Safety summary
What happened
At about 1901[1] on 22 August 2014, a V/Line train travelling the Werribee line on the Melbourne Metropolitan Rail Network collided with a stationary Metro Trains Melbourne (MTM) passenger train between Maidstone Street level crossing and Kororoit Creek Road. The MTM train had come to an unintended stop due to a loss of air pressure in its braking system. The V/Line train had stopped at an Automatic[2] signal that was indicating a Stop aspect and after a short while proceeded past the stop signal. Trains can proceed past an Automatic signal at Stop under conditions specified by an operating rule. Shortly after passing the signal, the train collided with the rear of the stationary MTM train at 43 km/h. The MTM train was carrying 51 passengers at the time of the collision. The driver and conductor on the V/Line train, the driver of the MTM train and eight passengers on the MTM train sustained minor injuries in the incident.
What the ATSB found
The ATSB found that the operating rule permitted the V/Line train to proceed past a signal at Stop into a section that was occupied by the MTM train. The V/Line train was operated past the signal at Stop in a manner contrary to the operating rule and proceeded at a speed that reduced the opportunity to observe the train ahead and stop in time. The rule placed reliance on the train driver to provide separation between trains by line-of-sight observation and was not an effective defence against errors.
The ATSB also found that the marker lights on the MTM train (Comeng type) did not meet the requirements of the Australian Standard for Railway Rolling Stock Lighting and Rolling Stock Visibility, AS/RISSB 7531.3:2007 for permissive working[3]. This standard was developed by the Rail Industry Safety Standards Board (RISSB) and although MTM had adopted this Standard, it was not implemented on the Comeng trains in their fleet.
What's been done as a result
Metro Trains Melbourne has amended the existing procedure in Section 3 Rule 1 of The Book of Rules and Operating Procedures 1994 for permitting trains to pass an uncontrolled, unmonitored signal at Stop. The new amendments incorporate a procedure, which requires train drivers to contact and respond to an automated voicemail facility providing their details, the rail vehicle details and details of the signal at Stop.
Metro Trains Melbourne has advised the ATSB that a modification is being developed to increase the intensity of the marker lights of Comeng trains to a level compliant with the Australian Standard for Railway Rolling Stock Lighting and Rolling Stock Visibility, AS/RISSB 7531.3:2007.
Safety message
The rules pertaining to permissive signalling rely on a train driver to provide separation between trains by line-of-sight observation. In the hierarchy of hazard controls, rule based controls are considered the least effective defence against human error or violations. Train operators should institute additional risk mitigation measures, where safeworking systems allow permissive working.
__________
MTM Service 6502
At about 1840[4] on 22 August 2014, Metro Trains Melbourne (MTM) passenger train 6502 departed Werribee Railway Station on its scheduled service to Flinders Street Station. The train arrived at Laverton Railway Station at about 1852 without incident.
Figure 1: Location map – Showing train line from Werribee to Melbourne and location of collision
Source: Copyright Melway Publishing 2013, Edition 41 with annotations by the Chief Investigator, Transport Safety (Victoria)
The train departed Laverton Railway Station and all signal aspects from Laverton were at clear normal speed (Green over Red). At about 1855, the train achieved a maximum speed of 115 km/h — the maximum authorised line speed for this section of track. Shortly after passing signal GG630 (Figure 2) and when near Cherry Creek, the driver heard a ‘loud bang’ from under the train. He noted that the brake pipe pressure had decreased and the brake cylinder pressure had increased. There was an immediate reduction in speed and the driver placed the brake handle to the full service braking position. When the train came to a stop, he placed the Reverser to the off position, which automatically applied the park brake. The train came to a stop at 1855, with the rearmost car, 427M, at about the 16.53 rail km mark[5].
The driver looked back and concluded that the train had not derailed and that it was not fouling the adjacent running lines. He called Metrol[6] to advise them of the location of the train and that the train had lost brake pipe pressure. He then made an announcement on the public address system to the passengers to advise them that the train would be delayed due to a defect. The driver then called Metrol for authority to go on the track to conduct an inspection of the train.
Figure 2: Collision location and signals
Source: Metro Trains Melbourne with annotations by the Chief Investigator, Transport Safety (Victoria)
Figure 3: Signal GG630 and indication of collision site
Source: Chief Investigator, Transport Safety (Victoria)
V/Line Service 8280
At about 1802 on the same evening, V/Line train 8280 departed Geelong for Southern Cross Railway Station. The train was returning to Southern Cross in preparation for a scheduled passenger service, and was crewed by a driver and a conductor but carried no passengers. At about 1832, the train came to a stand at Automatic signal GG1178 (between Little River and Werribee) which was at Stop and resumed its journey about 17 seconds later. After passing through Laverton Station, it proceeded at about 90 km/h past Automatic signal GG672 that was indicating a normal speed warning (Yellow over Red). The train then arrived at Automatic signal GG630 that was indicating a Stop aspect (Red over Red). This signal was at Stop as train 6502 had not cleared the block ahead. Train 8280 stopped at signal GG630 for about three seconds before resuming its journey. Trains can proceed past an Automatic signal at Stop under conditions specified by a rule in The Book of Rules and Operating Procedures 1994.
