengers with limited engineering controls in place to detect potential or actual SPADs and manage their risk, and there were limited processes in place to monitor driver compliance with SPAD management procedures (see next section).
Overall, QR had a defined structure and process for risk management, which included various policies, standards and procedures and incorporated three lines (or levels) of assurance. The process identified risks and planned second line and third line assurance activities accordingly, with first line assurance activities being conducted at the local level by relevant personnel.
In the case of the MOC, there were planned second line assurance activities that examined the MOC process. However, these activities focussed on determining the extent to which MOCs were being conducted at the required time intervals. Given the formal requirements associated with conducting MOCs at 18-month intervals, this focus was understandable. There was minimal focus on examining how the MOCs were being conducted, and it would be reasonable to expect that many transport operators would not have identified a need to focus assurance activities on how their competency processes were being conducted.
Nevertheless, through a second line assurance activity conducted in November 2015, it was identified that a high percentage of driver and guard written MOC assessments contained answers matching word-for-word with the assessor’s marking guide, and this was raised as an observation in the auditor’s report. Similarly, a first line assurance activity undertaken in 2016 within TSD training identified a case of a tutor’s MOC containing word-for-word answers, and this activity was conducted soon after a manager observed a driver undertaking a written MOC assessment with a copy of the marking guide, and a number of that driver’s responses contained word-for-word answers. QR’s Human Resources (HR) section also encountered the problem in another investigation in 2015, and at that time were advised by TSD management that word-for-word answers from the marking guide would be common.
In response to some of these identified problems, TSD managers sent out a series of reminder emails to tutors regarding the importance of ensuring marking guides were secure and not able to be accessed by drivers or guards undertaking MOC assessments. In addition, a written instruction for the MOC process was developed in September 2017, which expanded on guidance already contained within the written MOC assessment and the associated marking guide.
Although these interventions occurred, at no stage did QR or Citytrain ever seek to conduct a more detailed audit or review of the situation to determine the extent of the problem or the underlying reasons for the problem, or whether the problem was still ongoing after the interventions. When the ATSB reviewed a sample of written MOC assessments from November 2017, and a smaller sample in June 2018, the problems associated with word-for-word answers were still evident. Problems with individual development plans in the MOC process were also identified in a November 2015 audit, but as far as could be determined, were not revisited in subsequent assurance activities.
It is acknowledged that during the period leading up to the 10 January 2018 SPAD occurrence, the TSD training section was under significant pressure with its requirements for training new drivers as well as administering MOCs for existing drivers. Nevertheless, given the significance of the MOC as a risk control, and the nature of the problems previously identified, further assurance activities were warranted.
In summary, the driver MOC process was a necessary and very important risk control within Citytrain. However, QR’s management oversight of the Citytrain driver maintenance of competency (MOC) process did not include planned assurance activities or regular and effective auditing of how the MOCs were being conducted, even after there were multiple indications that the process was not being administered as designed.
Other processes for monitoring compliance with operational rules
QR Citytrain carried a large number of passengers each year and, as already discussed, it had limited engineering controls in place to detect potential or actual SPADs and manage their risk . Accordingly, Citytrain placed a heavier reliance on driver performance to minimise the risk of SPADs compared to rail networks that had additional or more sophisticated engineering controls.
However, although SPADs are somewhat frequent events in terms of the number of occurrences per year on a rail network, they are rare events in terms of the number of times they occur per driver. For example, an independent review of SPADs commission by QR in 2014 noted that on the Citytrain network each driver would average about 2.2 SPADs in a 40-year career (or about one SPAD every 18 years).
In addition, SPADs are also rare events in terms of the number of red aspects encountered. For example, in the UK rail context, the UK RSSB (Gibson 2016) estimated that the rate of SPADs was one per 25,000 approaches to a red aspect. It also noted that this level of performance was approaching the currently understood limits of human reliability for such tasks. Although it is problematic comparing SPAD performance between different networks, it appeared that Citytrain’s SPAD performance was at about these levels (averaging about one SPAD per 31,000 approaches to a red aspect during the period from July 2016 to June 2018).
Given such statistics and the inherent nature of human performance, it is not possible to eliminate SPADs by focussing on driver performance. Nevertheless, a rolling stock operator needs to continually review and enhance its processes and controls to improve and/or at least maintain its SPAD performance levels.
As part of such activities, it is considered good practice for a rolling stock operator to collect and analyse information about normal operations in order to understand the level of compliance with relevant rules and procedures, and to best target further efforts for improving driver performance. QR had some processes in place for monitoring driver performance. These included the MOC for existing drivers, a program for monitoring recent drivers, and occasional in-cab monitoring of drivers. However, with such processes, drivers know they are being assessed, and may perform differently to their normal operations. In addition, sample sizes may not be sufficient to understand the true nature of driver performance on a network and the factors that may be influencing driver performance.
In contrast, a best-practice process of monitoring driver compliance with relevant rules and procedures would involve reviewing event recorder data from normal operations. Although QR had trialled such a process in 2015, this was not continued.
In summary, prior to the SPAD occurrence on 10 January 2018, QR did not routinely and systematically analyse recorded data to determine driver compliance with key operational rules that had been designed to minimise the risk of SPADs. As such, its ability to effectively target interventions to continually improve driver performance or identify problems with particular locations or other factors, on the Citytrain network was limited.
It is noted that QR started considering another process for reviewing event recorder data in late 2017, which commenced collecting baseline data in April 2018. Until more sophisticated engineering controls to detect potential or actual SPADs and manage their risk can be introduced on the Citytrain network, such a process is essential to better target future interventions to improve driver performance.
Last line of defence
In March 1996, a suburban passenger train and a freight train collided after the suburban train exceeded its limit of authority by passing signal ME45 while it displayed a red aspect (stop indication). As the suburban train passed ME45, the signalling system generated a SPAD alarm in the network control centre, warning the network control officer (NCO) that the train had exceed its authority. However, at that time the NCO was not in a position to respond to the situation by transmitting an emergency stop command to the driver of the suburban train. Therefore, the final opportunity to prevent the train-to-train collision was lost.
The 10 January 2018 SPAD at ME45 has similarities to the March 1996 SPAD and subsequent train-to-train collision. In both cases, the drivers passed signal ME45 unaware it was displaying a stop indication, and in both cases there was an opposing train movement.
However, on 10 January 2018, the NCO observed the SPAD alarm and issued a stop command to the driver, and the driver stopped the train prior to reaching the conflict point. Although the two trains would not have collided had they continued at their expected speeds, this occurrence has highlighted the potential consequences of a SPAD and the importance of having an effective series of risk controls in place to minimise the likelihood of a SPAD and maximise the ability to detect and manage potential or actual SPADs before adverse consequences can occur.
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to TP43 passing signal ME45 without authority resulting in a near miss with suburban passenger train TR50 near Bowen Hills, Queensland on 10 January 2018.
Contributing factors
Approaching the first signal (ME45, displaying a red aspect) after departing from Bowen Hills, the driver probably read through to another signal for an adjacent line that was displaying a green aspect, which they incorrectly believed was signal ME45.
Although the driver of train TP43 acknowledged the automatic warning system audible alarm, this was almost certainly an automatic response that did not result in an effective check of signal ME45’s aspect indication, resulting in the signal’s red aspect not being detected.
The automatic warning system (AWS) provided the same audible alarm and visual indication to a driver on the approach to all restricted signals (that is, double yellow, yellow, flashing yellow and red aspects). The potential for habituation, and the absence of a higher priority alert when approaching a signal displaying a red aspect, reduced the effectiveness of the AWS to prevent signals passed at danger (SPADs). This placed substantial reliance on procedural or administrative controls to prevent SPADs, which are fundamentally limited in their effectiveness. (Safety issue)
Other factors that increased risk
Although the driver of TP43 had observed the departure signal (ME25) displaying a yellow aspect before boarding the train at Bowen Hills, it is very likely they did not check the signal again, either before or after receiving the ‘rightaway’ from the guard. This removed a critically important opportunity to reinforce their awareness of the status of the departure signal, and the likely status of the next signal (ME45).
After mandating the use of risk triggered commentary driving (in 2011) to mitigate the risk of signals passed at danger, Queensland Rail Citytrain did not provide the necessary support to its trainers, assessors and drivers to effectively maximise the potential benefits of the technique and minimise the potential limitations or risks associated with the technique. (Safety issue)
Queensland Rail’s administration of the maintenance of competency (MOC) assessment process provided limited assurance that its Citytrain train drivers met relevant competency requirements. (Safety issue)
Queensland Rail’s management oversight of the Citytrain driver maintenance of competency (MOC) process did not include planned assurance activities or regular and effective auditing of how the MOC assessments were being conducted, even after there were multiple indications that the process was not being conducted as designed. (Safety issue)
Prior to the signal passed at danger (SPAD) occurrence in January 2018, Queensland Rail did not routinely and systematically analyse recorded data to determine driver compliance with key operational rules that had been designed to minimise the risk of SPADs. (Safety issue)
Other findings
After the universal traffic control system generated a SPAD alarm, the network control officer broadcast an emergency stop command to the driver of TP43 to stop their train.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: Queensland Rail’s administration of the maintenance of competency (MOC) assessment process provided limited assurance that its Citytrain train drivers met relevant competency requirements.
Oversight of the train driver maintenance of competency process
Safety issue description: Queensland Rail’s management oversight of the Citytrain driver maintenance of competency (MOC) process did not include planned assurance activities or regular and effective auditing of how the MOC assessments were being conducted, even after there were multiple indications that the process was not being conducted as designed.
Safety issue description: The automatic warning system (AWS) provided the same audible alarm and visual indication to a driver on the approach to all restricted signals (that is, double yellow, yellow, flashing yellow and red aspects). The potential for habituation, and the absence of a higher priority alert when approaching a signal displaying a red aspect, reduced the effectiveness of the AWS to prevent signals passed at danger (SPADs). This placed substantial reliance on procedural or administrative controls to prevent SPADs, which are fundamentally limited in their effectiveness.
Implementation of risk triggered commentary driving (RTCD)
Safety issue description: After mandating the use of risk triggered commentary driving (in 2011) to mitigate the risk of signals passed at danger, Queensland Rail Citytrain did not provide the necessary support to its trainers, assessors and drivers to effectively maximise the potential benefits of the technique and minimise the potential limitations or risks associated with the technique.
Use of event recorders to monitor driver performance
Safety issue description: Prior to the signal passed at danger (SPAD) occurrence in January 2018, Queensland Rail did not routinely and systematically analyse recorded data to determine driver compliance with key operational rules that had been designed to minimise the risk of SPADs.
Safety action not associated with an identified safety issue
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Additional safety action by Queensland Rail
The Queensland Rail (QR) internal safety investigation into the 10 January 2018 SPAD occurrence at signal ME45 was completed in February 2018. The report included the following safety action that had been initiated relating to signal ME45:
Rail Safety Specialist to lead a systemic and comprehensive review of the effectiveness of current Signal Passed at Danger (SPAD) risk controls specific to signal ME45 including but not limited to:
- Analyse the timetabling and routing of services that traverse the signal and the crossovers and diamonds beyond the signal
- Investigate potential initiatives to reduce risk specifically at this signal including signalling, interlocking, UTC, approach signage and timetabling.
- Use the ‘Hierarchy of Control’ model to identify and inform appropriate recommendations in establishing safety measures that would prevent or minimise the risk of SPAD events occurring at signal ME45 thus reducing the risk of collision.
In February 2019, Queensland Rail (QR) advised the ATSB that an engineering solution had been identified for signal ME45 to significantly reduce the possibility of collision risk due to a signal passed at danger (SPAD). In March 2021, QR also advised the following regarding signal ME45:
In order to minimise the risks associated with trains passing signal ME45 at danger, 290 and 291 points (the conflict point past signal ME45) are now required to be set in the normal position before signals ME23 and ME25 will clear and allow trains to approach signal ME45.
This significantly reduces the risk of a SPAD occurring due to ‘read through’ and the risk of a train-to-train collision. There have been no further SPADs at signal ME45 since this intervention.
Following earlier advice in June 2018, in March 2021 QR also advised:
Following the incident and subsequent on-track observation session, the driver was allocated an Operational Improvement Plan (OIP). On the eleventh and final practical on-track coaching and mentoring session, the Relief Driver was deemed ‘not competent’ having not met the required Professional Driving standards.
The Relief Driver chose (supported by QR management) to relinquish the position of train driver and subsequently took up the position of Trainee Guard.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Queensland Rail
the driver of train TP43
a range of Queensland Rail personnel
event recorders and CCTV footage from TP43
the Department of Transport and Main Roads (Queensland).
References
Chabris C & Simons D 2010, The invisible gorilla and other ways our intuition deceives us,
HarperCollins, Hammersmith UK.
Earl L, Mavin TJ & Soo K 2017, ‘Demands on cognitive processing: Implications for verbalisation in complex work environments’, Cognition, Technology and Work, vol. 19, pp.31–46.
Gibson H 2016, Industry human factors SPAD review: Project summary report, Rail Safety and Standards Board, UK.
McLeod RW, Walker GH & Mills A 2005, ‘Assessing the human factors risks in extending the use of AWS’, in JR Wilson, B Norris, T Clarke & A Mills (Eds) Rail human factors: Supporting the integrated railway, Ashgate, Aldershot UK, pp.109–119.
Naweed A 2013, ‘Psychological factors for driver distraction and inattention in the Australian and New Zealand rail industry’, Accident Analysis and Prevention, vol. 60, pp.193–204.
Naweed A, Rainbird S & Chapman J 2015, ‘Investigating the formal countermeasures and informal strategies used to mitigate SPAD risk in train driving’, Ergonomics, vol.58, pp.883–896.
Punzet L, Pignata S & Rose J 2018, ‘Error types and potential mitigation strategies in Signal Passed at Danger (SPAD) events in an Australian rail organisation’, Safety Science, vol. 110, pp.89–99.
Reason J 1990, Human error, Cambridge University.
Regan MA, Hallett C & Gordon CP 2011, ‘Driver distraction and driver inattention: Definition, relationship and taxonomy’, Accident Analysis and Prevention, vol. 43, pp.1771–1781.
Stanton NA & Walker GH 2011, Exploring the psychological factors involved in the Ladbroke Grove rail accident’, Accident Analysis and Prevention, vol. 43, pp.1117–1127.
Wickens CD, Hollands JG, Banbury S & Parasuraman R 2013, Engineering psychology and human performance, 4th edition, Pearson Boston, MA.
Young AH, Chapman P & Crundall D 2014, ‘Producing a commentary slows concurrent hazard perception responses’, Journal of Experimental Psychology: Applied, vol. 20, pp.285–294.
Young AH, Crundall D & Chapman P 2017, ‘Commentary driver training: Effects of commentary exposure, practice and production on hazard perception and eye movements’, Accident Analysis and Prevention, vol. 101, pp.1–10.
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the driver of TP43
Queensland Rail
the Office of the Rail Safety Regulator (ONRSR).
Submissions were received from Queensland Rail and ONRSR. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 17 December 2017, a Qantas A330 aircraft, registered VH-QPD, was being loaded with freight in preparation for an international passenger flight from Sydney, New South Wales to Beijing, China. After landing in Beijing, the operator’s freight agent identified that the aircraft had been loaded incorrectly. As a result, the aircraft exceeded its maximum take-off weight on departure from Sydney by 494 kg.
What the ATSB found
A decision by the flight crew to uplift additional fuel for the flight to Beijing led to a reduction in the aircraft’s freight capacity. This required the operator’s load control department to re-issue the ‘load instruction report’ for the flight. The re-issued report required that a 2,005 kg freight pallet be replaced with a lighter unit weighing 1,130 kg.
The required cargo variation was not actioned by the loading supervisor as electronic messages associated with the revised loading instruction were acknowledged without being correctly interpreted. That action was probably influenced by the supervisor’s experience that load changes were accompanied by verbal advice, and that did not occur on this occasion.
In addition, the loading irregularity was not immediately reported, as required by the operator’s procedures.
What's been done as a result
As a result of this, and other freight loading occurrences, Qantas have updated the technology used by staff directly involved in freight operations. The update involved the introduction of handheld scanning devices that automate much of the freight confirmation and mobile communication process using printed barcode and scanning technology. The hand scanners were implemented at most domestic and international Qantas ports by June 2019.
Qantas also advised that in order to reduce the potential for communication errors between those responsible for loading the aircraft, an amendment to their Weight and Balance Manual was implemented on 1 September 2019. The changes formalised communication associated with loading changes.
Safety message
This incident highlights a loading error that led to a maximum take-off weight exceedance during the conduct of a high-capacity passenger flight from Sydney to Beijing. Planning and loading of freight within this sector is often conducted in a time-pressured environment where delays can lead to scheduling issues. Effective communication between all parties responsible for aircraft loading can assist in reducing errors in such an operating environment.
The occurrence
What happened
On 17 December 2017, an Airbus A330-303 aircraft, registered VH-QPD and operated by Qantas Airways, was being prepared for passenger flight QF107 from Sydney, New South Wales, to Beijing, China (Figure 1). The loading of baggage and freight into the lower hold of the aircraft was conducted as part of pre-departure operations. The aircraft departed from the international terminal at Sydney Airport at 1346 Eastern Daylight-saving Time.[1] After landing in Beijing, the operator’s freight agents identified that the aircraft had been loaded incorrectly. An incorrect freight pallet resulted in the aircraft exceeding its maximum take-off weight on departure from Sydney.
Figure 1: A330 aircraft VH-QPD
Source: Anthony Filippousis
Aircraft loading sequence of events
The following sequence of events describes the primary actions and decisions during the freight-loading process prior to the departure of QF107 from Sydney. The sequence of events is further summarised in Figure 2.
Preparations for loading the aircraft typically commenced about two hours prior to departure. These included finalisation of passenger numbers, freight planning, fuel uplift and aircraft departure weight calculations. The freight that had been prepared for transport to Beijing on QF107 included three unit load devices (ULDs).[2] All three ULDs were weighed and assigned a unique identification number as follows:
PMC42476QF at 2,175 kg
PMC41566QF at 2,005 kg
PMC42559QQ at 1,130 kg.
The pallets were then towed to a holding bay near the aircraft.
At 1210, the operator’s staff within the load control office determined that the aircraft’s maximum take-off weight (MTOW) would be exceeded if all three ULDs were loaded into the hold. Load control determined that only two of the three ULDs could be sent on QF107. PMC42476QF at 2,175 kg and PMC41566QF at 2,005 kg were selected. The provisional flight plan was subsequently issued to the operating flight crew for review.
At 1225, approximately 75 minutes prior to the scheduled departure time, Edition 1 of the load instruction report (LIR) was sent from the load control office to the ramp staff allocated to load the aircraft. The ULDs PMC42476QF at 2,175 kg and PMC41566QF at 2,005 kg were identified in the LIR to be loaded into the aircraft. The loading supervisor accessed Edition 1 of the LIR using his portable electronic tablet (iPad).
At 1234, the operating flight crew contacted the load control office with a request to remove some cargo from the aircraft due to the requirement to carry an additional fuel reserve for the flight to Beijing. In order for the aircraft to depart below its MTOW, load control elected to switch a heavier ULD with a lighter unit. The resultant changes to aircraft take-off weight required the release of another LIR (Edition 2), detailing that:
PMC42476QF at 2,175 kg was to remain as originally planned and to be loaded within the rear hold of the aircraft at position 31P.
