The Australian Transport Safety Bureau has commenced an investigation into an incident involving the container ship CMA CGMPuccini when departing Port Melbourne on 25 May 2023.
The following is attributable to ATSB Chief Commissioner Angus Mitchell:
“On 25 May, CMA CGM Puccini departed its berth in Swanson Dock under the conduct of a harbour pilot. During the ship's transit of the Yarra River it is reported that the ship experienced a steering gear failure.
“While the pilot and crew were responding to the steering failure, the ship moved to the side of the channel and contacted a navigation beacon, damaging it. A short time later, some steering control was restored, and the pilot called the two tugs that had attended for unberthing to assist the ship.
“The ship was then moved to a berth in Webb Dock, where the Australian Maritime Safety Authority detained it while technicians and others conducted checks and inspections of its steering gear and hull on 25 and 26 May.
“The steering gear was found operational, and no defects were identified. An underwater hull inspection did not identify any damage due to the incident or evidence of grounding. The ship was released from detention on the evening of 26 May and it subsequently departed Port Melbourne without incident.
“As part of its investigation, the ATSB will examine the circumstances leading to the steering gear failure and the response to it, determine any contributing factors to the failure and related safety issues.
“The ATSB deployed a team of investigators with experience in marine navigation, engineering and data recovery to interview the ship's master and crew, and the pilot and other relevant persons, to inspect the steering gear and systems, to download and analyse recorded data for the incident, and to examine relevant records and documents.
“Should a critical safety issue be identified at any time during the investigation, the ATSB will immediately notify the operators of the ship and the port, and other relevant parties so that appropriate and timely safety action can be taken. A final report will be published at the conclusion of the investigation.”
The Lycoming O-360 engine of a four-seat MS.893A Rallye light aircraft which failed during a ferry flight from Moruya to Archerfield, resulting in a forced landing and serious injuries to the pilot, had not been overhauled in more than two decades.
The ATSB’s investigation report from the 6 November 2020 accident details that the pilot experienced a catastrophic engine failure when they were about 37 km from their destination. With their forward visibility reduced due to engine oil over the windscreen and smoke created by escaping oil on the exhaust system, the pilot force landed in a paddock, with the aircraft striking trees.
Witnesses found the unconscious pilot had been thrown from the aircraft and moved them to safety before the aircraft was consumed by a post-impact fire.
“The ATSB’s investigation found the separation of the number 2 piston connecting rod initiated a catastrophic mechanical failure of the engine,” ATSB Director Transport Safety Dr Stuart Godley said.
The engine had not been overhauled since 1997, and had had limited usage for an extended period, possibly with no specific engine preservation done while in storage.
“Had the engine been overhauled at the manufacturer’s recommended calendar time, the connecting rod journal bearings would have been replaced with post-modification bearings,” Dr Godley said.
“This accident highlights the need for owners and maintainers to be cognisant of the manufacturer’s service information, to ensure the serviceability of engine and airframe systems are maintained to the highest standards.”
In addition, the pilot had been ferrying the aircraft on behalf of the owner and had limited aircraft type experience and knowledge of its performance capabilities.
“The pilot was unaware of the aircraft’s slow speed performance capability, a full understanding of which capability may have been beneficial when responding to the engine failure and forced landing,” Dr Godley said.
The investigation also found that the aircraft was not fitted with a fixed or portable emergency locator transmitter, and that the pilot did not leave a flight note with a responsible person.
“Fortunately the forced landing occurred in a populated area and there were witnesses to the accident who were able to render assistance and call emergency services,” Dr Godley said.
Personnel involved in maintenance and operations of R44 helicopters should be aware of the risks posed by the failure of the drive belt tensioning motor, as demonstrated by an incident at Hamilton Island in January.
On 8 January 2023, the pilot of an R44 was on approach to Hamilton Island Airport, Queensland, when they noticed a persistent clutch warning light.
The pilot carried out the clutch warning light emergency procedure, and landed at the airport.
Ground crew found the clutch actuator electric drive motor had separated from the gearmotor assembly, and fallen between the drive belts and the right-hand fan shroud.
“A subsequent Australian Transport Safety Bureau investigation found that during assembly of the gearmotor, the required thread adhesive was either not applied, or applied in a manner that did not prevent the loosening of the electric motor retaining nut,” ATSB Director Transport Safety Stuart Macleod said.
“Consequently, over time, normal aircraft vibrations loosened the retaining nut, resulting in the clutch actuator electric motor separating from the gearmotor assembly in flight.”
Robinson Helicopter Company advised the ATSB they are working with the component manufacturer to rectify identified quality issues with the gearmotor assembly.
Robinson said it is also considering updating the procedures for the inspection of the clutch actuator assembly.
“This incident is a reminder to R44 maintainers and operators to be aware of the risks posed by the failure of this component, specifically the risk of a loose component interfering with the v-belts and impacting rotor drive,” Mr Macleod said.
“The ATSB encourages pilots and maintenance engineers to physically check the security of the R44 clutch gearmotor assembly on a regular basis.”
Additionally, Mr Macleod emphasised that any discovered defects should be rectified, and reported to the Civil Aviation Safety Authority, and the manufacturer.
The propeller blade of a Beech 1900D regional airliner sheared off after it was struck by matting that had been installed to prevent stone damage to propeller blades at a gravel aerodrome.
The Australian Transport Safety Bureau investigation report from the incident notes that on 17 November 2022, the flight crew of the Beech 1900D, operated by Penjet, refuelled and then boarded passengers at Fortnum Aerodrome, in WA’s Murchison region, for a flight to Perth.
The runway, taxiways, and parking area at Fortnum are gravel. At the time of the incident, there were designated parking areas with pieces of conveyor belt matting fixed to the ground, intended to allow engines to be operated with minimal propeller damage from loose gravel.
“As the flight crew was conducting pre-take-off checks, the end of the conveyer belt matting under the left propeller was drawn into the propeller arc, resulting in a sheared propeller blade and vibration damage to the aircraft,” ATSB Director Transport Safety Stuart Macleod said.
The aerodrome manager, who witnessed the event, detailed that the propeller picked up a corner of the matting and one propeller blade was ejected about 50 to 100 m in the air.
In addition to the detached propeller blade, another propeller blade snapped approximately 250 mm from the blade tip, and the left engine propeller governor control arm fractured.
There was also buckling to the left engine firewall and cracking to the nacelle structure adjacent to the engine mount.
Since the incident, the aerodrome operator has removed the strips from the apron.
“The installation of the matting was a non-standard method to prevent propeller damage, and was not subject to any installation specifications or inspection requirements,” said Mr Macleod.
“As this occurrence demonstrates, the consequences of a propeller strike can be serious, and operators of aircraft and aerodromes are advised to review the use of any non-standard surfaces for aircraft movement areas.”
Under section 13AE of the Transport Safety Investigation Act 2003 and in line with section 29 of the Public Governance, Performance and Accountability Act 2013, Commissioners must declare to the Minister any interests which are material personal interests.
In accordance with section 13(7) of the Code of Conduct contained in the Public Service Act 1999, an APS employee must:
a) take reasonable steps to avoid any conflict of interest (real or apparent) in connection with the employee's APS employment
b) disclose details of any material personal interest of the employee in connection with the employee's APS employment
Our Conflict of Interest Policy provides guidance for all employees, Commissioners and contractors to disclose and take reasonable steps to avoid and manage any conflicts of interest connected to their employment.
Bulk ore train was unable to slow down and collided with rear of stationary wagons;
Final report details ten findings, including three safety issues addressed by relevant parties;
Accident highlights importance of ensuring published rules and procedures are followed, with effective monitoring and auditing.
An Australian Transport Safety Bureau investigation into an empty ore train’s collision with stationary wagons has led to the operator and Australia’s rail standards board taking a number of safety actions.
A driver was unable to slow a bulk ore train as it approached a bauxite loading station north of Weipa, resulting in a collision with a rake of stationary wagons on 22 September 2019.
As detailed in the ATSB’s preliminary report, the locomotive and four wagons from the stationary rake derailed in the collision. The modular driver’s cabin separated from the main body of the locomotive and was substantially damaged, and the driver was initially trapped inside, but fortunately sustained only minor injuries.
The ATSB’s final report, released at the conclusion of a systemic-level investigation into the accident, details 10 safety factors, which either contributed to the accident, or increased risk.