The collision and post collision events
After passing signal GG630, the V/Line train reached a speed of 43 km/h and collided at this speed with the rear of the stationary MTM service 6502 at about 1901. The MTM train had been stopped for about 6 minutes, before the collision. The data logger of the V/Line train indicated that emergency braking was applied by the driver 1.4 seconds before the collision.
The MTM train was shunted about 30 m due to the impact and the impacted cars stopped at about the 16.5 rail km mark, approximately 1210 m from signal GG630. The driver of the MTM train was thrown onto the cab floor by the impact. The V/Line driver was trapped between the train control console and the seat but managed to extricate himself by lowering the seat. He got out of his cab, walked towards the MTM train and spoke to passengers on the train to inquire as to their wellbeing and then spoke to the MTM driver who was still in the cab of his train.
MTM staff detrained the 51 passengers and escorted them to service replacement buses. The driver and conductor on the V/Line train, the driver of the MTM train and eight passengers from the MTM train sustained minor injuries in the incident. Both trains were significantly damaged (Figure 5).
Figure 4: Impacted trains
Source: Chief Investigator, Transport Safety (Victoria)
Figure 5: Train damage
Source: Chief Investigator, Transport Safety (Victoria)
__________
Location
The collision occurred on the MTM rail network between the Maidstone Street and Kororoit Creek Road level crossings in Altona, Victoria (Figure 6). Altona is approximately 22 km from Flinders Street Station, Melbourne.
Figure 6: Location of collision
Source: PASS Assets (Public Transport Victoria) with annotations by Chief Investigator, Transport Safety
Track and environmental conditions
The track infrastructure in this section consisted of a Broad Gauge East Line, a West Line and an independent parallel Standard Gauge line (Figure 2). Both trains were operating on the West Line. From the Maidstone Street level crossing, the track has a slight uphill gradient towards Cherry Creek. Clear sighting is available up to Cherry Creek from the Maidstone Street level crossing. The weather conditions were fine and it was a clear night with light winds.
Suburban train 6502
Train 6502 was of the Comeng type and consisted of two, 3-car sets, in a Motor (M) - Trailer (T) - Motor (M) three-car configuration. This train consisted of cars 338M - 1092T - 484M and 487M - 1052T - 427M. Comeng type Electrical Multiple Units (EMU) are single deck stainless steel car body trains, built by Commonwealth Engineering (Comeng) Dandenong, Victoria between 1982 and 1989.
Figure 7: Train 6502 configuration
Source: Chief Investigator Transport Safety, Victoria
MTM train crew
The MTM driver at the time of the incident had about 2½ years train driving experience. He held the required qualifications to operate the train, was route certified and assessed as medically fit for duty. Following the collision, the MTM train driver underwent mandatory drug and alcohol testing, returning a zero result.
Unintended stop of Comeng train
The train’s data recorder indicated that the brake application was not driver initiated or a vigilance[7] brake application. The evidence also did not indicate that the braking was a result of the activation of the trip lever[8]. The Comeng train was inspected after the collision, with particular attention to the braking system. Visual inspection and testing of the first three units 338M-1092T-484M did not reveal any damage to the brake pipes or the reservoirs. Inspection of the next three cars 487M-1052T-427M, revealed that the brake pipe of 427M was damaged and the suspension airbag on 487M was found to be leaking. The cause of the damage to these two cars could not be determined with certainty due to the impact damage.
Comeng train marker lights
Comeng train marker lights are located above the drivers cab windscreens and consist of an outer white light and an inner red light. The white light when illuminated indicates the front of the train, while the red light when illuminated indicates the rear of the train.
Figure 8 - Comeng train lights
Source: Chief Investigator, Transport Safety (Victoria)
Post incident inspection and testing indicated that the train’s rear marker lights were operational. Analysis of CCTV footage of this train passing Laverton Railway Station also showed that the marker lights were on at the time of passing this station.
Rollingstock lighting standards
The Rail Industry Safety and Standards Board (RISSB) is owned by its funding members that include Commonwealth, State and Territory governments and Rail Transport Operators in Australia. RISSB develops and manages rail industry standards, rules, codes of practice and guidelines.
In 2007, RISSB published a standard for Railway Rolling Stock Lighting and Rolling Stock Visibility, AS 7531.3:2007 (AS/RISSB 7531:3:2007). The RISSB standard is not prescribed, but some operators including MTM have adopted this Standard. The standard states ‘If operating in a network where the Safeworking System allows Permissive Working then each tail light shall have a luminous intensity of at least 100 candela’.
Luminous intensity testing of marker lights
The luminous intensity of a new marker light (new lens, retro reflective sheeting and lamp) of the type fitted to Comeng trains was measured. An approximate luminosity reading of 33 Lux at one metre[9] was recorded. In comparison, MTM advised that the approximate luminosity of the Siemens train marker light was 30 Lux at one metre and the X’Trapolis train marker light was 200 Lux at 1 meter.
V/Line Service 8280
The V/Line train 8280 was a VLocity Diesel Multiple Unit consisting of VL05 (units 1105 and 1205), VL12 (units 1112 and 1212) and VL39 (units 1139, 1339 and 1239).
