Executive summary

What happened

Early on the morning of 2 March 2024, BHP Western Australia Iron Ore trains M05519A and M05519B were stopped 232 m apart, queued to be unloaded at BHP’s Finucane Island Balloon Loop, near Port Hedland, Western Australia. At about 0425 local time, the driver of M05519A slowly moved their train 325 m forwards to the handover point, where the train would be prepared for unloading. 

As train M05519A came to a stop, the driver of train M05519B began to move their train forwards, intending to stop 200 m behind train M05519A. Over the next 6 minutes, train M05519B accelerated to a maximum speed of 12 km/h, and the driver acknowledged 4 audible alerts of the locomotive’s vigilance system. However, there was no brake application or reduction in throttle during that time, resulting in the train colliding with the rear of train M05519A. The driver was uninjured and there was no damage to the rollingstock.

What the ATSB found

The ATSB found that the driver of train M05519B had been experiencing stress, sleeping with the light on, and waking often, resulting in poor quality sleep. As a result, on their fourth consecutive night shift, during darkness and while experiencing low workload, the driver set the train in motion while in a degraded level of alertness, possibly associated with a microsleep, and did not detect the impending collision.

The ATSB also found that without awareness or memory of having done so, the driver acknowledged 4 audible vigilance alerts, which, by design, prevented a penalty brake application. This resulted in a low-speed collision with stationary train M05519A.

What has been done as a result

Following the collision, BHP undertook a series of actions to manage fatigue and the limitations of the vigilance systems in the SD70Ace/LCi locomotives.

BHP reviewed the fatigue risk periods for their fly-in fly-out (FIFO) rail operations driver rosters, and increased the number of fatigue assessments during each rotation. Fatigue assessments are now conducted on each of the first 5 night shifts and on the first and fourth day shifts of each rotation. These assessments are conducted face-to-face with the on-shift supervisor or coordinator at each depot location.

BHP is also implementing an additional check-in per shift, to be conducted with the rail crew team member either face-to-face or electronically via phone or radio. To support this activity, BHP employed additional resources to support existing operations supervisors and superintendents to identify and monitor fatigue concerns within the rostering environment. 

Additionally, research was conducted into the viability of an interactive fatigue assessment tool (FAT), delivered through a mobile application, to improve the quality of fatigue assessments. A trial of the FAT was scheduled to commence at the end of November 2024.

BHP also proposed several changes to the vigilance system installed on their SD70Ace/LCi locomotives, including changing from fixed-time intervals to random intervals for the countdown, and limiting consecutive alerter resets to require different inputs and eliminate ‘muscle memory’.

Safety message

Adequate sleep duration is important, but sleep quality is also important. Of the factors that affect sleep, light has the most profound effect on the sleep-wake cycle. Exposure to light promotes wakefulness and darkness is necessary for deep restorative sleep. Exposure to sun or blue light, before and during sleep, also results in fragmented sleep and reduces the amount of deep restorative sleep. Stress also negatively affects sleep quality and creates hyperarousal that can mask symptoms of tiredness and fatigue. An increasing deficit of restorative sleep increases the body’s sleep drive and can result in reduced levels of alertness during waking hours, as well as napping, dozing, and microsleeps outside of planned sleep times. 

Effective fatigue management includes self-reporting of fatigue or factors likely to contribute to fatigue. Conditions such as stress and interrupted sleep that affect sleep quality should prompt workers to assess and report an elevated risk of fatigue even if sleep quantity may be adequate. Use of fatigue reporting mechanisms is essential for an organisation to be able to apply mitigation strategies to address the associated risks.

The investigation

The occurrence

Late at night on 1 March 2024, at the Mooka staging facility (about 32 km south-south-east of Port Hedland, Western Australia) train M05519, operated by BHP Western Australia Iron Ore, was divided into 2 single-crew trains. The 2 trains, M05519A (train A) and M05519B (train B), were each about 1.4 km long, consisting of 2 Progress Rail EMD SD70Ace/LCi Locomotives, short-end leading, followed by 135 wagons loaded with iron ore. A flashing red LED light was secured on the last wagon of each train as an end-of-train marker. 

Train A, followed by train B, proceeded towards BHP’s Finucane Island facility at Port Hedland, which consisted of a standard-gauge dual track balloon loop servicing 2 car dumpers (CDs), where iron ore wagons were emptied. Emptying occurred under the authority of a dumper operator, in a semi-automated process where wagons were rotated to dump their contents, and control arms progressed each rake through the dumper facility. As the emptying process could take up to several hours, drivers would secure and hand over the train, then head to the control room for a short break before being assigned a further task. 

At about 2320 local time, train A entered Finucane Island yard limits.[1] Within the yard limits, drivers had authority to move their train up to the owner transfer point (OTP) board for the relevant CD (Figure 1). There were no signals and limited controller oversight of the section between the yard limits board and the OTP board, and train drivers were responsible for visually maintaining separation with other rail traffic. Train A slowly progressed, before coming to a stand between 28 points and the OTP board for CD4, where it remained between 0156 and 0425 on 2 March 2024.

Figure 1: Finucane Island facility showing car dumper 4 and its owner transfer point

Source: Google Earth, annotated by the ATSB

At about 0200, having been stopped by train control for one hour at an en route yard, train B was authorised to enter Finucane Island yard limits and, at 0220, came to a stand 260 m behind train A. The entirety of train B was stopped between 26 and 27 points, the section of track with the steepest uphill grade before the car dumpers. Train B remained stopped in that location from 0220 until 0327 (Figure 2). 

Figure 2: Diagrammatic representation of train positions from 0220 to 0327

Not to scale

Source: BHP, annotated by the ATSB

Recorded locomotive data for train B showed that between 0327 and 0331, the driver moved the train forward 27 m before briefly coming to a stand. At 0334, the driver moved the throttle to 1 notch,[2] the train moved forward 1 m then stopped, and the driver applied the independent brake at 0340. Train B was then 232 m behind train A and remained there with the throttle in 1 notch and the brake on, which deactivated the vigilance system (see the section titled Locomotive vigilance system), until 0400 when the driver moved the throttle to idle. 

The driver of train B reported that while waiting for the train in front to move, they monitored the radio, swept and cleaned out the cab and spent some time standing outside on the locomotive’s footplate. At that time, the half-moon was above the horizon, and it was a clear night.

At 0425, after the preceding train departed CD4, the driver of train A placed the throttle into 2 notch, applying sufficient tractive effort to slowly move the train 325 m to the OTP board, before coming to a stand at 0432 (Figure 3). Train A’s driver then awaited authority from the dumper operator to start the process for the train to proceed into CD4 and commence unloading. 

Figure 3: Diagrammatic representation of train positions at 0432

Not to scale

Source: BHP, annotated by the ATSB

After detecting that train A had moved ahead, the driver of train B applied power to move their train forward, intending to stop at least 200 m behind train A. At 0431:27, the driver placed the throttle to 1 notch, then 10 seconds later to 2 notch, and another 31 seconds later to 3 notch. At 0433:28, the driver responded to an audible alert from the vigilance system, the train started to move, and the driver placed the throttle into 4 notch. 

Over the next 4 minutes, as the trained slowly accelerated to 12 km/h, the driver made 3 more responses to audible alerts from the vigilance system, the last of which occurred at 0437:28. At 0437:42, nearly one hour before first light,[3] train B impacted the rear of train A. The impact sequence lasted 38 seconds and, although the locomotive brakes were fully applied on train A from the point of contact, train A was pushed forwards about 40 m. 

The driver of train B reported remembering moving the throttle to 1 notch, but had no awareness of hearing or responding to audible vigilance alerts in the lead up to the collision, and thought they must have had a microsleep. The driver reported being awoken by the impact, and immediately communicated with drivers on nearby trains and controllers to coordinate movements, maintain safe operations, and initiate post-incident protocols. 

The driver also uncoupled the lead locomotive of train B from the rear of train A and checked for any damage. There was no damage to rollingstock (Figure 4) and the driver was uninjured.

Figure 4: Lead locomotive of train M05519B after the accident

Source: BHP

Context

Train driver information

Experience, qualifications, and training

The driver had over 30 years of experience driving trains and had worked in Western Australia for over a decade on a fly-in, fly-out (FIFO) basis, operating grain, container, and heavy bulk mineral trains. The driver joined BHP in 2022 and completed all relevant safeworking, locomotive, and in‑field training courses. The driver also held the required route knowledge and operational competencies for the tasks undertaken. The driver regularly operated trains around Finucane Island and last did so 3 days prior to the incident.

The driver successfully completed BHP’s fatigue management training course in 2022 as part of the induction process, but had not completed a refresher course that had been due since December 2023, due to an absence from work. 

Medical information 

The driver passed an annual category 1 rail medical assessment on 4 October 2023. The driver’s responses to the sleep-related questions in the medical assessment indicated no sleep issues, no tendency to doze, and the driver reported normally sleeping for 6 hours when on day or night shifts and at home.

On 29 November 2023, the driver presented to a medical centre at Port Hedland with a bite on their leg, which they had received while sleeping at night in the barracks.[4] The driver was given temporary pain relief and flew home to Sydney, New South Wales, where they subsequently underwent surgery for what was identified as a white‑tailed spider bite. The driver was subsequently cleared by their general practitioner to resume normal work duties from 16 January 2024 and, that day, flew from Sydney to Port Hedland.

Just over one week after returning to work, on the morning of 25 January 2024, the driver awoke at 0600 and noticed similar signs of a white-tailed spider bite, this time on their neck. On 29 January, the driver returned to Sydney, where they underwent surgery for the second white‑tailed spider bite, followed by a period of rehabilitation. The general practitioner then deemed the driver fit to return to duties, with no requirement for ongoing treatment or medication, and the driver returned to work on 27 February 2024. 