These include three safety issues, which have now been addressed by the operator RTA Weipa Pty Ltd, the Rail Industry Safety and Standards Board (RISSB), and the locomotive’s design owner.
“The ATSB’s investigation found the driver was not able to slow the train as there was no continuity of air through the train’s brake pipe,” Chief Commissioner Angus Mitchell said.
“This was due to the brake pipe cock not being opened when the locomotive and rake were coupled together, prior to the accident journey.”
Compounding this, the ATSB found a brake continuity test was not performed during the pre-departure check – a missed opportunity to detect the issue.
“The coupling process being used was inconsistent with the published procedure, and routine audits conducted by the operator did not identify this inconsistency,” Mr Mitchell said.
Additionally, the investigation found management of change processes were not applied when the end of train telemetry system became inoperable, and the Lorim Point dump station became automated.
“This accident highlights the importance of ensuring that published rules and procedures are followed, through an effective monitoring and audit process, which is fundamental to rail safety,” Mr Mitchell said.
“Likewise, changes to rail operations need to be adequately managed to identify new or altered risks.”
As a result of the accident, RTA Weipa has installed a revised telemetry system to allow drivers to perform brake continuity tests without relying on a second person. In addition, the operator has introduced safety improvements to the manual brake continuity testing, and all relevant team members have been re-trained in the test requirements.
The ATSB’s investigation also found the design of the modular driver’s cabin mount was not resilient to frontal impact forces, and the industry standard did not provide design and/or performance standards for modular cabin resilience and retention for locomotive crashworthiness.
Since the accident, RISSB has included modular cabin retention within the update to Australian Standard 7520, which is underway.
Separately, the locomotive’s design owner, Progress Rail, has re-engineered the modular cabin mounts to improve strength, to reduce the risk of cabin separation in the event of a collision.
“One of the ATSB’s primary goals is to encourage safety action to prevent reoccurrences when safety factors are identified, and I welcome the actions taken in response to this accident,” Mr Mitchell said.
On 24 May 2023, a Queensland Rail suburban passenger train (TE43) was operating a scheduled service between Coopers Plains and Ferny Grove in Brisbane, Queensland. After stopping at Fortitude Valley Station platform 2, the driver continued their trip, passing a signal (BS07) that was displaying a yellow aspect (caution indication) at the northern end of the platform. The next signal ahead (CS025) displayed a red aspect (stop indication) due to another train (EM03) that was ahead of a further signal (CS027) and waiting to enter Bowen Hills Station.
Between Fortitude Valley Station and signal CS025, the driver of train TE43 reported that they had a sudden sneezing fit. Approaching signal CS025 at red, the driver acknowledged the in-cab Automatic Warning System alarm and shortly after, realising the signal was at stop, applied emergency braking. Train TE43 passed signal CS025 by about 64 m, stopping prior to signal CS027 and about 296 m behind train EM03.
After train TE43 stopped, the driver contacted the Queensland network control centre to report a signal passed at danger (SPAD). The network control officer subsequently issued an authority for the driver to proceed to Bowen Hills Station, where they were relieved from duty. There were no injuries to passengers or crew, and no damage to either the train or infrastructure.
What the ATSB found
The driver likely experienced a degree of impairment arising from the sneezing reflex, which adversely affected their control of train speed and observance of the signal aspect displayed on signal CS025. Additionally, the multiple automatic warning system (AWS) alerts previously acknowledged by the driver during the trip, possibly in conjunction with the impairment arising from the sneezing fit, likely influenced the driver’s action to acknowledge the AWS alarm and not identify the red aspect in signal CS025 until it was too late to prevent passing it.
The ATSB previously identified the AWS provided the same audible alarm and visual indication to a driver on the approach to all restricted indications. The potential for habituation, and the absence of a higher priority alert when approaching a signal displaying a red aspect, reduced the usefulness of the AWS to prevent signals passed at danger (SPADs).
Queensland Rail had a system designed to alert the network control officer of a SPAD event. However, there were inherent constraints in the system, particularly for automatic signals, where an alert would not be provided under certain circumstances. This reduced the opportunity for the network control officer (NCO) to identify and respond to a SPAD.
While the driver recognised the signal was at red and stopped their train in this instance, the critical risk control provided by the NCO intervention was ineffective. This was not considered in the risk assessments that addressed risks to train separation, including SPAD events.
What has been done as a result
Queensland Rail continues to maintain the current risk control arrangements, in conjunction with the AWS functionality, to manage the risk of SPADs while the preferred engineering control of European Train Control System (ETCS) technology is being implemented.
The Queensland Department of Transport and Main Roads has a long-term plan to deploy ETCS throughout the South East Queensland rail network. Deployment is occurring in prioritised sectors and full deployment will take several years. ETCS is currently installed on the Shorncliffe pilot line and is undergoing verification, validation and certification. Bowen Hills Station and surrounding areas were indicated to be included in sectors 2 and 3. Until this occurs, the established risk will remain.
Additionally, Queensland Rail is undertaking a range of SPAD risk management activities, and has advised the ATSB that the current enterprise and operational area risk assessments support the organisation’s so far as is reasonably practicable (SFAIRP) position. However, Queensland Rail’s current risk registers were not updated following this occurrence and therefore did not assess inherent constraints identified by the ATSB that may lead to risk controls being less effective. Specifically, the ATSB considers the scenario where a SPAD alarm was not generated and the driver did not report the SPAD, had not been considered in the Queensland Rail risk assessments.
The ATSB therefore issued a recommendation that Queensland Rail reviews the risk associated with a SPAD in circumstances where the inherent constraints of the universal traffic control system do not alert the network control officer and the driver does not self‑report, and any additional risk controls that may be appropriate for the current signalling system.
Safety message
This investigation highlighted inherent limitations in the effectiveness of the automatic warning system (AWS) to prevent a SPAD event. It also identified that a SPAD alarm may not be presented to NCOs in all circumstances, preventing their active intervention.
These types of limitations should ideally be eliminated and, where that is not possible, the hazards they create should be considered in risk assessments related to SPAD and collision prevention.
The occurrence
On 24 May 2023, Queensland Rail suburban passenger train TE43 was operating a scheduled service between Coopers Plains and Ferny Grove in Brisbane, Queensland.
At about 0942 local time, as the train approached platform 2 at Fortitude Valley Station, the rail traffic driver (driver) received an alarm from the onboard automatic warning system (AWS) (see the section titled Automatic warning system information). This indicated that signal BS07, located at the northern end of platform 2, displayed a caution indication (steady yellow aspect).
The driver acknowledged the AWS alarm and continued into the platform where they stopped the train for passengers, as scheduled. At 0943:31, train TE43 departed platform 2 to continue along the down[1] suburban line towards Bowen Hills Station. Signal BS07 continued to display a steady yellow caution indication. The next 2 signals ahead, CS025 and CS027, displayed a restricted indication (red, ‘at danger’ aspect).
Ahead of signal CS027, empty suburban passenger train EM03 was stopped at signal ME19, waiting to proceed into platform 2 at Bowen Hills Station. Signal ME19 had changed from a restricted indication to a proceed indication (green aspect), however train EM03 had not yet moved. Train EM03 was travelling in the same direction as train TE43 (Figure 1).
Figure 1: Midsection track layout of down suburban line between Fortitude Valley Station and Bowen Hills Station
The train images superimposed on the aerial view of the track are not their precise location. Source: Google Earth and Queensland Rail, annotated by the ATSB
After departing Fortitude Valley Station, train TE43 accelerated to 50 km/h, before the driver shut off traction power. The driver later reported that they had a sneezing fit, sometime after departing platform 2.
At 0943:51, as train TE43 traversed a curve in the track, signal CS025 came into the driver’s view. As the front of train TE43 passed over the AWS magnet, fixed between the rails about 80 m before signal CS025, the in‑cab AWS sounded a continuous audible alarm, indicating that the signal ahead displayed a restricted indication. The driver responded to the alarm by pressing the AWS acknowledgement button, however, they later advised they could not remember doing so.
The driver recalled that just before they passed signal CS025, they recognised the red restricted indication and immediately placed the brake controller into full-service, and then the emergency brake position.
Train TE43 stopped about 64 m past signal CS025, and about 296 m behind train EM03 (Figure 2). The rear of train EM03 was about 92 m ahead of signal CS027, which was also displaying a restricted indication. The driver of TE43 recalled seeing the rear of train EM03 as it started to move.