PMC41566QF at 2,005 kg was to be removed and replaced with the lighter weight unit, PMC42559QQ at 1,130 kg, within the forward hold at position 24P.
At 1237, the load control officer contacted the ground services coordinator to advise that a ULD change had been requested by the operating flight crew and to delay loading the ULDs pending release of Edition 2 of the LIR.
At around 1238, all three ULDs were brought by tug from the holding bay to the aircraft. By 1248 PMC42476QF at 2,175 kg and PMC41566QF at 2,005 kg were loaded and secured into their respective positions on board the aircraft, in accordance with Edition 1 of the LIR.
At 1248, the operating flight crew contacted the load control office to confirm the final fuel upload data, also confirming that a change to a lighter ULD would be required to offset the weight of the additional fuel.
At 1250, the load control officer ‘locked out’ the flight within the freight management system. Just prior to the freight management system lock out, the loading supervisor at the aircraft accessed the system and both loaded ULDs were ‘ramp cleared’, indicating they had been loaded and secured into their respective positions. The loading supervisor then logged off from the system, and directed the tug driver to return the remaining ULD (PMC42559QQ at 1,130 kg) back to the freight terminal.
At 1251, Edition 2 of the LIR was entered into the freight management system with three accompanying electronic messages from the load control office:
1. Flight Locked by Load Control. Please contact Load Control.
2. Edition has changed
3. 24P has changed Ref: PMC41566QF to PMC42559QQ Cargo Weight: 2005 to 1130
At 1252, shortly after the release of Edition 2 of the LIR, the loading supervisor locked the forward hold door of the aircraft.
At 1254, the load control officer contacted the ground services coordinator in the ramp office to confirm that Edition 2 of the LIR had been released with a requirement for the heavier ULD to be exchanged with the lighter unit.
At 1300, the loading supervisor at the aircraft logged back into his iPad and resumed using the freight management software. All three messages advising that Edition 2 of the LIR had been issued, that a ULD change was required, and that he was to contact Load Control, were displayed on the tablet device. The supervisor acknowledged the electronic messages and tapped the ‘OK’ button, clearing them from the system. Despite the electronic acknowledgement, the supervisor did not change the ULD configuration at Position 24P.
The final load sheet provided to the operating flight crew incorporated the ULD change from Edition 2 of the LIR, where the 1,130 kg ULD had been loaded to Position 24P, when in fact the heavier 2,005 kg ULD remained on the aircraft. Calculations showed that with the heavier unit in place the aircraft take-off weight was 233,494 kg, which was 875 kg above the planned take-off weight and 494 kg above the aircraft’s MTOW.
The flight crew were unaware of the load discrepancy during the flight. There were no reported handling or control issues encountered during take-off and no associated abnormal indications were received.
Figure 2: Sequence of events for this loading event
The A330-303 is a wide-body aircraft with underfloor cargo hold areas used for the carriage of baggage and freight (Figure 3). As is typical of most wide-body aircraft, all of the freight in the main cargo hold area is contained within a unit load device (ULD) (Figure 4). Specialised loading equipment is required with trained operators to ensure that the correct freight is loaded and positioned in accordance with the load instruction report (LIR).
The freight loading of wide-body aircraft is generally considered more complex than the loading of smaller, narrow-body aircraft in which freight is predominantly handled manually. The Airbus A330-303 aircraft cargo area consists of a forward and rear hold. Position 24P, which was associated with the loading of the incorrect ULD, is located in the forward hold as shown in Figure 5.
Figure 3: Typical A330-300 cargo hold
For reference only – internal detail of the A330‑300 rear cargo hold.I Source: ATSB
Figure 4: Sample unit load devices being loaded into an A330 forward hold
Source: ATSB, image digitally altered to remove aircraft operator logos
Figure 5: A330-300 series cargo hold showing the position of location 24P (shaded red) within the forward hold
Source: Qantas, edited by ATSB
Freight management system
To facilitate communication between those responsible for loading a departing aircraft, Qantas used an electronic freight management system. The system provided a direct means of sending data or messages between staff at the load control office, the ramp and the ramp office. Once an aircraft’s departure load was determined, the freight was configured and an electronic copy of the LIR sent from the load control office to the loading supervisor’s portable electronic tablet.
The LIR was also sent to the ramp office where it was automatically printed for hard-copy distribution to ramp personnel. The ramp office was staffed by the ground services coordinator, whose role was to provide liaison between the load control office and ramp staff, at the aircraft.
Any additional announcements or instruction from the load control office were also sent to the loading supervisor’s tablet via this system. If a LIR was re-issued, Qantas procedures required the load control office to make contact with ramp staff.
Qantas reported that loading supervisors often received messages on their iPad while using the freight loading application. Though not necessarily directly related to the loading task, all messages received from load control were related to the specific flight being worked on. To use the application on the iPad, loading supervisors were required to ‘log in’ to a specific flight, in order to progressively record the ULDs loaded onto that aircraft.
Aircraft loading procedures
The LIR assigned a specific location to each container or pallet in order to maintain the calculated weight and balance of the aircraft. It was the responsibility of the loading supervisor on the ramp to ensure that each item of allocated freight was loaded and secured in the correct position.
The procedures describing the loading supervisor’s responsibilities are contained in the Qantas Ramp Operations Manual. Section 5.2.2.2 of the manual describes the specific operating procedures that the loading supervisor was required to follow when loading a departing aircraft, including:
When loading, the Loading Supervisor and in-hold operators are all responsible for confirming that the following details are checked and in accordance with the LIR:
• Flight Number and Date
• Destination
• ULD numbers (containerised aircraft), where the ULD numbers are noted on the LIR.
After finalising the load, section 5.2.2.3 of the Ramp Operations Manual required the loading supervisor to record the final load, including any variations to the planned load on the LIR before a final ‘ramp clearance’ is given to the load control office.
In the event that an LIR was re-issued, Section 5.7.2.4 of the Ramp Operations Manual indicated that the load control office would make contact with the loading supervisor or ramp staff. Section 5.5.3.2 of the Ramp Operations Manual required that:
If a subsequent edition of the LIR is received during the loading process the Loading Supervisor must instruct the team to cease loading until the next edition LIR has been received and distributed to ALL relevant operational team members.
The operator’s Weight and Balance manual specified that:
Load Control (are) to make contact with and Notify Ramp in the event that an LIR needs to be re-issued.
Load Instruction Report – Edition 2
When Edition 2 of the LIR for flight QF107 was issued by the load control office, a copy of the LIR was automatically printed in the ramp office. The officer responsible within the load control office contacted the ramp office by telephone and spoke to the ground services coordinator, advising of the new edition LIR.
Qantas advised the ATSB that they were unable to establish the person on duty within the ramp office at that time. Nor could that they establish why the message that a new LIR had been released was not conveyed directly to the loading supervisor and his team at the aircraft.
Loading supervisor
The loading supervisor performs an integral role during the loading of an aircraft. The main tasks of the loading supervisor include managing ramp staff during aircraft-loading activities and ensuring that freight, goods and other luggage are appropriately loaded on a departing aircraft. The loading supervisor responsible for loading QF107 had about 15 years of experience in aircraft freight operations. In relation to this loading occurrence, the loading supervisor advised the ATSB that he:
had no clear recollection of the QF107 freight-loading irregularity. This was largely due to the high number of aircraft he had subsequently loaded and the latency period between the incident flight and the time it was reported.
had no clear recollection that an Edition 2 LIR had been released, requiring an exchange in the freight pallet at position 24P from the 2,005 kg unit to the 1,130 kg unit.
indicated that in his experience, ramp staff were always verbally contacted whenever the load control office released a new edition LIR. The announcement arrives from personnel within the ramp office, or via a radio or telephone call from the load control office.
advised that messages were often received on the iPad that were not necessarily directly related to the current task.
Load control officer
The load control officer had about 16 years of experience in aircraft loading and freight operations and the following comments were provided to the ATSB:
Contact with the loading supervisor or ramp staff was accomplished through various means including a messaging system on the loading supervisor’s portable tablet device (iPad), a phone call, or ground-to-ground radio contact.
When a new Edition LIR is released from the load control office, it must be acknowledged by the loading supervisor on their iPad.
When the Edition 2 LIR was issued, the freight management system was programmed to change the colour of position 24P from ‘green’ to ‘white’. That colour change would have been displayed on the loading supervisor’s iPad when he logged back into the system. It would have also required the loading supervisor to ramp clear position 24P again, despite already completing that task minutes earlier.
The load control officer’s understanding was that the ground services coordinator within the ramp office would deliver a printed copy of the new edition LIR to the loading supervisor once Edition 2 had been released.
Ground services coordinator
Qantas advised the ATSB that they could not identify the duty officer (ground services coordinator) within the ramp office when Edition 2 of the load instruction report was released. The ATSB was therefore unable to interview that person to discuss the occurrence.
Communication and actions
The loading supervisor reported that he had always been verbally contacted by the load control officer via radio or telephone if an aircraft load plan had changed while he was on the ramp, and he had never previously simply been issued a change via iPad with no accompanying verbal notification. Therefore, his expectation was that if a change occurred in this case, it would be accompanied by a call.
Since this occurrence, Qantas has formalised a procedure for verbal communication to accompany any changes in the load instruction report (refer to section titled Safety issues and actions).
Operator’s investigation
The operator’s agents noted a discrepancy with the palletised freight during the evening of 18 December when the aircraft was unloaded in Beijing. The contents of the offload instruction report indicated that ULD PMC42559QQ (1,130 kg) should have been within the forward hold of the aircraft. The ATSB received an occurrence notification of the maximum take-off weight exceedance on 10 January 2018, approximately 3 weeks after the incident had occurred. The Qantas investigation into this occurrence detailed a number of factors that led to the reporting delay.
Operator’s notification procedures
In their investigation report of this loading occurrence, Qantas indicated that their procedures for international airports contained various options when addressing an operational incident. The response and level of escalation was dependant on the identified level of safety risk. The risks were categorised from Very Low through to Extreme. Incidents that led to a breach in the MTOW limits qualified as a Medium Risk requiring an immediate escalation to the company authorities. The Qantas procedures for international airports required that when an irregular load was identified, such as a misplaced ULD, an internal report was to be lodged within a 12-hour period.
The Qantas investigation established that the freight personnel in Beijing had not realised the aircraft MTOW limits had been exceeded by the ULD discrepancy. As such, the occurrence report was not identified as an occurrence notifiable to any authority. On 19 December 2018, two days after the occurrence had been identified, an internal notification report was lodged into the Qantas reporting system. The report was titled, ‘Miss Handle of Cargo’.
Due to a combination of the corporate Christmas shutdown period, the classification level of the notification, and a significant backlog of other accumulated notifications, the report relating to the MTOW exceedance remained in triage within the internal Qantas reporting system and unattended for another 10 days. On 9 January 2018, the significance of the ULD discrepancy was identified by a quality assurance manager who realised the aircraft’s MTOW had been exceeded. The occurrence report was then internally escalated and the ATSB was notified.
Previous loading-related occurrences
A search of the ATSB occurrence database was conducted for ’Aircraft loading’ occurrence types involving high-capacity, Australian-registered aircraft, throughout the years 2010 to 2019. The search returned 1,135 Aircraft Loading occurrences[3] over the 10-year reporting period. Nearly all of these reported occurrences involved passenger-carrying operations. They were further defined into three broad categories (displayed in Figure 6):
Occurrence types identified as Loading Related have the potential to affect the aircraft weight and/or balance, aircraft structural integrity, aircraft performance and its flight characteristics. In the reporting period, there were 25, or about 6 per cent, of the notifications that described an impact on aircraft performance involving centre of gravity and/or maximum take-off weight. Of the 408 Loading Related occurrences within the 10-year reporting period, 12 investigations were commenced by the ATSB.[5] Most of the loading occurrences had minimal impact on the safety of operations and there were either people, processes, procedures, and/or engineering equipment to control the risks to the aircraft.
Figure 6: Aircraft Loading occurrence types over the period 2010 to 2019 (left chart), and (right chart), a subset of the Loading Related occurrence types with a descriptor breakdown
Image source: ATSB
Further derivation of the Loading Related data revealed 123 occurrences attributable to ‘Load Sheet Errors’ that included unaccounted freight, receipt of a new load sheet after take-off, incorrectly recorded weights of baggage and freight items, and calculation of the weight of children as adult passengers.
There were 82 occurrences coded as ‘Load Restraint’ mostly relating to securing of containers and pallets. Some also related to bags not being secured with webbing. For the 60 occurrences relating to an aircraft ‘Weight Error’, most were the result of either non-manifested containers, pallets or bags being loaded. The most significant ‘Weight Error’ involved additional and unaccounted baggage that constituted an additional 1,600 kg of weight to the aircraft. The 44 ‘Incorrect Position’ occurrences related to passengers in the wrong seating location or baggage and freight being loaded into the incorrect position within the hold.
There were 37 occurrences coded as a ‘Locks Problem’. Containers and pallets are positioned in the hold using a series of electronically controlled rollers, which are then locked into place using retractable latches integrated into the floor or wall of the aircraft. These latches, called cargo locks, stop containers and pallets from moving while the aircraft is in flight or when taxiing.
The following analysis discusses the factors surrounding the incorrect freight pallet being loaded onto the Qantas A330, which resulted in an exceedance of the aircraft’s certified maximum take-off weight (MTOW) on departure.
Maximum take-off weight exceedance
An operational requirement for additional holding fuel resulted in the issuing of a revised load instruction to carry less cargo. This instruction was not actioned and led to a heavier pallet of freight remaining on board the aircraft, instead of being exchanged for a lighter unit. The aircraft subsequently departed Sydney 875 kg above the weight listed in the revised load sheet and 494 kg above the aircraft's maximum take-off weight.
The heavier freight was positioned in the underfloor hold close to the aircraft’s centre of gravity. This limited the potential for control of the aircraft to be affected. Further, the flight crew did not report any control or performance anomalies. While the outcome was benign in the case of QF107, the operational risk level is increased when any significant addition of freight and/or passengers remains unaccounted. Continued operation of an aircraft that has exceeded its certificated weight may lead to unaccounted structural damage and pose a safety risk.
Load instruction report not actioned
Although the presence of an electronic message of a cargo variation was acknowledged by the loading supervisor, as confirmed through pressing ‘OK’ on the iPad, it was not correctly interpreted. This led to the required cargo variation not being actioned. The lack of accompanying verbal advice from load control or the ramp office personnel meant that the usual prompt for the loading supervisor of a significant change to the aircraft cargo configuration did not exist. This variation from normal practice probably influenced the actions of the loading supervisor on this occasion.
Additionally, as the freight had been loaded and the forward cargo doors locked by the time the new electronic messages were received, it is possible that the messages were perceived as not relevant.
Reporting delay
A number of factors were identified that led to a three-week delay in the operator identifying, and subsequently reporting to the ATSB, that the aircraft MTOW limits had been exceeded when QF107 departed from Sydney.
The freight agent in Beijing did not immediately report the loading irregularity, as required by the Qantas procedures for international airports. Additionally, the initial occurrence report did not identify the ULD irregularity as a serious risk. This limited the ability of the company to understand and address the circumstances associated with the loading error.
Another factor identified by the operator’s investigation was the significant backlog of occurrence notifications awaiting processing. The backlog, in combination with a corporate shutdown period, led to the delay in identifying the significance of the MTOW breach and its subsequent reporting to the ATSB. Although there was no consequence associated with this occurrence, reporting delays can lead to an increased safety risk with regard to continued operation of an overstressed aircraft and/or identification of deficiencies in the loading process.
Findings
From the evidence available, the following findings are made with respect to the loading-related occurrence involving an Airbus A330-303, registered VH-QPD on 17 December 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Contributing factors
An operational requirement for additional holding fuel resulted in the issuing of a revised load instruction to carry less cargo. This instruction was not actioned and led to a heavier freight pallet remaining on board the aircraft, instead of being exchanged for a lighter unit. The aircraft subsequently departed Sydney 875 kg above the weight listed in the revised load sheet and 494 kg above the aircraft's maximum take-off weight.
The required cargo variation was not actioned by the loading supervisor as electronic messages associated with the revised loading instruction were acknowledged without being correctly interpreted. That action was probably influenced by the supervisor’s experience that load changes were accompanied by verbal advice, and that did not occur on this occasion.
Other factors that increased risk
The loading irregularity was not immediately reported, which was not in accordance with the operator’s procedures for international airports, therefore delaying any assessment of the hazard presented by the exceedance of the aircraft’s maximum take-off weight.
Safety issues and actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Freight management
Qantas advised that an internal project to address freight discrepancies and loading errors was commenced in June 2018 and was completed in June 2019. The project involved the replacement of the loading supervisors’ portable electronic tablets (iPads) with handheld scanning devices. The new devices provide an automated freight confirmation and mobile communication process using printed barcode and scanning technology. The vast majority of domestic and international Qantas ports are using the scanners to validate freight before loading onto an aircraft.
Internal occurrence reporting
A change to the Qantas international airports occurrence notification form has been made. The completion of the ‘Loading Related Incident’ field within the form is now mandatory.
Load control to loading supervisor communication
To reduce the potential for communication errors between load controllers, ramp staff and loading supervisors, an amendment to the Qantas Weight and Balance Manual was incorporated on 1 September 2019. The amendment stated:
The preferred methods of contacting the Loading Supervisor when notifying of a LIR/LGR new edition or any other urgent message are:
1. Directly via phone, VHF radio or FM Messenger to First Load requiring a positive response that the message has been understood, not just read, e.g. “have you received the changes in EDNO 2?”,
2. Via Ramp office or Duty Manager, explicitly stating the Loading Supervisor MUST be notified.
CAUTION: If at any point you are unsure that the Loading Supervisor will not or has not received and understood the message, lock out the FirstLoad application by setting the Load Control status to LO or LL until contacted.
Sources and submissions
Sources of information
The sources of information during the investigation included:
Qantas Airways.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the loading supervisor, and the load controller, Qantas Airways and the Civil Aviation Safety Authority.
Submissions were received from Qantas Airways and the Civil Aviation Safety Authority. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 27 December 2017, a Network Aviation Fokker F100 aircraft, registered VH‑NHA was on final approach to Karratha Airport, Western Australia. The aircraft was operating as a scheduled passenger flight from Perth.
After a normal descent and touchdown, the captain selected both engine thrust reversers. The right engine thrust reverser did not activate. The aircraft decelerated using normal braking and taxied to the gate without further incident. There was no damage to the aircraft or injuries as a result of the incident. The captain reported the thrust reverser issue to maintenance personnel for investigation.
What the ATSB found
During maintenance the previous day in Perth, the right engine thrust reverser ‘minimum equipment list’ (in-service) lockout bolt had been installed instead of the maintenance lockout bolt. The maintenance bolt had a red warning flag and needed to be booked out from the tool store. Using the in-service bolt rendered ineffective the visual checks (warning flag) and procedural tooling check that were in place to ensure the bolt’s removal. Consequently, the aircraft was released to service with the bolt installed.
