 
This investigation was conducted under the Transport Safety Investigation Act 2003 (Commonwealth) by the Office of Transport Safety Investigations (NSW) on behalf of the ATSB in accordance with the Collaboration Agreement. Released in accordance with section 25 of the Transport Safety Investigation Act 2003. |
What happened
On the evening of 3 June 2020, two Aurizon banking locomotives assisted a loaded coal train, WH512, up the Ardglen bank in the Hunter Region of New South Wales (NSW). On completion of the banking assist at Ardglen yard, the train crew prepared the lead locomotive 5031 to become the trailing locomotive, then transferred to locomotive 5034.
The two banking locomotives started to move while the train crew were walking from 5031 to 5034. The train crew boarded 5034 and attempted to take control of the locomotives without success. As the locomotives rolled back down the Ardglen bank, the train crew attempted to stop the locomotives with a series of brake applications. The locomotives reached speeds of up to 114 km/h before derailing and overturning on their side and coming to rest 13 m apart.
The train crew sustained minor injuries in the crash and were able to exit the cabin. The locomotives were significantly damaged and approximately 100 m of rail track was also damaged.
What the ATSB found
During the process of changing ends, the driver likely depressed the Independent Brake Handle accidently, at the same time as placing locomotive 5031 into Trail Cut-out mode. This released the automatic air brake application on both locomotives.
The park brakes were ineffective in holding the locomotives on the grade at Ardglen and the banking locomotives started to roll away after the train crew left the cab of locomotive 5031. The train crew were then unable to establish control once the locomotives started rolling and the banking locomotives rolled approximately 3 km before derailing at 366.529 km near Kankool.
Aurizon did not ensure that the train crew had a consistent understanding of how to safely change ends on banking locomotives. Further, the train crew had not been trained to use the forced lead function which would have likely allowed the train crew to regain control of the locomotives.
Aurizon had not fully considered emergency egress from a locomotive overturned on its side. This increased the risk of further injury to the train crew and could also have prevented emergency services accessing personnel within the locomotive in a timely manner.
What has been done as a result
Aurizon completed their internal investigation and advised the following actions were commenced and completed to prevent recurrence:
- Completed modifications on the locomotive classes involved in the derailment to improve alignment in the braking system, resulting in improved park brake force.
- Modified the procedure clarifying steps for changing ends and when to use forced lead function and monitoring the correct application of the procedure through regular analysis of locomotive downloads.
- Developed training resources to enable more effective training in emergency situations.
Safety message
Rail transport operators should ensure, parking brake systems on locomotives are effective, regularly inspected and maintained. Their safety management systems should contain operational work instructions with sufficient detail on how to carry out safety critical tasks, such as forced lead function. Additionally, rail transport operators’ competency management systems should assess all safety critical competencies, including emergency operational instructions and emergency egress and ensure train crew are trained and assessed.
The occurrence
Preparation of locomotives and banking operation
At approximately 1750[1] on 3 June 2020, the two-person train crew (driver A and driver B) arrived at Chilcotts Creek siding and commenced preparing the banking locomotives[2] (5031 and 5034) for the planned assist of train WH512 up the bank between Chilcotts Creek and Ardglen in the Hunter Region of NSW.
Driver A prepared locomotive 5031 and driver B prepared locomotive 5034. Driver B joined driver A on locomotive 5031 after preparing locomotive 5034. Driver A then attempted to move the locomotives under power and noticed they were not moving as easily as they should have.
Driver B then got back down from the cab and checked the brakes on locomotive 5034. Driver B found the park brake on 5034 number 2 bogie was not releasing. The train crew cycled through applying and releasing the park brake in an attempt to make it release.
Driver B contacted the Rollingstock Defect Coordinator (RDC) to help resolve the sticking park brake. Driver B and the RDC worked through the problem and resolved the issue by manually releasing the park brake. Driver B then returned to locomotive 5031 and updated the locomotive 5034 logbook writing down the park brake issues experienced on number 2 bogie.
At approximately 1910, train WH512 arrived at Chilcotts Creek and stopped in the loop at signal CC12L. After receiving confirmation of the train being stopped, Network Control (NC) authorised the banking locomotives to depart Chilcotts Creek engine siding.
Driver A moved the banking locomotives to the rear of WH512. The train crew undertook a test attach/detach of the banking locomotives to the rear of train WH512 and conducted an independent brake test on locomotive 5034 to confirm it was operational. Both attach/detach and the independent brake were verified as working.