Figure 2: Approximate stopping locations of train TE43 and train EM03 after train TE43 passed signal CS025 at stop
The train images superimposed on the aerial view of the track are not their precise location. Source: Google Earth and Queensland Rail, annotated by the ATSB
The driver of TE43 made an emergency radio call to the network controller officer (NCO) to report a signal passed at danger (SPAD). The NCO established details surrounding the SPAD with the driver, then issued an authority for train TE43 to proceed to Bowen Hills Station platform 2, where the driver was relieved from duty.
The NCO did not receive a SPAD visual dialogue box or audible alert for signal CS025 at their workstation.
There were no injuries to passengers or crew, and no damage to either the train or infrastructure.
Context
Driver information
The driver had about 25 years of driving experience and was qualified on the route. They had completed the required maintenance of competency[2] assessments in June 2021 and subsequent on‑job observations on 12 April 2022 and 5 March 2023. An audit on safe driving was also completed on the Brisbane suburban network on 11 October 2021.
They underwent a medical assessment (rail category 1 – high‑level safety worker) in September 2022 and were considered fit for duty (unconditional). Following the incident, testing of the driver for both drugs and alcohol returned negative results.
After 2 consecutive early morning shifts, the driver signed on for work at 0437, the morning of 24 May 2023. During the shift, they had completed 2 scheduled trips, with a meal break between 0738–0808. They had commenced the incident trip from Cooper Plains at 0910. They reported feeling fully alert at the time of the occurrence. However, about 12 hours later, they tested positive to Coronavirus disease (COVID-19).[3]
Records provided by Queensland Rail (QR) showed that the driver had 2 previous signal passed at danger (SPAD) incidents (2001 and 2019), however these were not considered relevant to the occurrence.
Train information
General
Train TE43 consisted of a 6‑car multiple unit (3‑car interurban multiple unit [IMU] 181 leading and a 3‑car suburban multiple unit [SMU] 295 trailing), with an overall length of about 145 m, and individual car length of 72.4 m. Lead unit IMU181 was fitted with an event recorder and forward‑facing CCTV recorder.
Lead unit IMU181 had been modified to decrease the volume of the automatic warning system (AWS) audible beeps at a green proceed indication, and increase the volume for the continuous buzzing alarm at a restricted indication (see the section titled Previous occurrences).
Recorded information
Park Road Station to Fortitude Valley Station
A review of data from the event recorder showed that, prior to departing Fortitude Valley Station, the driver operated the train consistent with safe driving procedures (see the section titled Safe driving procedures). The driver recalled that from Park Road Station,[4] there was peak congestion, which was normal for the inner‑city area at that time of day.
Recorded data showed that, from Park Road Station, the driver:
acknowledged 20 AWS alerts for restricted indications
received 3 AWS alerts for proceed indications, of which they acknowledged one.
Fortitude Valley Station to signal CS025
The event recorder captured the following sequence after TE43 departed Fortitude Valley Station:
0943:31 traction power was applied and the train departed platform 2
0943:47 traction power was shut off at 50 km/h
0943:59 the lead unit IMU181 passed over the on-track AWS magnet (see the section titled Automatic warning system information)
0944:00 AWS buzzer activated and shortly after the driver pressed the acknowledgment button
0944:03 at 50 km/h driver selected full-service brake position
0944:07 at 37.5 km/h driver selected emergency brake position
0944:15 train TE43 stopped
The driver safety control, also known as ‘deadman’s system’,[5] did not activate at any time during the incident.
Rollingstock brake performance
The recorded braking distance was calculated to be within the expected performance for the rollingstock and the track gradient. No braking issues were recorded in the train fault log on the day of the occurrence. Additionally, the driver of train TE43 did not report anything unusual about the train's handling on the day.
Safe driving procedures
QR procedure MD‑11‑72 Train service and delivery (TSD) Professional driving – safe driving outlined rules for train drivers ‘to mitigate the incidence of signals passed at danger (SPAD) and other adverse operational safety events’.
The procedure contained general safe driving rules which included:
75% speed rule: rail traffic must be travelling at or below 75% of the designated track and/or traction speed at the point of passing a double yellow or single yellow aspect signal.
20/20 rule: on the approach to a red aspect signal, the speed of the rail traffic must not exceed 20 km/h at the point of passing over the automatic warning system (AWS) magnet.
The procedure also contained ‘safe driver application’ rules which included that when starting on a single yellow aspect, the driver must:
after coming to a stop at a platform, place direction controller to neutral
apply or maintain the 75% speed rule
maintain situational awareness and vigilance through scanning, crosschecking and application of, or continued use of RTCD [risk triggered commentary driving] (MD-13-165 TSD Professional driving - risk triggered commentary driving procedure)
When approaching a red aspect signal the procedures included that the driver must:
initiate a further positive action, i.e., make a brake application or reduce tractive power depending on track gradient
maintain situational awareness and vigilance through scanning, crosschecking and application of, or continued use of RTCD (MD-13-165 TSD Professional driving - risk triggered commentary driving procedure)
apply the 20/20 rule
When approaching restricted indications, QR procedure MD‑13‑165 TSD Professional driving – risk triggered commentary driving required drivers to verbalise:
acknowledgement of the aspect of the restricted signal
the location and aspect of the next signal
their intended actions.
On receiving an AWS alert, risk triggered commentary driving (RTCD) was to be applied continuously from the acknowledgement of the audible alarm, until the required actions were complete.
The driver recalled applying RTCD on the morning of the incident, but could not recall if it was applied at Fortitude Valley Station platform 2. The QR internal investigation report found that the driver did not apply RTCD on approach to signal CS025.
Network and signalling information
Train safeworking system and signalling
On the Brisbane suburban network, the train safeworking system utilised remote controlled signalling. The system included signalling infrastructure (signals, points, etc.), which network control officers (NCOs) could interact with using the universal traffic control (UTC) system.
The UTC system displayed a range of indications on the NCO’s workstation. These included the location of all trains, points, signals and alarms, such as a SPAD alarm message (see the section titled Signal passed at danger warning system).
Signals on the network were either controlled (operated by the NCO) or automatic (set by the passage of rail traffic). The aspect of a controlled signal was displayed on the NCO’s workstation. In contrast, automatic signals were displayed as a yellow icon and their aspect was not shown (Figure 3).
Universal traffic control recorded information
The recorded UTC replay identified the following:
0943:50 as train TE43 departed Fortitude Valley Station, the path for train EM03 was set to Bowen Hills Station
0943:52 signal ME19 displayed a green proceed indication for train EM03 to enter Bowen Hills Station, as train TE43 approached signal CS025
0944:04 train TE43 passed signal CS025 and occupied track circuit CS025CT. Train EM03 was occupying track circuits CS027AT and CS027BT. Train EM03 was likely moving but had not passed signal ME19.
Figure 3 shows the UTC replay of the track section between Fortitude Valley Station and Bowen Hills Station after the SPAD. Of note, no SPAD warning dialogue box was displayed (see the section titled Signal passed at danger warning system).
Figure 3: UTC replay of TE43 passing CS025 at stop
Source: Queensland Rail, annotated by the ATSB
Automatic warning system information
QR’s suburban network was fitted with an automatic warning system (AWS). This system consisted of an in‑field magnet on the track and a magnetic receiver linked to a warning system on the rollingstock.
QR Standard MD‑10‑119 Automatic warning system (AWS) operations manual noted that the AWS was designed to:
provide an in-cab visible and audible indication of the aspect displayed in the next signal
prompt and warn the rail traffic driver of a RESTRICTED signal aspect displayed in the next signal
stop the rail traffic if the rail traffic driver fails to acknowledge the AWS alarm of a RESTRICTED signal aspect.
This procedure also stated:
AWS is an advisory system and not a control system. The setting of rail traffic speed remains with the rail traffic driver. The AWS is designed to apply the brake when the rail traffic driver cannot or does not acknowledge a RESTRICTED signal aspect…
When the train’s magnetic receiver passed over the in-field magnet on approach to a signal, the AWS would provide a different alert to the driver for proceed or restricted indications:
proceed indication: the AWS indicator would display a black visual and sound a short series of beeps. Acknowledgment of the clear to proceed indication was not required by the driver.
restricted indication: the AWS indicator would display the same yellow and black ‘sunflower’ visual display for both caution and stop indications and sound a louder, continuous buzzing alarm. The driver was required to cancel the alarm by pressing and releasing the acknowledgment button. If the AWS alarm was not acknowledged after 3 seconds, a penalty brake application would occur.