What's been done as a result
The aircraft’s maintenance organisation advised that in response to this incident it has taken safety action to highlight to maintenance staff the importance to follow the safety instructions and warnings contained in the aircraft maintenance manual. Further, the procedures for maintenance activities including task assessments, tooling and task procedures, have been reinforced.
Safety message
This investigation highlights the risk of varying procedures when performing maintenance tasks. It is important that, in all parts of the maintenance system, there is an awareness of human factors associated with completion of the task. An understanding of the demands associated with a task may help identify informal work practices that can then be aligned with the formal procedures (see Civil Aviation Safety Authority publication Safety Behaviours: Human Factors Resource Guide for Engineers).
The occurrence
What happened
On the morning of 27 December 2017, a Network Aviation Fokker F100 aircraft, registered VH‑NHA (NHA) was on final approach to Karratha Airport, Western Australia. The aircraft was operating as a scheduled passenger flight from Perth, with three flight crew, three cabin crew, and 64 passengers.
At about 1039 Western Standard Time,[1] air traffic control cleared NHA to land. After a normal descent and touchdown, the captain (pilot flying) selected both engine thrust reversers.[2] The left engine thrust reverser activated but the right engine thrust reverser did not. This was followed by an alert tone and a message on the multifunction display that the thrust reverser had not operated.
The flight crew continued with the landing and the aircraft decelerated to a taxi speed using normal braking. The captain moved the thrust reverser controls to the stowed position, the aircraft taxied to the gate without further incident and the passengers disembarked.
The flight crew reported the thrust reverser issue to engineering personnel for investigation. The subsequent engineering inspection found that the right engine thrust reverser had the ‘minimum equipment list’ (in-service) lockout bolt installed, effectively deactivating the reverser. The lockout bolt (Figure 1) was removed, normal operation of the thrust reverser was confirmed, and the aircraft returned to service.
There was no damage to the aircraft or injuries as a result of the incident.
Figure 1: In-service thrust reverser lockout bolt and lock tab
Source: Operator, annotated by ATSB.
Previous maintenance
Maintenance on the aircraft’s right engine was carried out in Perth on 26 December, the day before the incident flight, by a licensed aircraft maintenance engineer (engineer).The engineer began his scheduled day shift at about 0400.
The engineer initially progressed a maintenance task on another Fokker F100 to a stage where he was waiting on the availability of parts. In the interim, at about 0900, he was allocated another task to inspect both engines’ emergency fuel shut-off cables on two Fokker F100 aircraft, including NHA.
The Fokker F100 job instruction card specified using a rigging pin to de-activate the thrust reversers. Instead of using the rigging pin, the engineer decided to use the in-service lockout bolt from the aircraft’s cockpit. The aircraft maintenance manual specified the use of a maintenance bolt. This bolt was available from the tool store and had a red warning flag about 0.5 m long (Figure 2). The in-service bolt did not have an attached warning flag, nor was it required to.
Figure 2: Maintenance lockout bolt
Source: Operator, annotated by ATSB.
The engineer completed the inspections on the first aircraft and returned the in-service bolt to the aircraft cockpit. He then began inspections on NHA, again using the lockout bolt from the cockpit. After completing the inspection on the left engine, he installed the bolt into the right engine. The installation position was about 3.5 m from the ground and required the engineer to use a stand to insert the bolt (Figure 3).
Figure 3: Photograph of right engine with an exemplar in-service thrust reverser lockout bolt
Source: Operator, annotated by ATSB.
The engineer completed the inspection but, due to a reported oversight, did not remove the bolt. He then completed the maintenance paperwork for both aircraft inspections.
At the release to service of NHA, a tooling inventory check was conducted. As the bolt installed in NHA’s engine was not booked out on the store’s computer, it did not show up during the check so the error went undetected.
As part of the maintenance on NHA, the engineer remembered conducting a circuit breaker task that involved activating the engine and auxiliary power unit (APU) circuit breakers. That task required the use of specified warning labels in the cockpit marked ‘do not operate the engine controls’ and ‘do not start the APU’ warnings. The engineer did not recall using these warning labels.
Subsequently the aircraft was released to service with the lockout bolt installed. The installed bolt was not identified during the dispatch engineer’s and the flight crew’s pre-departure inspections.
In September 2018, the engine thrust reversers on a Jetstar A320 aircraft did not activate following landing at Sydney Airport, New South Wales. The ATSB investigation of that occurrence found that the thrust reverser lockout pins on both engines were not removed after maintenance at the Brisbane Airport, Queensland facility before the flight.
In that case, the aircraft maintenance lockout pins (fitted with warning flags) were also substituted with in-service pins without flags. Further, the functional check of the thrust reversers following reactivation as per the operator’s task card for that planned maintenance was not carried out. The investigation also found that operational pressure to expedite the maintenance probably influenced the deviation from procedures.
In December 2017, the left engine thrust reverser on a Jetstar A320 aircraft did not activate after landing at Gold Coast Airport, Queensland. The ATSB investigation found that the thrust reverser lockout pin was not removed after maintenance at the Adelaide Airport, South Australia facility before the flight.
The aircraft maintenance lockout pin in this case had a 1 m long red warning flag that was difficult to see in the prevailing low-light conditions. Further, the lockout pin was not booked out of the tool store nor was its installation recorded in the technical log.
Safety analysis
The right engine thrust reverser did not activate after VH-NHA landed at the Karratha Airport, because its in-service lockout bolt was installed. The engineer who installed the bolt during the maintenance in Perth before the flight had mistakenly not removed the bolt after the maintenance was completed. The presence of the bolt was missed for a number of reasons.
The engineer used the lockout bolt during the maintenance task to safely isolate the thrust reverser mechanism. However, he used the bolt from the cockpit because it was conveniently located. Therefore, the risk controls associated with using the specified maintenance lockout bolt were rendered ineffective.
Specifically, there was no warning flag to alert the engineer, dispatch engineer and flight crew that the lockout bolt was still installed. Further, the tooling check that would have identified that the bolt had not been removed was circumvented. Additionally, there were no warning labels in the cockpit to warn the flight crew that the bolt may be installed. Consequently, the aircraft was returned to service with the thrust reverser deactivated, but that was not identified prior to flight.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The lockout bolt on the right engine thrust reverser was not removed after maintenance, resulting in the aircraft returning to service with it deactivated.
The engineer used the in-service lockout bolt from the cockpit instead of the maintenance lockout bolt. As a result, the risk controls associated with using the maintenance bolt (red warning flag and tool store check‑out procedure) were rendered ineffective.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Network Aviation
The aircraft maintenance organisation, Network Aviation, advised the ATSB that it has taken safety actions that include highlighting to maintenance staff the importance of following the safety instructions and warnings contained in the aircraft maintenance manual. Further, the procedures for maintenance activities including task assessments, tooling and task procedures have been reinforced.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 11 January 2018, a team of six crewmembers was conducting cargo hold cleaning and painting under the supervision of the chief mate on board Berge Daisetsu. While working aloft, on a jury-rigged platform suspended from a cargo crane, the crane falling block and hook caught and then suddenly released from the hatch coaming. That resulted in shock loading of the platform and serious injuries to two crewmen.
What the ATSB found
The ATSB’s investigation found that prior to starting the work, the ship’s crewmembers had several discussions, made plans, and completed a risk assessment. However, the work was not conducted in accordance with company safety management procedures or industry best practice with regard to risk management and working aloft permit requirements.
Additionally, the deck crane was being operated with its working limits bypassed when used to support the ship’s crew during the painting task. This enabled the crane to reach a position which allowed the block to contact and catch on the hatch coaming.
Finally, the fall arrest equipment used by the crew on the platform was incorrectly attached. As such, had either of the crewmen fallen from the platform the equipment would not have worked correctly, resulting in serious or fatal injuries.
What's been done as a result
Berge Bulk Maritime has completed the supply of approved working aloft equipment to its geared bulk carriers and is progressing modification of vessel cranes for personnel lifting. Specific working aloft and bulk carrier safety training has been conducted and made mandatory for crewmembers every two years. In addition, a fleet-wide assessment of safety maturity is progressing.
Safety message
This accident illustrates the consequence of deviating from accepted safety management procedures and industry best practice. The use of machinery and equipment contrary to its intended purpose makes hazard identification difficult and exposes those directly involved to significantly increased risk.
The occurrence
On 2 January 2018, the 180 m, geared bulk carrier Berge Daisetsu (Figure 1) arrived in Gladstone, Queensland, after a voyage from Long Beach, United States. The ship was carrying a cargo of petroleum coke for discharge in three Australian ports (Gladstone, Newcastle and Portland). The following voyage was to carry a cargo of grain, necessitating cleaning and inspection of the holds by a cargo surveyor before they could be certified for carriage of grain. Voyage instructions and cleaning guidance were sent to the ship prior to it arriving in Australia.
Figure 1: Berge Daisetsu alongside in Portland
Source: ATSB
Hold preparation
After departing Gladstone for Newcastle, New South Wales, the deck crewmembers, under the guidance of the chief mate, washed the empty cargo holds (numbers 1 and 4) with chemicals and water. A small amount of repair painting was also conducted in reachable areas. The guidance from shore management (Berge Bulk) advised that the chemical should be left on the surfaces for 30 to 45 minutes before washing down. However, in the hot conditions[1] this dwell time resulted in the chemical drying on the hold surfaces. This was in contrast to the safety management system procedures and chemical use advice to wash down before the surfaces dry.
Berge Bulk had engaged the services of a cargo surveying company to inspect the condition of the cargo holds and provide advice regarding the areas requiring attention and also the appropriate techniques to use. A surveyor inspected cargo holds 1 and 4 in Newcastle and, along with photographic appraisal by Berge Bulk shore management, determined that the holds did not meet the required standard of cleaning due, in part, to staining from the chemical used. On board discussions with the surveyor concluded that an acceptable solution was to paint the hold surfaces. However, this was not discussed with shore management, despite Berge Bulk policy and expectations that, other than touch-up painting of surfaces, hold painting was to be undertaken during drydockings.
The lower sections of each cargo hold could be painted from the hold bottom using paint rollers on extended handles. However, the upper sections needed to be accessed by other means. Berge Daisetsu did not have portable scaffolding equipment or dedicated suspended access (work) platforms which could be used for this task. Consequently, the master sought ideas for accessing the upper sections of the holds from those on board and discussed those options with the chief mate and bosun.
Improvised work platform
The decision was made to jury-rig a portable gangway which the ship carried[2] into a work stage which could then be suspended from the cargo crane hook via slings. This plan required working aloft which in turn required procedural safeguards including a permit to work aloft, a risk assessment and tool box meetings. Furthermore, the risk assessment associated with working aloft required approval from shore management. However, in this case, this approval was not sought.
The gangway (Figure 2) comprised an approximately 0.6 m wide by 4 m long aluminium base with stanchions and rope side rails. As a gangway it was designed to be supported at its ends only, with a safe working load of 150 kg. In preparation for the painting task, the gangway was rigged with additional ropes to secure the open ends and then with slings at either end for lifting and suspending from the crane. Tag lines were connected to the underside of each end of the gangway and run to the hold bottom where they were used to control the motion of the suspended staging.
The movement of the ship while underway was considered unsuitable for this work. Consequently, the master and chief mate agreed that the painting of the upper hold areas would proceed while the ship was alongside in Portland, Victoria.
Figure 2: Portable ship’s gangway as rigged for use as the suspended painting platform
Source: ATSB
The two-day sea passage from Newcastle to Portland was spent painting the lower sections of cargo holds 1 and 4 and discussing and refining the plans for painting the upper sections. The chief mate and bosun discussed the rigging and a hand sketch of how the stage would be supported was made (Figure 3).
Figure 3: Hand‑drawn sketch of the work plan
Source: Berge Bulk
At 2054[3] on 10 January 2018, Berge Daisetsu was all fast alongside in Portlan. Cargo discharge from cargo holds 2 and 5 commenced soon after and continued into the following day.
Preparation for painting
At 0800 on 11 January 2018, the chief mate held a toolbox meeting during which the painting in cargo hold number 4 was discussed. This was the first time the chief mate had undertaken hold painting on board Berge Daisetsu but he had done similar work on other ships using lifting equipment designed for the task.
At this meeting, the standard risk assessment for painting the upper sections of cargo hold number 4 by lifting basket (dated 11 January 2018) was worked through. The ship was not equipped with an approved lifting platform and this form did not include verification that the risk assessment had been approved by shore management as required. The working aloft permit to work for the job was discussed and completed and the chief mate signed the form as the responsible person in charge. The preparations for the work included discussion of the required personal protective equipment, use of safety harnesses, individual roles and responsibilities, communication and task details. After the incident, all involved persons stated that they were aware of the task requirements and of their duties during the task.
The deck crew gathered the necessary equipment, including the improvised work stage, guy ropes, safety harnesses, a double lanyard fall arrest safety line and painting implements (drums for the paint, paint rollers and extended handles). The work team consisted of the chief mate, in charge, the bosun, 3 able seamen (AB1, AB2 and AB3), an ordinary seaman (OS) and the deck cadet (cadet). At about 0830, they gathered on deck at the aft end of cargo hold number 4.
The bosun was tasked to drive number 4 crane to access the forward area of number 4 cargo hold and number 3 crane for the after part. He had driven cargo cranes on ships prior to Berge Daisetsu although this was the first time he had driven a crane for lifting personnel. None of the cranes on the ship were certified for the lifting of personnel.
The painting was to be done by AB2 and AB3, both experienced seafarers. As monitor, AB1’s role was to remain on the main deck and provide assistance to, and act as lookout for, those in the hold and assist the chief mate as required.
The OS and cadet, both with less than one year’s seagoing experience, were to manage the tag lines from the hold bottom, keeping the movement of the staging under control. Five radios were distributed to the chief mate, bosun, the staging crew, AB1 and to the OS.
In preparation for accessing the upper hold sections, the staging slings were placed over the hook and bound together to form a tight loop around the hook (Figure 4). AB2 and AB3, donned the safety harnesses and attached themselves one to each of the fall arrest line’s lanyards. Once readied, with rollers, extended handles and 20 litre buckets for paint, the ABs boarded the staging on the main deck. The free end of the fall arrest safety line was then tied off to one of the crane hook shackles, clear of the staging slings and the hook itself. Because the improvised arrangement had limited stability, the ABs stood one at each end of the staging to balance it. They were to work from these positions and limit their movement so as to not upset the staging and equipment on board.
Figure 4: Stage and hook configuration
Source: ATSB
The OS and cadet held the tag lines and controlled the motion of the staging as it was lifted off the deck and lowered over the hatch coaming into hold number 4. The tag lines were then lowered into the hold and the OS and the cadet transferred from the main deck to the hold bottom. Once there, they retrieved the tag lines and maintained control of the staging as it was moved into position for the painting to commence.
Painting cargo hold 4 from the suspended work platform
Crane access into the cargo hold was limited by the edge of the hatch coaming. With the crane hoist wire against the coaming the staging hung about 4.5 m away from the hold’s athwartship bulkhead. To reach the bulkhead the ABs used paint rollers fixed to extended handles. The rollers were brought back into the staging to be replenished with paint from the buckets of paint. The staging was moved into position by the bosun at the direction of AB2, via the radio. Once in the desired location, the staging was steadied by the OS and cadet using the tag lines which were then tied off to secure points in the hold (bulkhead eyes or lugs and tank lid hand holds).
The work proceeded without incident throughout the morning. On several occasions the progress of the work (Figure 5) was witnessed by the master. At 1200, the painting of the forward and starboard side areas of the hold was completed and the work team returned to the main deck and stopped for lunch.
Figure 5: Photograph, taken by the master, of work in cargo hold number 4 during the morning
Source: Berge Bulk, annotations by ATSB
During the lunch break a cargo surveyor boarded the ship to continue the earlier inspections and guidance. At about 1300 the chief mate took the surveyor to cargo hold number 4. The surveyor pointed out the remaining areas that required painting. At about 1400, the inspection of hold 4 was completed and they moved to cargo hold number 1. The chief mate asked AB1 to assist with the remaining inspection by opening number 1 hatch.
At about the same time, painting recommenced in cargo hold number 4. The jib of crane number 4 was slewed outboard and over the port side of the ship to allow sufficient room for crane number 3 to provide access to the aft coaming of cargo hatch number 4. The bosun operated crane number 3, however, in contrast to the morning’s operation, this crane would not plumb over the hatch coaming within its normal operating range. In order to reach overhead the aft coaming, the crane’s lower luffing limit protection was bypassed. This was done without the knowledge of crewmembers other than the crane driver.
The incident
Utilising crane number 3, the team commenced painting on the port side aft area of the hold bulkhead in the same manner as they had earlier in the day – AB2 and AB3 boarded the staging on the main deck, it was lowered into the hold and the OS and cadet took control of the tag lines from the hold bottom (Figure 6). AB1 was on the main deck providing assistance to both the painting team and to the chief mate as required.
Figure 6: Re-enactment of the approximate staging position at the time of the incident, looking aft from the crane driver’s position
Source: ATSB
By 1500 the chief mate and the cargo surveyor completed their inspection of hold number 1 and returned to the main deck, before moving aft to the accommodation and the ship’s office. AB1 had moved forward to close number 1 hatch. In cargo hold number 4, the work team had moved inboard and were painting an area just to port of the centreline and about 8 m above the hold bottom. The crane falling block[4] was against the aft coaming face with the hook hanging below the coaming edge and the staging below that (Figure 7). The ABs completed the work they could reach and sought to reposition the staging further to starboard. AB2 asked the bosun to move the hook forward, horizontally, clear of the coaming, by luffing the jib up. The ABs were standing at either end of the staging with the paint buckets and rollers beside them.
At about 1510, as the bosun raised the crane jib, the falling block caught on the lower edge of the hatch coaming. This went unnoticed by the work team and, as the jib was raised further, the block suddenly came free of the coaming sending an unexpected heavy shock into the staging, upsetting it and its load. Both ABs were knocked over on the staging, and landed heavily on their knees and lower body. The paint buckets and rollers fell to the hold bottom.
Incident response
At the time of the incident the chief mate was on the main deck adjacent to number 5 cargo hold and AB1 was returning along the deck, adjacent to number 1 cargo hold. Both heard the sound of the falling equipment and hurried to number 4 cargo hold to investigate. The bosun stopped moving the crane and could see both ABs laying on the staging, injured. Below, the OS and cadet had avoided the falling equipment, gained control of the tag lines and stabilised the staging. After quick observation of the area, the OS radioed the bosun to lower the staging to the hold bottom so assistance could be provided to the ABs. Once on the hold bottom first aid was provided to the two injured men.
Figure 7: Re-enactment of the painting stage in the cargo hold
Source: ATSB
From the main deck, the chief mate radioed the master telling him of the accident and requesting immediate shore assistance. The master contacted the shore-based international medical firm contracted by the company to provide medical advice. He also notified the agent, shore authorities and company officials. He then attended the site to assess the situation. Meanwhile, an ambulance was directed to the ship and arrived alongside at about 1600. Both seriously injured men were transferred to the local hospital for assessment and further treatment.