Between 1918 and 1945, WH512 was assisted up Ardglen bank by banking locomotives 5031 and 5034. The banking locomotives stopped prior to signal 09-12M on the main line at Ardglen and WH512 continued its trip in the Up[3] direction towards Newcastle.
Driver A recalled reducing the power on the banking locomotives from notch 8 to notch 4 to allow the banking locomotives to come away from the rear of the train WH512.
At 1946 driver A applied the independent brake on locomotive 5031 to bring the locomotives to a stop.
Changing ends of banking locomotives
Driver B told driver A that locomotive 5031’s park brakes were on and driver A said that they turned to see the lights indicating the park brakes were on. Driver A then started the process of changing 5031 from the Lead locomotive to the Trail locomotive.[4]
Driver A firstly moved the throttle/dynamic brake handle to idle and the reverser handle to neutral. They then moved the automatic brake handle to the Handle Off (HO) position which activated the Electronic Brake Valve (EBV) to release the air pressure in the train brake line to zero.
When the air pressure had dropped to zero, driver A turned the locomotive headlights off and released the independent brakes. Driver A then used the locomotive Smart Display Interface Screens (SDIS) to place locomotive 5031 into Trail Cut-out mode which electronically isolated the EBV and the independent brake. After completing this task Driver A stepped off locomotive 5031 and started to walk towards locomotive 5034. Earlier, Driver B had exited the cabin and made their way towards the hut to activate the level crossing.
Runaway and derailment
At 1948, with both drivers outside the locomotive and in the process of changing ends, the banking locomotives began to slowly roll in the Down direction back towards Chilcotts Creek. Driver A had just reached locomotive 5034 when they noticed the locomotives slowly moving. Driver A called out to driver B, and driver A then boarded the moving locomotive and got into the driver’s seat. Driver B boarded locomotive 5034 shortly after.
Figure 1: Runaway
This figure shows the path of the runaway and the speed of the locomotives as they progressed from Ardglen towards Kankool.
Source: SIX maps and ARTC trip report, modified by OTSI
Driver A attempted to activate locomotive 5034 as the Lead locomotive using the SDIS but the screen did not respond. Driver A pressed the vigilance reset button and turned the locomotive headlights on.
Driver A then moved the automatic brake handle from the HO position into the service zone, which had no effect in stopping the locomotives. The locomotives had increased speed to approximately 6 km/h. Driver B also attempted to activate locomotive 5034 as the Lead locomotive on the SDIS screen but could not get the system to acknowledge commands.
Driver B told driver A to apply the emergency brake, then driver B leaned across driver A and placed the automatic brake handle into emergency but this had no effect in stopping the locomotives. Driver B sounded the horn as the locomotives passed the level crossing, one minute and 45 seconds had elapsed from when the locomotives started to move and they were travelling at approximately 29 km/h.
At 1950, Driver B made an emergency call to Network Control and reported that they were a runaway train. The Upper Hunter Network Control Officer (NCO) asked for clarification of their situation. Driver B remained in communication with the NCO over the next 2 minutes.
Driver A moved the automatic brake handle to the release position, the locomotives were travelling at approximately 73 km/h. Driver A moved the automatic brake handle to the emergency position again but there was no effective application of the brakes. Driver B was still on the radio with the NCO and reported they had no effective brakes and were travelling at 87-88 km/h. The NCO confirmed that the track ahead was clear through to Chilcotts Creek.
About four minutes had elapsed and the locomotives were travelling at approximately 114 km/h when the data logger on locomotive 5031 stopped recording at 1952. At the same time, Network Control observed the locomotives disappear from the Phoenix display[5]. The locomotives had derailed.
The NCO attempted to contact the train crew two times unsuccessfully. On a third attempt, the train crew responded advising the NCO that the banking locomotives had tipped over on their side and come to rest.
Driver B reported that they were okay and were trying to get out of the locomotive cabin. They also made a call to Aurizon Control to inform them of their situation.
The locomotives had derailed at 366.529 km by overturning to their left side and parting in the process, sliding along the ballast, before coming to rest approximately 13 m apart at 366.619 km.
Post derailment and recovery
Driver A attempted to push the front windscreen of the locomotive open but was unsuccessful. As the locomotive was lying on its left side, the designated emergency escape was through the open side window on the right side of the cabin, which was now approximately 1.2 m above head height. Driver B managed to climb up and out of the cabin and driver A followed shortly after.
When driver B exited the cabin, they made another phone call to the NCO to advise them they were out of the locomotive cabin and was informed by the NCO that NSW ambulance and Fire and Rescue NSW personnel were on their way.