Figure 9: Train 8280 DMU configuration
Source: Chief Investigator Transport Safety, Victoria
Post incident testing indicated that the train’s headlights were operational and the train’s data logger indicated that the train’s headlights were on at the time of the incident.
V/Line train crew
The V/Line train had two crewmembers, a driver and a conductor. The driver had been driving trains since qualifying in 1989 and was employed as a train driver by V/Line for the last 11 years. He held the required qualifications to operate the train, was route certified and assessed as medically fit for duty.
Control console
The driving control console of the VLocity is a wrap-around style instrument panel (Figure 10). The cab windows provide good visibility for the train driver. The Reverser is a four-position switch that is moved between Off, Forward, Neutral and Reverse positons. The Power/Brake Controller (PBC) is used to control traction power and brake effort. The PBC operates in power mode when pulled back from the centre ‘off’ position and in the brake mode when pushed forward from the centre position. There are six power notches that dictate the tractive effort. In brake mode, the controller moves seamlessly between minimum and full service braking. The Secondary Brake Controller (SBC) is used in the event of a brake control unit failure and braking effort becomes unavailable through the PBC. The SBC directly controls the brake pipe pressure to independently apply and release the brakes. Emergency braking can also be achieved by activating the emergency brake pushbutton located on the control console.
Figure 10 - Driver control console showing the main controls
Crashworthiness performance of the trains
Both trains were designed for the possibility of a limited speed collision with another train or obstruction. Train body structures and fittings were designed to accommodate significant loads and each train included special crashworthiness features to absorb collision energy. Such features aimed to reduce injury to passengers and train crew, particularly in low to medium speed collisions.
Crashworthiness design features of the VLocity included:
- energy absorption within multi-function couplers at #1 (driver cab) ends
- energy absorption within semi-permanent couplers at #2 (non-driver) ends
- shear-off plates at multi-function couplers
- anti-climbers at both #1 and #2 ends
- an energy absorbing structure protecting the driver’s cab.
Crashworthiness design features of the Comeng included:
- energy absorption within multi-function couplers at #1 (driver cab) ends
- energy absorption within semi-permanent couplers at #2 (non-driver) ends
- anti-collision posts at both #1 and #2 ends.
The collision speed of 43 km/h exceeded the design capacity of several of the energy absorbing features. Nonetheless, many of the features performed as would be expected, absorbing energy and providing a level of protection to passengers and train crew. In particular, the energy absorbing structure protecting the driving position deformed as designed when the VLocity impacted the rear end of the stationary Comeng train.
VLocity car-to-car crashworthiness features performed as expected, with the following exceptions:
- The shear off plates on the leading coupler functioned in advance of any significant absorption within the coupler itself.
- The leading coupler of the second car set (car 1112) did not absorb energy as might have been expected in an end-to-end collision.
- Anti-climbers between the lead and second car sets (between cars 1205 and 1112) have engaged but then distorted leading to some override by car 1205. Probably as a result of this climb, some members and connections within the structure protecting the cab have failed in advance of full absorption of collision energy. In turn, there was significant encroachment of the cab of car 1112.
Comeng car-to-car crashworthiness features performed largely as expected. Coupler energy absorption features functioned and car end collision posts remained intact.
The car body structures of both trains generally withstood the collision loading with some minor structural incursions at car ends. As a result, the level of damage within the passenger envelopes was not significant. In addition, on both trains there was only a small amount of equipment dislodgement within the passenger compartments.
Signalling system
A three-position colour light signalling system is in place between Laverton and Newport, and consisted of Home (Absolute) and Automatic signals (Permissive). Three position signals provide information to drivers regarding the compliance speed for the block[10] and information on the aspect of the signal ahead.
Home signals are controlled by a signaller or train controller. Home signals are Absolute signals and are not to be passed when displaying a Stop aspect unless written or verbal authority is provided as specified in the Book of Rules and Operating Procedures 1994.
An automatic signal is not directly controlled by a signaller or train controller but by the passage of trains detected by track circuits. Their function is to provide separation between trains travelling in the same direction on the same track in accordance with the line speed and headway requirements of that section of track.
When the track ahead is unoccupied, an Automatic signal will be at Proceed. In the MTM managed Melbourne Metropolitan Network the Safeworking System allows Permissive Working.
Permissive signalling
Historically permissive signalling systems were adopted to allow following train movements between controlled locations predominantly through areas where there were no communications. Permission to pass an automatic signal at Stop was provided in the form of a rule, to allow train movements to continue, under prescribed conditions, when a signaller could not be contacted.
Victoria
In Victoria, permissive signalling has been in operation since the introduction of 3-position signalling in 1915. There have been several changes to the rule pertaining to permissive signalling since its introduction. In the MTM managed Melbourne Metropolitan Network, the safeworking system allows Permissive Working.[11]
The current rule pertaining to permissive signalling is specified in Section 3 Rule 1 of The Book of Rules and Operating Procedures 1994.[12] This rule is also specified in the ARTC Code of Practice for the Victorian Main Line Operations, Section 3 (Rule TA 20). The rule extracted in part states that:
‘The Driver must bring the train to a stand for 30 seconds if an automatic signal displays ‘Stop’. If the automatic signal is still at ‘Stop’ after 30 seconds, the Driver may proceed, but must control the speed of the train at extreme caution, being prepared to find the section ahead occupied or obstructed, or the track damaged’.