Berge Daisetsu departed Portland bound for Wallaroo, South Australia on 14 January 2018. During the voyage the cargo holds were satisfactorily cleaned under the guidance of the cargo surveyor who travelled with the ship. Any work aloft required for the clean and touch-up repairs were discussed with, and approved by, Berge Bulk shore management. A certificate of fitness to load grain was issued on 15 January 2018 for all cargo holds.
Figure 8: Re-enactment of the approximate location of the platform and falling block at the time of the accident
At the time of the incident, Berge Daisetsu was registered in the Isle of Man, owned by the Berge Daisetsu Company (Marshall Islands), and managed by Berge Bulk Maritime (Singapore). The ship was built in 2015 in Japan and classed with DNV GL.
Cargo cranes
Berge Daisetsu has five cargo holds serviced by four, Mitsubishi 30 t capacity hydraulic deck cranes – crane numbers 1 to 3 have a working radius of 24 m and number 4 (aft) crane a working radius of 26 m. The cranes were not rated or approved for personnel lifting duty.
Crewmembers
Berge Daisetsu had a crew of 21 appropriately qualified Chinese nationals including 2 cadets. The master held a Chinese certificate of competency and had joined the ship in August 2017. This was his first contract with Berge Bulk but he had sailed as master in bulk carriers since 2010.
The chief mate held a Chinese chief mate’s certificate of competency and had been on board since July 2017. He first went to sea in 2007 and this was his second ship as chief mate, both were geared bulk carriers. This was the first time the chief mate had undertaken this task on board Berge Daisetsu but he had done similar hold painting work on other ships using lifting equipment designed for the task.
The bosun had a current Chinese certificate of proficiency as an able seafarer. He had worked at sea since 2007 and joined Berge Daisetsu in October 2017. This was his first time on this ship but he had driven cargo cranes on several previous occasions though this was the first time he had driven a crane for lifting personnel.
AB1 (monitor) held a Chinese certificate of competency as third officer in charge of a navigation watch and first went to sea as a deck cadet in 2014. This was his first ship with Berge Bulk and he joined Berge Daisetsu as an able seaman in October 2017.
AB2 (directing work from the platform) first went to sea in 2004 and held a Chinese certificate of proficiency as an able seafarer. This was his first time on board Berge Daisetsu and he had worked as a bosun or able seaman on several geared bulk carriers prior to joining Berge Bulk in 2016.
AB3 (assisting AB2 with painting) held a Chinese certificate of proficiency as an able seafarer. He joined Berge Daisetsu and Berge Bulk in October 2017 after several years’ experience serving as an able seaman on general cargo ships and bulk carriers.
The ordinary seaman had been at sea since 2017 and held a Chinese certificate of proficiency for seafarers (as rating forming part of a navigational watch). Berge Daisetsu was his second ship, both with Berge Bulk.
The deck cadet held a Chinese certificate of proficiency for seafarers having completed basic training. He joined Berge Bulk in 2017 and Berge Daisetsu was his first ship.
Berge Bulk Maritime
Berge Bulk Maritime (Berge Bulk) specialises in dry bulk ships and cargoes. From a fleet of 12 vessels in 2007, Berge Bulk has grown to operate and manage a fleet of over 70 ships in 2018. The fleet includes 12 ships of less than 40,000 DWT[5] (9 owned by Berge Bulk) all fitted with deck cranes. The remainder of the fleet consists of ships of more than 170,000 DWT in size. In 2017 Berge Bulk transported over 75,000,000 t of cargo.
The latest addition to the geared bulk fleet was Berge Snaefell (37,800 DWT), delivered in 2018. This ship is fitted with personnel riding certified deck cranes and was delivered with class approved platforms for working aloft.[6]
Industry guidance and legislation
Legislation,[7] reflected in industry guidance, states that no lifting equipment shall be used for lifting persons unless it is designed for the purpose, except in exceptional circumstances such as for rescue or in emergencies.
At the time of the incident, Berge Daisetsu was flagged in the Isle of Man (IOM). The IOM Merchant Shipping Act 1985, Merchant Shipping (Code of Safe Working Practices) Regulations 1989 require that multiple copies of the current UK Maritime and Coastguard Agency (MCA) Code of Safe Working Practices for Merchant Seafarers (COSWP) are carried on board and made available to all crewmembers. COSWP references MCA Marine Guidance Notes (MGN) and UK Statutory Instruments (Regulations).[8] While the referenced MCA notices do not apply to IOM‑registered vessels, it is expected that they be used as best practice guidelines. Further guidance on the standards for working and living conditions on board is provided by the IOM Merchant Shipping (Maritime Labour Convention) Regulations 2013.
Code of Safe Working Practices for Merchant Seafarers (United Kingdom Maritime and Coastguard Agency)
The MCA publication COSWP is a widely referenced nautical publication and is made available on board all Berge Bulk ships. The procedures and guidance in Berge Bulk’s safety management system (SMS) relied heavily on the advice and resources available in the COSWP. If guidance or training was required on board and not covered in the SMS, the master was directed to refer to the COSWP.
The COSWP provided best practice guidance for improving health and safety on board ships. Aspects relating to the working aloft task being undertaken on board Berge Daisetsu were addressed in the publication. This included, but was not limited to:
personal protective equipment (PPE) including protection from falls
permit to work (PtW) systems
work at height
provision, care and use of work equipment
lifting plant and operations including personnel lifting equipment.
Safety management system and work procedures
The Berge Bulk SMS document suite contained procedures, guidance and forms relevant to the task of hold cleaning and preparation for carriage of grain, and to the methods being employed on Berge Daisetsu on 11 January.
The SMS identified all work at a height of more than two metres above the deck as requiring a permit to work. In addition to this, risk assessments were required for cargo hold cleaning, working aloft and lifting operations with the work aloft risk assessment requiring shore management approval. Furthermore, the operation of lifting appliances was identified as a high risk task and advised that design limits were to be adhered to and safety devices working.
Relevant SMS documents for the painting task included:
health, safety and security policy
hold cleaning
permit to work systems
risk management
working aloft
operation of lifting appliances – a lifting appliance is one that is used for the purpose of suspending, raising, lowering or moving a load, including personnel.
Health Safety and Environmental policy
The Berge Bulk Health Safety and Environmental policy emphasised the safety of the crewmembers on board. Under this policy, the incorrect usage of any equipment was ‘strictly’ prohibited. On board Berge Daisetsu, the portable gangway (jury-rigged as the suspended work platform) was supplied to assist safe access to and from the ship. It was not intended to be used as a personnel lifting platform for cargo hold cleaning/painting.
Cargo hold cleaning
The cargo hold cleaning document stepped through stages of the inspection, cleaning and approval process. Subjects addressed included safety during cleaning, grades of hold cleaning, the use of cleaning chemicals and cargo contamination problems, including actions to minimise the contamination. The procedure dealt predominantly with cleaning and protection of paint systems and included the advice that chemicals should be washed off before they dry. Painting of surfaces was mentioned as part of damage repair, with the need to allow sufficient time for the paint to cure and harden emphasised.
Berge Bulk management advised that the crewmembers were instructed to chemically clean the cargo hold surfaces, scrubbing reachable areas only. Cleaning equipment provided for this task included high pressure water guns with a 15 m reach. After the cargo holds did not pass inspection, management expectations were that further cleaning would be required to remove the staining. This would be done at the surveyor’s guidance. Painting of holds, other than minor touch‑up, was usually done in dry dock after receiving inspection reports from the ship. In Berge Bulk’s experience the cargo hold area most affected during cargo operations was limited to areas less than 5 m above the hold bottom. This area could be reached with equipment made available on board the ship without the need for working aloft. Consequently, the ship’s crewmembers were not instructed, nor expected, to paint the upper area of cargo holds.
However, the on board discussions after the surveyor’s inspection concluded that painting the hold surfaces would result in an acceptable finish, and be completed more quickly than washing and scrubbing. This would however, require accessing the upper areas of the cargo holds and thus working aloft.
Permit to work procedure
The Berge Bulk permit to work (PtW) procedure included the steps:
assessment - including the need for a toolbox meeting and risk assessment
authorisation – included requiring that shore approval of risk assessments, if applicable, was to be received on board prior to commencing the task
monitoring – persons carrying out the task were to be supervised
response to change – empowered any responsible person to stop a job if unsafe conditions were found
closure.
Work aloft was one of the tasks identified as requiring a PtW.
The PtW procedure then listed barriers to be in place including supervision, use of safety harness and fall arrest equipment and that at least two safety barriers were to be in place.
A working aloft PtW form was completed for the task of ‘Paint bulkhead by lifting basket’ in hold number 4 on 11 January 2018. This form indicated that:
a risk assessment was completed with a resultant level of risk at 2 (on a scale of 3) – the form prominently included the notice that ‘whenever work is being carried out on board involving the risk of falling more than two (2) meters [sic], such work shall be considered “Working Aloft” and subjected to a risk assessment and permit-to-work.’
equipment had been checked
persons had been provided with safety harnesses
other safety measures taken included the use of safety belts and safety lines
the work and method of work had been agreed and understood
personnel were briefed
the chief mate was supervisor and person in charge and had signed on as person in charge as well as the person responsible for the work aloft.
The permit was approved and signed by the master.
Risk assessment procedure
The Berge Bulk SMS included a risk management procedure which had the objective to ‘cover risk management and risk mitigation to ensure that protective and precautionary measures are taken, which will reduce risks associated with operation to a level that is considered to be 'as low as reasonably possible and practicable.'’ One resource identified to assist users when assessing risk was to refer to the COSWP.
The risk management procedure worked through the steps to be taken including:
hazard identification
using the ‘Take 5’ – stop, think, identify, plan, proceed – technique to identify and mitigate hazards
the procedure for completing a toolbox talk
a list of the tasks requiring a risk assessment – this list included cargo hold cleaning, working aloft and lifting operations
the risk assessment procedure which included referring to the relevant permit to work procedure
a list of risk assessments requiring shore management approval prior to commencement of the associated activity, including working aloft.
A risk assessment was completed (dated 11 January 2018) for ‘Working aloft - Painting cargo hold by lifting basket’. This identified several precautions to be taken to reduce the risk of harm, including:
familiarization of the work place and surrounds prior to work commencing
all work team members must be briefed on the work to be done and proper communications are to be maintained
a responsible and knowledgeable person must continuously supervise and remain in communication with relevant personnel
all equipment to be used is to be inspected and tested.
The PtW was identified as one additional precaution to be taken to reduce the risk of harm.
Contrary to the SMS requirement, this risk assessment was not provided to shore management for approval.
Operation of lifting appliances procedure
The Berge Bulk operation of lifting appliances procedure identified this as a high risk task. The procedure therefore included precautions such as:
the appliance should never be operated outside its design limits
all safety devices as fitted are to be tested for good working order and under no circumstance must the safety devices be isolated or overridden.
However, the lifting appliance was used outside its design limits and with safety devices overridden.
Personal protective equipment usage
Personal protective equipment (PPE) is an essential tool for preventing injury in the workplace. However, to be effective it must be used correctly and as per manufacturer and industry recommendations. For the work aloft on board Berge Daisetsu, the risk assessment and PtW had correctly identified that PPE including safety harnesses, safety belts and safety lines was required. The equipment used included a twin-legged energy absorbing fall arrest lanyard. Several of these were on board at the time.
Figure 9: Energy absorbing double lanyard fall arrest equipment in use at the time
Source: Berge Bulk with annotations by ATSB
This type of lanyard[9] comprises a ‘Y’ configuration – the body of the ‘Y’ has the tear out energy absorbing component and the two legs have safety lanyards and attachment loops (Figure 9). The energy absorber loop is to be connected to the safety harness of the user and the lanyards are then used for attaching to strong points. One lanyard is attached to one point, and the second can be moved and attached to a second point some distance away. The first can then be disconnected and moved to another point, and so on. This arrangement allows a user to move about a worksite without ever being unhooked from a strong point.
Crane operation
The cargo crane in use at the time of the incident (number 3) served cargo hold numbers 3 and 4. It has a 30 t load capacity and 24 m maximum working radius (at 20° jib angle to the deck). The vertical position of the hook changed by 1,650 mm over the full range of jib angle movement from about 81° to 20° (error in level luffing).[10]
To get the work platform as close to the bulkhead as possible during the painting task required the crane’s falling block to be against the coaming. That positioning also limited the fore-aft movement of the hook and platform. To do this however, the crane was required to plumb over the hatch coaming. This was beyond its normal maximum working radius. The working zone luffing limit for the crane was 20°, but to plumb over the hatch coaming the jib needed to be at a lower angle of about 15°. To achieve this, the lower luffing limit of the crane was bypassed. This limit was routinely and regularly bypassed to allow the crane jib to be housed. However, operating with the bypass active for any other reason was prohibited.
Prior to this accident, Berge Bulk had identified the need to have specific and approved equipment for working aloft, including work platforms available on its ships. This equipment had already made available on several ships. However, although an approved work platform for Berge Daisetsu had been manufactured, it was pending delivery to the ship at the time of the occurrence. Therefore, hold cleaning and touch-up work was limited to those areas that could be reached from the deck.
The company had also identified the need for working aloft in cargo holds and had commenced a process of having new ships fitted with deck cranes approved for personnel lifting in addition to cargo handling.
On 11 January 2018, a six‑member team was conducting cargo hold cleaning and painting under the supervision of Berge Daisetsu’s chief mate. While working aloft, on a jury-rigged platform suspended from a cargo crane, two persons were seriously injured when the crane falling block and hook made contact with the hatch coaming and upset the platform.
This analysis will explore the reasons for the platform upset and examine circumstances around the accident more broadly. This will include consideration of the safety management system and procedures in place for cargo hold painting and working aloft. In addition to this, the knowledge and use of equipment and machinery used for the task will be discussed.
The accident
In a decision probably motivated by efficiency, Berge Daisetsu’s crewmembers elected to paint the stained areas of the ship’s cargo holds, rather than clean them, in order to meet the requirements to pass inspection and obtain a Certificate of Fitness to Load Grain. While painting the upper areas of the aft bulkhead of cargo hold number 4, the work platform was suspended from number 3 cargo crane with the crane falling block flat against the hatch coaming to position the painters as close as possible to the bulkhead being painted. In this location and orientation, one of the falling block shackle pins protruded fore-aft and extended under the lower edge of the hatch coaming (Figure 10). This presented as a catch point should the hook be lifted vertically.
Figure 10: Crane hook and shackle in approximate position as at time of incident. Inset shows the view from the side with protruding hook shackle pin.
Source: ATSB
To reach this location, the crane’s lower luffing limit was bypassed. Bypassing the limit removed control protections from the crane including its level luffing function. Operating the crane in this mode was prohibited by company procedures, against crane manufacturer advice and contrary to sound working practices.
The need to operate the crane with the limit bypass active was not identified or discussed at any stage during the planning, risk assessment, permit to work or toolbox discussions completed for the job. The bosun regularly drove the cranes and it is likely that he alone was aware that the crane was being operated with the bypass active. However, he was probably unaware of this specific fouling risk when operating with the limit bypassed.
Consequently, when AB2 (on the staging) asked the crane driver (bosun) to raise the jib to access an area to be painted, the falling block rose with the jib. AB2’s intent was that the platform would move horizontally and clear of the coaming using the level luffing function of the crane. However, as this function had been bypassed, the jib and falling block moved upwards and this likely led to the protruding hook shackle pin catching under the hatch coaming. As the fouling went unnoticed by the work party, the jib (and hook) continued to move and the shackle pin came free from the hatch coaming with a sudden movement which in turn transferred a significant force to the platform occupants, seriously injuring them.
Safety management system
At the time of the accident, safety management system (SMS) procedures required a risk assessment and a permit to work be completed for the cleaning and painting of the upper areas of the cargo hold. Berge Bulk policy for working aloft agreed with industry guidance in that only suitably designed, approved and certified equipment and machinery should be used for lifting personnel.
On board Berge Daisetsu, this task was undertaken using a jury-rigged portable gangway suspended from the cargo‑only crane(s) to access the upper areas of the cargo hold(s). The portable gangway was a common piece of ship equipment for use as a means of access to/from the ship and for no other purpose. Additionally, the cranes, though rated to lift 30 t, were not approved for lifting personnel.
Therefore, although the ship’s crewmembers had several discussions, made plans and completed a risk assessment in accordance with the SMS requirements, the equipment and machinery use was contrary to company policy and procedures. They were not suitable for the task and their use made hazard identification difficult and exposed the workers to increased risk.
While the decision to adapt on board equipment may have been motivated by a desire to expeditiously prepare the ship for loading, it may also indicate that:
detailed understanding of the use of machinery and equipment was lacking on board Berge Daisetsu
although the required on board familiarisation included the use of lifting appliances such as cranes, the systems to ensure this knowledge was acquired by users was ineffective.
Furthermore, the risk assessment completed during preparations for the work was not sent ashore for office approval prior to the work being commenced, as required by the SMS. Consequently, shore personnel were unaware that hold painting requiring working aloft was to be done. This removed the opportunity for external scrutiny of the task to determine whether it was necessary and to identify that it involved the use of non-approved equipment and machinery.
Proactive safety action taken by the company in response to this accident (see the section titled Safety issues and actions) included training and assessment of safety culture. The intention of that action was to ascertain whether these identified safety deficiencies were confined to this occurrence or symptomatic of a fleet‑wide issue.
Personal protective equipment
During site inspection after the accident, the crewmembers demonstrated how the equipment, including the personnel protective equipment, was being used at the time. During this demonstration it was apparent that the use of the twin legged energy absorbing fall arrest lanyard was not correctly understood. One lanyard was used for both workers (one person attached to each leg), in contrast to the correct usage of one lanyard per person. Furthermore, the energy absorber was excluded from use in the way in which the equipment was attached to the strong point (crane hook shackle). Figure 11 shows how the fall arrest lanyard was rigged.
Had either of the ABs fallen from the work platform, the fall arrest lanyard would not have worked as designed. As the energy absorbing end of the lanyard was incorrectly connected it is possible that the lanyard may have failed completely and the user(s) fallen, unchecked, to the hold bottom.
Figure 11: Composite image and sketch showing how the energy absorbing double lanyard was used and secured
Source: ATSB
The use of safety equipment was discussed during the pre-work toolbox meeting and then on the worksite when all was inspected prior to work commencing. This process involved all crewmembers of the work team including the chief mate. Furthermore, the worksite was checked several times by the master. At no time were any concerns raised about the safety equipment being used or how it was being used. In particular, the use of a single fall arrest lanyard for two persons when several were available on board was not mentioned.
This suggests that the use of this equipment had not been explained or demonstrated to the ship’s complement and/or had been supplied to the ship without any explanatory or usage documentation.
Findings
From the evidence available, the following findings are made with respect to the serious injuries sustained on board Berge Daisetsu whilst berthed in Portland, Victoria on 11 January 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The suspended painting platform was upset when the hook was moved and suddenly came free from being caught under the hatch coaming. This led to the occupants falling on the platform and receiving serious injuries.
Contrary to normal operating procedures, the deck crane was being operated with its working limits bypassed when used to support the ship’s crew during the painting task. This enabled the crane to reach a position which allowed the block to be in contact with and catch on the hatch coaming.