Driver A heard fluid leaking and smelt diesel fuel and found it was coming out of locomotive 5031. Driver A was able to locate a rag and stem the flow of the fuel until emergency services could arrive.
At approximately 2030 emergency services arrived. The train crew were treated for their injuries which included bruising to the left elbow and a cut to the head of driver A and injury to the right ear and other cuts and abrasions to driver B.
Both locomotives sustained significant damage and approximately 100 m of rail track was damaged as a result of the derailment.
Figure 2: Derailed locomotives
Source: OTSI
__________
Context
Location
Kankool is a locality in the Hunter Region of NSW approximately 200 km north-east of Newcastle. The banking locomotives derailed and came to rest approximately 2 km from Kankool.
Figure 3: Location map
Source: Geoscience Australia, modified by OTSI
Ardglen bank
The section between Chilcotts Creek and Ardglen is where WH512 required assistance from the banking locomotives. This section of track is more commonly referred to as the Ardglen bank and freight services generally require banking locomotives to assist them up the hill towards Ardglen.
The ruling grade[6] on the Ardglen bank between Ardglen and Kankool is 1:40, between Chilcotts Creek and Kankool the ruling grade is 1:38 (Figure 4).
Figure 4: Ardglen bank
This figure shows the gradient between Chilcotts Creek and Ardglen. Figure is not to scale.
Source: ARTC NSW Curve and Gradient Diagrams: Section 1 – North and Hunter Valley, modified by the OTSI
Organisations
Australian Rail Track Corporation
The Australian Rail Track Corporation (ARTC) was the rail infrastructure manager. ARTC was an accredited operator[7] and since September 2004 held a 60-year lease of the interstate and Hunter Valley rail lines of NSW.
Aurizon
Aurizon was the rollingstock operator responsible for WH512 and the banking locomotives that assisted WH512 up Ardglen bank. Aurizon (previously known as QR National) was also an accredited operator and has had above rail operations in the Hunter Valley since 2005. QR National was rebranded Aurizon in December 2012.
Environmental information
Weather observations from Murrurundi Gap Station (approximately 6 km south-east from Kankool) recorded the temperature at 3 pm at 11.5 °C. There had been no recorded rain on the day and 1.2 mm was recorded the day before.
The first light at Ardglen was at 0623 and the last light was at 1727. The incident occurred at 1750, in darkness.
The Ardglen Yard is open with good visibility. The ARTC curve and gradient diagram (Figure 4) indicates the rail line is on a 1:147 grade prior to the Ardglen tunnel entry. The diagram also indicates the rail line through the yard is on a 1:107 grade and transitions to a 1:44 grade.
Train crew
The train crew both worked from the Quirindi depot.
Driver A
Driver A had been a train driver with Aurizon since September 2012 working in Central Queensland and NSW. Driver A joined the Quirindi depot in February 2017. Driver A had acquired the Aurizon competency as a main line driver prior to joining Quirindi depot and qualified for the relevant Aurizon accreditation to undertake banking operations on 26 August 2017.[8]
The roster for driver A in the week prior to the incident is shown in Table 1.
Table 1: Actual duty times for driver A[9]
|
Date
|
Duty start
|
Duty end
|
Duty time
|
Time off
|
|
28 May 2020
|
2030
|
0700
|
10:30 hours
|
14:00 hours
|
|
29 May 2020
|
2100
|
0755
|
10:55 hours
|
|
|
30 May 2020
|
Break (from night shift to day shift)
|
23:35 hours
|
|
31 May 2020
|
0730
|
1810
|
10:40 hours
|
15:20 hours
|
|
1 June 2020
|
0930
|
1900
|
9:30 hours
|
15:00 hours
|
|
2 June 2020
|
1000
|
2005
|
10:05 hours
|
13:55 hours
|
|
3 June 2020
|
1000
|
Incident occurred at 1948
|
Driver B
Driver B had transferred to Quirindi depot from Antiene in September 2019. Driver B was the co-driver or second qualified driver on the locomotives. Driver B had acquired the Aurizon competency as a main line driver in May 2019 and qualified for the relevant Aurizon accreditation to undertake banking operations on 12 May 2020.
The roster for driver B in the week prior to the incident is shown in Table 2.