The rule further states that:
‘Extreme caution is defined as being able to stop the train in half the distance that can be seen ahead; not exceeding 25 km/h or the posted track speed if that is the lesser, and always being prepared to find the section ahead occupied or obstructed, or the track damaged. Except where special instructions are issued to the contrary or where a disabled train requires assistance, a Driver must not pass any signal when it is known there is a train in the section’.
New South Wales
In New South Wales (NSW), the operating rule pertaining to permissive signalling systems is specified in the ARTC Operating Rule ANSG 608. The rule extracted in part states that:
- If a Driver can see that the block ahead is obstructed, they must speak to the Signaller before passing an automatic signal at STOP.
- If the whole of the block ahead cannot be seen, a Driver must try to speak to the Signaller before passing an automatic signal at STOP.
- If the Driver is unable to speak to the Signaller, they may pass the signal at STOP.
- A Driver may pass an automatic signal at STOP without speaking to the Signaller, if the Driver can see that the whole block ahead to the next signal is unobstructed.
As soon as practicable, the Driver must report to the Signaller at the next attended location:
- the number or designation of the signal passed at STOP, and
- the condition of the line.
At any time, the Signaller may tell the Driver not to pass the signal at STOP. In all cases, the Driver must record, in permanent form, the time and the signal number or designation of the signal passed at STOP.
Western Australia
In Western Australia, Automatic Signals are referred to as Approach Signals as they are situated on the approach side of a home signal.
The network rule for passing an Approach Signal states that:
The driver of a train stopped at a red Approach signal must contact the Train Controller and state:
- train number and description,
- signal number and section.
The Train Controller must then instruct the Driver to remain at the signal or pass the signal at Stop.
Where a Driver is instructed to pass the Approach signal at Stop, the Driver must proceed cautiously, prepared to find the line obstructed, or a broken or displaced rail.
If the Driver is unable to contact the Train Controller the Driver must wait one minute then pass the signal, proceeding cautiously, prepared to find the line obstructed, or a broken or displaced rail.
Monitoring trains on the network
Metropolitan Train Control Centre (Metrol) is the control centre for Melbourne's suburban rail network. Metrol has the ability to directly monitor approximately 43 per cent of the electrified metropolitan train network.
Signallers and train controllers located at Metrol directly control all train movements in the inner core of the suburban system including the operation of points and signals. Outside the suburban inner core, the movement of points and signals is carried out from remote signal boxes in consultation with Metrol.
Each signaller monitors a visual display unit indicating signals and points and there are five display units for Caulfield, Western, Northern, Burnley and Clifton Hill regions. The role of the signallers is to monitor the movement of trains, signals and points, and route trains as required.
Train drivers are required to contact signallers to clarify operational requirements, report faults or operational breaches.
There are three train control workstations and a radio operator’s workstation, each staffed by a signaller. The radio operator receives verbal information relayed to them by train drivers, station staff and signallers at the remote sites. The role of these signallers is to convey information received to the Metrol shift supervisor and other relevant personnel or fault rectification centres.
A portion of the metropolitan train network, including the incident area (Laverton), is currently not directly monitored by Metrol and is controlled and partially monitored from signal boxes located at remote sites. The incident area was controlled from the Newport signal box. The display unit at Newport does not provide specific information on the location of trains. In general, the signalling and station staff located at remote signal boxes will only contact Metrol when there is new information or an incident.
Compliance monitoring of Section 3 Rule 1
On the Melbourne Metropolitan Network, MTM has the dual role of the network manager and a train operator. MTM train drivers are subjected to regular safety audits but there is no specific network monitoring processes in place to measure compliance with Section 3 Rule 1. MTM does not monitor V/Line trains for compliance with the rule on their network.
From May 2015, MTM instituted an automated voicemail system, where train drivers on the metropolitan network are required to call on the system when they encounter an automatic signal at Stop and proceed past the signal as allowed by Section 3 Rule 1. Based on the voicemail data from 01 July 2015 to 31 December 2015, MTM and V/Line trains stopped and proceeded past automatic signals about 35 times per day.
Train communication
When a suburban train driver needed to contact Metrol, the driver was required to log a call to Metrol using the train’s radio system, the Urban Train Radio System[13] (UTRS). Once a call was logged, the driver had to wait for Metrol to respond. If the driver deemed the situation to be an emergency, they could contact Metrol using the emergency call button on the radio system or use their company-issued mobile phone. V/Line trains operating on the Melbourne metropolitan network cannot contact Metrol directly. They have to call Centrol[14] who contact Metrol to convey any information on V/Line train operations. Similarly, Metrol cannot contact V/Line trains and have to convey any information regarding their trains and network to Centrol, who convey that information to V/Line trains.