On approach to signals BS07 and CS025, the AWS provided a ‘sunflower’ visual display and a continuous buzzing alarm, which were both cancelled by the driver using the acknowledgement button. During interview, the driver advised that they could not recall acknowledging the AWS for signal CS025, and they could not remember if they were first alerted to the red aspect by the AWS alarm, or visual observation of the signal.
Previous ATSB investigations have identified instances where train drivers have acknowledged the AWS alarm for a red aspect, and subsequently passed the signal at danger (see the section titled Previous occurrences ).
Signal CS025
Signal CS025 was a 4‑aspect[6] automatic signal located at the 2.545 km mark on the down suburban line, mid‑section between Fortitude Valley Station and Bowen Hills Station (Figure 4). On approach to signal CS025, the mainline speed for this track section was 60 km/h.
Figure 4: Approach to signal CS025 along down suburban line towards Bowen Hills Station
Note that this image shows CS025 with a caution steady yellow aspect. Source: Queensland Rail, annotated by the ATSB
There were 2 track circuits between signal CS025 and the next signal CS027 (CS025CT and CS025DT) (Figure 5). Signal CS025 would display a stop indication when either track circuit CS025CT or CS025DT was detected as occupied. Additionally, if track circuit CS027AT was occupied, after CS025CT and CS025DT had cleared, CS025 would also display a stop indication.
Figure 5: Track circuits between signal BS07 and ME19 on the down suburban line towards Bowen Hills Station
Source: ATSB, based on signalling arrangement maps and diagrams - not to scale
QR confirmed via simulation that the UTC system would generate a SPAD alarm, and display a SPAD message indication on the NCO’s workstation for signal CS025, if track circuit CS025DT was occupied by another train ahead when signal CS025 was passed at stop (Figure 6). In this simulation track circuit CS027AT, ahead of signal CS027, was unoccupied.
Figure 6: UTC simulation of train passing CS025 at stop
Source: Queensland Rail, annotated by the ATSB
QR identified that there had been no SPADs recorded at signal CS025 since 2010, and the signal complied with the sighting distance requirements described in QR Standard MD‑10‑95 Signalling positioning principles.
Signal passed at danger (SPAD) warning system
The SPAD warning system consisted of an audible 3‑beep alert tone and a red text dialogue box that appeared on the NCO’s workstation (Figure 6).
The QR manual MD‑14‑37 Network control manual outlined different UTC alarm messages that would be provided to warn the NCO of threats to safeworking. The NCO was required to immediately respond to these messages, unless they assessed that doing so had the potential to increase the hazard.
UTC SPAD alarm messages were identified as of critical importance, with the highest response requirement by the NCO. The NCO was to:
Investigate cause. Make emergency call to stop offending train. If other trains are present, call all trains in the area(s) to stop. Assess if rail traffic driver is fit to continue, move train to position of safety.
QR procedure MD‑11‑42 Signal passed at danger – module EP1‑13 reflected the above required response by the NCO following receipt of a SPAD alarm.
In this instance, the NCO did not receive a SPAD alarm and was first alerted to the SPAD of train TE43 by the driver’s emergency radio call.
Signal passed at danger alarm generation principles
The QR manual SR105 SPAD Alarm generation principles defined the criteria used by the UTC system to determine if a SPAD alarm message would be displayed to the NCO.
Section 6.1 of the manual stated:
The UTC Controller Workstation shall generate a ‘Train passed signal at stop’ alarm if all of the following rules are met:
Rule 1 The first track beyond a Limit of authority (LOA)[7] becomes occupied.
Rule 2 There is no train on a track adjacent to the newly occupied track with a proceed authority onto this newly occupied track.
Rule 3 There are one or more trains that can step onto the newly occupied track from an adjacent track which has an LOA facing towards the newly occupied track.
To illustrate the application of the rules, several scenarios were included in the appendices of the manual (Figure 7).
Figure 7: Extract from appendices of SR105 signal passed at danger alarm generation principles manual
Source: Queensland Rail, annotated by the ATSB
The examples showed:
For C.14, all the track circuits between the automatic signal and the next signal were unoccupied. The automatic signal was assumed to be displaying a proceed indication. When train 1111 passed the automatic signal to occupy the track ahead, no SPAD alarm would be generated.
For C.15, a track circuit between the automatic signal and the next signal is occupied by train 1109. The automatic signal was assumed to be displaying a stop indication. When train 1111 passed the automatic signal to occupy the track ahead, a SPAD alarm would be generated.
For C.16, a track circuit ahead of the next signal is occupied by train 1109. The automatic signal was assumed to be displaying a proceed indication. When train 1111 passed the automatic signal to occupy the track ahead, no SPAD alarm would be generated.
Additionally, Section 6.8.1 of the manual noted that:
Automatic signals are not indicated, and therefore UTC is unaware of whether the signal has a proceed aspect or not. So that SPAD alarms can be generated for automatic signals, UTC will assume that an automatic signal has a proceed aspect when all of the tracks up to the next signal are all clear. The tracks in the overlap[8] (if any) will not be checked.
Section 7 also noted further limitations:
If the replacement track[9] of a signal is already occupied (e.g. by another train, gang or track fault), then a train passing the signal will not be able to be detected, and therefore a SPAD alarm will not be generated.
Due to the possibility of timing issues,[10] the overlap of an automatic signal (if any) will not be checked when determining whether an automatic signal is clear. Consequently, if the overlap of an automatic signal is occupied, then a SPAD alarm will not be generated if a train passes the automatic signal.
Overview of Queensland Rail SPAD risk management
QR maintained a suite of risk registers that identified hazards and related risk controls. The enterprise risk register identified several key risks and controls related to SPAD events including the following:
…SEQ [South East Queensland] Operations failing to adequately prevent a rollingstock collision (train to train, train to vehicle, train to person), potentially resulting in one or more fatalities
…rail traffic separation or route integrity not being maintained on the mainline resulting in train to train, train to person, train to infrastructure, train to object collision or derailment
These risks were last reviewed on 22 September 2021. Risk controls included:
The effectiveness of the respective controls was assessed as ‘substantially effective’ with the hierarchical level primarily identified as ‘administrative’. For each of the risk controls above, the risk score following implementation of the controls was assessed as ‘medium’. The justification for the risk score was respectively:
Controls at this level are administrative. Where appropriate GM’s [General Managers] registers identify higher levels of controls where the control owner has accountability/responsibility of the control.
No higher-level engineering control is currently available to control this risk. Until ETCS [Level 2][11] is fully implemented across the QR SEQ network this safety risk is being controlled by administrative/people control (active supervision) which is inherently partially effective in the absence of the higher engineering control (ETCS).
The TSD Operations SEQ Risk register – Risk 3 Train to train collision included the risk description: ‘risk of train‑to‑train collision resulting in injury or death as a result of a SPAD event’.
Risk controls included:
rail traffic crew training
safe driving techniques
risk triggered commentary driving (RTCD)
application of the SPAD risk management standard (MD-10-89)
SPAD risk management procedure (MD-13-362)
SPAD risk management instruction (MD-13-446).
Again, the effectiveness of the controls was assessed as ‘substantially effective’ and the hierarchical level as ‘administrative’. The residual risk score was assessed as ‘medium’. The justification for the risk score was:
Higher order controls are in place but owned by other business areas (e.g. Engineering: Level Crossing protection systems, signalling system & UTC). TSD Operations therefore has not identified any further higher order controls available for implementation by our functional area.
Additionally, a pilot bowtie analysis for QR operations was developed on 1 September 2021. This was intended as an information aid for QR’s safety management system, including the enterprise and operational area risk registers. The bowtie analysis identified risk controls and highlighted those assessed as critical risk controls[12] associated with the prevention of human factors‑related SPADs, including driver distraction. Risk controls listed in the bowtie included:
Safeworking training standards (MD‑10‑199) – critical risk control
TSD Professional driving followed by drivers (MD‑11‑72)
Train safety systems (AWS, ATP, DTC)[13] (MD‑10‑218) – critical risk control
Automated train protection remove and replace with train safety systems
QNRP network rules and procedures (MD‑12‑189)
Safety in yards (MD‑10‑175)
DTC Alarms in cabs
UTC SPAD alarm triggering emergency response procedure
NCO emergency response to SPAD alarm to stop train
Potential control: Train control radio for emergency comms with driver (workers on track do not have radio)
Observe signal approach warning (MD‑10‑109) – critical control
Potential control: Rail resource management human factors framework training and competency (RTC and NCO)
Potential control: ETCS controls train in event of incapacitation
UTC SPAD alarms and the NCO’s emergency response to a SPAD alarm were listed as risk controls in the bowtie analysis. QR did not consider them as critical risk controls, as they were partially effective administrative controls. In contrast, train safety systems (including AWS) were considered a critical risk control.