Upon returning to Port Hedland, the driver began to experience panic attacks and stress, possibly associated with a response to the previous spider bites. The driver had been allocated the same room at barracks after returning to duty in January and February. BHP provided the ATSB with receipts confirming that the driver’s room and 3 adjacent rooms were fumigated on 1 February 2024. However, when the driver returned to their room 26 days later, they reported there were no obvious signs it had been fumigated as it did not appear to have been cleaned. As a result, the driver began frequently spraying their room and locomotive cab with insect spray. The driver reported that their sleep quality was affected as they woke often, including to spray the room, fearing they would be bitten again, and slept with the lights on to deter spiders. 

Following the collision, BHP conducted standard post-incident drug and alcohol testing on the driver, with negative results for both drugs and alcohol, and no substance-related impairment was identified. 

Rostering and recent history

Roster and fly-in fly-out arrangements

The driver’s FIFO roster involved 7 12-hour night shifts, followed by a minimum 24-hour changeover period, then 7 12-hour day shifts, followed by 7 days off duty. Drivers were expected to fly in on the day of their first shift (or the day prior, if their start time was at or after midnight), with an opportunity to rest for several hours at barracks prior to commencing their first shift later that night. At the end of each rotation, drivers would fly home on the first morning after their final day shift. The driver travelled from their home in Sydney to Port Hedland via Perth on scheduled airline flights.

Accommodation at Port Hedland

The accommodation barracks were located next to Port Hedland International Airport. The barracks were fully serviced with a dining area and recreational facilities, and all personnel were allocated a single occupancy room with an en suite and air-conditioning. The driver reported that, as a 24-hour facility, the barracks could be moderately noisy at times with the movement of cleaners and their equipment during the day, and the activities of other workers between shifts. 

Adjusting to shift work and variable sleep patterns

The driver was experienced in shift work and reported that they adjusted well to variable sleep and roster patterns. The driver reported maintaining similar sleep habits at barracks in Port Hedland and at home. The driver also reported commonly having broken sleep, but no problems returning to sleep.

The driver reported that they would usually be in bed no later than 2 hours after the end of each shift, and aimed to wake at least 2–3 hours prior to commencing their next shift. The driver also reported that they could sleep for several hours on the flights to Port Hedland prior to commencing the first shift of a new rotation.

Fatigue mitigation strategies

BHP Western Australia Iron Ore had strategies aimed at mitigating fatigue risks associated with the FIFO roster. These included a fatigue assessment, which was required to be conducted at specific times in the roster and under certain other conditions. Individuals could also voluntarily complete the assessment at other times. If a driver reported being fatigued, they could be assigned rest or non-operational duties. Drivers could also request a fatigue break during a shift. 

The ATSB assessed whether a safety issue relating to BHP’s rostering practices, which was identified during investigation RO‑2018‑018, was relevant to this occurrence. However, contrary to the circumstances associated with RO‑2018‑018, the driver had been off work for one month and during this first rotation back had 11–12 hours of sleep opportunity each day, during which they reported obtaining their normal sleep duration. 

Recent history

The driver reported having had a good sleep at home in Sydney, before waking on the morning of 27 February 2024. The driver then obtained another 4–5 hours of sleep on the flights to Port Hedland with their first 12-hour night shift rostered to commence that night at 2200. The driver reported that, prior to arriving at Port Hedland, they had completed a fatigue assessment form, which based on their responses, indicated a low fatigue score.[5] The collision occurred on the fourth night of this rotation, after which the driver was relieved from duty and placed on leave. The driver reported that they generally felt most fatigued towards the end of the fourth shift of a rotation.

The driver reported that in the 72 hours prior to the collision, they followed their normal sleep pattern. They went to bed about 1130–1200, obtained about 6–7 hours of broken sleep, with a maximum continuous sleep period of about 4 hours. The driver rated the quality of their sleep in the days prior to the collision as being 1 out 10 (where 0 indicates the worst possible sleep and 10 indicates the best possible sleep), due to numerous sleep interruptions. 

Despite that, the driver reported that before the incident shift, they felt well rested and did not consider completing a fatigue assessment. The driver assessed their perceived level of alertness at the time of the collision as ‘ok, somewhat fresh’, and reported feeling wide awake with no symptoms of tiredness. 

Food and drink consumption

The driver maintained regular eating patterns, eating conventional breakfast foods in the morning and more traditional or substantial dinner-style meals in the evening. The driver was not taking medication, natural sleep aids or vitamin supplements, and they rarely consumed alcohol and did not drink caffeinated energy drinks. 

After returning from the previous night shift mid-morning, on 1 March 2024, the driver consumed a light meal before going to bed, and, after waking, ate a full meal at around 1900. The driver made a coffee at the office when signing-on at 2100, which was the only caffeinated beverage they consumed prior to the collision.

Locomotive vigilance system

Locomotive vigilance systems monitor driver activity and responsiveness and apply the train’s brakes if the driver does not respond to vigilance alerts in a specified period. The vigilance alerts consist of an initial visual alert followed soon after by the addition of an audible alert. The system will initiate a penalty brake application, causing the train to stop, if no acknowledgement is made. 

A limitation of such systems, as identified in an ATSB investigation into a collision between 2 freight trains in 2019 (RO-2019-022), was that drivers could acknowledge vigilance systems during periods of acute fatigue, and habituate to these systems, responding to alerts without conscious thought by pressing the reset button through a reflexive motor response. Vigilance systems could identify and intervene in cases of driver absence or total incapacitation but were less effective in detecting and responding when drivers were mildly incapacitated, inattentive, fatigued, or otherwise distracted.

The vigilance system installed on SD70Ace/LCi locomotives operated as a task/activity-based system with a fixed-time element. If the system detected inactivity in relation to control inputs or locomotive settings, the timer would commence a countdown with a visual alert displayed on the Functionally Integrated Railroad Electronics (FIRE)[6] system display screen and a warning light on the vigilance push‑button. 

If the driver did not respond within a specified time, an audible tone would sound. The timer would automatically reset if the driver made control inputs such as throttle, brake, or directional controller settings, or operated items such as the locomotive horn or sanding[7] equipment. It would also reset if the driver pressed the vigilance acknowledgement push‑button or the reset button on the FIRE display screen.

The vigilance timer operated on a 90-second cycle with the following sequence:

• 0 seconds – system reset, commence silent countdown
• 70 seconds – flashing countdown and warning lights on the driver’s display, warning light illuminated on the FIRE alert reset button and vigilance pushbutton
• 75 seconds – commencement of audible tone increasing in volume and frequency to accompany visual alerts
• 85 seconds – rising audible tone reaches peak volume and continues to sound along with the visual alerts until the vigilance is reset or the timing cycle ends
• 90 seconds – full emergency brake application.

The alerts would not be generated while the train was idle or the independent brake[8] was applied, and only became active when at least one of the following conditions were met:

• locomotive speed was greater than 0.8 km/h (task-linked to the throttle)
• brake cylinder pressure was lower than 25 psi (task-linked to the independent brake).

In addition to the electronic button on the FIRE display screen, there were 4 physical alerter reset buttons available to drivers in the SD70Ace/LCi locomotives, in the following positions:

• driver’s console (right side of the cab, on the right of the desk)
• driver’s control panel (left of the driver’s seat above the dynamic brake handle)
• observer’s console (left side of the cab)
• rear of locomotive cab.

The first 2 of these listed alerter reset buttons, together with the FIRE display screen, are shown in Figure 5.

Figure 5: Alerter reset button on control panel and driver’s console

Source: BHP, annotated by the ATSB

Recorded information

The FIRE system also recorded data on a logger when an event occurred, or at an interval when no other triggers had caused an event recording. The events that triggered a recording included changes in analogue parameter values, and changes of discrete inputs, such as the movement of throttle or brake controls, activation of the horn, changes to light settings, and the acknowledgement of the vigilance system. There was no way to determine which specific button the driver pressed in the locomotive to reset the vigilance system, as the buttons were all in parallel through a single digital input/output channel in the locomotive. 

Data from one locomotive per train – locomotives 4328 (train A) and 4480 (train B) – showed that both trains were operated below the track speed limits with both trains functioning within normal parameters and responding appropriately to driver inputs. The system recorded speed in whole km/h, and the following tables outline key events recorded on train B across 3 time periods.

Table 1 shows the sequence of events on train B between 0327 and 0332, when the driver applied power for over 2 minutes before releasing the independent brake. The driver responded to either the flashing reset button or the visual alert on the FIRE screen to acknowledge the vigilance system as train B moved forwards 27 m.

Table 1: Sequence of events recorded on train B (0327 to 0332)

Table 2 shows the driver released the independent brake at 0334. The driver then applied power, and responded to the audible alert tone when resetting the vigilance system on 4 occasions, during which time the train moved forward 1 m. At 0340, the driver reapplied the independent brake, deactivating the vigilance system but with power applied to the traction motors for the next 20 minutes. Due to the brakes, uphill grade, and tonnage, this setting was insufficient to move the train fast enough to reactivate the vigilance system. At 0400, the driver moved the throttle to idle. 

Table 2: Sequence of events recorded on train B (0334 to 0400)

Between 0400 and 0431, train B remained at a stand with idle throttle and brakes applied, before the driver made a series of control inputs as outlined in Table 3Table 4. The throttle was moved to 4 notch, which applied half the available power to the traction motors and the driver responded to the audible alert tone when resetting the vigilance system on 4 occasions. 

Table 3: Sequence of events recorded on train B (0431 to 0438)

Human factors considerations

Workload

The driver described their workload on the night prior to the incident night as being ‘flat out’ with numerous locomotive and rolling stock movements. On the incident night, the driver’s workload was low, the train having been stationary first at Mooka, then stopped by train control for one hour, and again while waiting at Finucane Island. Low workload situations lack stimulation, leading to monotony and boredom, and this can reveal underlying sleepiness from inadequate sleep, and degrade performance (Williamson et al 2011). Limited stimulation of a task can also reduce attention (Young and Stanton 2002).