In this instance, the MTM driver did not consider the situation to be an emergency, hence waited for Metrol to call him after logging a call on the train’s radio system. While waiting for Metrol to respond, he contacted his supervisor on his mobile phone to discuss the mechanical defect that caused the Comeng train to come to a stop. After speaking to his supervisor, he called Metrol on his mobile phone and managed to get through to Metrol. During his mobile phone call with Metrol, Metrol called him on the train radio system, and he advised Metrol that he was already speaking to a controller on his mobile phone. During his conversation with Metrol, the V/Line train collided with the Comeng train.
Signal operation data logging
Laverton and Altona Junction utilises Computer Based Interlocking (CBI-SSI)[15]. The system provides safety interlocking between points, signals and train movements and a data logging facility.
The block section between Laverton and Altona Junction is indicated on the Laverton Data logging Facility as well as the Newport Logging Facility.
The area where the incident occurred is between these two locations and limited information is available from the incident area. The available data indicates that the Maidstone Street level crossing and the signals in the block section between Altona Junction and Laverton were operating satisfactorily. No signal aspect information is logged in the area between LAV732 and ALJ232; hence, there was no signal aspect information for Signal GG630. However, post incident testing of Signal GG630 indicated that the signal was functioning as required.
Previous occurrences associated with permissive signalling
There have been several incidents associated with Automatic signals and the application of the ‘Stop and Proceed’ rules.
On 17 June 1982, an Up[16] standard gauge freight train collided with rear of the Up Interstate passenger train Spirit of Progress at Barnawartha, Victoria. The freight train had passed the previous automatic signal at Stop as permitted by Regulation 74[17]. At the time of the incident, the passenger train was stationary due to a defective locomotive and there was heavy fog in the area. The driver and fireman operating the freight train were fatally injured and 20 passengers on the Spirit of Progress suffered injuries. Because of this incident, radio communications between the network control centre and locomotive drivers and the locomotive driver and train guard were introduced on the intrastate network.
On 8 October 1986, an Up freight train collided with the rear of another freight train, which was stationary at a Home signal waiting entry into the South Dynon yards in Victoria. The previous automatic signal was passed at Stop as permitted by Regulation 74. Visibility was restricted by track curvature. As a result of this incident, the Automatic signal involved was converted to a Home signal.
On 16 October 1989, a suburban passenger train collided with the rear of another suburban train, which was stationary at a Home signal at Ringwood in Victoria. The driver had passed the previous automatic signal as permitted by Regulation 74. Twenty-one passengers were injured in the collision. Because of this incident, the application of Regulation 74 was reinforced with train drivers.
On 20 November 1989, a suburban passenger train collided with the rear of another suburban passenger train, which was stationary at the Syndal Station platform in Victoria. The driver had passed the previous automatic signal as permitted by Regulation 74. The collision resulted in injury to 75 persons. Because of this incident, the application of Regulation 74 was reinforced with train drivers.
On 27 July 1998 a suburban passenger train collided with the rear of a stationary freight train near Aircraft Railway Station in Laverton, Victoria. Weather conditions at the time resulted in a limited viewing distance. At this time, Section 3 Rule 1 in the Victorian Book of Rules and Operating Procedures 1994 had superseded Regulation 74 (). Because of this incident, the application of Section 3 Rule 1 was reinforced with train drivers.
On 2 December 1999, an inter-urban train collided with the rear wagon of the Indian Pacific train at Glenbrook, New South Wales. The Indian Pacific train was stopped at an automatic signal displaying a Stop aspect. The driver of the inter urban train, on arriving at the previous automatic signal also displaying a Stop aspect, sought authority from a signaller to pass the signal. Once he received the authorisation he proceeded at a speed contrary to the relevant operating rule. On observing the rear wagon of the Indian Pacific train, the driver made an emergency brake application, but was unable to stop in time and collided with Indian Pacific train. The main recommendation from the inquiry into this incident was that the NSW Government should establish two separate independent authorities for regulating rail operations (Rail Safety Inspectorate) and investigating rail accidents (Rail Accident Investigation Board).
On 26 July 2000, a suburban express passenger train collided with the rear of another suburban passenger train that was stationary at the Holmesglen Station platform. The incident resulted in severe damage to both trains and 12 persons sustained injuries. Because of this incident, Section 3 Rule 1 was amended to include a mandatory maximum speed of 25 km/h after an automatic signal had been passed at Stop.
A report (dated May 2001) produced by the then Department of Infrastructure’s Office of the Director of Public Transport, Safety and Technical Services Branch recommended that the train operator assess the benefits and practicality of installing speed limiting equipment (after passing signals at danger) and data loggers to suburban trains. The train operator Connex assessed the benefits and practicality of installing the speed limiting technology but did not adopt it due to the perceived impacts on time performance, the limited effectiveness of the equipment and the complexity and costs involved.
On a Flinders Street to Craigieburn Metro Trains Melbourne suburban train, travelling on the Down[18] broad gauge line, ran into the rear wagon of a stationary Pacific National freight train between Roxburgh Park and Craigieburn stations in Victoria. At the time, the freight train was stopped at a signal. The investigation conducted by the Chief Investigator, Transport Safety, determined that the driver of the suburban train had passed two automatic signals after departing Roxburgh Park that presented a stop aspect. When passing the signals the driver did not comply with the network Rules and operating procedures. The investigation made recommendations with respect to the network’s ability to monitor the application of and compliance to Section 3 Rule 1 of the Book of Rules and Operating Procedures 1994, train speed limiting devices after passing signals at stop and the acceptance and application of industry standards for train tail signals.