The QR standard MD‑10‑89 SPAD Risk Management ranked the severity of a SPAD incident to the application of risk controls, based on the Office of the National Rail Safety Regulator (ONRSR) Reporting requirements for notifiable occurrences guideline. Where the rollingstock stopped more than 50 m from the rear of the train ahead by the actions of the driver alone, the severity was ranked as ‘minor’ due to ‘significant escalation of SPAD required before incident could occur’. Additionally, where the rollingstock stopped more than 50 m from rear of the train ahead by the actions of the NCO, the severity was also ranked as ‘minor’ due to ‘significant escalation of SPAD required before incident could occur’.
In contrast, where the rollingstock stopped less than or equal to 50 m from the rear of the train ahead by the actions of NCO, the severity was ranked as ‘significant’ due to ‘potential incident prevented by recovery action’.
QR confirmed that training and toolbox talks for NCOs included information about SPAD alarm warning messages not being presented under certain circumstances.
QR advised that the effectiveness of the recovery action provided by the NCO (including the effectiveness of the SPAD alarm warning system), were not risk assessed by QR business or functional areas.
The QR internal investigation report for this incident did not identify the absence of the SPAD alarm activation for signal CS025.
Previous occurrences
The ATSB has investigated several occurrences that identified the important role of active intervention by the NCO to prevent a further reduction in safety margins once a SPAD had occurred. These investigations all showed that it was possible for the driver to completely miss a signal.
RO-2017-010 Signal ME45 passed at danger, involving suburban passenger train 1A21, Bowen Hills, Queensland, on 26 August 2017[14]
Train 1A21 passed controlled signal ME45 at the northern end of Platform 2 Bowen Hills, and an alarm activated at the QR Rail Management Centre at Mayne. The network control officer overseeing that particular area, broadcast an emergency radio message calling for the driver of 1A21 to stop. Due possibly to distraction, the driver did not apply the applicable procedures relevant to the restricted indication displayed at signal ME25 prior to departing the platform, therefore missing vital information concerning the aspect status of signal ME45. The driver’s attention was likely focussed on peripheral trackside activity as the train approached signal ME45, distracting him from the primary task of observing signal indications.
RO-2018-002 Signal ME45 passed at danger involving suburban passenger train TP43 and near collision with another suburban passenger train, Bowen Hills, Queensland, on 10 January 2018[15]
Train TP43 passed controlled signal ME45 at the northern end of Platform 2 Bowen Hills, and an alarm activated at the QR Rail Management Centre at Mayne. After receiving a SPAD alarm, the network control officer broadcast an emergency stop command to the driver of TP43. The train was stopped 220 m past signal ME45, and 126 m prior to a conflict point. At the time that TP43 came to a stop, another suburban passenger train had just cleared the conflict point.
Approaching the first signal (ME45, displaying a red aspect) after departing from Bowen Hills, the driver probably read through to another signal for an adjacent line that was displaying a green aspect, which they incorrectly believed was signal ME45. Although the driver of train TP43 acknowledged the automatic warning system audible alarm, this was almost certainly an automatic response that did not result in an effective check of signal ME45’s aspect indication, resulting in the signal’s red aspect not being detected.
During the investigation, the ATSB identified a safety issue with the AWS (Safety Issue RO‑2018‑002‑SI‑03).[16] This was due to the potential for habituation, and the absence of a higher priority alert when approaching a signal displaying a red aspect, which reduced the effectiveness of the AWS to prevent SPADs.
QR advised the ATSB of safety action taken, including:
…conducting a whole fleet project to decrease in volume of the AWS audible indication at a proceed signal aspect (green) and increase the volume of the AWS audible indication at a restricted signal aspect, with input from the Principal Human Factors Advisor and Principal Electrical Engineer. The estimated project completion was 30 December 2023.
…projected introduction of the European Train Control System (ETCS) into the Citytrain network as a safety action to manage the risk of SPADs. In April 2019, the Queensland Government announced that the ETCS works package would be delivered by Hitachi Rail STS. As the future operator, Queensland Rail would be responsible for successfully integrating the cross-river rail project and ETCS Level 2 project into its rail network.
On 15 April 2021, the safety issue was closed as partially addressed:
The ATSB notes the safety action to change the auditory volume of the AWS for restricted signals verses green signals, but believes that this will not have a significant impact in reducing the risk of the safety issue as it does not help differentiate red signals from other restricted signals. The ATSB also appreciates that there would be substantial difficulty in redesigning the AWS to provide a clear distinction between the alerts that occur in response to signals with a red aspect compared to other restricted signals. However, the ATSB welcomes the safety action to introduce the European Train Control System (ETCS) and believes that this system will reduce the risk of SPADs where and when it is implemented.
Safety analysis
Introduction
After departing Fortitude Valley Station on the down suburban line, suburban passenger train TE43 passed signal CS025 that was displaying a red stop indication by about 64 m. There were no technical issues associated with the rollingstock, and the signalling system functioned as designed.
The safety analysis will discuss:
the immediate reason for the signal passed at danger (SPAD)
the habituation of acknowledging the automatic warning system (AWS)
alarms for SPAD occurrences not being displayed to the network control officer (NCO) by the universal traffic control (UTC)
the effectiveness of current recovery risk controls for signal passed at danger (SPAD) events in risk assessments.
Driver performance
On departure from Fortitude Valley Station platform 2, a steady yellow aspect was displayed on signal BS07. Application of the safe driving procedures meant the driver was required to travel at a speed not exceeding 45 km/h (75% speed rule) and maintain situational awareness and vigilance through cross checking and the use of risk triggered commentary driving.
Approaching the next signal (CS025) displaying a red, ‘at danger’ aspect, the driver was required to initiate further positive action to slow the train. If the signal remained at stop, the driver was to further reduce speed to not exceed 20 km/h as the train traversed the AWS magnet (20/20 rule). The driver would then receive, and acknowledge, the AWS alarm before stopping 20 m prior to the signal.
In this instance, after passing BS07, the driver accelerated train TE43 to 50 km/h before removing traction power and coasting. There was no braking or reduction of train speed as TE45 rounded the curve on the approach to signal CS025. Additionally, there was no reduction in speed as TE43 approached and then traversed the AWS magnet. The first brake application and reduction in train speed occurred just prior to passing signal CS025.
A review of the onboard recorded data found that prior to Fortitude Valley Station, the driver generally reduced train speed in accordance with the safe driving procedures, as they approached and passed each restricted indication. Additionally, the driver also placed the direction controller in neutral at the platform in accordance with the safe driving procedure. The only recorded occasion during the trip where the driver had not applied the speed reduction occurred after the departure from platform 2 at Fortitude Valley Station.
The driver reported that, after departure from platform 2, they experienced a sudden sneezing fit. Additionally, they were diagnosed with COVID‑19 about 12 hours after the occurrence. They also stated that although they did acknowledge the AWS alarm approaching CS025, they could not recall if it was a conscious or reflex response to the alarm.
Sneezing is a symptom that may be observed in individuals presenting with COVID‑19 or other acute respiratory infections (Australian Centre for Disease Control, 2024). Such a prolonged sneezing reflex, or fit of sneezing while operating a train, could affect the driver’s capacity to effectively control the train during a critical phase approaching a restricted indication, and impair their ability to detect and react to stimuli.
The ATSB concluded that, although the driver was aware the departure signal (BS07) displayed a restrictive indication showing the signal ahead (CS025) was at stop, they likely experienced a degree of impairment arising from the sneezing reflex, which adversely affected the driver’s control of train speed and observance of the signal aspect.
Contributing factor
The sneezing fit between signal BS07 and signal CS025 reported by the driver likely impeded their control of the train and observance of the red aspect displayed in CS025. Train TE43 subsequently passed signal CS025 at stop by about 64 m.