Table 2 Actual duty times for driver B
|
Date
|
Duty start
|
Duty end
|
Duty time
|
Time off
|
|
28 May 2020
|
2045
|
0600
|
9:15 hours
|
15:00 hours
|
|
29 May 2020
|
2100
|
0755
|
10:55 hours
|
|
|
30 May 2020
|
Break (from day shift to night shift)
|
16:05 hours
|
|
31 May 2020
|
0000
|
0620
|
6:20 hours
|
27:40 hours
|
|
1 June 2020
|
1000
|
1715
|
7:15 hours
|
18:00 hours
|
|
2 June 2020
|
1115
|
1620
|
5:05 hours
|
20:10 hours
|
|
3 June 2020
|
1230
|
Incident occurred at 1948
|
Based on the duty times worked by the train crew and the time the incident occurred, fatigue was not considered a contributing factor.
Rollingstock information
Locomotives
Both locomotives (5031 and 5034) involved in the incident were 5020 class locomotives (Standard Gauge, 180 tonne, 3184 kW tractive power, model C44acHi). The locomotives were built in 2010 by United Group Limited (Rail) at Chullora NSW.
The locomotives were set up to run as an end-to-end configuration which allowed the locomotives to be operated from the front cabin of whichever locomotive was in the Lead for the direction of travel (Figure 5).
Figure 5: Banking locomotives
This figure shows the end-to-end setup of the banking locomotives. Locomotive 5034 faced the Up direction.
Source: C44acHi Locomotive Vol.1 Rev 00 Operator’s Manual, modified by the OTSI
The Air Brake System
FastBrake® Electronic Air Brake is a microcomputer based electro-pneumatic braking system developed by Wabtec Corporation. It is the braking system used on the 5020 class locomotives.
The system consists of two major components, the Electronic Brake Valve (EBV) and the Pneumatic Operating Unit (POU).
Electronic Brake Valve
The EBV consists of two handles that are used to operate the locomotive and train air brake system. The handles are the Automatic Brake and Independent Brake.
Figure 6: Electronic Brake Valve
This figure shows the EBV, with the Automatic Brake Handle in HO position and the Independent Brake Handle in REL position. This is the positioning the handles should be in when a locomotive is set up as a Trail unit
Source: OTSI
Automatic Brake Handle
The Automatic Brake handle is used to apply brakes to a consist that is being hauled by the locomotive. The Automatic Brake handle operates through six control positions:
1. Release (REL)
2. Minimum reduction (MIN)
3. Full service (FS)
4. Suppression (SUP)
5. Handle off (HO) or Continuous service (CS)
6. Emergency (EMER).
The service zone is between MIN and FS. A brake application in the service zone will reduce brake pipe pressure by 43 kPa with a MIN application and up to 193 kPa with a FS application.
As stipulated in the Operator’s Manual[10] the Automatic Brake handle should be moved to HO position when the locomotive is a Trail unit in a multiple-unit configuration or is being towed as an unpowered unit.
Independent Brake Handle
The Independent Brake handle is used to apply brakes to the locomotive only.
It has two positions:
1. Release (REL)
2. Apply (FULL).
When the handle is in the REL position the brakes are released. As the handle is moved towards the FULL position, the brake application is gradually increased.
The Operator’s Manual stated that, the independent brake handle should always be in the REL position when set up as a Trail unit in a multiple-unit configuration or when it is being towed as an unpowered unit (Dead).
Pneumatic Operating Unit
The POU responds to the electrical signals from the EBV to control (apply/release) the train air brakes. There are four major components:
1. Brake Pipe control
2. Brake Cylinder control
3. Independent application and release
4. Power supply.
The train driver sends commands to the braking system through the EBV. When the automatic brake handle is moved to a position other than REL, the Brake Pipe pressure will reduce and result in the application of the automatic train brake including the locomotives.
When an automatic brake application has been made, the independent brake handle can be used to make an independent release of the automatic brake application on the locomotives (bail-off). This is to minimise the effect of hauled rollingstock bunching into the rear of the locomotives.
Bail-off is achieved by pushing the independent brake handle down towards the floor of the locomotive. The spring action in the handle returns the handle to its original position when released and stops the bail-off. The brakes return to the service application level a few seconds after the handle is released.
When the independent brake is applied, positive air pressure is placed in the No.3 Control Pipe and brakes apply. When the independent brake is released, positive air pressure is placed in the No.4 Independent Release Pipe and brakes release. Figure 7 shows the end air pipe connections at the rear of locomotive 5031 which were connected to the rear of locomotive 5034. With these pipes connected, commands to the braking system from the Lead locomotive pneumatically triggered the same braking control functions in the Trail locomotive.