Sleep cycle

It is generally agreed that most adults need at least 7 hours of sleep each day to achieve maximum levels of alertness and performance (Hirshkowitz and others 2015). Getting enough sleep quantity is critical in mitigating fatigue. However, sleep quality is also important. Good quality, restorative sleep depends on obtaining sufficient deep and rapid eye movement (REM) sleep, which only occur after being asleep for some time (Carskadon and Dement 2017). 

The sleep cycle comprises 4 stages – drowsiness, light sleep, deep sleep, and REM sleep. During sleep, adults normally cycle through these stages, with the duration of each stage and the proportions changing with age. Each stage is important, and waking frequently reduces the ability to obtain deep sleep and REM sleep, because after waking, the cycle begins again. 

Sleep quality broadly refers to the capacity of sleep to restore waking function. Ohayon et al (2017) reviewed sleep-related research and identified characteristics consistent with poor sleep quality. These include 4 or more awakenings per night (for more than 5 minutes) or being awake for more than 40 minutes after falling asleep. While there is less research on the effect of sleep quality than of sleep duration on performance, it has been found that sleep fragmentation has been shown to degrade memory, reaction time, vigilance, and mood (Bonnet & Arand 2003).

Sleep-wake cycle

In addition to the sleep cycle, there is the daily sleep-wake cycle. The sleep-wake cycle, known as the circadian rhythm, is usually comprised of a single period of wake and a major sleep episode every 24 hours. This alternation of sleep and wake normally coincides with the daily light-dark cycle, such that sleep occurs at night and wake occurs during the day (Kosmadopolos 2023). The sleep-wake cycle is regulated by the circadian clock and sleep homeostasis – the longer a person is awake, the stronger the drive for sleep. A reduction in sleep quantity or quality, or extension of the time awake since sleep, produces a sleep debt and increases the drive to sleep (Williamson et al 2011).

Effects of light

Light affects both the sleep cycle and the sleep-wake cycle. The greatest influence on circadian rhythm is sunlight or blue light. Exposure to light promotes wakefulness and hinders sleep (Chellappa et al 2011). Light exposure before or during sleep times can reduce sleep quality, cause repeated awakenings and interrupt the sleep cycle.

Effects of stress

Psychological stress and worry are known to reduce the recuperative value of sleep and increase mental demands in waking hours (Kim & Dimsdale 2007). Being stressed or anxious affects multiple systems in the body and increases activation of the sympathetic nervous system and cortisol levels (Stanford et al 2015). This causes alertness, or hyperarousal, and can lead to sleep fragmentation and reduced deep sleep (Han, Kim & Shim 2012). The effects of stress and anxiety can result in a high state of alertness despite disrupted sleep, where a person feels ‘tired but wired’ (Ramlakhan 2010). 

Stress responsible for prolonged sleep disruption in humans may be a cognitive and emotional phenomenon that is not necessarily always associated with an acute challenge. Humans may experience stress based on memories of past events as well as worries and expectations about the future. They can take a single acute stressor or life event that occurred in the past, or even one pending in the future, into a persistent and chronic stress state. Research has found that stress and worry experienced over successive days, particularly at bedtime, was shown to negatively affect sleep quality (Akerstedt et al 2012). In addition, poor sleep can result in people performing an action without any awareness or memory of having done so (Leschziner 2020).   

Microsleeps

As sleep is a biological need, when it reaches a critical level, the brain will sleep regardless of any effort to remain awake. This may result in microsleeps, which are described as brief fragments of sleep shorter than 15 seconds (Malafeev et al 2021). They can occur due to sleep loss, where the propensity for sleep is increased (Durmer and Dingers 2005), or during periods of low workload. One consequence of a microsleep is when a person does not respond during cognitive performance demands (Kause et al 2017). Microsleeps can occur without conscious awareness and can occur in settings where automation is provided, such as through automatic train protection systems (Thomas et al 2023). 

Safety analysis

Following multiple surgeries and medical leave because of 2 white-tailed spider bites, which occurred while the train driver was asleep in their accommodation at Port Hedland, the train driver returned to work at Port Hedland and commenced a week of night shifts. Experiences of acute stressors, such as spider bites, can result in persistent stress based on memories and associations of the past event and worries that a bite may occur in the future. Fearing another bite, the driver was frequently spraying insecticide in the locomotive and their bedroom, including waking from sleep to do so. In addition to impacting sleep, stress stimulates the sympathetic nervous system. This likely led to the driver feeling awake and alert, rather than experiencing symptoms of tiredness that would normally arise from a deficiency of deep restorative sleep.

In the 11–12 hours of sleep opportunity on each of the first 3 daytime off-duty periods, the driver reported having obtained the same total duration of sleep as normal. However, the disruption detail above inhibited their ability to obtain deep restorative sleep, reducing overall sleep quality. This was exacerbated by the driver sleeping with the light on (to deter spiders), which delays sleep onset and fragments sleep, reducing the amount of deep sleep. As the circadian rhythm is dependent on bright light for regulation, sleeping with the light on also likely affected the driver’s ability to adapt to sleeping during the day and being wakeful while on duty at night. 

Unlike the previous (third) night shift, during which the driver experienced a high workload, on the incident night (fourth night shift), the driver spent long periods of time in a stationary locomotive, resulting in an extremely low workload situation. This, combined with the reduced overall sleep quality, and a dark environment, likely resulted in a condition where the driver started to perform actions, without any awareness or memory of having done so.

Between 0335 and 0340 on the incident morning, while applying some tractive effort with the brakes released, the driver acknowledged 4 audible alerts with no memory of having heard or acknowledged them. The driver then set the independent brake, deactivating the vigilance system, and both throttle and brakes were then engaged for about 20 minutes. This configuration was unlikely to have been conscious, given that the simultaneous application of power and brakes was not a normal operating mode and would almost certainly have resulted in the train moving either forwards or backwards but for the incline on which the train was stopped. 

The unusual configuration was resolved at 0400 by the driver moving the throttle to idle, following which the train was stationary with no driver inputs for 31 minutes. That period was consistent with the driver’s recollection of standing outside on the footplate and cleaning the cab in preparation for the handover that would occur when the locomotive eventually reached the car dumper. 

When the driver recognised that the train ahead had progressed, they set their train in motion. However, the driver had no recollection of subsequently hearing and acknowledging another 4 vigilance alerts. Vigilance systems are ineffective in detecting drivers who are mildly incapacitated, inattentive, fatigued, or otherwise distracted, and who can perform an automated task in acknowledging the alerts without conscious awareness. 

Although the driver did not respond to visual alerts within the time required, and the vigilance system progressed to issuing audible alerts, the vigilance timer reset each time the driver acknowledged a vigilance alert, and consequently, the vigilance system did not activate the emergency brake. There was also no driver action to reduce the throttle or apply independent braking, or any other recorded control or system inputs by the driver. The pattern of slowed reaction times to the vigilance system alerts throughout the shift may indicate the driver was pre‑occupied or distracted. However, there was no evidence of any distraction.

As a result of poor-quality sleep, low workload, and dark conditions, after the driver set the train in motion it is probable that the driver was in a degraded level of alertness, possibly associated with a microsleep. During this period, the driver was unable to detect the risk posed by the stationary train ahead and identify the appropriate actions to be taken to stop the train. 

As a result, about 5 minutes after the train started to move, and 14 seconds after the driver last acknowledged a vigilance alert, the locomotive impacted the rear of the stationary train ahead. The driver reported having no recollection of anything after setting the train in motion until the collision. 

After the impact the driver was immediately able to perform normal and post-incident functions. This was consistent with being aroused from a degraded state rather than having suffered a medical incapacitation, and there was no evidence of any condition likely to result in incapacitation in the driver’s medical history or subsequent evaluation.

Findings

From the evidence available, the following findings are made with respect to the low-speed collision between trains M05519A and M05519B at Finucane Island Balloon Loop, Port Hedland, Western Australia on 2 March 2024.

Contributing factors

• The driver of train M05519B had been experiencing stress, sleeping with the light on, and waking often, resulting in poor quality sleep. As a result, on their fourth consecutive night shift, during darkness and while experiencing low workload, the driver set the train in motion while in a degraded level of alertness, possibly associated with a microsleep, and did not detect the impending collision.
• Without awareness or memory of having done so, the driver acknowledged 4 audible vigilance alerts, which, by design, prevented a penalty brake activation. This resulted in a low-speed collision with stationary train M05519A.   

Safety actions

Safety action by BHP

Following the collision, BHP undertook a series of actions to manage fatigue and the limitations of the vigilance systems in the SD70Ace/LCi locomotives.

BHP reviewed the fatigue risk periods for its FIFO rail operations driver rosters and increased the number of fatigue assessments during each rotation. Fatigue assessments are now conducted on each of the first 5 night shifts and on the first and fourth day shifts of each rotation. These assessments are conducted face-to-face with the on-shift supervisor or coordinator at each depot location.

BHP is also implementing an additional check-in per shift, to be conducted with the rail crew team member either face-to-face or electronically via phone or radio. To support this activity, BHP employed additional resources to support existing operations supervisors and superintendents to identify and monitor fatigue concerns within the rostering environment. 

Additionally, research was conducted into the viability of an interactive fatigue assessment tool (FAT), delivered through a mobile application, to improve the quality of fatigue assessments. A trial of the FAT was scheduled to commence at the end of November 2024.

BHP also proposed several changes to the vigilance system installed on its SD70Ace/LCi locomotives, including changing from fixed-time intervals to random intervals for the countdown, and limiting consecutive alerter resets to require different inputs and eliminate ‘muscle memory’.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the driver of train M05519B
• BHP.

References

Åkerstedt T., Orsini N., Petersen H., Axelsson J., Lekander M., and Kecklund G. (2012). ‘Predicting sleep quality from stress and prior sleep–a study of day-to-day covariation across six weeks’, Sleep Medicine, 13(6):674–679. doi: 10.1016/j.sleep.2011.12.013.