In response to the Craigieburn incident Public Transport Safety Victoria (PTSV) now Transport Safety Victoria (TSV) issued a safety alert requesting transport providers and managers of rail infrastructure and rolling stock review the procedure and drivers compliance with the procedure for passing an automatic signal at stop. MTM carried out a review of Section 3 Rule 1 of the Book of Rules and Operating Procedures 1994 and concluded that no change was required to the Rule. Further, they reported that driver compliance monitoring was being carried out during the driver audit process. MTM also reported that they intended investigating the practicality of implementing speed limiting of trains when passing an Automatic signal at Stop and had adopted the standard Railway Rolling Stock Lighting and Rolling Stock Visibility, AS 7531.3:2007.
A recent example of an overseas incident was when a passenger train collided with a train that was stabled at a platform at Norwich station in the United Kingdom on 21 July 2013. Permissive working was authorised in the signal section of the station, hence the passenger train was authorised to proceed past a signal at Stop. The driver of the passenger train was aware that a train was stabled at the platform, and observed this train, when he made a brake application. The Rail Accident Investigation Board (RAIB) identified that the driver had either a lapse of concentration or a microsleep. The RAIB recommended that the rail operator review its audit procedures and non-compliance with their operational procedures, driver training, driver fatigue management and conduct a risk assessment of permissive working.
__________
- The vigilance control system verifies that the driver is not incapacitated by monitoring task linked activities and, in the absence of any such activities, provides intervention by applying the train’s brakes.
- When a signal is at Stop, the trip arm of the train-stop-unit located beside the track is raised so that the trip lever on the train will strike it causing the emergency air brake to be applied and the train to come to a stand.
- At a measuring distance of one metre, the values for candela and lux are the same.
- A block is a section of track between two signals.
- Book of Rules and Operating Procedures 1994 - Section 3 Rule 1 – Detention at Automatic Signals.
- The UTRS system has now been replaced by the Digital Train Radio System (DTRS), which has a call log facility (TCall), Train Emergency Call (TEC) and Rail Emergency Call (REC).
- Central Control, the operational control centre for Victoria’s regional broad gauge rail network.
- A proprietary processor based system developed originally by GEC-General Signal and Westinghouse Signals Ltd.
- Track heading towards Melbourne.
- This was the previous regulation, which applied to ‘Detention at Automatic Signal’.
- Track heading away from Melbourne.
Unintended stop of Comeng train
The Comeng train’s data recorder indicated a sudden loss of brake pipe air pressure at about 18:55. At the same time, the data recorder indicated an instantaneous rise (a spike) in the lateral acceleration graph of car 484M. Visual inspection and testing of the train revealed that the brake pipe of car 427M was damaged and the suspension airbag on car 487M was leaking. The cause of the damage to these two cars and the sudden loss of brake pipe pressure could not be determined.
Permissive signalling systems
Section 3 Rule1 facilitates the flow of rail traffic on the network under certain circumstances by permitting trains to pass an uncontrolled, unmonitored signal, enter a section which may or may not be occupied by another train that is not immediately observable, or enter an unoccupied section where some infrastructure condition may be affecting the signal’s operation.
There are 925 automatic signals on the Melbourne metropolitan train network. A driver may be required to stop and proceed at any of these Automatic signals for any of the above reasons. On average, the provisions of Section 3 Rule 1 are applied about 35 times a day at these automatic signals, before proceeding past them at Stop.
Although permissive signalling is used in other jurisdictions in Australia and overseas, the Stop and Proceed Rules in these jurisdictions are more rigorous in that they permit drivers to proceed past an automatic signal at Stop only if they are unable to contact a signaler and under conditions specified in the rule.
In Victoria, the Rule does not require a driver to report that they are intending to pass an Automatic signal at Stop. Further, there is no monitoring of compliance with the Rule when a train passes an automatic signal at Stop. However, the system requires drivers to advise the train controller the reasons for not passing an automatic signal at Stop.
Since 1982 there have been seven collisions involving trains that have stopped and proceeded past automatic signals at Stop. These incidents resulted in changes to radio communication methods and minor changes to the Stop and Proceed Rule. Despite these changes, the Stop and Proceed Rule still relies on a train driver to provide separation between trains by line-of-sight observation. Considering the hierarchy of controls[19], administrative or rule based controls are low on the hierarchy and is considered the least effective defence against human error or violations.
Actions of the train driver and situational factors
Compliance with rule at and after passing signal GG630
After arriving at signal GG630, the V/Line train stopped at this signal for about three seconds before resuming its journey. The rule required drivers to stand at an Automatic signal at Stop for a minimum of 30 seconds and then travel at a speed not exceeding 25 km/h. The train reached a speed of 43 km/h before colliding with the stationary MTM train. This reduced the opportunity to observe the train ahead and stop in time.