Figure 7: Air pipe connections
This figure shows the end air pipe connections of locomotive 5031
Source: OTSI
Spring Applied Park Brake System
The locomotives had spring applied, air pressure released, park brakes mounted on each bogie. Each park brake cylinder unit operated two brake shoes to actuate braking on two axles of each bogie.
The park brakes were applied and released using push buttons situated on a panel located behind the driver’s seat (Figure 10). When a park brake button was pressed on, an electrical signal was sent to apply all park brakes in the locomotive consist.
When the park brakes were sticking on locomotive 5034, driver B manually released the park brake. The worm screw spindle located on the rear of the park brake cylinder was wound in an anticlockwise direction to release the park brake.
If required, the spring park brake could be manually applied by rotating the worm screw spindle in a clockwise direction.
Figure 8: Park brake system
This figure shows the park brake mechanism which is located on one of the bogies of a 5020 class locomotive.
Source: OTSI
To reset and reapply the spring park brake, air pressure must be reapplied to the park brake; this releases the park brake and resets the manual override feature. An application of the park brake can then be made using the push buttons, which vents air pressure from the park brake.
The braking system also contained an anti-compounding air brake circuit which prevented simultaneous application of the service brake and the spring park brake. The combined force of the spring park brake and the service brake is additive and would be excessive without the anti-compounding brake circuit.
Smart Display Interface Screens
There are three Smart Display Interface Screens (SDIS) that allow the train crew to set up, control, and monitor locomotive operation. The SDIS receives touch screen input from the train crew and displays the operating conditions of the locomotive. Two screens are located at driver A’s control position and another is located at driver B’s position.
The SDIS could only be used when the locomotives were stationary. Screen parameters could not be changed when the locomotive was moving faster than 0.8 km/h.
Figure 9: Locomotive cabin
This figure shows the SDIS screens and train crew positions. Two images were merged to display full cab layout.
Source: OTSI
Master Controller
The Master Controller comprised of two handles: the Reverser handle and the Throttle/Dynamic brake handle. These interlocked handles are used by the driver to set direction, regulate locomotive speed, and apply dynamic braking.
The Reverser handle
The Reverser handle is a removable handle that when removed, disables the Master Controller.
When the Reverser handle is inserted, it can be used to set the direction of travel of the locomotive. The handle can be set to forward mode by moving the handle forward, neutral by centring the handle or reverse by moving the handle rearwards.
A mechanical interlock with the Throttle/Dynamic brake handle prevents the Reverser handle from being moved from the neutral position unless the Throttle/Dynamic Brake handle is set to notch 0.
The Throttle/Dynamic Brake handle
The Throttle/Dynamic Brake handle is used to control locomotive speed and dynamic braking.
As a dual-purpose handle, it is spring loaded to maintain separation between throttle and dynamic brake operations. The default position is in throttle operations.
To operate as a throttle handle, the Reverser handle has to firstly be placed in either forward or reverse and then the throttle handle can be moved between the nine throttle notch positions (0 to 8).
To use Dynamic Brake operations the handle must be pushed to the right against the spring, through a mechanical interlock, and forward to the Dynamic Brake setup position.
Once the Dynamic Brake handle is in the setup position, the Dynamic Brake handle can be moved forward to increase braking, and rearward to decrease braking.
Figure 10: Driver’s controls
This figure shows the layout of the driver’s controls
Source: OTSI
Other controls situated next to the Master Controller are the Horn control switch and the Vigilance reset push-button. The Horn control switch initiates the operation of the town and country horns. The Vigilance reset button was the interactive point of the random non-predictive-type vigilance control system fitted to the locomotive.
Banking operations
Aurizon conducted its banking operations utilising the train crew from the Quirindi depot. Up to four trains could be bank assisted between Chilcotts Creek and Ardglen in a 24-hour period.
A local work instruction for the Quirindi depot detailed the procedure for bank working between Chilcotts Creek and Ardglen.[11] Specifically, requirements when departing from Chilcotts Creek Siding, attaching and detaching with the train to be assisted, the banking operation, the change of operating cabins and the return of the locomotives to the Chilcotts Creek Siding.
Banking operations were conducted with two train crew members. Both crew members travelled in the cabin of the Lead locomotive in the direction of travel.