Bonnet M.H. and Arand D.L. (2003). ‘Clinical effects of sleep fragmentation versus sleep deprivation’, Sleep Medicine Reviews, 7(4): 297-310, doi: 10.1053/smrv.2001.0245.

Carskadon M.A. and Dement W.C. (2017). ‘Normal human sleep: and overview’, in Kryger, M.H., Roth T. and W.C. (eds). Principles and practice of sleep medicine (6th edition), Elsevier. 

Chellappa S.L., Gordijn M.C. and Cajochen C. (2011). ‘Can light make us bright? Effects of light on cognition and sleep’. Progress in Brain Research, 190:119 –133, doi: 10.1016/B978-0-444-53817-8.00007-4.

Durmer J.S. and Dinges D.F. (2005). ‘Neurocognitive consequences of sleep deprivation’. Seminars in Neurology, 25(1):117-129, doi: 10.1038/nrn.2017.55.

Han, K.S., Kim, L., Shim, I. (2012). ‘Stress and sleep disorder’, Experimental Neurobiology, 21(4):141-50. doi: 10.5607/en.2012.21.4.141. Accessed 5 September 2024: Stress and Sleep Disorder - PMC (nih.gov)

Hirshkowitz M., Whiton K., Albert S.M., Alessi C., Bruni O., DonCarlos L., Hazen N., Herman J., Katz E.S., Kheirandish-Gozal L., Neubauer D.N., O’Donnell, A.E., Ohayon, M., Peever, J., Rawding, R., Sachdeva, R.C., Setters B., Vitiello, M.V., Ware, J.C., and Adams-Hillard, P.J. (2015). ‘National Sleep Foundation’s sleep time duration recommendations: methodology and results summary’, Sleep Health, 1(1):40–43. doi: 10.1016/j.sleh.2014.12.010.

Krause A.J., Simon E.B., Mander, B.A., Greer S.M., Saletin J.M., Goldstein-Piekarski A.N. and Walker M.P. (2017). ‘The sleep-deprived human brain’, Nature Reviews Neuroscience, 18(7):404-418. doi:

Kim, E. J. and Dimsdale, J. E. (2007). ‘The effect of psychosocial stress on sleep: a review of polysomnographic evidence’, Behavioural Sleep Medicine, 5(4), 256-278.

Kosmadopolos A. (2023). ‘Sleep pressure and circadian rhythms’, in Rudin-Brown C. and Filtness, A.J., The handbook of fatigue management in transportation: waking up to the challenge, CRC Press, Boca Raton, Florida.

Leschziner, G. (2020). The nocturnal brain: nightmares, neuroscience, and the secret world of sleep. First St. Martin's Griffin edition. New York, NY, St. Martin's Griffin.

Malafeev A., Hertig-Godeschalk A., Schreier D.R., Skorucak J., Mathis J. and Achermann P. (2021). ‘Automatic detection of microsleep episodes with deep learning’, Frontiers in Neuroscience, 15:1-12. doi: 10.3389/fnins.2021.564098.

Ohayon M., Wickwire E.M., Hirshkowitz M., Albert S.M., Avidan A., Daly F.J., Dauvilliers Y., Ferri R., Fung C., Gozal D., Hazen N. (2017). ‘National Sleep Foundation's sleep quality recommendations: first report’, Sleep Health 3(1):6–19. doi:10.1016/j.sleh.2016.11.006.

Ramlakhan, N. (2010). Tired but wired: how to overcome sleep problems – the essential sleep toolkit. Souvenir Press; Main edition (3 May 2010). London, United Kingdom. 

Sanford L.D., Suchecki D. and Meerlo P. (2015). ‘Stress, arousal, and sleep’. Sleep, Neuronal Plasticity and Brain Function, 25:379-410. doi:10.1007/7854_2014_314.

Thomas M.J.W., Sprajcer M. and Dawson D. (2023). ‘The effects of fatigue on performance in transportation operations’, in Rudin-Brown C. and Filtness, A.J., The handbook of fatigue management in transportation: waking up to the challenge, CRC Press, Boca Raton, FL.

Williamson A., Lombardi D.A., Folkard S., Stutts J., Courtney T.K. and Connor J.L. (2011). ‘The link between fatigue and safety’, Accident Analysis and Prevention, 43(2): 498–515. doi:10.1016/j.aap.2009.11.011.

Young M.S. and Stanton N.A. (2002). ‘Malleable attentional resources theory: a new explanation for the effects of mental underload on performance’, Human Factors, 44(3):365–375. doi:10.1518/0018720024497709.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the driver of train M05519B
• BHP
• the Office of the National Rail Safety Regulator.

Submissions were received from:

• BHP
• the Office of the National Rail Safety Regulator. 

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Investigation summary

What happened

At about 0945 local time on 25 February 2024, Metro Trains Melbourne (MTM) train 7255 travelling between Bayswater and Upper Ferntree Gully passed through Ferntree Gully and entered the single line section between the stations. The train then stopped around mid‑section at a signal at stop. The train was a non-revenue service without passengers.

At 0958, passenger train 3148 travelling in the opposite direction departed Upper Ferntree Gully towards Ferntree Gully and entered the same single line section. The driver of train 3148 had been given permission by the station officer at Upper Ferntree Gully to pass the station departure signal which was at stop. After the train had travelled about 350 m, the driver sighted train 7255 ahead and brought their train to a stop. The two trains were facing each other and about 300 m apart. 

What the ATSB found

It was found that the station officer at Upper Ferntree Gully gave permission for train 3148 to enter the single line section in the belief that the track was clear of other rail traffic. They were unaware that train 7255 had departed Bayswater earlier than its scheduled departure time and had entered the section. Although the signal panel at Upper Ferntree Gully indicated that the section was occupied, they believed that the panel indication was due to a recurring track fault. The panel was of an older type and did not include train identification information. The investigation also found:

• Processes in place at Upper Ferntree Gully did not require validation by a second person of a station officer’s decision to issue permission to pass a signal at stop.
• The station officer at Upper Ferntree Gully did not receive a bell signal from Ringwood signal box for the early departure of train 7255 from Bayswater. Over time, the application of several MTM administrative signalling procedures and practices had become inconsistently applied by signalling staff on the Belgrave line.
• An internal MTM audit was ineffective in addressing deviation from MTM train control processes on the Belgrave line.
• Departure signals at Bayswater and Ferntree Gully stations were set to fleeting which meant train 7255 could depart both stations without signaller intervention or awareness.

What has been done as a result

Metro Trains Melbourne has:

• introduced a procedure that requires the signaller to obtain the permission of the train controller at Metrol (the central control centre for the Melbourne suburban rail network) when they are required to issue an Automatic and Track Control system caution order
• introduced a new belling procedure, trained all affected signallers on the new procedure, and issued a communication to reinforce the usage of train describer bells
• reviewed procedures to improve safeworking training and competency assurance activities
• commissioned changes to the control circuitry to remove the capability of fleeting movements onto the single line section between Ferntree Gully and Upper Ferntree Gully.

Safety message

Rail infrastructure managers should ensure that procedures associated with managing trains are consistently applied and checks on safety critical decisions are incorporated into procedural systems to reduce the likelihood of single-person errors.

The occurrence

Background

The incident occurred in a single line section between Ferntree Gully (FTG) and Upper Ferntree Gully (UFG) Railway Stations. These stations are located on the Melbourne metropolitan rail network on the Belgrave line (Figure 1). 

Figure 1: The Belgrave line from Ringwood

Source: Public Transport Victoria annotated by the Office of the Chief Investigator (OCI)

As part of the Victorian Government’s Level Crossing Removal Project (LXRP), level crossing removal works were being carried out at Bedford Road in Ringwood. The works affected train operations between Ringwood and Belgrave. Belgrave trains from Melbourne were being terminated at Ringwood and trains from Belgrave towards Melbourne were being terminated at Bayswater. Buses replaced trains between Ringwood and Bayswater.

Prior to the incident

At about 0935 local time on 25 February 2024, passenger train 3109 departed Bayswater railway station for Belgrave. At 0936, train 7255, a non-revenue service (not taking passengers), was provided a proceed aspect at signal BAY306 located about 500 m on the Ringwood side of Bayswater station to travel towards Belgrave. 

At about 0939, train 7255 passed through Bayswater station with signals at proceed and without stopping, following train 3109. Train 7255 was not scheduled to depart Bayswater station until 0951 and therefore left about 12 minutes ahead of its timetabled departure from Bayswater. Train 3109 continued ahead of train 7255 and arrived at UFG station at 0944.

The incident

Train 7255 passed through Boronia station at about 0942 and then through FTG station and departure home signal[1] 2R at about 0945 (Figure 2). Signal 2R displayed a medium speed warning which indicated that the line ahead was clear, but that the next signal was at stop. Medium speed at this location was 40 km/h.

Figure 2: Signalling arrangement between Bayswater and UFG

Source: Metro Trains Melbourne annotated by the OCI

Train 7255 then entered the single line section between FTG and UFG. At about 0947 the train stopped on the single line at signal L1161 which displayed a stop indication (Figure 3). Under network rules and procedures, the signal could have been passed and the train continue under caution. However, the driver advised that they decided to wait because they were aware that train 3109 was ahead and had probably not yet exited UFG.

Figure 3: Signal L1161 on the approach from FTG, annotated to show at stop

Signal L1161 has been annotated to show the signal aspect when at stop. Source: Still frame taken from Metro Trains Melbourne training video, annotated by the OCI

At around the same time, the station officer[2] at UFG returned to the signal panel after preparing a meal in the nearby office kitchen and observed the red illumination at track circuit 2RBK (Figure 4). 