Driver attention and distraction
Cognitive workload
The driver was familiar with the line and route. He was familiar with the operation of the VLocity train and the tasks required of him. There was no compelling evidence to suggest that the driver’s cognitive workload impeded the performance of his train driving tasks.
Fatigue
In the context of human performance, fatigue is a physical and psychological condition which can arise from a number of different sources, including time on task, time awake, acute and chronic sleep debt, and circadian disruption (disruption to normal 24-hour cycle of body functioning). Fatigue can have a range of influences on performance, such as decreased short-term memory, slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance, and increased errors of omission.[20] Fatigue impairment has been identified as contributory in a significant number of rail accidents and incidents. Research has indicated that anything less than 5-6 hours sleep in 24 hours and 12 hours sleep in 48 hours is likely to lead to fatigue impaired performance.[21] [22]
The train driver’s roster indicated that he had been on afternoon shift for the previous fortnight. The driver indicated that his previous three shifts were ‘standby’ shifts and that the workload was light. On the day of the incident he was rostered to and signed on at about 1300. He travelled as a passenger on the 1320 Geelong train. In Geelong, he prepared a locomotive and then completed a run-around to Marshall and returned to Geelong. He was then assigned to take the 8246 empty service to Southern Cross Station, Melbourne.
Based on the evidence provided to the ATSB, the driver of the train obtained about 7-8 hours of sleep in the 24 hours leading up to the occurrence and about 16-18 hours of sleep in the 48 hours prior. There was no evidence to suggest that the quality of the driver’s sleep in the preceding days had been compromised. Further, the sleep opportunity periods provided while driving the afternoon shift had significant overlap with the circadian trough (around 0200 to 0600), when sleep is generally at its most restorative.
Considering all of the available evidence concerning quantity and quality of sleep obtained and reported alertness on duty, the driver’s cognitive performance was likely to have been at a manageable level at the time of the event. The available evidence did not support a contention of fatigue impairment as contributory to this accident.
Expectancy
The V/Line driver reported that typically, he followed the train ahead and adjusted his speed in order to ensure that the train had cleared the block before he approached the signal. This was to ensure that the signal changed to Caution (Yellow) when he approached it and he could proceed past the signal without stopping. He stated that the EMU should have been ‘gone’ from the section and did not expect it to be in the section. Further, the driver advised that he had encountered automatic signals at Stop before and had stopped and proceeded past the signal without encountering another train in the section ahead. It is unlikely that the driver would have operated the train in the manner he did, had he expected the track section to be occupied.
Driver distraction
Distraction can be understood as a type of inattention, where a person’s attention is diverted by a particular event or object. Potential sources of distraction for the train driver included his mobile phone and two-way radio in the cab. There was no evidence to indicate that the driver was operating or otherwise attending to any of this equipment on passing signal GG630.
The driver stated that the lights and noise from the refinery distracted him. Although the refinery is about three kilometres from the location of signal GG630, it is possible that the flame from the refinery’s flare stack may have distracted the driver.
Attentional disengagement (mind wandering)
While driver distraction is widely acknowledged as impeding performance of driving tasks, it is important to recognise that people can also become unintentionally inattentive to driving tasks without the presence of a competing activity.[23] Attentional disengagement, or mind wandering, can be described as occurring when attention normally directed toward the primary task momentarily shifts away from the external environment, even though the individual continues to show well practiced automatic responding.[24] [25] Mind wandering or ‘zoning out’ can occur in situations where tasks are protracted, unvarying, familiar, repetitive or undemanding.[26] It is therefore possible that the driver’s mind wandered and that his focus was not on the driving tasks and he did not observe the Comeng train ahead of him until it was too late.
Train marker lights
The Board of Inquiry into the incident near Aircraft Station in Victoria in 1998, made several recommendations with respect to end of train marker lights:
- End of Train Markers (ETM) should denote the rear vehicle of a train to the driver of a following train during darkness and especially during inclement weather.
- That a standard be developed for marker lights that allows viewing by the driver of a following train, as well as by signalling staff and others to ascertain a train is complete.
- That a study be undertaken to assess the viewability of marker lights currently in use on all trains during inclement weather.
- That a defined procedure for checking the viewability of ETMs and (if not already in place) other tail signals be adopted.
A standard for ETMs was first developed 2007 and the current version of the standard AS/RISSB 7531.3:2007 recommends that rolling stock operating in a network where the Safeworking System allows Permissive Working then each tail light shall have a luminous intensity of at least 100 candela (100 lux at one metre). The other recommendations by the board have not been implemented or carried out by subsequent train operators.
Tests carried out on the type of marker lights used on the Comeng and Siemens trains indicated a luminosity of 33 Lux at one metre and a luminosity of 30 Lux at one metre, both below the value recommended by the Standard. After the incident, Comeng train tail light sighting tests were conducted at night, in the incident site. An observer noted that the marker lights tended to disappear at night due to the refinery lighting and the LED signals. Low luminosity marker lights may not be discernible in areas of other illuminations. Although MTM had adopted the AS/RISSB Standard, they have not implemented it on their rail fleet.
Considering the above, it would be appropriate for MTM to institute measures to ensure that the luminous intensity of marker lights of all passenger trains in their fleet meet a railway industry approved and accepted standard.