According to the procedure, banking operations commenced once the train to be banked had stopped in the siding and made a full-service automatic brake application. The driver of the banking locomotives was required to request permission from the driver of the train to be banked to attach to the rear of the train. Once attached, a test was conducted to ensure the anti-coupling device operated correctly by remaining released.[12]
The driver of the train being banked notified the banking locomotive train crew of the signal to proceed and banking commenced. Communication of signal indications was provided by the driver of the train being banked and had to be acknowledged by the banking locomotive train crew. At Ardglen, the banking locomotive driver reduced throttle power to allow the train to detach and continue its journey while the banking locomotives came to a stand prior to the Up home starting signal (09-12M) at Ardglen.
Once the banking locomotives stopped at Ardglen the train crew on the banking locomotives completed the process of changing ends.
Figure 11: Phoenix display
This figure shows the separation of banked train (WH512) from the banking locomotives (AZBK) prior to reaching the Up home starting signal (09-12M) at Ardglen.
Source: ARTC, modified by OTSI
Changing ends
The banking locomotives were operated as a multiple-unit configuration. In this configuration one locomotive is deemed the Lead and the other locomotive/s are set to Trail or un-powered (Dead). This allows the train crew to operate the consist from the cabin of the Lead locomotive only, with commands passing to the Trail locomotive through the MU cable[13] and the connected pneumatic hoses.
To change ends so control can be passed from the cab of one locomotive to the cab of the other locomotive, the C44acHi Locomotive Volume 1 Operator’s Manual provided instructions on how to set up the locomotive as Lead, Single, Trail or Dead.
Locomotive setup as Lead
According to the manual the following procedure sets the locomotive as the Lead:[14]
- Set all applicable circuit breakers on the Engine Control (EC) panel ON or OFF for Lead or Trail. All circuit breakers should be ON for Lead operation.
- Verify the Master Controller handles are in the following positions in the Lead locomotive:
- Dynamic Brake handle is in OFF position.
- Throttle handle is in IDLE.
- Reverser is in the centre position.
- Verify the Electronic Air Brake (EAB) system is properly set up for Lead operation.
- Ensure that the Electrically Controlled Pneumatic (ECP) Brake system is set up for operation.
- SDIS ELECTRONIC AIR BRAKE, in this publication for additional information.
- Set the appropriate headlight switches ON or OFF for short hood (No. 1 end) Lead or long hood (No. 2 end) Lead.
- The EOT [End of Train] devices (if used) must have an identification code and be armed to function.
- The Lead locomotive is identified on the SDIS for EAB operation. Set up all Trail locomotives in the consist before identifying and setting up the Lead locomotive.
- Set the Engine Run circuit breaker, Generator Field circuit breaker, Control circuit breaker, and the Dynamic Braking control circuit breaker to ON in the Lead locomotive. Start all locomotive engines in the consist and ensure the MU lines [cables] are connected before setting the circuit breakers to OFF in the Trail units.
Locomotive setup as Trail
According to the manual the following procedure sets the locomotive as a Trail locomotive:[15]
- Set all applicable circuit breakers on the Engine Control (EC) panel ON or OFF for Lead or Trail. In a Trail configuration, follow the labels or all Railroad Operating Procedures for proper settings.
- Move the Reverser handle to the centre position and remove the handle. The Throttle handle is in IDLE.
- Verify the Electronic Air Brake (EAB) system is properly set up for Trail operation.
- Move the EBV Automatic Brake handle in the HANDLE OFF (HO) position and Independent handle in the RELEASE (REL) position for Trail operation.
- Set the appropriate Headlight switches ON or OFF. Follow all Railroad Operating Procedures.
- The EOT devices (if used) must have an identification code and be armed to function.
- The Lead locomotive is identified on the SDIS for EAB operation. Set up all Trail locomotives in the consist before identifying the Lead locomotive in SDIS.
- Set the Engine Run circuit breaker, Generator Field circuit breaker, Control circuit breaker, and the Dynamic Braking Control circuit breaker to OFF in the Trail locomotives. Start all locomotive engines in the consist and ensure the MU lines [cables] are connected before setting the circuit breakers to OFF in the Trail units.
Competency for banking operations
Train crew deemed competent to operate banking operations were required to have successfully completed training.[16] The knowledge and practical assessment for bank engine working was conducted on train crew that have successfully completed ‘Engine and Air’ school as a pre-requisite.
The questions contained in the assessment document[17] asked of the person being tested to either demonstrate or explain parts of the procedure.
There were 11 questions in the assessment document, but none specifically asked the person being tested to demonstrate or explain the process for changing ends.
The assessment was completed on the job. The assessor was required to only sign off a person as competent, if they were confident the person had a thorough understanding of the location and operation of the various items of locomotive equipment. The ‘on job’ assessment was used to assess banking operations in various locations across the network.