The task was not conducted in accordance with company safety management procedures or industry best practice with regard to risk management and working aloft permit requirements. Consequently, machinery and equipment were used in a way they were not designed or approved for, making hazard identification difficult and exposing the workers to increased risk.
Other factors that increased risk
The fall arrest equipment used was incorrectly attached to the workers on the suspended platform. Consequently, had either of them fallen from the platform the equipment would not have worked correctly, resulting in serious or fatal injuries.[Safety issue]
Safety issues and actions
The safety issue identified during this investigation is listed in the Findings and Safety issues and actions sections of this report. The ATSB expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the marine industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: The fall arrest equipment used was incorrectly attached to the workers on the suspended platform. Consequently, had either of them fallen from the platform the equipment would not have worked correctly, resulting in serious or fatal injuries.
Additional safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence
Berge Bulk Maritime advised the ATSB that it has also taken the following actions as a result of this incident:
completed the fleet‑wide purchase and supply of Class‑approved work platforms for work aloft to all company-owned geared bulk carriers
commenced a programme to have all fleet geared bulk carriers’ cranes modified and approved for personnel lifting at scheduled dry dockings
engaged an external consulting company to conduct a fleet‑wide assessment of safety maturity by measuring the company’s level of safety practice and how well this is embedded in the behaviour and belief of employees. This assessment is intended to assist the development and implementation of an integrated company-wide safety strategy.
General details
Ship details
Name:
Berge Daisetsu
IMO number:
9713179
Call sign:
2IPO5
Flag:
Isle of Man
Classification society:
DNV-GL
Ship type:
Geared log / bulk carrier
Builder:
The Hakodate Dock Co. Ltd, Hokkaido, Japan
Year built:
2015
Owner(s):
Berge Daisetsu Company Inc. (Marshall Islands)
Manager:
Berge Bulk Shipping Pty. Ltd. (Singapore)
Gross tonnage:
21,530
Deadweight (summer):
34,533 t
Summer draught:
9.822 m
Length overall:
179.97 m
Moulded breadth:
30.00 m
Moulded depth:
14.05 m
Main engine(s):
Mitsubishi 6UEC45LSE-Eco-B2
Total power:
5,690 kW at 108 rpm
Speed:
14.0 knots
Damage:
Nil
Sources and submissions
Sources of information
The sources of information during the investigation included:
the master and crewmembers of Berge Daisetsu
Berge Bulk Maritime
Mitsubishi Heavy Industries
DNV GL
the Australian Maritime Safety Authority
the Isle of Man Ship Registry.
References
British Standards Institution 2010, BS EN 14502-1:2010 Cranes - Equipment for the lifting of persons. Suspended baskets, British Standards Institution, London. Available at www.bsi-global.com
DNV GL 2016, DNVGL-ST-0378 Standard for offshore and platform lifting appliances, DNV GL. Available at http://dnvgl.com
International Maritime Organization (IMO) 2009, MSC.1/Circ.1331Guidelines for construction, installation, maintenance and inspection/survey of means of embarkation and disembarkation, IMO, London.
International Maritime Organization (IMO) 2014, The International Convention for the Safety of Life at Sea (SOLAS) 1974 as amended, IMO, London.
Isle of Man Ship Registry 1989, Government Circular 152/89, Merchant Shipping (Code of Safe Working Practices) Regulations 1989, Isle of Man Ship Registry, Douglas, Isle of Man, British Isles. Available at www.iomshipregistry.com/
Maritime and Coastguard Agency (MCA) 2006, Marine Guidance Note MGN 331 (M+F)The Merchant Shipping and Fishing Vessels (Provision and use of work equipment) Regulations 2006, (PUWER), MCA, Southampton, UK. Available at /www.gov.uk/government/organisations/maritime-and-coastguard-agency
Maritime and Coastguard Agency (MCA) 2006, Marine Guidance Note MGN 332 (M+F)The Merchant Shipping and Fishing Vessels (Lifting Operations and Lifting Equipment) Regulations 2006, (LOLER), MCA, Southampton, UK. Available at www.gov.uk/government/organisations/maritime-and-coastguard-agency
Maritime and Coastguard Agency (MCA) 2010, Marine Guidance Note MGN 410 (M+F)The Merchant Shipping and Fishing Vessels (Health and Safety at Work) (Work at Height) Regulations 2010, MCA, Southampton, UK. Available at www.gov.uk/government/organisations/maritime-and-coastguard-agency
Maritime and Coastguard Agency (MCA) 2017, Code of Safe Working Practices for Merchant Seafarers, MCA, Southampton, UK. Available at www.gov.uk/transport/maritime-safety
Work at Height Safety Association (UK) n.d., Guidance on the use of single and twin energy absorbing lanyards WAHSA TGN02 Technical Guidance Note 2 (formerly TGN04), viewed 05 October 2018. Available at http://www.wahsa.org.uk/guidance-notes/
Working at Height Association (WAHA) 2011, Twin Tail Lanyard Use (Rev 2), Technical Bulletin, WAHA Australia, viewed 05 October 2018. Available at www.waha.org.au/technical-bulletins/
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the master, chief mate, bosun, 3 able seamen, ordinary seaman and deck cadet from Berge Daisetsu, Berge Bulk Maritime, the Australian Maritime Safety Authority and the Isle of Man Ship Registry.
Submissions were received from Berge Bulk Maritime, the Australian Maritime Safety Authority and the Isle of Man Ship Registry. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On 21 December 2017, the pilot of a Gregory S. Browning Zodiac 601XL departed Shelbyville Municipal Airport, Tennessee on a flight to Wifferdill Airport, Chapmansboro, Tennessee. A short time later, witnesses in the vicinity of Chapmansboro reported hearing a loud ‘boom’ similar to a crash. The aircraft was found in an open field in an upright position with substantial damage. The pilot, the only person on board, sustained fatal injuries. The National Transportation Safety Board (NTSB) of the United States commenced an investigation into the occurrence.
As Australia is the State of Manufacture of the engine, the ATSB requested to be appointed as an accredited representative to the NTSB investigation in accordance with clause 5.18 of Annex 13 to the Convention on International Civil Aviation Aircraft Accident and Incident Investigation. An ATSB investigator was appointed as accredited representative to the NTSB on 8 January 2018. To facilitate support to the NTSB investigation, the ATSB also initiated an investigation under the Australian Transport Safety Investigation Act 2003.
On 2 January 2018 at about 1413, V/Line train 7750 was travelling from Waurn Ponds to Geelong as an empty car service not carrying passengers. Shortly after passing Marshall Railway Station, the train passed two signals at Danger. After passing these signals, the train entered the single line section between Marshall and South Geelong, and also the Marshalltown Road level crossing before the crossing booms had lowered. The driver applied braking as the train entered the crossing and the train came to a stop.
The 1305 V/Line Melbourne to Warrnambool passenger service, train 8865, had departed Geelong at about 1410 and was proceeding towards Marshall on the same single line section. The trains were scheduled to cross using the loop track at Marshall. The train controller in Melbourne was monitoring the progress of both trains in order to operate the points and signals at Marshall to effect the crossing. When he became aware that train 7750 was passing signals at Danger, the controller initiated a radio emergency fleet call instructing both trains to stop. When stopped, the distance between the trains was about 940 m.
What the ATSB found
The ATSB found that the driver of train 7750 did not respond to the Stop indications of signals MSL10 and MSL8 at Marshall. He subsequently made an emergency brake application, either after noticing that the Marshalltown Road level crossing booms were not lowered or possibly in a delayed recognition of signal(s) MSL10 and/or MSL8 being at Stop. The driver’s performance was probably influenced by symptoms associated with nicotine withdrawal, having not applied a nicotine patch on this day.
Following this incident, the driver of train 7750 tested positive for an inactive metabolite of cannabis, with levels suggesting use within the previous 7 days. It could not be determined whether cannabis use had affected the driver’s performance at the time of this incident.
V/Line’s drug and medical regimes had not previously identified that this driver had been using cannabis, and the driver had not been subject to random drug testing during his employment with V/Line.
The signalling system at Marshall was not fitted with any form of positive train protection system and was reliant on driver compliance with signal indications.
What's been done as a result
V/Line has installed a train protection system at this location to stop a train that has passed a signal at Danger. The system also has several over-speed sensors to prevent a train entering the Marshalltown Road level crossing when unprotected.
V/Line continues with planning for the provision of three-position signalling for this section as part of other infrastructure projects.
Safety message
Nicotine withdrawal can affect a driver’s performance. To minimise adverse impacts, attempts by safety-critical workers to stop smoking should be managed under medical supervision.
Rail operators should consider fitting authority-overrun intervention at locations (like Marshall) that present a heightened risk due to rail operations on a single, bidirectional track.
The occurrence
On 2 January 2018, the driver was rostered to commence work at 1158. He first ran the V/Line 1250 service from Southern Cross Station to Waurn Ponds. On arrival at Waurn Ponds, the driver changed ends and train 7750 departed empty cars[1] towards Geelong. The driver was to proceed to Geelong where the train would then form the 1435 passenger service to Melbourne (Figure 1).
Figure 1: Marshall Railway Station location relative to Waurn Ponds and Geelong
Source: PASS Assets (Public Transport Victoria) adapted by Chief Investigator, Transport Safety (Vic)
After passing the Departure signal at Waurn Ponds, there were five signals within the Marshall location over a distance of about 5 km. Distant signal[2] MSL22 was followed by four Home Signals,[3] MSL24, MSL26, MSL10 and MSL8 (Figure 2).
Figure 2: The sequence of signals through Marshall, travelling towards Geelong
Source: Chief Investigator, Transport Safety (Vic)
At 14:09:23[4], the train passed Distant signal MSL22 at a speed of about 86 km/h. This signal displayed a Caution indication, meaning that at least one Home signal within the Marshall location was at Stop. Prior to MSL24, the train’s speed was reduced to 57 km/h at the Surf Coast Highway level crossing, exceeding the Temporary Speed Restriction (TSR) of 40 km/h at that location.
The train speed was then increased and the train passed signal MSL24 (that was at Proceed) at a speed of about 85 km/h at 14:12:15. The train then continued at speeds of up to 94 km/h before reducing speed and passing MSL26 at about 71 km/h at 14:13:10. This reduction in speed was consistent with an approaching TSR of 70 km/h that applied just beyond signal MSL8.
The right-hand arm of signal MSL26, that was applicable for the straight-route, was at Proceed and the signal for the loop was at Stop. This indicated that the points were set for the straight (number 1) track and that train 7750 was authorised to proceed on this track.
The intention of the train controller was to hold train 7750 at MSL10 to allow the Warrnambool bound train (8865) to enter the loop (number 2) track. Train 7750 was then to proceed towards Geelong. Train 8865 would then have been required to remain in the loop at Marshall to allow a Warrnambool to Southern Cross train that was following train 7750 to also cross.
After passing MSL26, the speed of train 7750 further reduced. Home signals MSL10 and MSL8 were at Stop and the train passed both signals at a speed of about 64 km/h, at 14:13:24 and 14:13:29 respectively. The train had passed signals MSL10 and MSL8 without authority. This type of event is referred to as a Signal Passed At Danger (SPAD).
The driver reported noticing that the Marshalltown Road level crossing booms were up and making an Emergency brake application. The train entered the single line between Marshall and South Geelong and then the level crossing, before the booms had lowered.
The train controller had commenced his shift at 0700 working the ‘Geelong Room’ that managed rail traffic between Manor Junction[5] and Waurn Ponds. In preparation for the cross of the two trains at Marshall, he was observing the signalling control and CCTV VDU[6] when he saw train 7750 go through Marshall platform travelling too fast to stop at MSL10. Realising that train 7750 would not be able to stop, the train controller made a fleet radio transmission to all trains in the area to ‘Red Light’ (Stop). He then radioed the drivers of trains 7750 and 8865 to confirm that they had both stopped. The CCTV also allowed the train controller to confirm that train 7750 had stopped beyond the Marshalltown Road level crossing.
When both trains were stopped, the separation between train 7750 and train 8865 was about 940 m. For a single train travelling at an average speed of 85 km/h, this distance equated to about 40 seconds of travel.
Post-incident
Following the incident, the driver of train 7750 was drug and alcohol tested at Geelong at approximately 1538. Drug testing was by sampling oral fluid and returned a negative result. Testing for alcohol also returned a negative result.
V/Line subsequently requested (under its Rail Safety Worker Health Assessment processes) that the driver undertake a drug test by urine sample. This was taken at around 1000 the following morning (3 January). This testing returned a positive result for the presence of an inactive metabolite of cannabis. __________
Marshall is located on the single line between Geelong and Warrnambool, about 80 rail-km from Melbourne. The line is part of the regional intrastate network managed by V/Line Corporation. Adjacent to Marshall Railway Station was the main line (number 1 track) and a loop (number 2 track) to facilitate trains crossing or passing. Marshall Railway Station had a single platform adjacent to the number 1 track. Except where speed restrictions applied, the line speed for this track was 115 km/h.
Safeworking and signalling
Rail traffic between Geelong and Waurn Ponds was managed under the operating rules and procedures applicable to the Track Block Safeworking System. The object of this system is to prevent trains being in the section between two adjoining locations at the same time. Interlocking prevented the train controller from being able to place a signal controlling the entrance into a single line section to the Proceed position until the section was clear.
Fixed signalling through Marshall was two-position. This type of signalling is now uncommon in Victoria, having mostly been replaced with three-position signalling. Two-position signals are route signals that apply to a single route. Home signals do not provide information on the aspect of the next signal, nor specific guidance for the driver on the speed to the next signal. The driver of train 7750 indicated that he was familiar with the signalling system through Marshall.
Marshall had a signal sequence that comprised a Distant signal followed by a series of Home signals. For Geelong-bound trains, the signal sequence through Marshall was:
MSL22 (Distant signal)
MSL24 (Home signal)
MSL26 (Home signal) that included separate signal heads for the mainline and the loop tracks
MSL10 (Home Signal) and MSL12 (Home signal on the loop track)
MSL8 (Home signal).
MSL26 was located before Marshall Railway Station, and MSL10 and MSL8 following the station and before Marshalltown Road level crossing (Figure 3).
Figure 3: Extract of signalling diagram at Marshall Railway Station
The diagram is based on the signalling diagram covering Marshall Railway Station. Key features are retained to show the location of signals MSL26, MSL 10 and MSL8 in relation to the station platform and Marshalltown Road level crossing.
Source: PTV DMS, amended and annotated by Chief Investigator, Transport Safety (Vic)
The aspect displayed on Distant signals at each end of the Marshall location was governed by the status of the Home signals through Marshall and functioned automatically. For traffic coming from Waurn Ponds, if all mainline Home signals at Marshall were Clear, MSL22 would indicate Proceed (green). However, if any of MSL24, MSL26, MSL10 or MSL8 were at Stop, MSL22 would indicate Caution (yellow). A similar signalling sequence was in place for trains travelling from South Geelong to or through Marshall.
Home signals MSL10 and MSL8 were two-position, colour-light signals that displayed either a red (Stop) or green (Proceed) aspect (Figure 4).
Figure 4: Signals MSL10 and MSL8 at Marshall, pictured displaying ‘Stop’ indications
The picture shows signal MSL10 adjacent to the Geelong-end of Marshall Railway Station. Signal MSL8 is identified in the distance, closer to the Marshalltown Road level crossing.
Source: Chief Investigator, Transport Safety (Vic)
Signalling control for Marshall was managed from Centrol[7] in Melbourne. The control workstation provided for remote control and monitoring of the signalling system. Train controllers could observe the status of all the signalling in the area and operate points and signals. The system was fitted with a SPAD alarm for this location (that would alert the controller), but in this instance the alarm volume had been turned down.
The train controller had control of all Home signals at Marshall. Home signals were operated individually, or a through-route could be set. In the through-route scenario, signals would clear when the section ahead became available without any call on the system from the train controller. However, whenever trains were to cross, the train controller was required to select and call for the desired route and clear the signals individually.
The safe application of signalling at Marshall was reliant on drivers responding correctly to signals, and did not include any additional enforcement controls to protect against a train exceeding its authority.
Marshalltown Road level crossing activation
The Marshalltown Road level crossing was track-circuit activated. However, when signal MSL10 displayed a Stop indication, the level crossing would not be activated if a train passed the signal and occupied the track circuit on the Geelong side of the signal. This configuration was to cater for a low-speed run-around movement[8] where a calling-on signal[9] provided authority for a locomotive to move from one end of a train to the other without activating the Marshalltown Road level crossing. Consistent with this configuration, train 7750 did not trigger the crossing protection system until it had travelled beyond signal MSL8, approximately 28 m before the level crossing.
Signalling system playback
The status of signals and the movement of trains through the section were captured on the recording of the train controller’s VDU. The colour of each track section also provided an indication of its status as follows:
Red indicated the presence of a train in the section
Green indicated the track was clear and the route was set
Blue indicated the track was clear but no route was set.
The first snapshot (Figure 5) showed the status of the network with train 7750 at the Waurn Ponds platform.
At this point, a route had been set (in green) from Waurn Ponds Railway Station to Marshall. Departure signal WPD10 was at Proceed, MSL22 at Caution (because MSL10 and MSL8 were at Stop), MSL24 and MSL26 were at Proceed, and MSL10 was at Stop to hold train 7750 at Marshall Railway Station.
Beyond MSL10, the track was clear but a route had not yet been set beyond MSL10. This route condition remained unchanged until train 7750 later occupied this single-line section of track.
Figure 5: Snapshot of VDU when train 7750 was at Waurn Ponds
A route had been set from Waurn Ponds to Marshall Railway Station. Distant signal MSL22 was at Caution (because MSL10 and MSL8 were at Stop) and signals MSL24 and MSL26 wereat Proceed. Beyond MSL10, the track was clear but a route had not yet been set beyond MSL10.
Source: V/Line, annotated by Chief Investigator, Transport Safety (Vic)
The second snapshot (Figure 6) showed the status of the network as train 7750 passed WPD10. The route for train 8865 (green) was set from South Geelong through to MSL4 but the train had not yet been detected in this section. The status of signals and points at Marshall remained unchanged.
Figure 6: Snapshot of VDU after train 7750 had departed Waurn Ponds
The route for train 8865 (the Melbourne to Warrnambool) was setthrough to MSL4 but the train had not yet been detected in the section beyond South Geelong. The status of signals and points at Marshall remained unchanged. Source: V/Line, annotated by Chief Investigator, Transport Safety (Vic)
The third snapshot (Figure 7) showed train 7750 having passed signals MSL24 and MSL26,and these had reverted to Stop. The train was now in the track sections adjacent to the Marshall Railway Station. It had passed MSL10, but had not yet reached MSL8. The Warrnambool-bound train 8865 occupied the section up to Distant signal MSL2.
Train 8865 had a route (green) set towards Marshall, but not beyond signal MSL 4, which was at Stop.
Figure 7: Snapshot of VDU when train 7750 was passing Marshall Railway Station
Train 7750 had passed MSL24 and MSL 26, and the train was in the track sections adjacent to the Marshall Railway Station and beyond MSL10, but not yet past MSL8. The Warrnambool-bound train 8865 was in the section up to Distant signal MSL2, and had a route set towards Marshall, but not beyond signal MSL 4 which was at Stop.