Automatic warning system
During the trip between Park Road Station and Fortitude Valley Station, the driver promptly acknowledged multiple AWS alarms (continuous buzzers) from restricted indications, and on one occasion an AWS alert (short series of beeps) from a proceed indication, which the driver was not required to acknowledge. Approaching signal CS025, the driver again acknowledged the AWS alarm for the restricted indication promptly, although they could not remember doing so.
ATSB investigation report RO‑2018‑002 discussed the effectiveness of AWS alarms, noting that although they reduced the likelihood of SPADs in some situations, the design was fundamentally limited and would not eliminate SPADs. The report also highlighted research indicating a significant number of drivers in many rail networks had reported ‘automatically’ acknowledging an AWS alarm at a restricted signal without recognising it had occurred, particularly in situations where drivers repeatedly encountered signals displaying restricted indications. The report also noted with drivers encountering an increased frequency of restricted indications, they could become conditioned to cancelling the AWS alarm as a habitual or reflex reaction.
In this instance, the driver recalled that from Park Road Station, the suburban network was operating at near peak capacity. This meant that the driver received and acknowledged many AWS alarms to restricted indications along with proceed indications. This, possibly in conjunction with the impairment arising from the sneezing fit, likely influenced the driver’s action to acknowledge the AWS alarm and not identify the red aspect until it was too late to prevent passing it.
Contributing factor
There were frequent automatic warning system (AWS) alarms presented to the driver between Park Road Station and Fortitude Valley Station due to traffic congestion. This likely influenced the driver’s reaction in acknowledging the AWS alert on approach to signal CS025, which cancelled the train’s automatic brake application, while not recognising the red aspect.
ATSB investigation RO‑2018‑002 identified the AWS alarm was also not an effective risk control because it provided the same visual and aural alarm for all restricted indications and that substantially diminished the significance of approaching a stop indication (red aspect). Queensland Rail (QR) undertook several safety actions, including changing the auditory volume of the AWS for restricted indications versus proceed indications. Although this action provided a degree of improvement, it did not differentiate a red aspect from other restricted indications (double yellow, yellow, flashing yellow aspects).
The AWS was the primary engineering risk control used by QR in the suburban network to reduce the likelihood of, or to mitigate the consequences of a SPAD event. However, the AWS system was vulnerable to human error as drivers could acknowledge the alarm and cancel the automated application of a brake penalty, without necessarily considering the next signal ahead was at stop.
This risk control was less effective than systems like Automatic Train Protection or European Train Control Systems (ETCS), that offered a higher level of automation, such as automatic initiation of a penalty brake application following a SPAD event. In 2021, QR advised that, in addition to improvements to the AWS, work was being undertaken with suppliers to determine an ETCS Level 2 implementation schedule for parts of the QR rail network in South-East Queensland. As of May 2023, the project had progressed to testing ETCS technology on the Shorncliffe Line with compatible rollingstock, but had not been commissioned into operational service.
Contributing factor
The automatic warning system (AWS) provided the same audible alarm and visual indication to a driver on the approach to all restricted indications. The potential for habituation, and the absence of a higher priority alert when approaching a signal displaying a red aspect, reduced the effectiveness of the AWS to prevent signals passed at danger (SPADs). This placed substantial reliance on procedural or administrative controls to prevent SPADs, which are fundamentally limited in their usefulness. (Safety issue)
Signal passed at danger warning
The UTC signal passed at danger (SPAD) warning functionality was designed to generate a SPAD alarm on the network control officer’s workstation if a train passed a signal aspect displaying a stop indication. However, inherent constraints within the UTC system meant that under certain situations, although an automatic signal displayed a stop indication, no alarm was generated if a SPAD occurred.[17]
In this instance, automatic signal CS025 was displaying a red stop indication when passed by train TE43, and no SPAD alarm was generated at the NCO’s workstation. The track circuit ahead of the next signal CS027 was occupied by train EM03, the reason signal CS025 was at stop. However, signal CS025 was assumed by the UTC to be displaying a proceed indication as the 2 track circuits in between were clear.
The SPAD alarm generation principles were designed to not check the track ahead of the next signal, to avoid timing issues associated with the operation of the UTC system. This design, while solving a technical problem, prevented notification of certain SPAD events to the NCO. It also compromised the effectiveness of the recovery action provided by the active intervention of the NCO in making an emergency call to the driver to stop their train.
The signal after CS025 (CS027) ahead of train TE43 was also at stop, and the red aspect, coupled with the associated AWS warning, provided protection to the rear of train EM03. However, if the driver had not stopped after passing signal CS025, and continued passed CS027, with EM03 still occupying the track immediately ahead of the signal (CS027AT), again no SPAD alarm would have been produced on the NCO’s workstation. This was also due to a design limitation in function, as the replacement track circuit to signal CS027 (CS025AT) was already occupied by EM03, and the UTC was unable to detect a change in state of the track circuit from unoccupied to occupied.
Other factor that increased risk
The universal traffic control (UTC) system did not present a signal passed at danger (SPAD) alarm for signal CS025 to the network control officer, because the conditions required for the UTC to display the alarm were not met. Consequently, mitigation of the safety risk relied on the driver recognising the SPAD and stopping the train.
In this occurrence, the driver of train TE43 recognised that signal CS025 was at stop just before they passed it, stopped the train and made an emergency broadcast, initiating the NCO’s response. Fortunately the inherent constraint resulting in the absence of a SPAD alarm and associated risk mitigation from active intervention by the NCO had no effect on the consequence of this occurrence. However, if the driver had completely missed signal CS025, then automatically acknowledged the next AWS warning and continued past signal CS027 (i.e., multiple SPAD), a SPAD alarm would again not have been generated, if the replacement track was still occupied by train ahead EM03.
Other finding
The driver of train TE43 recognised signal CS025 was at stop just before they passed it, applied emergency braking and made an emergency radio call to network control. The signal after CS025 (CS027) ahead of train TE43 was also at stop. This red aspect, coupled with the associated automatic warning system activation, provided protection to the rear of train EM03. However, if train TE43 had passed signal CS027 with train EM03 occupying the replacement track, a SPAD alarm would also not have been generated by the universal traffic control system.
Risk management of signal passed at danger
QR knew of conditions that would prevent a signal passed at danger (SPAD) alarm being provided to the NCO following a SPAD event. These conditions were noted in SR105 – SPAD Alarm generation principles manual, which included specific limitations applicable to automatic signals.
In this instance, the NCO became aware of the SPAD at signal CS025 after the driver had stopped their train and only because the driver made an emergency call. QR Network control manual identified the signal passed at danger alarm as a critically important control to mitigate the risk from SPADs. Additionally, the QR standard MD‑10‑89 SPAD Risk Management noted the actions of the NCO as a factor that reduced the severity of SPAD incidents once they occurred. The absence of a SPAD alarm message to an NCO, would prevent them from taking any recovery action.
Additionally, QR had developed a bow tie analysis to assess the risk of a SPAD due to driver distraction. All of the risk controls listed were contingent on the driver performing the correct action, which while they were distracted was unlikely to be effective. The bowtie analysis did identify ‘UTC SPAD alarm triggering emergency response procedure’ and ‘NCO emergency response to SPAD alarm to stop train’ as risk controls. However, it did not recognise that the NCO taking action was dependent up on a SPAD alarm being generated, and the UTC SPAD alarm was not specifically identified as critical risk control.
QR had also undertaken both enterprise and operational area risk assessments that addressed risks to train separation, including SPAD events. The risk assessments did not assess the effectiveness of the recovery action provided by the NCO or consider the SPAD alarm warning limitations inherent to the UTC system. Risk assessments conducted in operational areas referenced other QR functional areas, however these also did not assess the risk further.
The risk control of active intervention by the NCO in response to a SPAD was an administrative control and was not defined as a critical risk control. This was because it could not guarantee all trains in the area would stop. However, previous ATSB investigations noted NCOs had an important role in preventing further reduction in safety margins, once a SPAD had occurred. In other SPAD scenarios where a signal was completely missed by a driver and not self‑reported, the system was reliant upon the NCO receiving and responding to a SPAD alarm (which will not always occur) to prompt the driver to stop the train.
Other factor that increased risk
The signal passed at danger (SPAD) alarm for CS025 did not alert the network control officer when train TE43 passed the signal at stop. This was due to inherent constraints of the universal traffic control system, which was not considered in the way Queensland Rail managed the risk of SPADs. (Safety issue)
Findings
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
From the evidence available, the following findings are made with respect to the signal passed at danger involving passenger train TE43 between Fortitude Valley and Bowen Hills, Queensland on 24 May 2023.