Figure 4: Photograph of signal panel taken by station officer at 0947

Note 1: The distance between signals L1161 and 2L was approximately 830 track-m. Train 7255 was about 72 m long and therefore able to stand at signal L1161 without encroaching on the track circuit in advance of signal 2L. Hence, 2L was able to show a proceed aspect. Note 2: The signal panel was not capable of displaying an indication for signal 6 (L1161) when the trackside signal showed a stop aspect. Source: MTM, annotated by the OCI

Unaware that the red illumination was caused by the presence of train 7255 which was now stationary at signal L1161, the station officer, using switches on the panel, made an unsuccessful attempt to change the UFG departure signal (signal 18) to proceed in preparation for train 3148 (which was approaching from Upwey) to travel to FTG.

At 0950, train 3148 arrived into platform 1 at UFG. At 0951 train 3109 departed the station platform 2 towards Belgrave.[3] Train 3148 was then to depart UFG towards FTG but was held at platform 1 by departure signal 18 which continued to display a stop indication (Figure 5).

Figure 5: Home departure signal 18 at UFG platform 2 shown at stop

Source: Office of the Chief Investigator

The station officer recalled seeing a train at Bayswater station on the station CCTV. As train 7255 was not due to depart Bayswater until 0951, the station officer assumed that the train at the Bayswater station was train 7255. The train sighted was likely to have been train 3111, which had arrived at Bayswater station at 0951 and was due to depart the station at 1006.

Believing departure signal 18 would not clear because of a recurring track fault, the station officer contacted Metrol[4] and sought permission to issue a caution order[5] to the driver of train 3148. The Metrol train controller advised that the station officer had the authority to issue a caution order as they were the controlling signaller for both ends of the single line section. At 0953 a signal fault was logged by Metrol for the suspected fault advised by the station officer.

At 0954, the station officer issued a caution order to the driver of train 3148[6] to allow the train to pass signal 18. The caution order allowed the driver to proceed at no more than 25 km/h past signal 18 at stop and towards FTG. 

At 0958 the train departed and on reaching signal 18 tripped at the train stop[7] and came to a stop a short distance past the signal. The driver then reset the train’s systems to allow the train to proceed into the single line section towards FTG. This was the normal practice when a train stop was tripped after a train was allowed to proceed under a caution order.

As train 3148 proceeded towards FTG and the stationary train 7255, it did not exceed 20 km/h. After the train had travelled about 350 m, the driver sighted train 7255 stationary at signal L1161 and brought train 3148 to a stop at about 1001. Trains 3148 and 7255 were facing each other and about 300 m apart. Drivers of both trains contacted the station officer at UFG to advise of the situation. It was a clear day and visibility was good. 

No injuries or damage were reported. The incident resulted in significant delays to train operations on the Belgrave line.

Context

Melbourne metropolitan rail network

Overview

Metro Trains Melbourne (MTM) was the metropolitan train franchisee and accredited rail transport operator. MTM’s responsibilities included the operation and maintenance of the rail system assets, including the signalling system. 

For about 4 weeks leading up to the incident, there were no direct train services between Melbourne and Belgrave due to the level crossing removal works at Bedford Road, Ringwood. On the day of the incident the level crossing removal works were continuing and trains from Melbourne, which would normally travel to Belgrave were terminated at Ringwood and then returned to Melbourne. Trains from Belgrave which would normally travel to Melbourne were terminated at Bayswater and then returned to Upper Ferntree Gully (UFG). Buses had replaced trains between Ringwood and Bayswater.

The Belgrave Line

The incident occurred on the Ringwood to Belgrave line on the MTM rail network, in the single line section between Ferntree Gully (FTG) and UFG stations (Figure 6). FTG is about 35.8 rail km from Flinders Street Station in central Melbourne.

Figure 6: MTM station map - Belgrave line, east of Melbourne

Source: Office of the Chief Investigator

Train control on the metropolitan network

Overview

Metrol was the central signalling and train control centre for the Melbourne suburban rail network. Train controllers and signallers based at Metrol were able to control the points and signals within central Melbourne and some outer suburban areas. Metrol also controlled passenger information and coordinated emergency response. 

Outside the areas of Metrol’s control, train movements were managed by signallers or station officers located either in dedicated signal boxes or operating signal control panels at suburban railway stations. The Ringwood station signal box and UFG station signal box controlled local areas using signal control panels at each station.

There were also several sections of track on the metropolitan network known as ‘dark territory’. When a train was in dark territory, the signalling system did not pass train location information to a signal box. Trains within dark territory were controlled by the signals located within that section without intervention from Metrol controllers or locally based signallers. 

Fleeting signals

Controlled signals that were capable of being set to operate automatically and show a proceed indication when a section ahead was clear of rail traffic were termed fleeting signals. The provision of a fleeting signal at the entrance to a single line section was in accordance with MTM’s engineering standard for signal box workstations (2018). The standard advised that fleeting was used to provide the ability for signaller workload to be minimised during periods where direct control of the Home Signal was not required.

Train control on the Belgrave line

Overview

The Belgrave line between Ringwood and Belgrave was comprised of 3 control sections:

• local signalling between Ringwood and Bayswater by the Ringwood signal box
• a section of dark territory (with automatic signalling)[8] between the Bayswater and FTG and including Boronia
• local signalling between FTG and Belgrave by the UFG signal box.

Ringwood signal box 

The Ringwood signal box controlled train operations on the Lilydale line, the Belgrave line as far as Bayswater and the section between Ringwood and Blackburn. Three separate signal panels controlled the three sections. Station staff operated customer information system equipment from a separate room at the station. 

During the level crossing removal works, Ringwood signallers were signalling train movements at Bayswater and Ringwood, including turning around trains that terminated at Bayswater and Ringwood for their return trips to Belgrave and Melbourne respectively. 

Two signallers were rostered for duty at Ringwood signal box on the morning of the incident. The Ringwood signallers operated the signalling panels in two-hour shifts, rotating between signalling and their other duties. The first signaller started work about 0600 and handed over to the second signaller about 0800. 

On the morning of the incident, the train to become train 7255 was to have a change of direction (back towards UFG) at the crossover located about 500 m on the Ringwood side of Bayswater station (Figure 7). The train was provided with a proceed indication at signal BAY306, took the crossover and travelled towards platform 2 of the Bayswater station. 

Figure 7: Track and signalling layout at Bayswater

Source: Metro Trains Melbourne, annotated by the OCI

The platform 2 departure signal BAY310 was set to ‘fleeting mode’. This feature allowed the signal to provide a proceed indication as soon as the track ahead was clear of rail traffic. This also meant that trains could be provided a proceed indication in advance of their timetabled departure times. On the day of the incident, signal BAY310 displayed a proceed aspect when train 7255 approached the signal. This allowed the driver to pass the signal without stopping at platform 2 at Bayswater station and in advance of its scheduled departure time and proceed towards FTG.

Upper Ferntree Gully signal box

Control panel

The signal control panel at the station showed the signal aspects and the position of the points (Figure 8). Installed in 1962, the incandescent indicators on the panel illuminated red when sections of track were occupied but did not display a corresponding train number to show which train occupied the section. 

Switches, used to set points and signals were positioned close to the bottom of the panel. The panel was used to control points and signals between FTG station and the line’s terminus at Belgrave station and was one of only five such panels operating on the MTM network. 

Figure 8: UFG station signal control panel

Source: Office of the Chief Investigator

Train entry into section between Ferntree Gully and Upper Ferntree Gully

Departure home signal 2R, located at platform 2 of FTG station for outbound trains, controlled entry onto the single line section between FTG and UFG. Controls for that signal were on the signal control panel (Figure 9).

Figure 9: No. 2 control switch on the UFG signal control panel

Source: Office of the Chief Investigator

Signal 2R could be set to fleeting for train movements towards Belgrave by setting the control switch on the signalling panel to the ‘R’ position. The switch was in this position and set for fleeting when train 7255 approached platform 2 at FTG. Once train 3109 had cleared the single line section and arrived at the platform at UFG station, signal 2R provided a proceed indication which allowed train 7255 to enter the section at about 0945. 

Other positions for the control switch were ‘L’ and ‘N’ (Normal). With the switch in the ‘L’ position, the points at the Ferntree Gully end of the single line section were set to allow trains to travel towards Melbourne and signal 2L would show a proceed aspect if the track section ahead was clear of rail traffic. In the ‘N’ position, signals 2R and 2L would show a stop aspect and the points would remain in the last position used. With either the 2R or 2L position selected, signals 2R or 2L respectively would operate in fleeting mode, and continue to operate in fleeting mode until the switch position was changed by the signaller.

The settings of the signalling control panel at UFG were not recorded.

CCTV and passenger information systems

At UFG, a control desk was situated in the same room as the signal control panel. Monitors located on the control desk showed real time CCTV images of other stations on the Belgrave line (Figure 10). 

Figure 10: UFG control desk equipment

Source: Office of the Chief Investigator

Station staff could manipulate the CCTV images depending on the station they wished to view. A television monitor for the Passenger Real-Time Information Dissemination Equipment (PRIDE), an electronic timetable and announcement system that provided information to passengers, were also located on the control desk and displayed the location of trains to station staff (Figure 10). However, the PRIDE system could not be relied upon for signalling purposes as it did not always accurately indicate where trains were situated.

The PRIDE system in the Bayswater to Belgrave area relied on the Train Location Provider (TLP) system to indicate the location of trains. TLP used the timetable to update Train Description Numbers (TDN) once trains reached their destinations. In cases where the TLP could not determine a TDN from the timetable, it allocated an undescribed TDN (‘U’ Number) to the train. 

Because the TLP could not identify train 7255 when it left Bayswater to travel to UFG, the train was allocated a ‘U’ number (U076) within the PRIDE system. The train was shown located in the single line section between FTG and UFG (Figure 11). The PRIDE system also displayed scheduled departures for trains leaving Bayswater. At 0947 it indicated that train 7255 was scheduled to depart at 0951.