Source: V/Line, annotated by Chief Investigator, Transport Safety (Vic)
The VDU recording showed that train 7750 travelled beyond signal MSL8 and entered the Marshalltown Road level crossing travelling on the single line towards South Geelong (Figure 8). The level crossing protection had also activated (indicated by its change on the VDU from a black line to white).
This had placed the trains in potential conflict. Once past MSL8, the next Home signal that would face train 7750 was SGL19 at South Geelong, beyond the location of train 8865.
Figure 8: Snapshot of VDU when train 7750 passes MSL8 and enters the level crossing
Train 7750 was now on the single line towards South Geelong, placing the trains in conflict.
Source: V/Line, annotated by Chief Investigator, Transport Safety (Vic)
The recording then showed that train 8865 had passed signal MSL2 and entered the section up to signal MSL4, that was at Stop (Figure 9). The trains were now in adjacent track sections. There were no further signals that could have prevented train 7750 continuing to the location of train 8865.
Figure 9: Snapshot of VDU with trains 7750 and 8865 stopped in adjacent sections
Train 8865 would be held by signal MSL4 thatwas at Stop. However, therewas no signal ahead of train 7750 that would prevent it fromcontinuing to the location of train 8865.
Source: V/Line, annotated by Chief Investigator, Transport Safety (Vic)
The driver
The driver had been working with V/Line since 2005. His safeworking and route knowledge qualifications were current and he was certified as medically fit for duty. By arrangement with the rostering area, together with the mutual exchange of shifts with other drivers, he generally worked shifts commencing between 0900 and 1000. This resulted in him regularly running of services between Melbourne and Waurn Ponds.
On this day, his shift had commenced at about 1200. This shift and the previous 7 days rostering would not have contributed to a fatigue condition.
Nicotine withdrawal
The driver had been a heavy smoker. In his endeavours to stop smoking, he had been using nicotine patches for about 3 months
Tobacco smoking exposes the user to a significant number of substances. The nicotine component of tobacco is a particularly addictive compound, and it is largely this property of nicotine that leads to difficulty in ceasing smoking.[10][11][12]
Cessation of tobacco smoking, especially if abrupt, can lead to the development of nicotine withdrawal. This is a recognised clinical entity, with clearly established criteria laid down in the World Health Organisation’s International Classification of Disease. Symptoms of nicotine withdrawal usually appear quite quickly after the last tobacco intake (within 2-3 hours) and peak in 2-3 days.[13] Tobacco withdrawal can lead to a myriad of symptoms, including task-related effects such as difficulty concentrating, memory impairment and attention difficulties. There are also other potential psychological and physiological effects.
Smoking cessation strategies usually adopt the approach of gradually reducing the nicotine intake rather than suddenly stopping. The transdermal patch is typically the first choice in terms of therapies to assist smokers to quit.[14] It comes in a range of different nicotine doses, from 5 mg to 21 mg. The replacement regime depends on the usual cigarette intake of the smoker prior to quitting. For example, a smoker of more than 10 cigarettes per day might use a 21/14/7 mg regimen, that involves wearing a 21 mg patch daily for 6 weeks, then a 14 mg patch daily for 2 weeks, then a 7 mg patch daily for 2 weeks.
In this instance, the driver had maintained the use of a 21 mg patch, and had not yet commenced to taper the dosage. However, the driver reported that on the day of this incident he did not apply a nicotine patch.
Use of Cannabis
The driver reported that he had been using cannabis for about 2 months to assist with sleep and nicotine withdrawal issues. Cannabis contains over 530 chemical compounds, including over 100 pharmacologically active constituents known as cannabinoids.[15]
The most potent and psychoactive of these is ∆9-tetrahydrocannabinol (∆9-THC, or more simply THC). Cannabinoids act on a specific class of cell receptor, which are widely distributed in the brain. They tend to be particularly located in brain regions associated with cognitive processes, memory, pain perception and psychomotor coordination.[16]
THC is broken down into an inactive metabolite, 11-nor-9- tetrahydrocannabinol-∆9-carboxylic acid (THC-COOH). This substance is the principal secondary metabolite of THC and is excreted from the body over a period of days to weeks.[17] THC-COOH is the metabolite targeted in blood or urine testing for cannabis use.
A single dose of THC may take up to 30 days to be fully eliminated from the body. THC may be found in the urine for at least 48 to 72 hours after oral administration.[18] With repeated use, however, cannabinoids can accumulate in high levels in the body. Such chronic, long term use leads to accumulation of THC and THC-COOH in fatty tissue, with continued excretion into the urine for as long as 30 to 60 days from the time chronic use is halted.
The effects of cannabis on cognitive function and psychomotor performance are documented in literature. Studies have shown that acute cannabis use impairs cognitive functions such as attention and learning,[19] increases reaction time and causes difficulty in concentration.[20][21] Cannabis can also adversely affect human performance of complex cognitive tasks for up to 24 hours, with the extent of effects post-exposure depending on the task complexity.[22][23] One consistent finding with cannabis exposure is the adverse effect on memory. Cannabis-induced disruption of normal memory functions, particularly short-term memory, have been described.[24][25][26][27]
Driver toxicology
The toxicology assessment for this driver used a urine sample collected from the driver at around 1000 on 3 January. Analysis performed on 4 January 2018 revealed the presence of THC-COOH in the urine. THC-COOH is the inactive secondary metabolite of THC and there is no specific biological effect of THC-COOH. Whereas the inactive THC-COOH can be detected in urine for more than 7 days after a single use, and longer for habitual use, urinary THC values have been shown to peak about two hours post cannabis use, and then decline to be unrecordable within 6 hours.[28] There was no level of THC (the active metabolite) recorded or reported in the toxicology assessment.
The presence of THC-COOH in urine at concentrations greater than 15 ng/mL is a strong indicator that the individual has used cannabis. If the urinary THC-COOH level is greater than 100 ng/mL, this indicates relatively recent use, probably within the previous 7 days. Levels greater than 500 ng/mL suggest chronic and recent use. The recorded level in the driver involved in this particular incident was 120 µg/L (equivalent to 120 ng/mL). This measured level was over 100 ng/mL and therefore suggests use of cannabis probably within the previous 7 days.
Methods for detecting cannabis use
Drug testing is generally effective at determining the presence of a drug or its metabolite. A drug test will have a minimum threshold (‘cut-off’ value) above which the test result will be considered positive, and below which it will be considered negative. A drug test may also be negative despite recent or ongoing drug use if the window of detection has passed or there has been adulteration of the specimen.
Oral fluid testing
Oral fluid testing for cannabis targets the active metabolite Delta-9-tetrahydrocannabinol (THC). This is the most potent and psychoactive of the metabolites of cannabis.[29] The consumption of cannabis via smoking leads to the oral tissues being exposed to high concentrations of THC. The THC is then released and is detectable in the saliva during the next several hours following use, and this process can last up to 24 hours.[30]
Oral fluid testing represents relatively new technology, being introduced in several countries in the last 10-20 years.[31][32] In general, it is used for detecting the presence of certain drugs in settings such as the workplace or road traffic enforcement. The accuracy and reliability of these tests has also been improving over the years.[33]
Urine testing
Typically, urine is tested for THC-COOH, an inactive metabolite of cannabis. This metabolite can be detected in urine for more than 30 days after cannabis use, and so this test is effective at detecting prior use of cannabis. However, a positive result for this metabolite does not provide information about impairment at the time of testing. A more extensive test panel including testing for THC and 11-hydroxy-THC as well as THC-COOH could provide a more comprehensive picture of recent cannabis use.
Urine tests have some disadvantages, including a greater potential for false samples and adulteration. Products can be used to mask the presence of certain drugs in urine samples and intentional urine dilution may reduce drug concentration below the cut-off level of the test.
V/Line systems to identify employee use of cannabis
Relevant legislation
Drug and alcohol requirements for Rail Transport Operators and Rail Safety Workers were governed by the Rail Safety National Law (RSNL)[34] and associated Regulations. The RSNL required that rail operators prepare and implement a Drug and Alcohol Management Program (DAMP). It also required that Rail Safety Workers not carry out, or attempt to carry out, rail safety work whilst ∆9-THC (the active metabolite of cannabis) was present in their oral fluid or blood.
V/Line Policy and Procedures
V/Line had developed a drug and alcohol policy and implemented a drug-testing regime. The policy required that its employees not be under the influence of alcohol or illicit drugs or be impaired by any other drugs.[35] Further detail on the implementation of the policy was included in its management guide.[36]
Responsibilities
The management guide specified that employees, including drivers, report to work in a fit condition without detectable levels of alcohol or other drugs, and notify their manager if their ability to undertake rail safety work might be hindered by alcohol or any other drug.
The guide also detailed responsibilities for V/Line management including supervisors of drivers. Supervisor responsibilities included ensuring persons were not hindered by the presence of alcohol or other drugs whilst reporting for or being on duty. It also included a requirement to ensure the provision of information to employees about the problems arising from the consumption or use of alcohol, tobacco and other drugs.
Testing Program
Assurance of employee compliance with its alcohol and drug management policy included random[37] and post-incident drug testing. Testing was conducted by an independent agency. Employees working only in Victoria were tested using sampling of oral fluid.[38] This method included testing for the presence of cannabis metabolites in oral fluid. The program required testing of a minimum of 30 per cent of workers per annum, of which at least 25 per cent were required to be Rail Safety Workers (RSW). In practice, the proportion of RSW tested was significantly higher than this requirement. Between commencement of random testing in 2015 and 1 January 2018 (prior to this incident), there was one positive result returned from the random drug testing program, and that was for THC.
The guide also made provision for ‘for cause’ testing. In the event that a supervisor or manager had reasonable grounds to suspect that a person may not meet the drug and alcohol criteria, that person could be required to undergo testing. For the same period from 2015 to 1 January 2018, there had been one ‘for cause’ test, and it had returned a positive result for cannabis use. There was no specific training of supervisors to assist them to undertake fitness for duty assessment or to make decisions on the need to conduct ‘for cause’ testing.
In addition, its train drivers were classified as Category 1 Safety Critical Workers and were required to undertake medical assessment that included testing of urine for the presence of a number of prescribed drugs (including cannabis). Drivers were required to undergo Category 1 medical assessments every 5 years (up to the age of 50), every 2 years (50 – 60) and every year above age 60.
Other SPADs at or near Marshall
On 29 May 2015, a V/Line train passed signals MSL10 and MSL 8 at Stop.[39] Following its investigation of this incident, the ATSB reported that:
Marshall was re-established with infrastructure that catered for the relatively small number of passenger services. However, over a ten-year period, rail traffic increased significantly (16 services per week in 2005 to 160 in 2015), altering both the operating environment and the risk profile of the location. To improve the control of traffic through this location, there was scope to upgrade to three-position signalling and potentially introduce measures to mitigate against SPAD events.
In response to the May 2015 SPAD event, V/Line introduced a Temporary Speed Restriction (TSR) of 70 km/h at this location. This TSR was still in place at the time of the January 2018 SPADs.
Subsequent to the May 2015 SPAD, V/Line advised that its internal investigation had recommended a three-position signalling upgrade for the Geelong-Waurn Ponds section of track and that it was undertaking a study into the duplication of track between South Geelong and Waurn Ponds. V/Line has advised that track duplication was still under consideration.
Between January 2015 and January 2018, there were six other SPAD events between Waurn Ponds and South Geelong. Five involved signal MSL24 and one was at MSL4. All of these SPADs were attributed by V/Line to driver misjudgement. As a mitigation for the SPADs at MSL24, a 40 km/h TSR was introduced for the approach to this signal.
The driver did not respond to the Stop indications of signals MSL10 and MSL8 and passed these signals without authority. His subsequent action to stop the train was either after noticing that the Marshalltown Road level crossing booms were not lowered, or possibly in a delayed recognition that signal MSL10 and/or signal MSL8 was at Stop. Had the driver not stopped the train, there were no other signalling defences to alert the driver against continuing through the section in conflict with the approaching Warrnambool-bound passenger train.
The actions of the train controller to monitor the passage of the trains and then make a radio call to stop trains were appropriate.
The driver
Nicotine withdrawal
Withdrawal from nicotine can produce a range of symptoms that can also affect human performance. The driver had been using the 21 mg patch for about 3 months. However, the driver reported that on the day of the incident he did not apply a patch. It is therefore likely that he was experiencing symptoms of nicotine withdrawal.[40]
Nicotine withdrawal symptoms typically become apparent within a few hours of last nicotine exposure. Task-related effects can include difficulty concentrating, memory impairment and attention difficulties. These and other symptoms of nicotine withdrawal probably had an adverse effect on the performance of the driver.
Cannabis use
Cannabis has a range of short and long term adverse effects on human health and performance. There is considerable evidence of a residual effect of cannabis during the 12 - 24 hour period following use, which may occur after a single dose. The residual drug effects observed involve impairment of performance on tests of focused attention, visual and verbal memory, and visuomotor functions.[41]
Oral fluid testing (taken about 90 minutes after the event) returned a negative result for the presence of the active metabolite of cannabis (THC). Subsequent urine testing identified an inactive metabolite at a level suggesting cannabis use probably within the previous 7 days. Based on the available evidence, it was not possible to determine if the prior use of cannabis had affected the driver’s performance on the day of the event.
Expectancy
Train 7750 was a non-passenger-carrying train returning to Geelong and was therefore not required to make passenger stops at any stations, including at Marshall Railway Station. It is possible that the notion of the service being ‘express’ established in the driver’s mind an expectation that the train would have an unimpeded passage through to Geelong and that all signals would be at Proceed. It is possible that this expectancy affected the driver’s observation of, or perception of, the signal indications of MSL10 and MSL8.
Recall of Distant signal indication
When passed by train 7750, Distant signal MSL22 was at Caution, indicating that a subsequent signal within the Marshall location was at Stop. This Caution indication warns the driver to be prepared to stop at any upcoming Home signal within the Marshall group of signals, and the driver of train 7750 was familiar with its function and meaning.
However, this information was not utilised by the driver as the train approached signal MSL10. It is probable that the information indicated by Distant signal MSL22 was forgotten by the driver some time during the 4 minutes after passing MSL22. Such a lapse in short term memory would be consistent with symptoms associated with nicotine withdrawal.
Signalling information for driver
With two-position signalling, a Home signal at Stop (Red) may directly follow a Home signal at Proceed (Green), as it did in this case. Whereas, with three-position signalling, a driver is presented with signal aspects that indicate the status of the next signal. These aspects are also speed-related and in many locations have sequences that require the train speed to be reduced over several signal sections before a Stop indication is displayed. Three-position signalling would therefore have provided the driver with more information on the status of the next signal.
Drug testing
This driver
This driver had not been tested under the random drug testing program, and his use of cannabis had not been detected by V/Line prior to this event.
Comparison between oral fluid testing and urine testing
The detection window for oral fluid testing for cannabis use is much smaller than that for urine testing. The window of detection for cannabis in oral fluid testing is up to 24 hours, compared with 30 days or longer for testing of urine. The longer window for urine testing is due to the progressive metabolism of cannabinoids that are excreted in the urine over time.
The differences in detection windows and the targeted metabolite create different interpretations for a positive result for each type of test. Given the shorter detection window and the targeting of THC, a positive oral fluid test is indicative of recent use (within 24 hours).[42][43] In contrast, a positive urine test indicates prior exposure to cannabis which could be 30 days prior or more. The prolonged detection window for urine testing is well outside the corresponding window of cannabis-induced impairment. A positive oral fluid test for cannabis, therefore, is much more likely to be correlated with cannabis-induced impairment, although there can be individual variation.[44]
‘For-cause’ testing
V/Line drug management guidelines provided that ‘for cause’ testing could be conducted should a supervisor have grounds to believe that an employee did not meet the drug criteria. However, supervisors were not trained in how to identify impairment or assess whether such grounds existed.
SPAD mitigation at Marshall
The Marshall location was not equipped with any form of authority-overrun intervention. A previous ATSB investigation[45] identified that, particularly due to increased traffic and associated risks at Marshall, ‘there was scope to introduce measures to mitigate against SPAD events’.
The Train Protection and Warning System (TPWS)[46] was installed at many locations with three-position signalling. TPWS initiates train braking to reduce the potential consequences of a SPAD event.
The train control system included an audible SPAD alarm for this location, to alert the train controller. However, in this instance, its volume had been turned down. __________
From the evidence available, the following findings are made with respect to the Signals Passed at Danger by Train 7750 at Marshall, Victoria on 2 January 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
The driver did not respond to signals MSL10 and MSL8 at Stop and passed the signals without authority.
The driver did not use a nicotine patch on the day of the incident, probably leading to nicotine withdrawal and associated symptoms that affected performance.
Other factors that increased risk
The driver had been using cannabis and this was not identified by V/Line.
The signalling system was not equipped with any form of authority-overrun intervention
The volume of the audible SPAD alarm at the train controller’s station had been turned down.
Other findings
V/Line did not provide training to its driver supervisors to assist them to effectively identify and take action to manage possible drug use by safety critical workers.
Safety issues and actions
Additional safety actions
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Following this incident, V/Line applied a 40 km/h speed restriction at this location as a temporary measure, issued a SPAD alert, and briefed drivers on risks associated with this location and empty car movements. This empty cars service also became a normal passenger run from Waurn Ponds.
V/Line completed its installation of a bespoke (two position signalling) TPWS for this location in June 2019. The system is designed to automatically apply the braking of a train that has had a SPAD. The system also has several over-speed sensors that are designed to prevent a train occupying an unprotected Marshalltown Road level crossing.
V/Line continues with planning for the provision of three-position signalling for this section as part of other infrastructure projects.
Sources and submissions
Sources of information
The sources of information during the investigation included:
The driver of train 7750
V/Line
Medvet testing contractor.
References
Abel EL. Marijuana and memory: acquisition or retrieval? Science 1971; 173:1038-40.
ATSB, Investigation report RO-2015-009, Signals Passed at Danger by Train 1240 at Marshall near Geelong, Victoria on 29 May 2015
Beautrais AL, Marks DF. A test of state dependency effects in marihuana intoxication for the learning of psychomotor tasks. Psychopharmacologia 1976; 46:37-40.
Darley CF, Tinklenberg JR, Roth WT, Atkinson RC. The nature of storage deficits and state- dependent retrieval under marihuana. Psychopharmacologia 1974; 37:139-49.
Expert Opinion: Signals Passed at Danger by Train 7750, Marshall, Victoria 2 January 2018, Flight Medicine Systems, Dr David G. Newman 30 April 2018
Fiore MC: Treating tobacco use and dependence: an introduction to the US Public Health Service Clinical Practice Guideline.
Gallardo E, Barroso M, Queiroz JA. Current technologies and considerations for drug bioanalysis in oral fluid. Bioanalysis. 2009 Jun;1(3):637-67.
Gross SJ, Worthy TE, Nerder L, Zimmermann EG, Soares JR, Lomax P. Detection of recent cannabis use by saliva δ9-THC radioimmunoassay. Journal of Analytical Toxicology. 1985 Jan 1;9(1):1-5.
Hall W. Solowij N. Adverse effects of cannabis. Lancet 1998; 352:1611-6.