Contributing factors
The sneezing fit between signal BS07 and signal CS025 reported by the driver likely impeded their control of the train and observance of the red aspect displayed in CS025. Train TE43 subsequently passed signal CS025 at stop by about 64 m.
There were frequent automatic warning system (AWS) alarms presented to the driver between Park Road Station and Fortitude Valley Station due to traffic congestion. This likely influenced the driver’s reaction in acknowledging the AWS alert on approach to signal CS025, which cancelled the train’s automatic brake application, while not recognising the red aspect.
The automatic warning system (AWS) provided the same audible alarm and visual indication to a driver on the approach to all restricted indications. The potential for habituation, and the absence of a higher priority alert when approaching a signal displaying a red aspect, reduced the effectiveness of the AWS to prevent signals passed at danger (SPADs). This placed substantial reliance on procedural or administrative controls to prevent SPADs, which are fundamentally limited in their usefulness. (Safety issue)
Other factors that increased risk
The universal traffic control (UTC) system did not present a signal passed at danger (SPAD) alarm for signal CS025 to the network control officer, because the conditions required for the UTC to display the alarm were not met. Consequently, mitigation of the safety risk relied on the driver recognising the SPAD and stopping the train.
The signal passed at danger (SPAD) alarm for CS025 did not alert the network control officer when train TE43 passed the signal at stop. This was due to inherent constraints of the universal traffic control system, which was not considered in the way Queensland Rail managed the risk of SPADs. (Safety issue)
Other finding
The driver of train TE43 recognised signal CS025 was at stop just before they passed it, applied emergency braking and made an emergency radio call to network control. The signal after CS025 (CS027) ahead of train TE43 was also at stop. This red aspect, coupled with the associated automatic warning system activation, provided protection to the rear of train EM03. However, if train TE43 had passed signal CS027 with train EM03 occupying the replacement track, a SPAD alarm would also not have been generated by the universal traffic control system.
Safety issues and actions
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the Rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.
Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.
Safety issue description: The automatic warning system (AWS) provided the same audible alarm and visual indication to a driver on the approach to all restricted indications. The potential for habituation, and the absence of a higher priority alert when approaching a signal displaying a red aspect, reduced the effectiveness of the AWS to prevent signals passed at danger (SPADs). This placed substantial reliance on procedural or administrative controls to prevent SPADs, which are fundamentally limited in their usefulness.
Safety issue description: The signal passed at danger (SPAD) alarm for CS025 did not alert the network control officer when train TE43 passed the signal at stop. This was due to inherent constraints of the universal traffic control system, which was not considered in the way Queensland Rail managed the risk of SPADs.
Safety recommendation to Queensland Rail
The ATSB makes a formal safety recommendation, either during or at the end of an investigation, based on the level of risk associated with a safety issue and the extent of corrective action already undertaken. Rather than being prescriptive about the form of corrective action to be taken, the recommendation focuses on the safety issue of concern. It is a matter for the responsible organisation to assess the costs and benefits of any particular method of addressing a safety issue.
Safety recommendation description: The Australian Transport Safety Bureau recommends that Queensland Rail reviews the risk associated with a signal passed at danger (SPAD) in circumstances where the inherent constraints of the universal traffic control system do not alert the network control officer and the driver does not self‑report, and any additional risk controls that may be appropriate for the current signalling system.
Glossary
AWS
Automatic warning system
ETCS
European train control system
IMU
Interurban multiple unit
LOA
Limit of authority
NCO
Network control officer
QR
Queensland Rail
RTCD
Risk triggered commentary driving
RTO
Rail transport operator. Encompassed both rail infrastructure managers (track, signalling etc.) and rolling stock operators (locomotives, wagons etc.).
SEQ
Southeast Queensland operations
SMU
Suburban multiple unit
SPAD
Signal passed at danger (also known as a proceed authority exceedance)
TSD
Train service and delivery operations
UTC
Universal traffic control system
Sources and submissions
Sources of information
The sources of information during the investigation included:
the train driver of TE43
Queensland Rail
References
RISSB AS 7711:2018 Signalling Principles: Train control systems standard
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
the train driver of TE43
Queensland Rail
Office of the National Rail Safety Regulator
Queensland Government Department of Transport and Main Roads.
Submissions were received from:
Queensland Rail
Office of the National Rail Safety Regulator
Queensland Government Department of Transport and Main Roads.
The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
identifying safety issues and facilitating safety action to address those issues
providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
Publishing information
Released in accordance with section 25 of the Transport Safety Investigation Act 2003
Ownership of intellectual property rights in this publication
Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia.
Creative Commons licence
With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence.
The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.
Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.
[1]Rolling stock movements on the down-rail line travel away from the Central Railway Station (Brisbane).
[2]Maintenance of competency: QR program to ensure driver theory and practical competency. The program ran on a 3‑year cycle, with additional on the job observations at 12- and 24‑month intervals. In December 2023, the program was changed to verification of competency and added an additional 18‑month intervention within the 3‑year cycle. This intervention included a safeworking reaccreditation theory assessment, simulator scenario, unit preparation and shunt, and practical on track component, followed by an on‑job observation.
[3]The COVID-19 pandemic was a public health emergency of international concern between 30 January 2020 and 5 May 2023.
[4]Park Road Station was located 5 stations prior to Fortitude Valley Station on the down Ferny Grove line.
[5]Driver safety control: a safety feature designed to apply the train’s brakes in the event of the driver incapacitation.
[6]4-aspect signalling: A system of colour light signalling which provides red, yellow, double yellow and green aspects in a manner that normally provides the first caution at least 2 signals before a signal at red.
[7]Limit of authority (LOA): The limit of authority may be defined by a sign, a signal capable of displaying a STOP indication, or a specific kilometrage point on a line. It defines the location to which rail traffic may travel under a Proceed Authority or the limits of a work on track authority.
[8]Overlap: The overlap of a signal is an extension of a track circuit beyond a stop signal to provide a margin of safety beyond that signal. The overlap must be unoccupied and free of opposing signal locking before the signal is permitted to show a proceed aspect
[9]Replacement track: track sections that are after the entry signal
[10]In-built time delays within the UTC/interlocking software implemented to prevent the possibility of spurious SPAD alarms.
[11]European Train Control System (ETCS) Level 2: an engineering level control for the mitigation of SPADs, comprised of a system includes a Driver Machine Interface which displays maximum permitted speed and the distance to the applicable limit of authority (LOA) to the Rail Traffic Driver. Where the system detects that the rail traffic is exceeding the required braking curve to an LOA, warnings and if necessary, a brake intervention is automatically initiated. The braking curve and any required brake intervention are configured to prevent the rail traffic reaching a point of conflict where a collision with other rail traffic might otherwise occur.
[12]Critical risk controls in the Queensland Rail risk management framework were related to engineering controls. The remaining controls, although operationally critical were administrative controls.
[13]Refers to automatic warning system (AWS), automatic train protection (ATP) and direct train control (DTC) used across the whole Queensland Rail network.
[15]RO-2018-002 Signal ME45 passed at danger involving suburban passenger train TP43 and near collision with another suburban passenger train, Bowen Hills, Queensland, on 10 January 2018 /publications/investigation_reports/2018/rair/ro-2018-002
[17]This is contrary to previous ATSB investigations, which incorrectly reported that ‘non-controlled’ (automatic) signals located on the QR suburban rail network did not generate a SPAD alarm on the UTC system under any circumstances. See /publications/investigation_reports/2018/rair/ro-2018-002
Occurrence summary
Investigation number
RO-2023-004
Occurrence date
24/05/2023
Location
Between Fortitude Valley Station and Bowen Hills Station
A King Air aircraft with a pilot and six passengers on board touched down on the grass strip to the left of the runway at Lord Howe Island after conducting an approach and landing during a heavy rain shower, an ATSB investigation report details.
The aircraft, being operated by Eastern Air Link, was conducting a scheduled passenger flight from Port Macquarie to Lord Howe Island on the morning of 18 February 2022. Approaching Lord Howe at about 0800, the pilot commenced a DME (distance measuring equipment) instrument arrival procedure conducted under instrument flight rules.
Early in the DME approach the pilot established visual meteorological conditions and transitioned to a visual approach. The pilot then descended the aircraft visually below cloud while over the water to an altitude below 1,000 ft, while also positioning for a straight-in approach to runway 10. During the approach, the aircraft entered an area of reduced visibility in rain and then touched down to the left of the runway.