Driver A was assessed on a route from Ardglen to Murrurundi and return on 29 August 2017. This route included the Ardglen Bank. Driver B was assessed on a route from Werris Creek to Drayton Junction and on a route from Murrulla to Werris Creek on 20 May 2020.These routes included the Ardglen bank. Both driver A and driver B were assessed as competent.
Inspections and maintenance of locomotives
Prior to operation, train crew were required to undertake a series of inspections of the locomotives. These included a ground inspection, inspection after boarding and inspection after engine start up. These were conducted by driver A and driver B of locomotives 5031 and 5034 respectively.
The train crew encountered a problem with the park brake on 5034 not releasing which was rectified with the aid of the RDC. The locomotives were certified okay to operate as per Aurizon’s pre-start locomotive checks and inspections work instruction[18].
A review of the locomotive maintenance records over the previous two years indicated both locomotives had been serviced regularly and consistent with the requirements of the maintenance schedule. The locomotives were required to be inspected at 122, 366 and 732-day cycles.
Brake functionality tests were required during each inspection. Additionally, brake functionality tests were conducted when a locomotive required additional out of sequence inspection and maintenance.
A review of the planned work for the previous two years revealed one park brake problem on locomotive 5031. The park brake was reported as intermittently not applying and was scheduled for inspection on 6 December 2019. During the inspection, testing of the park brake cylinder found it was functioning correctly and the fault could not be replicated, and the locomotive was cleared to return to service.
__________
Safety analysis
Uncontrolled runaway of banking locomotives
Inadvertent depression of the Independent Brake Handle
The location of the independent brake handle leaves it susceptible to possible depression by the driver when the driver is interacting with the SDIS. The independent brake handle sits approximately below the driver’s elbow. A review of the activities undertaken by the train crew, as recalled from interviews and from the event recorder log, suggests that this was the most likely scenario to have occurred.
Driver A was interacting with the SDIS to change the locomotive from Lead to Trail. As they leant forward to do this, driver A likely inadvertently depressed the independent brake handle (Figure 12) causing the brake cylinder to vent air to atmosphere. At 1947:45, when driver A placed locomotive 5031 into Trail Cut-out mode, they were unaware brake cylinder air had also started to vent and continued until the brake cylinder pressure reached 0kPa.
Figure 12: Independent brake handle and SDIS
Source: OTSI
Post-incident testing to re-create a continuous air pressure release from the brake cylinder was conducted.
Continual air pressure release from the brake cylinder could only be achieved when the independent brake handle was depressed towards the floor (bail-off) at the same time the locomotive was set to Trail. These combined actions instructed the locomotive to maintain the release of air from the brake cylinder after downwards pressure is released from the independent brake handle and return springs move it to its regular position. Continual air pressure release from the brake cylinder could also be interrupted by venting the No.4 pipe. This results in the system resetting and re-applying the air brake.
Ineffective park brakes
Post-incident testing and stripping of the locomotive park brake cylinders was conducted by the operator in the presence of the Office of the National Rail Safety Regulator (ONRSR). This process verified the cylinders were operational and working to standard.
The standard for braking systems for locomotive rollingstock AS7510.1:2014 states:
A park brake shall hold the locomotive stationary on a 1:30 gradient under all conditions of loading of the uncoupled locomotive.
However, further investigation into the performance of the park brake system found previously undetected misalignment of the brake rigging on the vertical and horizontal planes and friction levels were contributing to a significant decrease in effective park brake force (Figure 13 and Figure 14).
Figure 13: Brake cylinder connection to top lever
This figure shows the misalignment of the top lever with the brake cylinder.
Source: Aurizon
The misalignment and friction in the brake rigging likely resulted in a reduced efficiency transfer of brake cylinder force, approximately 55 to 65 per cent efficiency. This resulted in a reduced force being applied at the interface of the brake pad and the wheel (brake shoe force).
The investigation into the performance of the park brake system found the locomotive park brake hold force was not effective on gradients steeper than 1:40.
Figure 14: Pivot plate and shackle
This figure shows points of friction and horizontal misalignment.
Source: Aurizon
Gradient of track at Ardglen
The gradient of the track at Ardglen was stated in the ARTC Curve and Gradient Diagrams as 1:107. However, further consultation with ARTC confirmed the gradient of the track at Ardglen was between 1:39.4 and 1:43.1 at the location the locomotives were stationary during the change of ends.
While the gradient of the track was steeper than the published gradient of 1:107, it was not as steep as the specified 1:30 gradient that applied park brakes were required to hold locomotives stationary.