Heishman SJ, Arasteh K, Stitzer ML. Comparative effects of alcohol and marijuana on mood, memory, and performance. Pharmacol Biochem Behav 1997; 58:93-101.
Heishman SJ, Huestis MA, Henningfield JE, Cone EJ. Acute and residual effects of marijuana: profiles of plasma THC levels, physiological, subjective, and performance measures. Pharmacol Biochem Behav 1990; 37:561-5.
Macavoy MG, Marks DF. Divided attention performance of cannabis users and non-users following cannabis and alcohol. Psychopharmacologia 1975; 44:147-52.
Manno JE, Manno BR, Kemp PM, Alford DD, Abukhalaf IK, McWilliams ME, Hagaman FN, Fitzgerald MJ. Temporal indication of marijuana use can be estimated from plasma and urine concentrations of ∆9-tetrahydrocannabinol, 11-hydroxy-∆9-tetrahydrocannabinol, and 11-nor-∆9-tetrahydrocannabinol- 9-carboxylic acid. Journal of analytical toxicology. 2001 Oct 1;25(7):538-49.
Mehmedic Z, Chandra S, Slade D, Denham H, Foster S, Patel AS, Ross SA, Khan IA, ElSohly MA. Potency trends of ∆9‐THC and other cannabinoids in confiscated cannabis preparations from 1993 to 2008. Journal of forensic sciences. 2010 Sep 1;55(5):1209-17.
Menkes DB, Howard RC, Spears GF, Cairns ER. Salivary THC following cannabis smoking correlates with subjective intoxication and heart rate. Psychopharmacology. 1991 Feb 1;103(2):277-9.
Niedbala RS, Kardos KW, Fritch DF, Kardos S, Fries T, Waga J, Robb J, Cone EJ. Detection of marijuana use by oral fluid and urine analysis following single-dose administration of smoked and oral marijuana. Journal of Analytical Toxicology 2001 Jul 1;25(5):289-303.
O’Kane CJ, Tutt D, Bauer L. Cannabis and driving: a new perspective. Emerg Med 2002; 14:296- 303.
Pope HG, Gruber AJ, Yurgelun-Todd D. The residual neuropsychological effects of cannabis: the current status of research. Drug Alcohol Depend 1995; 38:25-34.
Rail Safety National Law (South Australia) Act 2012.
Royal College of Physicians of London. Tobacco Advisory Group. (2000). Nicotine addiction in Britain: a report of the Tobacco Advisory Group of the Royal College of Physicians. Royal College of Physicians.
SAMG-51, Alcohol, Tobacco and other Drugs Management Guide, Revision 1, V/Line 17/08/2017.
SAPO-1, Policy – Alcohol and Drugs Management, V/Line, 26/10/2016.
Steinmeyer S, Ohr H, Maurer HJ, Moeller MR. Practical aspects of roadside tests for administrative traffic offences in Germany. Forensic science international. 2001 Sep 15;121(1-2):33-6.
Strano-Rossi S, Castrignanò E, Anzillotti L, Serpelloni G, Mollica R, Tagliaro F, Pascali JP, Di Stefano D, Sgalla R, Chiarotti M. Evaluation of four oral fluid devices (DDS®, Drugtest 5000®, Drugwipe 5+® and RapidSTAT®) for on-site monitoring drugged driving in comparison with UHPLC–MS/MS analysis. Forensic science international. 2012 Sep 10;221(1-3):70-6.
The Health Consequences of Smoking—Nicotine Addiction: A Report of the Surgeon General. Rockville, MD, US Department of Health and Human Services, 1988.
Tinklenberg JR, Melges FT, Hollister LE, Gillespie HK. Marihuana and immediate memory. Nature 1970; 226:1171-2.
Yesavage JA, Leirer VO, Denari M, Hollister LE. Carry-over effects of marihuana intoxication on aircraft pilot performance: a preliminary report. Am J Psychiatry 1985; 142:1325-9.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to Directly-Involved Parties. Submissions were received from V/Line and the Office of the National Rail Safety Regulator. These submissions were reviewed and where considered appropriate, the text of the draft report amended.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
At 1523 on Saturday 4 November 2017, Qube Logistics freight train 7MC1 was signalled into the crossing loop at Wallan, Victoria. Entering the loop from the main line, the leading bogie on the 37th wagon derailed and travelled in a derailed state until the train stopped within the loop. At this stage, the locomotive crew were unaware of the derailment.
Following the passing of an opposing passenger service, and signals clearing, 7MC1 commenced its departure from the loop. Shortly after, a member of the public made the crew of 7MC1 aware that a wagon was derailed and the train was brought to a stand.
What the ATSB found
The ATSB found that the leading left-hand wheel of the leading bogie of wagon LQAY 00025D climbed the left-hand stock rail within the turnout from the crossing loop to the cripple track. The second wheelset of the same bogie derailed several hundred metres into the loop after the train commenced its departure from the loop.
It was found that the derailment occurred within a rapid transition of track superelevation from the main line to the loop track, resulting in the unloading of the leading left-hand wheel. The twist through the location exceeded network requirements and the basis for its acceptance was not documented.
In addition, the track alignment through the turnout to the cripple track probably resulted in the wheel tracking towards the left stock rail. The condition of some sleepers was also degraded resulting in a reduced effectiveness of rail fastenings.
The wagon and its loading was compliant with network requirements.
What's been done as a result
ARTC completed rectification works at the derailment location to address the identified twist exceedances. Works included improving track geometry, the installation of turnout bearers with resilient fastenings and mechanised tamping.
ARTC has also enhanced work management processes for the response to geometry conditions in accordance with ARTC’s Safety Management System.
Safety message
Effective management of track defects is critical to minimising the risk of derailment and maintaining safe rail operations.
The occurrence
Train 7MC1 was an intermodal freight service between Melbourne and Junee operated by Qube Logistics Rail Services (Qube) on 4 November 2017. It comprised two QBX-class locomotives and 46 wagons. After loading and pre-departure inspections, the train departed Melbourne at 1315.
At Somerton, about 22 km into its journey, there was a change in the train crew. After departing Somerton, the changeover locomotive driver felt that the train was not performing as expected, suspecting that the second locomotive was not powering. The driver stopped the train to check the Multiple Unit (MU) cable connection between locomotives. They attended to the MU connection and on resuming, the driver was satisfied that the second locomotive was powering.
Figure 1: Wallan Loop layout and signalling
Source: Chief Investigator, Transport Safety (Vic)
Prior to Wallan, the crew of train 7MC1 was contacted by network control[1] and advised that their train would be routed into the crossing loop at Wallan to allow an opposing passenger train to pass (Figure 1).
Train 7MC1 was stopped prior to the loop at the Wallan Home signal (WLN/2). The signal then cleared to display a Low Speed Caution indication meaning a maximum speed of 15 km/h. The train departed at about 1523[2] and then entered the loop at about 13 to 14 km/h.
As 7MC1 was entering the loop, the leading wheelset of the 37th wagon (LQAY 00025D) derailed. The leading left-hand wheel of the wagon climbed[3] the stock rail[4] beyond the point blade in the cripple track turnout, ran along the railhead and dropped to the outside of the rail (Figure 2).
Figure 2: The location of the point of mount within the cripple track turnout
Source: Chief Investigator, Transport Safety (Vic)
The train continued its entry into the loop at around 13 km/h and then commenced braking for about 240 m before stopping at the Loop Home Departure signal (WLN/U6).[5] The train was now fully within the crossing loop. There was no loss of brake pipe continuity and the train crew were not aware of the derailment.
The V/Line Standard-Gauge passenger service 8620 that was running from Albury to Southern Cross Station then passed 7MC1. Its driver radioed to the crew of 7MC1 that their train was ‘complete’ and ‘looked ok’.[6]
Once the passenger train had cleared, 7MC1 received a signal indication to depart Wallan. As it was departing, the № 2 axle on the same bogie derailed and a member of the public who had seen the derailed wagon drove alongside the locomotive and signalled to the crew to stop.
The train was brought to a stand. Damage to the train was limited to wagon LQAY 00025D that had derailed all wheels of its leading bogie (Figure 3).
Figure 3: The derailed bogie (both wheelsets) after the train was brought to a stop
This picture shows the derailed wagon after the train was stopped when departing Wallan Loop. Source: Chief Investigator, Transport Safety
The track sustained damage to sleepers over a distance of several hundred metres (Figure 4).
Figure 4: Typical damage to concrete sleepers within the crossing loop
Source: Chief Investigator, Transport Safety (Vic)
Post-occurrence
The locomotive driver contacted the ARTC network controller and informed them of the situation while the driver’s assistant went back to inspect their train.
ARTC network control requested that the lead portion of 7MC1 continue its journey, as the train was now blocking the main line. 7MC1 was divided between the 33rd and 34th vehicles and departed Wallan at 1935 to Kilmore East where the train crew were drug and alcohol-tested. The drivers were cleared to continue and 7MC1 departed Kilmore East at 1945.
Recovery
Representatives from Qube’s maintenance contractor attended the site on 6 November to re-rail LQAY 00025D. After re-railing, the wagon was transferred to the Melbourne end of the loop. It was then moved towards the cripple track[7] adjacent to the loop. During this move, the leading axle of the wagon in the direction of travel derailed on the cripple track turnout. This was on a different section of track to the earlier derailment and the bogie was in a damaged condition.
This bogie was again re-railed and successfully shunted into the cripple track. The wagon was unloaded and the bogies changed out and transported to Melbourne where they were quarantined for further inspection.
Wallan loop is located about 47.3 rail km from Melbourne on the Victorian North-Eastern Standard-Gauge main line between Melbourne and Albury. The Australian Rail Track Corporation (ARTC) was the Rail Infrastructure Manager. It managed network rail traffic from its control centre in Junee, NSW, and track maintenance for this section of track from Seymour, Victoria.
Wallan crossing loop layout
The track at Wallan included the crossing loop and a cripple track for disabled rolling stock. The southern end of the loop consisted of a right-hand turnout from the main line and a second right-hand turnout to the cripple track. The Normal direction of this second turnout led into the crossing loop proper and to a short left-hand curve before the loop track curved right paralleling the main line (Figure 5).
Figure 5: The southern entry from the mainline into Wallan Loop and the cripple track
Source: Chief Investigator, Transport Safety (Vic)
The turnout at the southern entry to the crossing loop was located on a 1247 m radius main line curve with minimal gradient. The main line track has a superelevation[8] of 100 mm that transitioned to the flat loop track over a distance of about 24 m.
The cripple track turnout was on timber sleepers. At the derailment location, sleepers were in degraded condition with an observable loss of effectiveness in the rail fastenings.
Track geometry
Standards
The ARTC track geometry standards specified defect categories for track gauge, horizontal alignment (line), vertical alignment (top) and twist (variation in actual cross level). The standard noted that the specified maintenance response was based on an isolated geometric defect, and a more stringent response than that mandated by the geometry alone may be necessary if deterioration of the infrastructure both at the defect and on adjoining track is in evidence.
The required response to a defect varied depending on the permitted train speed. Response requirements reduced as train speed reduced. The standard also defined response timeframes (Figure 6).
Figure 6: Response categories and timeframes
Response category
Inspect (see notes 1 and 3)
Repair (see notes 2 and 3)
Other responses (see note 3)
E1 (Emergency Class 1)
Prior to next train
Prior to next train
Where the response category cannot be reduced below E1 by a reduction in speed, trains may only pass the site under the control of a pilot. Assessment of the defect by a competent worker should be made to determine if the train can be piloted.
E2 (Emergency Class 2)
Within 2 hours or prior to the next train, whichever is greatest
Within 24 hours
If the defect cannot be inspected or repaired within the nominated time and the response category cannot be reduced below E2 by a reduction in speed, trains may only pass the site at speeds up to 20 km/h following assessment by a competent worker.
P1 (Priority Class 1)
24 hours
7 days
P2 (Priority Class 2)
7 days
28 days
N
A deviation from design geometry up to the lowest level of P2 defect does not require any action above the normal inspection regime.
Notes: In the event of failure to inspect reported faults by the specified time the allowable speed should be reduced by at least one speed band. A revised inspection period in line with the lower speed band may then be used. If the defect is subsequently inspected the speed may be raised to the higher band subject to repair being achievable within the nominated period for the higher band.
In the event of an inability to repair the track, the fault should be reassessed on site prior to expiry of the repair response time. The repair period can only be extended by the Civil Engineering Representative or a person with delegated authority from the Civil Engineering Representative.
If the cause of a defect is known and it is known that it will not deteriorate into an unsafe condition an alternative response to that shown is permitted with appropriate documentation and approval by the Civil Engineering Representative or nominated representative.
Source: ARTC Code of Practice, Track Geometry Section 5
Twist criteria
Two criteria applied to track twist. Short twist was measured over 2 m (approximating typical wagon bogie wheel spacing) and long twist was measured over 14 m (approximating a typical spacing of wagon bogie centres). Higher levels of twist were permitted in transition curves.
Track geometry recording car and maintenance response
Prior to the incident, the track geometry of the Wallan Loop was last assessed on 1 September 2017, using the AK Car.[9] The inspection flagged two Emergency twist defects at the southern end of Wallan Loop and near the location of the derailment (Figure 7).
Figure 7: E Class defects identified near the derailment location
Source: ARTC Track Recording Car and Code of Practice, Track Geometry Section 5
Documentation indicated that the two defects were closed out on the asset management system on the same day as the inspection. There was no indication of any repair activity to correct the defects and no supporting documentation or approvals permitting the defect condition.
The previous two track-recording runs through the derailment site, in April 2017 and December 2016, also identified short and long twist defects categorised for emergency response.
Post-incident geometry measurement
Following the derailment, track gauge and cross level measurements were taken through the derailment location (Figure 8).
Figure 8: Point of wheel mount
Source: Chief Investigator, Transport Safety (Vic)
The PoM was at a chainage of approximately 47.316 km.[14] Static twist measurements peaked around this location. A measured peak static long twist of 78 mm[15] extended from 14 m before the PoM, up to the PoM. The measured peak static short twist[16] was about 22 mm about 2 m ahead of the PoM. These values were comparable to the E-defects measured by the AK Car.
The maximum measured (no-load) wide gauge through the location was 20 mm at the PoM. This was within permitted maintenance tolerances. Review of the most recent AK Car data, measured under load, indicated a peak wide gauge of 31 mm at a chainage of 47.319 km. This falls within the P2 (Priority Class 2) defect category for this low speed track.
Track lateral alignment through the cripple track turnout was also sub-optimal and there was a significant dip in both rails at the transition (mechanical joint) from the main line turnout to the cripple track turnout (Figure 9).
Figure 9: Transition from main line turnout to cripple track turnout
This picture shows a close-up view of the track through the derailment location and shows the rail lateral alignment around the point of mount. The deviation in rail line is exaggerated by the telephoto effect. Source: Chief Investigator, Transport Safety (Vic)
The train
Consist
Train 7MC1 comprised two QBX-class locomotives and 46 loaded wagons conveying shipping containers. It was 1,018 m long and had a gross mass of about 3,300 t. It had been loaded at Westgate sidings at Qube’s intermodal terminal in Melbourne. A Melbourne-based crew prepared and examined the train prior to its departure from the terminal, and then operated the train until a crew change-over at Somerton.
Wagon
The derailed wagon was designated LQAY 00025D. It was the 37th wagon from the locomotives and was “B” end leading. There were four wagons of this type in the consist, two ahead of the derailed wagon (2nd and 23rd), and one behind (the 46th and the last vehicle).
LQAY wagons are 19.3 m (60’) skeletal container wagons manufactured in China by Meishan Rolling Stock Works. The derailed wagon was one of 100 ordered by Macathur Intermodal Shipping Terminal (MIST) with production commencing in 2005. The use of this type of vehicle and bogie on the ARTC network was approved by ARTC in the form of a TOC Waiver in October 2009. As these wagons were initially operated on the Rail Infrastructure Corporation’s (RIC) NSW network they were required to meet the then RIC Minimum Operating Standards for Rolling Stock. ARTC’s Engineering Standard for Rolling Stock WOS 01 was based on these RIC requirements.
LQAY wagons are fitted with three-piece bogies with a steering arm mechanism linked to primary rubber pad arrangement between the side frame and axle box. They also have variable friction damping on the secondary springs and constant contact side bearers (Figure 10).
Figure 10: The derailed bogie after its transport to Melbourne
Source: Chief Investigator, Transport Safety (Vic)
Wheel profile
The bogies were delivered in 2005 with wheels profiled to the WPR 2000[17] profile. This was the profile preferred by RIC, the original network destination for this wagon. The profile was subsequently changed to the ANZR-1[18] profile, listed in the ARTC Route Access Standard General Information, for freight rolling stock operating on the Defined Interstate Rail Network. There was no evidence provided by the Rolling Stock Operator of a change management process associated with this change in wheel profile.
The WPR 2000 wheel profile is a worn wheel profile that was designed to increase wheel life compared to the ANZR-1 through limiting wear of the wheel flanges (Figure 11). It achieved this by utilising a more conical tread profile that generates a larger rolling radius difference between the wheels on a common axle. This increased the wheelsets ability to steer through curves and hence placed less load on the wheel flange.
Figure 11: Comparison between the WPR 2000 (blue) and ANZR-1 (red) wheel profiles
Source: Australian Transport Safety Bureau
While the increased steering capability of the WPR 2000 wheel profile offered less flange wear, it had been shown in use to lower the critical speed[19] for some combinations of wagon type and rail profile leading to undesirable dynamics known as hunting[20]. The ATSB understands that the flatter tread profile of the ANZR-1 was generally less susceptible to hunting and therefore the preferred profile for freight rolling stock operating on the ARTC Defined Interstate Rail Network (DIRN). It was also an option on other track where it could be demonstrated that a vehicle was experiencing bogie instability.
Wagon maintenance
LQAY wagons were on a preventative maintenance (PM) program. Maintenance records for LQAY 00025D indicated that:
On 30 November 2016 both bogies and all wheelsets were replaced.
The wagon had its last PM inspection on 24 October 2017.
Wagon type testing
Type testing of the LQAY wagon type was conducted in China in September 2005 and covered wagon numbers 00001 – 00100. The type testing was in accordance with the RIC Minimum Operating Standards for Rolling Stock and witnessed on behalf of MIST by Interfleet Technology. The type testing included a static vehicle twist test and vehicle/bogie swing test.
The twist test examined potential wheel unloading in response to track twist. Twist was simulated by packing wheels on one side of the wagon (Figure 12). For the type testing of the LAQY wagons, the packing used was P1 = 18 mm, P2 = 86 mm and P3 = 86 mm. The wheel unloading (the reduction in wheel load) was measured for the leading wheel (P0).
Figure 12: Test configuration for twist type testing, and centre-bowl engagement criterion
Source: QUBE, modified by Chief Investigator, Transport Safety
During this twist test, a maximum wheel unloading of 23% was measured, compared to the requirement of ‘…the loss of absolutely no more than 60% of the static wheel load for any wheel’. The measured engagement of the vehicle centre plate within the bogie centre casting was 14 mm, equal to the minimum permitted (Figure 12).