Figure 11: Screenshot of a recording of the PRIDE system at 0947, 25 February

Source: MTM, annotated by Office of the Chief Investigator

Communications

Telephone equipment on the UFG control panel was available to communicate with Metrol and Ringwood station staff. In the hours before the incident on 25 February, there were no telephone communications between the Ringwood signallers and the UFG station officer.

Drivers operating trains on the Belgrave line could communicate with UFG on the Digital Train Radio System and these conversations were recorded. On the day of the incident the driver of train 3148 contacted the station officer using his MTM‑issued mobile phone. These conversations were not recorded.

Staffing at Upper Ferntree Gully signal box

On the morning of 25 February and at the time of the incident, the station officer was working alone. Two other members of staff had been rostered to work at UFG that morning. One was scheduled to start at 0800 but was relocated to another station. The other was due to start at 1000 but arrived late as the train they were on was delayed by the incident. It was not uncommon for UFG to be staffed by one person. 

In the 4 weeks up until the day of the incident, of the 205 rostered shifts for all staff, 39 (19%) were not attended by the rostered staff member owing to sick leave, position vacancies, staff redeployed to cover absentees at other stations, training, and meetings. Five of the 10 positions that performed signalling duties at UFG were vacant at the time of the incident. 

Train location management and transfer 

Belling equipment and signals

Train operations on the MTM network outside of the Metrol controlled area were managed locally by various signalling control methods. In most cases the transmission of train numbers^[9] in the outer suburban network occurred electronically via the Train Number Transmitter (TNT) system. TNT required manual intervention by the signaller at each interlocked location to send train numbers onward to the next location. 

On the Belgrave line, signallers at Ringwood would typically inform signallers at UFG of the movement of trains using a belling system (Figure 12). 

Figure 12: UFG belling equipment

Source: Office of the Chief Investigator

MTM specified bell signal codes that were to be sent to the receiving signal box depending on the composition of the train (passenger train, ballast train, locomotive only). Specific codes were also required to repeat and cancel previous signals.

The Ringwood signaller would send a bell code to UFG when a train departed Bayswater and moved out of the Ringwood area of control. The receiving staff at UFG would send a reply bell code acknowledging the receipt of the original bell code. The system did not allow for train number information to be transmitted. 

The times that bell signals were transmitted was not recorded either electronically or by hand in the Ringwood signal box train register book, and the use of the belling system that day could not be verified. The Ringwood signaller on the day of the incident reported that they sent a bell signal to UFG signal box when train 3109 departed Bayswater station. However, they did not send a bell signal when train 7255 departed as they had not seen it depart on either the CCTV or the signal panel. They recalled being occupied performing other duties.[10] 

Annunciator bell

An annunciator bell was installed in the UFG signal box to provide an automatic audible notification that a train was approaching the station. 

The annunciator bell was designed to ring once when a train departed Boronia station towards FTG and occupied a specific track circuit (track circuit in advance of signal L1053). However, the bell would only ring if the section of track between signal L1119 and signal 2R at Ferntree Gully was clear of rail traffic (Figure 13).^[11] The station officer at UFG was not required to acknowledge receipt of the annunciator bell and its activation was not recorded.

Figure 13: Schematic of track and signals relevant to the incident location

Source: Metro Trains Melbourne, annotated by the OCI

Train register book

The signal boxes at UFG and Ringwood stations were both equipped with train register books. The train register books were used by the signallers to record activities relating to rail traffic and signals, including the movement of rail traffic. Section 26 of the Book of Rules and Operating Procedures (PTC 1994, incorporated into the MTM safety management system) required that information recorded in the train register include:

• the running of trains – details relating to the late running or alterations to the running of trains
• signaller ceasing duty – when finishing a shift, the signaller must sign off in the register under the last entry
• trains at stations – if a train occupies the platform at a station for more than 1 minute
• the time which electric bell signals were received (entered in the 'Train departure received' column)
• if a train is detained at a signal, the actual time and reason for detention must be recorded
• if a train is detained at a home signal, a notation must be made in the 'Remarks' column of the train register book stating the action taken by the signaller.

The Book of Rules also instructed signallers to advise the signaller on each side when leaving the signal box or signalling instruments and instructed supervising officers to check the train register book on each visit to a signal box.

Bell signals for trains departing Bayswater after about 0330 on the morning of the incident were not recorded in the UFG train register book (see Belling equipment and signals). Bell signals advising the departure of trains towards Upper Ferntree Gully from Bayswater were recorded correctly for all trains in the UFG register for only 15 of the 53 days of train operations prior to the day of the incident.

Review of the UFG train register book for the weeks preceding the incident showed that the train register book often contained entries that deviated from MTM procedures, including details of messages received not recorded, records of no-belling not recorded and details of signallers signing on and off not being recorded correctly.

Safeworking and caution orders

Train management

The safeworking system used at the incident location was known as Automatic and Track Control (ATC). Under ATC the authority to enter a section of track was given by signals located at the end of each section and arranged so that only one signal could be set to 'proceed' at a time. Once a train was in the section, a train travelling in the opposite direction could not be signalled to enter. Intermediate signals inside each section allowed multiple trains running in the same direction to enter the single line section. 

Caution orders

Procedure

The safeworking of trains was governed by the Book of Rules. On the MTM network procedural safeworking was used when the signalling system failed. It permitted the ongoing operation of the network through the use of caution orders. A caution order was issued by a train controller^[12] or signaller and it gave a train driver authority to pass a signal at stop in accordance with network rules. 

The safeworking system in place at UFG specified that the signaller was to complete a caution order form and hand it to the driver. The signaller was expected to ensure the points ahead of the signal were correctly set and that there were no trains in the section prior to the issuing of the caution order. The signaller was also required to note in the train register book^[13] when a caution order was issued and, when the train departed, advise the train controller^[14] and signaller in the area ahead.

The issuing of a caution order in this incident

Train 3148 was held at the platform at UFG by home departure signal 18 which displayed a stop indication. Due to their belief that the departure signal 18 would not clear because of a recurring track fault, the station officer issued a caution order to the driver of train 3148 to allow the train to pass signal 18 (Figure 13).^[15]

Operating procedures did not require the UFG signaller to seek authorisation when issuing an ATC caution order. 

Figure 14: Caution order provided to the driver of train 3148

Source: MTM, redacted by the OCI

The station officer at Upper Ferntree Gully

The station officer on duty at UFG on the day of the incident was performing the functions of a signaller. They had been carrying out signalling duties for about 6 months since completing their training for the UFG signal box. Prior to undertaking the functions of a signaller, they were engaged in customer service roles. The station officer was medically fit for duty. The station officer undertook mandatory drug and alcohol testing after the incident, returning negative results.

The station officer had not been rostered to work from 17 to 21 February, although they had attended training on 19 February. From 22 February to the day of the incident, the station officer began early morning shifts, commencing at about 0315 each day. The station officer was rostered to start work at 0315 on the day of the incident, which was their fourth early morning shift start in a row. 

Station officer responsibilities included the signalling of trains and other safeworking duties, providing information to passengers via the public address system and dealing with passenger ticketing and enquiries. 

Signaller training

Signallers working the UFG signal box were required to be qualified in the ATC safeworking system and for signalling specific to the location. New signalling staff at UFG learnt how to use the signalling panel by shadowing a qualified member of staff and operating the panel under supervision. 

The examination for the UFG panel listed 28 ‘topics of questions’ which required the station officer to demonstrate, amongst other criteria, that they could safely operate the signal panel and explain actions required when equipment failed. The checklist did not include a demonstration of how to use the train register book. 

The station officer on duty at the time of the incident held the relevant competencies for UFG, having successfully passed both the ATC and the examination to operate the UFG panel.

Prior to the COVID-19 pandemic, safeworking refresher training specific to the UFG signal box was conducted with staff performing signaller duties, however this was postponed because of the pandemic and had not been reinstated.

Reported signalling faults

A record of reported signalling faults (excluding graffiti on signal signage) affecting the single line section between FTG and UFG in the 2 weeks before the incident is shown in Table 1. The fault that occurred on 21 February 2024 would likely have resulted in the UFG signalling panel indicating that the single-track section was occupied by a train when it was not. This signalling fault was rectified on the same day.

Table 1: Signalling faults affecting the incident location

Source: MTM

[1]    A Proceed Authority Exceedance is when a train exceeds the Limit of Authority. In this instance a loss of power resulted in a signal reverting from a proceed aspect to a stop aspect. The signal aspect changed from proceed to stop as a train approached and without enough time for the train to be stopped before reaching the signal. 

Risk management

Risk of train-to-train collision

MTM had identified two trains in the same section as being a risk source for a train‑to‑train collision, and ‘human error’ as a cause/precursor for that risk source. The level of risk had been estimated for the whole MTM network rather than specific sections of line. 

At the time of the incident, MTM had noted the following controls relating to cause of human error:

• fatigue management policy and standard, supported by local plans
• speed restrictions
• station staff (some acting in a signaller role) compliance to Book of Rules and Operating procedures
• signaller / Metrol training
• route risk analysis when change to rail operating environment
• asset strategy (Signalling).

The MTM train to train collision between Metro Trains risk register included ‘RTPOTS (Real time position of train) for a train position visual aid (verification only)’ as a proposed control. This control was classified as closed, although was unavailable at Upper Ferntree Gully. 

MTM had not undertaken a risk assessment for train collision specific to the section between UFG and FTG, and there was no requirement for a location specific risk assessment in the MTM SMS.

In May 2023 MTM undertook a train collision risk review^[16] during which consultation occurred with relevant key stakeholders with the intent ‘to provide clarity and improve accountability and captured key risk scenarios and causes.’

The review identified ‘Incorrect authority’ as a train collision risk factor. Preventative controls documented by MTM for this risk factor included:

• double validation of instruction given (caution order)
• signalling control system (e.g. TCMS (Train Control Management System), Sigview, Railview’^[17]
• ensure section is unoccupied before providing authority to proceed
• nominated safe speed to proceed.