“At the time of the aircraft's final approach and landing, the Lord Howe Island aerodrome was experiencing a heavy rain shower with limited visibility, conditions that were marginal for visual flight,” said ATSB Chief Commissioner Angus Mitchell.
“While the pilot commenced a visual approach to the runway with the required visual cues, it was highly unlikely that the required visual contact with the runway was retained throughout the approach.”
The ATSB investigation found that, with the loss of visual cues, the pilot did not commence a go around, which was contrary to the missed approach requirements, and instead continued towards the runway. This resulted in an increasing displacement from the runway centreline.
“Late in the approach with the aircraft close to the runway but with a significant displacement from the runway centreline, visual contact with the runway was reacquired,” Mr Mitchell said.
“Considerable manoeuvring with significant heading changes were required to realign the aircraft with the runway, resulting in an unstable approach, and, ultimately, the aircraft touching down off and to the left of the runway, on the runway strip.”
The pilot was aware that the aircraft had touched down to the side of the runway, but at the time thought that only the left main tyre was displaced at or around the edge of the runway. They elected to therefore continue the landing, manoeuvring the aircraft onto the runway and completing the landing roll without further incident.
A postflight inspection of the aircraft did not identify any damage, however an inspection of the runway by the aerodrome operator identified ground marks from an aircraft’s tyres along the left section of the runway strip, and a broken runway edge light on the left side of the runway, about 1,000 ft (300 m) from the runway threshold.
The ground markings indicated that the aircraft had touched down on the runway strip, with the closest main landing gear to the sealed runway surface about 2 m from the edge, and that the aircraft had quickly regained the runway shortly after touchdown.
In addition, the investigation also identified several flights conducted by the operator that followed a similar approach profile as that used by the occurrence flight, which were also conducted in marginal weather conditions for visual approach operations.
This practice significantly increased the risk of reduced obstacle clearance assurance for both an approach and a potential missed approach.
“Adherence to operational procedures ensures consistency of pilot action and aircraft operation during the approach and landing phases of flight. This, along with careful monitoring of aircraft and approach parameters, ensures approaches are conducted safely,” Mr Mitchell said.
The ATSB has issued a safety recommendation to the operator that it provides guidance and training to flight crew concerning the safest option in the selection of an approach method when weather conditions are marginal for the conduct of a visual approach.
“Operators should encourage the use of the most appropriate and safe approach available,” Mr Mitchell said.
“When conditions are marginal, the use of an instrument approach that provides obstacle clearance assurance minimises the risks resultant from any unforeseen deterioration in conditions,” he continued.
“These approach types provide a protected flight path for any missed approach and have been shown to be significantly safer than a visual approach when weather conditions are marginal."
Following an in-flight hydraulics failure a Metro aircraft had a low-speed collision with a hangar at Perth Airport after the captain elected to taxi to the apron after mistakenly assessing that the brakes were functioning.
An ATSB investigation report details that on the morning of 12 August 2024, the Skippers Aviation Fairchild Metro 23 twin-turboprop was being operated on a charter flight from Forrestania, in Western Australia’s Wheatbelt region, to Perth, with two flight crew and four passengers on board.
The first officer was completing supervised line flying and was pilot flying. The captain was pilot monitoring.
Near the top of the planned descent into Perth, the aircraft sustained a complete loss of hydraulic system pressure.
The crew entered a holding pattern to determine the appropriate speed and extra distance required to conduct a flapless landing at Perth, and for the captain to instruct the first officer on how to conduct a manual extension of the landing gear using the hand pump.
“The captain advised air traffic control that a tow vehicle would be required to get the aircraft from the runway to the apron,” ATSB Director Transport Safety Dr Stuart Godley noted.
The captain then took over as pilot flying due to the first officer’s limited experience, and conducted an uneventful flapless landing on Perth’s runway 24.
“After landing, the captain could not see or establish direct communication with the requested tow vehicle,” Dr Godley explained. “Finding some brake pressure evident, the captain opted to taxi to the apron.”
As the aircraft approached the hangar, its speed increased due to a slight downhill gradient, and braking was ineffective.
“Aiming to avoid a collision, the captain momentarily used reverse thrust, but then shut down the engines and feathered the propellers before the aircraft’s right wingtip, and then propeller, collided with the hangar at a low speed,” Dr Godley said.
The aircraft came to a rest and all occupants then disembarked safely.
The investigation report notes that the first officer was a cadet in training with 325 hours total flying experience, and about 34 hours on type.
“Consistent with this minimal experience, the first officer’s ability to contribute to the in-flight emergency management was limited,” Dr Godley explained.
“This meant the captain was required to manage the emergency, effectively taking on both the pilot flying and pilot monitoring roles, and reducing their ability to manage the emergency effectively.”
After stopping on the taxiway after landing, the captain mistakenly assumed the brakes were functioning, after noting some braking pressure was evident.
“Unable to locate or contact the tow tug, and influenced by self-imposed time pressure, the captain chose to taxi to the apron, and the minimal available braking capacity meant the crew was unable to stop the aircraft.”
The investigation found the hydraulic failure occurred when a crack in a hydraulic line led to a hydraulic fluid leak.
Dr Godley noted that the investigation highlights the necessity for accurately assessing system functionality following an in-flight failure and the need to follow standard operating procedures.
“Vigilance when assessing aircraft performance and an objective assessment of system status are vital to minimise opportunities for error and avoid relying on potentially misleading indicators,” he said.
“This incident highlights the importance of prioritising procedural compliance in uncertain circumstances, especially when experiencing perceived pressure in non-normal situations.”
A landing gear electrical system fault likely ignited fuel from the cabin heater supply line, resulting in a cockpit fire;
ATSB advises maintenance organisations and operators to review current practices for the prevention of damage to wiring and ensure that all available steps are being taken;
Where available, 4-point restraints provide increased protection and survivability.
An in-flight fire and subsequent collision with terrain of a Beechcraft Baron near Kununurra, WA demonstrates the danger damaged electrical wiring can pose to safe flight, an Australian Transport Safety Bureau final report explains.
The fire ignited in the Baron’s cockpit during its approach to land at Kununurra’s East Kimberley Regional Airport on the morning of 16 April 2022.
Despite expending the contents of a portable fire extinguisher, the fire quickly filled the cockpit with flames and thick smoke, preventing the pilot from effectively seeing external visual references or the aircraft’s instruments.
The loss of visual cues combined with the direct heat of the fire meant that the pilot was presented with significant difficulty retaining control of the aircraft.
The aircraft subsequently diverged from the runway centreline track and collided with the ground, coming to rest inverted about 600 metres beyond the Ord River and about 800 m from the Kununurra runway threshold.
After the impact, the seriously injured pilot managed to extract themselves and the sole passenger out of the wreckage before it was destroyed by fire. Unfortunately, the passenger succumbed to their injuries.
The ATSB’s transport safety investigation determined that a fault associated with the landing gear electrical system likely ignited fuel from the cabin heater supply line, resulting in the significant and sustained cockpit fire.
“The fuel line to the aircraft’s cabin heater passes through the area where the pilot reported the fire initiated, and multiple looms of electrical wiring pass through that area as well,” ATSB Chief Commissioner Angus Mitchell said.
“The fire coincided with multiple unusual indications and a burning smell as the pilot attempted to extend the landing gear.”
A breach of the cabin heater fuel line likely created a fuel source, and an electrical fault within the aircraft’s landing gear system provided an ignition source, for a rapidly spreading and sustained fire in the cockpit.
The investigation report cites four other occurrences in Australia and the United States involving in-flight fires in Baron aircraft, with damaged wiring identified as a likely factor in three of these instances.
“Damaged electrical wiring can pose a range of hazards to the safety of flight, including loss of electrical power, malfunctioning systems, and in-flight fire,” Mr Mitchell said.
“This hazard is further increased when wiring is proximal to lines carrying flammable liquid. Maintenance organisations and operators should review current practices for the prevention of damage to wiring and ensure that all available steps are being taken.”
The investigation final report also details findings around the survivability of light aircraft accidents.
It notes the pilot’s four-point harness provided a better restraint and attenuation of impact forces compared to the best available option of a three-point restraint in the rear of the aircraft.
“Four-point restraints, where available, provide increased survivability,” Mr Mitchell said.
“And where available and practical, rearward-facing passenger seats improve frontal impact protection and survivability in an accident.”