__________
- Hierarchy of hazard control is a system used in industry to minimize or eliminate exposure to hazards. The controls are listed from strong controls to less effective controls and they are: elimination, substitution, engineering controls, administrative controls and personal protective equipment.
- Battelle Memorial Institute (1998). An Overview of the scientific literature concerning fatigue, sleep, and the circadian cycle. Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, US Federal Aviation Administration.
- Dawson, D. & McCulloch, K. (2005). Managing fatigue: It’s about sleep. Sleep Medicine Reviews, 9, 365-380.
- Thomas, MJW. & Ferguson, SA. (2010). Prior sleep, prior wake, and crew performance during normal flight operations. Aviation, Space, and Environmental Medicine, 81 (7), 665-670.
- Regan, M.A., Hallett, C., and Gordon, C.P. (2011). Driver distraction and driver inattention: Definition, relationship and taxonomy. Accident Analysis and Prevention, 43, 1771-1781.
- Smallwood, J. & Schooler, J.W. (2006). The Restless Mind. Psychological Bulletin, 132 (6), 946-958.
- Cheyne, J.A., Soman, G.J.F., Carriere, J.S.A., and Smilek, D. (2008). Anatomy of an error: A bidirectional state model of task engagement/disengagement and attention-related errors. Cognition, 111, 98-113.
- Cheyne, Soman, Carriere and Smilek, (2008).
The following findings are made with respect to the collision between a Metro Trains Melbourne passenger train 6502 and V/Line train 8280 between Maidstone Street level crossing and Kororoit Creek Road in Altona, Victoria. These findings should not be read as apportioning blame or liability to any particular organisation or individual.
Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
Contributing factors
- Comeng train 6502 stopped unexpectedly in the section.
- The rules pertaining to passing a permissive signal at stop place sole reliance on the train driver to provide separation between trains by line-of-sight observation. In the absence of any additional risk mitigation measures, this administrative control provides the least effective defence against human error or violations. [Safety issue]
- The V/Line train passed automatic signal GG630 at the Stop position in a manner contrary to the operating rule and proceeded at a speed that reduced the opportunity to observe the train ahead and stop in time.
- The V/Line train driver did not observe the Comeng train ahead probably due to being distracted or disengaged from his driving tasks.
Other factors that increased risk
- The marker lights on the Comeng train did not meet the requirements of the standard for Railway Rolling Stock Lighting and Rolling Stock Visibility, AS/RISSB 7531.3:2007. [Safety issue]
The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.
All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions are repeated separately on the ATSB website to facilitate monitoring by interested parties. Where relevant the safety issues and actions will be updated on the ATSB website as information comes to hand.
Permissive Signalling System
The rules pertaining to passing a permissive signal at stop, place sole reliance on the train driver to provide separation between trains by line-of-sight observation. In the absence of any additional risk mitigation measures, this administrative control provides the least effective defence against human error or violations.
ATSB Safety Issue No: RO-2014-016-SI-01
ATSB safety recommendation: RO-2014-016-SR-38
Passenger Train Marker Light Standards
The marker lights on some MTM passenger trains do not meet the requirements of the standard for Railway Rolling Stock Lighting and Rolling Stock Visibility, AS/RISSB 7531.3:2007.
ATSB Safety Issue: RO-2014-016-SI-02
ATSB safety recommendation: RO-2014-016-SR-39
Sources of information
The sources of information during the investigation included:
- Metro Trains Melbourne
- V/Line Pty Ltd
- Metro Trains Melbourne Train Driver
- V/Line Train Driver.
References
Battelle Memorial Institute (1998). An Overview of the scientific literature concerning fatigue, sleep, and the circadian cycle. Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, US Federal Aviation Administration.
Cheyne, J.A., Soman, G.J.F., Carriere, J.S.A., and Smilek, D. (2008). Anatomy of an error: A bidirectional state model of task engagement/disengagement and attention-related errors. Cognition, 111, 98-113.
Dawson, D. & McCulloch, K. (2005). Managing fatigue: It’s about sleep. Sleep Medicine Reviews, 9, 365-380.
Regan, M.A., Hallett, C., and Gordon, C.P. (2011). Driver distraction and driver inattention: Definition, relationship and taxonomy. Accident Analysis and Prevention, 43, 1771-1781.
Smallwood, J. & Schooler, J.W. (2006). The Restless Mind. Psychological Bulletin, 132 (6), 946-958.
Thomas, MJW. & Ferguson, SA. (2010). Prior sleep, prior wake, and crew performance during normal flight operations. Aviation, Space, and Environmental Medicine, 81 (7), 665-670.
Submissions
Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to V/Line, Metro Trains Melbourne, Public Transport Victoria, Transport Safety Victoria, Office of the National Rail Safety Regulator and the train drivers.
Submissions were received from V/Line, Metro Trains Melbourne, Public Transport Victoria, Transport Safety Victoria and the Office of the National Rail Safety Regulator. The submissions were reviewed and where considered appropriate, the text of the draft report was amended accordingly.
Purpose of safety investigationsThe objective of a safety investigation is to enhance transport safety. This is done through:
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. TerminologyAn explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing informationReleased in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly. |