The purpose of the vehicle/bogie swing test is to evaluate clearance when a wagon is navigating tight curves. The criteria used in testing was a 70 m simple curve. This testing found adequate clearances for normal operations. The only adverse finding was fouling when the handbrake was applied.
Wagon loading
Wagon LQAY 00025D was loaded with two containers. At its leading end was an empty 20-foot refrigerated container with a reported mass of 3.2 t. Behind this was a 40-foot container loaded with strapped bundles of recycled paper and having a reported mass of 26 t (Figure 13). Wagon tare was 19.9t, giving a total mass of 49.1 t. This compares with the train consist report that records a total mass of 69 t. The reason for this discrepancy is unknown.
The two containers wholly occupied the length of the wagon. The mass distribution of the containers and wagon tare resulted in an estimated 21 t at the leading bogie and about 29 t at the trailing bogie of (Figure 14).[21] The difference of about 8 t was within the ARTC Route Access Standard[22] requirement of no more than 20 t.
Figure 13: Paper bundles loaded in the 40-foot container
Source: Qube Logistics
Figure 14: The container loads and the resultant mass at each bogie
The mass at each end has been rounded up, resulting in a total rounding error of 1 t, and an apparent total mass of 50 t compared to the actual total mass of 49 t. Source: Chief Investigator, Transport Safety (Vic) based data from Qube
Post incident inspection
A detailed inspection was conducted on both bogies of wagon LQAY 00025D. The derailed bogie was designated LHSY113 (Figure 15).
Figure 15: The derailed bogie at the post-incident inspection
This picture shows the bogie that derailed. It shows damage to the centre bowl liner and some components, all believed to have occurred after the bogie derailed.
Source: Chief Investigator, Transport Safety (Vic)
No wear or damage conditions were identified that were considered contributory to the derailment. Wear to both bogies was minimal and consistent with the recent December 2016 overhaul. In addition, surface condition of constant contact side bearers did not indicate any unusual behaviour.
Wheel wear was within the operating requirements and similar on both bogies. Wheel wear on the derailed bogie was relatively light and evenly matched from side to side indicating the bogie had been tracking well. Wear on the wheel flanges was more than expected for a steering bogie, but was within tolerance.
The performance of self-steering bogies is, in part, dependant on the wheel profile used. A change was made from the higher steering WPR 2000 wheel profile to the lower steering ANZR-1 wheel profile and this may have contributed to the more than expected wheel flange wear.
Type of bogie
The LQAY wagon bogies were of a ‘self-steering’ bogie design. The steering mechanism is an adaptation of a design pioneered by Dr Herbert Scheffel in the 1970’s in South Africa[23]. The design sought to improve the curving performance of bogies by permitting the wheelsets to steer into curves reducing wheel and rail wear while retaining good stability and resistance to hunting. This bogie design is often referred to as the Scheffel Bogie.
Scheffel’s design mounted the wheelsets to sub-frames that were diagonally linked and utilised rubber shear pads (springs) to permit motion between the sub-frame and bogie frame. Configured in this way, the design permits yawing of the axles in response to wheelset steering forces, allowing them to adopt a ‘radial’ configuration that greatly improves curving performance (Figure 16). The design also resists shear motion between the two wheelsets and is therefore said to have good resistance to hunting.
Figure 16: The principle behind the steering bogie
The figure identifies the key design components (top) and radial steering (lower). Source: Australian Transport Safety Bureau
The magnitude of response of the steering mechanism is dependent on several factors including the wheel profiles used, with the resulting wheelset steering forces having an influence on the performance of the steering mechanism.
Train handling
Data logger
The lead locomotive was fitted with a data logger that provided a recorded history of the locomotive’s movements and train handling, including powering and braking during the sequence of events (Figure 17).
Figure 17: Key sequence of events from the locomotive data logger
Time
Comment
15.21.20
7MC1 stopped at signal WNL/2
15.22.58
Power applied (notch 3) and 7MC1 commenced move towards Wallan Loop
The throttle is modulated between notch 3 and notch 1
Speed 13 to 14 km/h
15.31.17
7MC1 brought to a stand at signal WNL/U6. The train then remained stationary for about 17 minutes
15.48.32
7MC1 commenced to depart loop
Power applied between notch 1 and notch 3
Maximum speed 14 km/h
15.51.54
7MC1 is brought to a stand
Source: Chief Investigator, Transport Safety (Vic)
7MC1 entered Wallan Loop at low speed and power was being applied between notch 1 and notch 3. In-train coupler action would have been minimal and it is unlikely that there was sufficient in-train forces generated to contribute to the derailment.
Locomotive crew
Both crewmembers were qualified for their respective roles and held current medical certification.
Victoria Police conducted post-incident alcohol and drug tests on the locomotive crew at Kilmore East with non-positive results for all tests.
Site evidence was conclusive that the flange of the leading left-hand wheel on the wagon LQAY 00025D climbed the left-hand stock rail in the turnout to the cripple track, a short distance past the point blade. The derailment was clear of moving turnout components including the point blade.
Flange climb derailment
Flange climb derailments initiate when the outward lateral force (L) applied by the wheel on the rail results in the wheel climbing the rail gauge face. This critical point is determined by several factors including the vertical load on the wheel (V), the angle of the wheel flange and the coefficient of friction between the rail and wheel.
A generally adopted limit for preventing flange climb is known as Nadal’s limit.[24] Nadal’s limit defines a limiting lateral on vertical force ratio (L/V) for given wheel geometry and friction conditions. Flange climb becomes more likely as the L/V ratio increases beyond this value. This means that either an increase in lateral force, a decrease in vertical force or a combination of both will increase the risk of flange climb.
The lateral force of the wheel against the rail may increase due to a track feature such as a tight curve or lateral misalignment or by a condition of the bogie that affects its tracking. A reduction in the vertical load, also referred to as wheel unloading, can be associated with a track feature such as twist and can also be influenced by wagon condition including loading.
Track geometry
Twist
Near the point of flange climb, there were long and short twist defects. The long twist was of comparable magnitude to the value used in type testing of the LQAY wagon and the short twist was probably at least 20 percent[25] greater than that used in the type testing. The track twist would have contributed to an unloading of the leading left-hand wheel of LQAY 00025D.
Alignment
Site observations indicated that traffic was probably tracking towards the Down leg[26] around the derailment location. For north-bound traffic (the incident train), this meant that vehicles were probably typically tracking to the left towards the stock rail of the turnout to the cripple track. The rail alignment through the cripple track turnout and the track configuration through this location probably influenced wagon tracking behaviour.
Gauge
Track gauge measured statically after the derailment was at its widest at the point of wheel climb, but was within permitted tolerances. Under dynamic conditions, the wide-gauge at this location was about 50 percent higher, but also not at a level that would have required emergency corrective action.
Sleeper condition and effectiveness of rail fastenings
The most-recent AK Car assessment recorded a wide gauge of 31 mm at a chainage about three metres past the point of mount. This exceeded the static (no-load) peak gauge measurement of 20 mm through this location. Considering the degraded condition of sleepers and the loss of effectiveness of the fastenings, it is probable that there was some movement of the stock rail under dynamic load, probably adversely impacting track geometry.
Track defect management
At and near the point of mount, there were two identified twist defects categorised as requiring immediate emergency response. Records indicated that these twist defects had existed for at least 12 months.
The long track twist through the location was a result of the superelevation being rapidly transitioned from about 100 mm on the main line curve through to the flat crossing loop track. The dynamic short twist within this transition was more severe, and probably the result of localised ballast subsidence under the load of rolling stock.
The acceptance of the track in this condition contrary to the network geometry standards was not supported by documentation and approvals as required by the standard.
Wagon performance
This wagon type and its loading was compliant with network requirements and the post-incident bogie inspection did not identify a condition that may have contributed to the derailment.
It is possible that the response of wagon LQAY 00025D to the track geometry anomalies was different to other wagons. A factor that may have influenced its response was its load distribution.
No conclusion was drawn from the second derailment of the vehicle as it was being transferred to the cripple track. The bogie was damaged and the second derailment occurred on a different part of the track to the first.
From the evidence available, the following findings are made with respect to the derailment of train 7MC1 at Wallan on 4 November 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
ARTC allowed identified track twist defects to remain in track contrary to network track geometry requirements. [Safety Issue]
Track twist contributed to unloading of the leading left-hand wheel of wagon LQAY 00025D.
Track alignment probably resulted in the leading left-hand wheel of wagon LQAY 00025D tracking to the left-hand stock rail as the wagon passed through the cripple track turnout.
When traversing the cripple track turnout towards the crossing loop, the leading left-hand wheel of wagon LQAY 00025D climbed the left-hand stock rail, and the wagon derailed.
Other factors that increased risk
The degraded condition of some sleepers through the location reduced the effectiveness of rail fastenings, probably adversely affecting track geometry under dynamic load.
Other findings
The operation of the train was consistent with network practice and unlikely to have contributed to the derailment.
Post-incident bogie inspection did not identify a condition that may have contributed to the derailment.
Safety issues and actions
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
Safety issue description:ARTC allowed identified track twist defects to remain in track contrary to network track geometry requirements.
Additional safety action
ARTC has completed rectification works at Wallan to address the twist exceedances in the vicinity of the turnout from the loop to the cripple track. The geometry was initially corrected on 23 December 2017. Follow-up works were completed on 19 March 2018 and included the installation of turnout bearers with resilient fastenings and mechanised tamping (Figure 18).
Figure 18: The derailment location after rectification works
Source: Chief Investigator, Transport Safety (Vic)
Sources and submissions
Sources of information
Qube Logistics (Rail) Services
Australian Rail Track Corporation
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the Australian Rail Track Corporation, Qube Logistics Rail Services, the Rail Regulator, and the locomotive drivers. Submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
On the morning of 18 December 2017, a Jetstar Airways Airbus A320 aircraft, registered VH‑VQG was on final approach for Gold Coast Airport, Queensland. The aircraft was operating as a scheduled passenger flight, from Adelaide, South Australia.
After a normal descent and touchdown, the captain selected both engine thrust reversers. The left engine thrust reverser did not activate. The aircraft decelerated using normal braking and taxied to the gate without further incident. There was no damage to the aircraft, or injuries as a result of the incident, and the captain reported the thrust reverser issue for investigation.
What the ATSB found
During overnight maintenance in Adelaide, the left engine thrust reverser lockout pin had been installed. However, the pin was not removed after the maintenance, resulting in the aircraft returning to service with the thrust reverser deactivated.
The lockout pin was located at the top of the engine and its 1 m red warning flag was difficult to see in the prevailing low‑light conditions. This probably led to the engineer not seeing the flag and removing the pin.
Further, the lockout pin was not booked out of the tool store nor was its installation recorded in the technical log. As a result, the checks that these procedures provided to ensure the pin's removal were missed.
What's been done as a result
The aircraft’s maintenance organisation, Qantas, advised that it is taking safety action that includes the following:
Highlighting the importance of the aircraft maintenance manual precautions to maintenance staff at Adelaide.
Lengthening all thrust reverser lockout pin warning flags to hang past the closed engine cowls. The pin will also have a warning notice attached for placement on the engine thrust reverser controls during maintenance.
The aircraft manufacturer, Airbus, advised that the August 2019 revision of the aircraft maintenance manual introduced an operational test of the thrust reverser system to confirm its re‑activation after maintenance tasks.
Safety message
This investigation highlights the importance of considering the environmental conditions in which equipment and tools will potentially be used, as well as the importance of following procedures that in this instance should have resulted in detecting the error.
When considering the effectiveness of equipment, tooling and procedures that aim to minimise the likelihood and/or consequences of an error, an engineered solution is generally more effective than relying on procedural compliance. Further, a functional check is generally more effective within procedural compliance than a self-check of work. See the ATSB research report, An overview of human factors in aviation maintenance (AR-2008-055), available from the ATSB website.
The occurrence
What happened
On the morning of 18 December 2017, a Jetstar Airways (Jetstar) Airbus A320 aircraft, registered VH‑VQG (VQG) was on final approach to Gold Coast Airport, Queensland. The aircraft was operating as a scheduled passenger flight, from Adelaide, South Australia, with two flight crew, four cabin crew, and 140 passengers.
At about 0845 Eastern Standard Time,[1] air traffic control cleared VQG to land. After a normal descent and touchdown, the captain (pilot flying) selected both engine thrust reversers.[2] The right engine thrust reverser activated but the left engine reverser did not, and the flight crew received a ‘reverse fault’ alert. They continued with the landing and the aircraft decelerated to a taxi speed using normal braking. The captain moved the thrust reverser controls to the stowed position, the aircraft was taxied to the gate without further incident and the passengers disembarked.
While taxiing, the captain cycled the thrust reverser levers and the alert extinguished. Nevertheless, the captain reported the thrust reverser issue for investigation by engineering personnel.
The subsequent engineering inspection found the left engine thrust reverser lockout pin installed, effectively deactivating the reverser. The lockout pin was removed, the thrust reverser confirmed to be operating normally and the aircraft returned to service.
There was no damage to the aircraft, or injuries as a result of the incident.
Overnight maintenance
Maintenance on the aircraft’s left engine was carried out in Adelaide during the night before the incident flight. Two A320 licensed maintenance engineers had carried out that maintenance.
One of the engineers (engineer 1) began his scheduled night shift at about 1900 on 17 December, and he described the weather that evening as hot and humid. He initially thought he was the only engineer on that shift to carry out maintenance certification on four A320 aircraft, and stated that he felt ‘stressed’ and under pressure. The other engineer (engineer 2) had been called in to work overtime that evening. He started his shift at 1830, carrying out other tasks before being assigned to assist engineer 1 with VQG later that evening.
At about 2300, after completing their other tasks, the engineers commenced maintenance on VQG. This maintenance was unscheduled and involved investigating an engine bleed air issue. Jetstar had not provided paperwork for this task. Engineer 2 began collecting the consumables required for the task. Engineer 1 went to the tarmac tool store to get a lockout pin, required to be installed on the engine to prevent inadvertent activation of the thrust reverser.
After locating the lockout pin with some difficulty, engineer 1 hurried back to the aircraft without booking out the pin on the store’s computer system. He opened the left engine cowling and, using a stand to access the top of the engine, installed the pin. Procedures required the pin’s installation to be entered in the aircraft’s technical log. The log was located in the line office, and the engineer decided to record it in the log later.
A couple of hours later, the engineers completed investigating the bleed air issue. By this time, it had started raining. Engineer 1 made a visual inspection around the engine in preparation to close the cowling. The available lighting had reduced as half the tarmac lights automatically turn off at midnight. Engineer 1 missed seeing the lockout pin and its 1 m long red warning flag, and closed the cowling (Figure 1). The flag was shorter than those on the pins in the hangar tool store at Adelaide, which had been lengthened to 4 m after a previous incident to make them more obvious. Additionally, the stand that engineer 1 had used to install the pin, and which may have reminded him about it, had been removed for another task.
The aircraft maintenance manual thrust reverser de-activation procedure also required the use of specific warning labels in the cockpit, stating that ‘thrust reverser HCU [hydraulic control unit] is de-activated’. This procedure was not used during this maintenance task.
Figure 1: Photograph of a thrust reverser lockout pin and warning flag (non-reflective)
Source: Operator, annotated by the ATSB
Shortly after 0230 on 18 December, the engineers completed the maintenance on VQG, and went to the line office to complete the paperwork. The engineers recorded different parts of the completed maintenance, but neither entered the installation of the lockout pin in the technical log.
At the release to service of VQG, a tooling inventory check was conducted. As the pin was not booked out on the store’s computer, it did not show up during the check.
The aircraft was released to service with the lockout pin installed.
In September 2018, the engine thrust reversers on a Jetstar A320 aircraft did not activate when landing at Sydney Airport, New South Wales. The ATSB investigation into that occurrence found that the thrust reverser lockout pins on both engines were not removed after maintenance at the Brisbane Airport, Queensland facility before the flight.
In that case, the aircraft maintenance lockout pins (fitted with warning flags) were substituted with in-service pins without flags. Further, the functional check of the thrust reversers following reactivation as per the operator’s task card for that planned maintenance was not carried out. The investigation also found that operational pressure to expedite the maintenance probably influenced the deviation from procedures.
January 2017
In January 2017, the right engine thrust reverser on a Jetstar A320 aircraft did not activate when landing at Melbourne Airport, Victoria. The operator’s investigation found that the thrust reverser lockout pin was not removed after maintenance at Adelaide before the flight.
In that case, the aircraft maintenance lockout pin also had a 1 m red warning flag and was not booked out on the store’s computer system.
Safety analysis
The left engine thrust reverser did not activate when VH‑VQG landed at the Gold Coast Airport because its lockout pin was installed. Engineers had installed the pin during maintenance in Adelaide before the flight, but missed removing it due to a number of reasons.
The maintenance in Adelaide was carried out in the night under artificial lighting on the tarmac. The lighting significantly reduced at midnight when the tarmac lights automatically dimmed (half extinguished). In addition, it was raining when engineer 1 carried out a visual inspection before closing the engine cowling. These conditions made it difficult to see the lockout pin’s red warning flag.
The red colour of the flag was also harder to see in the artificial lighting,[4] and the flag was not fitted with reflective material. The lockout pin was located at the top of the engine, where its 1 m flag was not as conspicuous as other longer flags, which would have hung below the engine to the tarmac. Further, the stand used to install the pin, which might have served as a reminder, had been removed. The combination of these factors probably led to the pin not being removed.
Procedures aimed at ensuring the lockout pin’s removal were not followed. These procedures included booking items out on the tool store’s computer system. As the pin was not booked out, its return to the store could not be checked. Further, the pin’s installation was not recorded in the technical log, which meant its removal went unnoticed and unrecorded.
Finally, the required cockpit warnings associated with thrust reverser deactivation were not used, thereby removing an opportunity to identify that the pin had not been removed before the aircraft was returned to service.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
The lockout pin on the left engine thrust reverser was not removed after maintenance, resulting in the aircraft returning to service with the thrust reverser deactivated.
The location of the thrust reverser lockout pin at the top of the engine meant that its 1 m red warning flag was difficult to see in the prevailing low‑light conditions. This probably led to the engineer not seeing the flag and removing the pin.
The lockout pin was not booked out of the tool store nor was its installation recorded in the technical log. As a result, the checks that these procedures provided to ensure the pin's removal were missed. Additionally, the required cockpit warnings associated with thrust reverser deactivation were not used, removing an opportunity to identify that the thrust reverser was disabled.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.
Qantas
The aircraft maintenance organisation, Qantas, has advised the ATSB that it is taking the following safety actions:
Highlighting the importance of the aircraft maintenance manual precautions, and the limitations of human performance on the stages of maintenance, to maintenance staff at Adelaide.
Lengthening all thrust reverser lockout pin flags to hang past the closed cowls. The pin will also have a warning notice attached for placement on the engine thrust reverser controls during maintenance.
Focused audits on work practices for tooling and documenting maintenance activities.
Reiterating the responsibilities of engineers to those involved in this incident.
Airbus
The aircraft manufacturer, Airbus, advised that the August 2019 revision of the aircraft maintenance manual introduced an operational test of the thrust reverser system to confirm its re‑activation after maintenance tasks.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence.
Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work.
The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