Fatigue

A fatigue risk register for UFG (MTM 2022a) identified ‘insufficient staff’ as a cause for the risk of fatigue, however no controls had been documented in the register against this cause. ‘Insufficient break time (or allocated)’ had also been identified as a cause. The MTM Fatigue Risk Management Plan Station Operations (2023c) had been listed as a control against the cause of insufficient break time. However, the plan did not reference break times within shifts. There was no evidence that MTM had assessed the risk of station officer fatigue caused by working a shift without a break.

Level crossing removal project (LXRP)

On 5 December 2023 MTM undertook a risk assessment workshop to assess the running of a fleet of trains between Belgrave and Bayswater during the LXRP works. The scope of the workshop was defined as:

Risk assess SW3688 Captive Fleet Operations and the associated occupation (BED03 Commissioning Occo), including Captive Fleet Running, which includes deviations from ensuring overhead mainline traction section is supplied by two circuit breakers from independent substations as required by MTM A1531 Electrical Networks Systems Standard, Cl9.4..5.

The context of the workshop was described as ‘The proposed works are noted to pose risks to assets and network operations.’ The workshop involved representatives from operations, signalling and other engineering disciplines and from MTM’s human factors section.

The workshop recorded the following 7 risk events:

• failure of a single circuit breaker, cutting power resulting loss of power to track
• train services unable to be delivered
• damaged or vandalised trains unable to be replaced (due to the occupation), resulting in reduced numbers of captive fleet trains
• train drivers experiencing issues with the positioning of trains (i.e. station platforms) resulting in impeded train onboarding and/or passenger trips and falls
• 3 car captive fleet trains beating level crossing times, resulting in train to vehicle collision
• failure of equipment causing delays to operations/handback or train breaching occupation area
• train driver disruptions and potential industrial relations issues.

No changes were made to the configuration of the signalling in the applicable area as a result of the risk assessment.

MTM had previously identified ‘human error’ as a cause/precursor to two trains being in the same section (MTM 2023b) and had identified ‘Route risk analysis when change to rail operating environment’ as a risk control. While the workshop conducted on 5 December 2023 considered the 7 risk events noted above, it did not identify risk factors that may have affected the signallers’ ability to undertake the signalling of trains between Bayswater and Belgrave during the LXRP works. 

MTM audit of signal boxes and signallers 

MTM had an assurance program that audited both individual signallers and signal boxes. Those performing signalling duties were scheduled to be audited every 12 months. Signallers were often qualified to operate more than one signal box, and the location of signaller audits could be undertaken at any signal box at which they were qualified to work. Some signallers working at UFG were overdue their 12-monthly audit. 

Signallers were also audited by MTM in their safety critical communication skills at least once per year. The station officer on duty at UFG had completed their training about 6 months prior to the incident and had not yet been audited. 

Separate audits of the signal boxes (not specific to individual signallers) were also scheduled to be undertaken by MTM about every 12 months. Both individual and signal box audits could include inspection of the train register book within their scope. 

Prior to the incident, 6 audits of the UFG signal box had been conducted by MTM since 17 May 2019, with the most recent on 9 July 2023. Two of these 6 audits, conducted in 2019 and 2020, recorded non-conformances associated with filling in the train register book. No non-conformances in relation to the train register book had been recorded by MTM since 2020.

MTM had also instituted a program of signal box audits specifically focused on occupations, such as when line engineering works were being undertaken at night. Fourteen audits of the UFG signal box were undertaken between 7 October 2020 and the time of the incident that were specific to occupations on the Belgrave line. The last occupation audit at the signal box had been undertaken on 12 August 2023. Four of these MTM audits recorded non-conformances in relation to the recording of occupation information into the train register book. The last non‑conformance prior to the incident had been made in January 2023. 

In addition to audits, ad hoc checks were undertaken by Rail Incident Controllers who visited signal boxes.

Trains and drivers

The trains involved in the incident were train 7255, which was not in service and travelling from Bayswater to UFG where it was to be stabled, and train 3148, a scheduled passenger service between Belgrave and Bayswater. Trains 7255 and 3148 were introduced to the timetable on 5 February 2024, along with other timetable changes, as a result of the level crossing removal works.

Both trains were comprised of 3-car Alstom X’Trapolis sets. Train 7255 was empty of passengers. Train 3148 had about 15 passengers on board.

Both drivers had booked on for duty on the morning of the incident. Both drivers were qualified and experienced on the Belgrave line.

Related occurrences

On 31 May 2022, the UFG station signaller issued a caution order to a train driver giving permission to depart. The signaller had commenced to set the points but did not check that they were set prior to issuing the caution order. The duty station master realised that the points were not set properly and advised the driver not to depart. It was determined that the caution order was issued 6 seconds prior to the points being set. 

The findings from the MTM investigation (MTM 2022b) included:

• consistent track faults affecting the Belgrave Line
• increase in errors and incidents over the preceding 8 weeks
• increased vacancy rate across stations staff in the Burnley Group. 

Actions identified by MTM to prevent recurrence included:

• reinstate refresher training
• round table workshop of key stakeholders to explore a Safety Improvement Plan for UFG panel
• review of the resource plan for Burnley Group including Occupation planning. 

Safety analysis

Introduction

This safeworking incident involved opposing trains concurrently being in the single line section between Ferntree Gully (FTG) and Upper Ferntree Gully (UFG). Train 7255 had entered the section departing FTG station under normal signal proceed indications and then stopped mid-section awaiting a signal to clear. Unaware that train 7255 was in the section, the station officer at the UFG signal box issued a caution order to train 3148 giving its driver permission to pass the station departure signal (which was at stop) and proceed towards FTG. After entering the single line section, the driver of 3148 observed train 7255 ahead and stopped their train about 300 m clear of 7255. 

The analysis discusses:

• Issuing of the caution order
• Validation of the caution order
• Train information at UFG
• Fleeting signals
• Belling systems
• Network rules and procedures
• Risk management of the level crossing removal project
• Reduced speed as a risk mitigation
• Recording of communications.

Issuing of the caution order 

The station officer’s belief that the section between UFG and FTG was clear of other trains was probably initially established by their expectation that train 7255 was not due to be in the section. When train 3148 arrived from Belgrave at about 0950, train 7255 was scheduled to have not yet departed Bayswater. The station officer had also not heard any bell signals that may have alerted them to the earlier departure of 7255.

The station officer’s subsequent assessment of information was probably influenced by confirmation bias. This type of bias is when information is perceived in a way that confirms an existing assumption or information is discarded if it is contrary to that assumption.

The presence of a train was indicated on both the UFG signal control panel and the Passenger Real-time Information Dissemination Equipment (PRIDE) display although neither identified the number of the train. In contrast, the PRIDE system showed the scheduled departure of 7255 from Bayswater as 0951. Further, the station officer observed a train at the Bayswater platform on the CCTV and based on the schedule, assumed that the train still at the Bayswater station was train 7255.

In processing the available information including the display information, the station officer concluded that the train detections shown on the signal panel was the result of a system fault rather than indicating the presence of a train. The station officer was aware of a fault that occurred on 21 February where a track occupancy was indicated between FTG and UFG but no trains were present. 

The station officer called Metrol to confirm that a caution order could be issued, and to report the perceived fault. Although the Metrol controller was probably intending to simply confirm to the station officer that they had the authority to issue a caution order, the conversation probably reinforced with the station officer that they were correct to be issuing the order. 

The station officer was in the latter part of their shift, had been working alone (increasing workload) and their sleep patterns in the days prior to the incident were consistent with an elevated likelihood of fatigue. However, there was insufficient evidence to conclude that fatigue contributed to this event.

Validation of the caution order

The station officer at UFG was working alone on the morning of the incident. Other staff had been rostered to work at UFG but had become unavailable for that shift. It was not uncommon for UFG to be staffed by one person, placing additional load on the individual at times of higher operational activity. 

MTM had previously identified that ‘double validation’ of instructions was a control to assist in the mitigation of risks associated with single person errors. Checking by a second person was reflected in the caution order form that called for signing by the signaller and the train controller. However, for the section under UFG signalling control (and some other similar sections on the network), it was normal for a station officer to perform all the signalling duties and there was not a separate train controller. That meant that caution orders at these locations on the network could be issued without second person validation, removing a risk control to reduce the likelihood of a single person error.

Train information at Upper Ferntree Gully

UFG signal box was equipped with a range of equipment and systems for the management of trains within its control area. The primary train monitoring facility was an older style signal panel which showed detected trains between FTG and Belgrave. However, unlike much of the modernised parts of the MTM network, the panel did not provide train specific identification of detected trains shown on the panel.

In the absence of this direct train identification information, there was a reliance on other information sources and administrative procedure to maintain an awareness of the location of each train in the control area.

Fleeting signals

Some signals have a facility to be set to fleeting for operational reasons and to minimise signaller workload during periods where direct signaller control of the signal is not required. Fleeting allows signals to operate automatically and clear to proceed when the required sections ahead are clear of trains.

In this instance, the departure signals at both Bayswater (controlled by Ringwood) and FTG (controlled by UFG) were set to fleeting. Train 7255 was able to pass through Bayswater station towards FTG without stopping, ahead of schedule and without the awareness of the Ringwood signal box. Then, at FTG, train 7255 was able to proceed into the single line section towards UFG without the awareness of the station officer at UFG.

It was not uncommon for non-revenue service trains to depart towards Belgrave on receiving a proceed aspect rather than wait for their scheduled departure times.

Belling systems

Bell signals from Ringwood

A belling system was used to communicate a train’s departure from Bayswater towards FTG. The belling process involved the sending of a bell signal to UFG by the Ringwood signaller and acknowledgement by a return bell from the UFG station officer. 

The departure of train 7255 was not accompanied by a bell signal by Ringwood to UFG. This removed a potential indicator to the station officer that train 7255 had departed early. 

The belling for other trains departing Bayswater towards FTG could not be confirmed due to the absence of recording. It is possible that the disrupted operations associated with the level crossing removal works impacted the normal belling routine of the Ringwood signal box. The track closure associated with the works resulted in shuttle operations between Bayswater and Belgrave and changes to a routine activity.

Annunciator bell

An annunciator bell at UFG station was designed to automatically ring when a train departed Boronia station which was located in dark territory. The system used train detection on track circuits and was designed for the bell to be inhibited if the section between signal U2R (L1119) and signal 2R was not clear. 

The signalling log showed that the section of track between signal U2R and signal 2R was probably occupied by train 3109 (travelling ahead of 7255) when train 7255 entered the circuit to trigger the annunciator. It is therefore probable that the annunciator did not ring, removing a potential audible indication of an approaching train. 

Network rules and procedures

Application of procedure

The train register book was an important tool used in signal boxes to record information about the movement of rail traffic, with each train movement logged by hand. At UFG signal box, the train register also recorded the times that bell signals were received from the Ringwood signal box. 

During the station officer’s shift that morning, there were no times recorded for the receipt of bell signals for the departure of trains from Bayswater were not recorded for any train. Review of records for the previous weeks also suggest missing bell signal entries on several occasions and other deviations from MTM procedure.

Record keeping at Ringwood did not require Ringwood to record the time the bell signal was sent to UFG nor the acknowledgement from UFG. Due to the absence of records, the effectiveness of the belling exchange could not be determined.

It was also identified that signallers at Ringwood and Upper Ferntree Gully were unaware of the correct bell code patterns to use when bell codes were to be sent between the signal boxes. 

Internal audit of signal box procedure application

Review of train register books and MTM internal audit records indicated that audits did not routinely detect and rectify deviations from MTM network rules. In particular, the time bell signals were received were often not recorded. 

The MTM assurance program also included the annual auditing of persons undertaking signalling duties on the network. An analysis of audit records revealed that several staff members undertaking signalling duties at UFG were overdue for their annual signalling audit.

Risk management of the level crossing removal project

Train operations in the section were disrupted due to level crossing removal project (LXRP) works between Ringwood and Bayswater. This meant that for several weeks trains were only operating between Baywater and Belgrave, and trains returning from Belgrave would be terminated at Bayswater and their direction changed for the return journey.

MTM conducted a risk assessment for the LXRP works and train operations between Bayswater and Belgrave. However, this assessment did not consider factors associated with the disruption which may have affected the signalling of trains between Bayswater and UFG. As a result, additional risk controls were not considered.

Reduced speed as a risk mitigation

Travel under a caution order required the train to be driven at a speed not exceeding 25 km/h and so that it could be stopped in half the distance that could be seen ahead. In this instance, the driver of train 3148 proceeded at a speed less than 20 km/h and consistent with this requirement. 

The outcome was assisted by train 7255 remaining stopped at the mid-section automatic signal that was at stop. This signal could have been passed under certain conditions, which included not exceeding 25 km/h, although in this instance the driver decided to wait. Had 7255 proceeded, the procedural maximum closing speed of the 2 trains would have been 50 km/h.

The caution and actions exercised by both train drivers mitigated the risk of a train‑to‑train collision despite two trains being in the same section.

Recording of communications

The investigation noted that several safety communications and operator activities undertaken by the signallers and station officers at Ringwood and UFG were not recorded. Signalling and control panel activities at UFG including the setting of points and signals, and the operation of the belling equipment and the annunciator bell were not recorded. The operation of the belling equipment at Ringwood station was also not recorded. The investigation also noted that communication between the driver of train 7255 and the station officer on the day of the incident was not recorded. 

As a result of an incident at UFG in 2015 (ATSB 2015) MTM advised that they would ‘consider a system modification to capture all safeworking communications at UFG’. The recording of safety communications provides significant benefits when determining the circumstances surrounding an incident and may mitigate the likelihood of similar incidents.

Findings

From the evidence available, the following findings are made with respect to the safeworking incident involving MTM trains 3148 and 7255 at Ferntree Gully, Victoria, on 25 February 2024.

Contributing factors

• The station officer at Upper Ferntree Gully issued a caution order for train 3148 to enter the single line section between Upper Ferntree Gully and Ferntree Gully while train 7255 was in that section. The station officer believed the section was clear of other trains and the failure of signals to clear for train 3148 was due to a system fault.
• At Upper Ferntree Gully (and some other parts of the MTM network), the issuing of a caution order did not require validation by a second person. (Safety issue)

Other factors that increased risk

• The signal control panel at the Upper Ferntree Gully signal box did not provide direct train-specific identification information for the monitoring of trains between Ferntree Gully and Belgrave. Compared to modern systems, this placed a higher reliance on procedural systems.
• The departure signals at Bayswater and Ferntree Gully stations were set to fleeting which meant the Upper Ferntree Gully-bound train 7255 could depart both stations without signaller intervention or awareness.
• A bell signal was not sent by the Ringwood signal box to the Upper Ferntree Gully signal box to notify Upper Ferntree Gully of the departure of train 7255 from Bayswater towards Ferntree Gully.
• The annunciator bell, installed at Upper Ferntree Gully to advise the station officer of a train’s departure from Boronia station towards Ferntree Gully did not ring for train 7255. This was a result of a design feature of the system and train 7255 following closely behind train 3109.
• Procedures associated with managing trains between Bayswater and Upper Ferntree Gully were inconsistently applied and gaps in protocols and record‑keeping probably impacted the effectiveness of the systems. (Safety issue)
• MTM assurance and audit processes for signal box management was ineffective in addressing deviation from MTM train control processes on the Belgrave line.
• A risk assessment conducted for the level crossing removal did not consider factors that may have affected the signalling of trains between Bayswater and Upper Ferntree Gully.

Other findings

• The driver of train 3148 drove at a speed less than 20 km/h after being issued the caution order and in accordance with MTM procedures. This mitigated the risk of a train‑to‑train collision despite two trains being in the same section.
• Several safety critical communications and signalling operations were not recorded at Ringwood or Upper Ferntree Gully signal boxes.

Safety issues and actions

Validation of the caution order

Safety issue number: RO-2024-001-SI-01

Safety issue description: At Upper Ferntree Gully (and some other parts of the MTM network), the issuing of a caution order did not require validation by a second person.

Application of procedure

Safety issue number: RO-2024-001-SI-02  

Safety issue description: Rules and procedures associated with managing trains between Bayswater and Upper Ferntree Gully were inconsistently applied and gaps in the recording protocols at Ringwood probably impacted the effectiveness of the administrative systems.

Safety action not associated with an identified safety issue

Additional safety action by Metro Trains Melbourne

Metro Trains Melbourne has commissioned changes to the control circuitry to remove the capability of fleeting movements onto the single line section between Ferntree Gully and Upper Ferntree Gully.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• MTM staff
• station CCTV from Bayswater and Upper Ferntree Gully
• MTM train data logger recordings
• MTM radio and telephone communications
• MTM Customer Information System data.

References

ATSB (Australian Transport Safety Bureau) (2015) Rail Occurrence Investigation Report RO-2015-008 Signals Passed at Danger by passenger train TD3050, Victoria, on 12 April 2015, Australia.

Lim, J., & Dinges, D. F. (2010). A meta-analysis of the impact of short-term sleep deprivation on cognitive variables. Psychological bulletin, 136(3), 375–389.

MTM (Metro Trains Melbourne) (2018) Engineering Standard- Signalling, Signal Box Workstation Specification, L1-CHE-STD-072, Version 1.

MTM (Metro Trains Melbourne) (2019) Technical Note – Vital Blocking, L1-CHE-INS-062, Version 1, dated 26 July 2019.

MTM (Metro Trains Melbourne) (2021a) Train Collision Risk Review (Level 3 – Assurance), Document A1898, Version 3, dated 21 December 2021.

MTM (Metro Trains Melbourne) (2021b) Fatigue Risk Management Standard, Document A8174, Version 1.

MTM (Metro Trains Melbourne) (2022a) Risk Assessment Report - 05112022 Exposure to Fatigue - Stations, dated 08 April 2022.

MTM (Metro Trains Melbourne) (2022b) Detailed Incident Investigation Report, INX180022, Safeworking Breach at Upper Ferntree Gully, 31 May 2022.

MTM (Metro Trains Melbourne) (2023a) Burnley Group Operating Procedures, Document number A8253, Version 22.

MTM (Metro Trains Melbourne) (2023b) Risk Assessment Report, Top train collision risk review, Reference No. 217386, dated 17 May 2023.

MTM (Metro Trains Melbourne) (2023c) Station Operations – Fatigue Risk Management Plan, Document A6236, Version 3, dated 17 April 2023.

MTM (Metro Trains Melbourne) (2024) Signalling diagram 95/23, Heathmont to Belgrave, 3 January 2024.

Public Transport Corporation (PTC) Book of Rules and Operating Procedures (1994), Revision 7.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A confidential copy of the draft report was provided to involved parties and agencies. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Rail safety investigations in Victoria  Most transport safety investigations into rail accidents and incidents in Victoria and New South Wales (NSW) are conducted in accordance with the Collaboration Agreement for Rail Safety Investigations and Other Matters between the Commonwealth Government of Australia, the State Government of Victoria and the State Government of New South Wales. Under the Collaboration Agreement, rail safety investigations are conducted and resourced in Victoria by the Chief Investigator, Transport Safety (OCI) and in New South Wales by the Office of Transport Safety Investigations (OTSI), on behalf of the ATSB, under the provisions of the Transport Safety Investigation Act 2003. The Chief Investigator, Transport Safety (OCI) is a statutory position established in 2006 to conduct independent, no-blame investigation of transport safety matters in Victoria. OCI has a broad safety remit that includes the investigation of rail (including tram), marine and bus incidents. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.