In the context of the locomotives running away, the gradient of the track was between 1:39.4 to 1:43.1 and the locomotive park brake hold force was not effective on gradients steeper than 1:40.
It is likely the locomotives started to move when the release of air from the brake cylinder decreased the brake shoe force.
Anti-compounding air brake mechanism
Operator testing after the incident showed that the brake shoe force dips below the applied park brake force when the independent brakes are released (Figure 15).
Figure 15: Brake shoe force over time
This figure shows the brake shoe force over time with a transition of independent brake to the park brake.
Source: Aurizon
It is likely this dip in brake force was caused by the arrangement and components used in the anti-compounding air brake mechanism. This acts to prevent excessive or compounded pressure being applied at the brake shoe and wheel interface. The brake force from the independent brake and the park brake applied together was greater (92.44kN) than when the park brake was applied alone. Additionally, when the independent brake was released, the resulting brake force dipped briefly before the park brake force settled at 65kN. It is most likely the locomotives started to roll when the resultant brake shoe force decreased during the brake force dip.
Change of ends process
Work Instruction
Aurizon had a work instruction for bank locomotive working between Chilcotts Creek and Ardglen[19] that specified the process for changing ends. The detail in the work instruction for changing ends was brief with the primary instructions including, the park brake must be applied before cutting out the Lead locomotive and changing of ends should happen in Ardglen Yard.
Work instructions in quality management systems[20] explain ‘how’ things need to be done. They are the step-by-step guide to implementing what an organisation expects and provides focus for those who are doing the actual work.
The work instruction lacked specific detail about how to safely change ends. This information was included in the Operator’s Manual and also detailed in the Training documentation.
Without the step-by-step information being detailed in the work instruction, Aurizon’s system did not provide a clear ‘how to’ for safely changing ends. Rather it provided what needed to be done which was then left to the train crew to conduct as they could recall from their training.
Training documentation
Aurizon had a training and assessment program that included instructions on how to change driving positions in multiple-unit configurations[21]. Comparisons between the steps in the training documentation and those in the work instruction revealed that there was no step in the training documentation to apply the park brake.
The steps taken by the driver on the day of the incident were consistent with the steps required in the training documentation.
Training and competency assessment
The training and assessment program also included an ‘on job’ assessment for banking operations.[22] This was the bank engine working knowledge and assessment undertaken by driver A and driver B. As mentioned in ‘Competency for banking operations’ (p16), there was no question specifically requesting the person being assessed to demonstrate how to change ends.
While it is probable the assessor may observe this in the course of an assessment, there was nowhere for the assessor to record this on the documentation. Without a record of the assessment there was no way of assuring that the competency of safely changing ends had been assessed for all train crew.
With inconsistencies between the work instruction and the training documentation and no method of assuring assessment of the change of ends competency had been completed, Aurizon’s system for safely changing ends in Ardglen Yard did not ensure train crew had a consistent understanding of the process.
Banking locomotives derailed
Control of the locomotives
The train crew had moved from the cabin of locomotive 5031 into 5034 with both locomotives in Trail Cut-out mode and the last instruction to the locomotives was to release air from the brake cylinder (bail-off).
With equalising reservoir pressure exhausted, brake pipe pressure zero and cut out, and all air released from the brake cylinders, the air brake system was rendered ineffective.
Shortly after sitting down in the driver’s seat, driver A attempted a brake application by moving the automatic brake handle to full service. This had no effect in stopping the locomotives as the locomotive was still in Trail Cut-out mode.
A few seconds later the automatic brake handle was placed into emergency, also to no effect in stopping the locomotives as the locomotive was still in Trail Cut-out mode. This application appears to have released a slight build-up of air in the brake pipe (see blue line in Figure 16). The cause of the slight build-up of air in the brake pipe (to 34 kPa) could not be determined. The brake pipe pressure did not increase again from 0 kPa after this first emergency application.
Figure 16: Analysed event recorder log
This figure provides an explanation of activities coinciding with recorded data on locomotive 5034.
Source: Aurizon
As the locomotives approached a speed over 70 km/h, driver A moved the automatic brake handle to the release position and then attempted another emergency application. There was no effective application of the brakes due to the locomotive already being in emergency braking status with brake line pressure at 0 kPa.
At an increasing speed, the locomotives approached a series of left- and right-hand bends with a signposted track speed of 55 km/h. The locomotives remained upright travelling at approximately 93.5 km/h through a left hand 360 m curve radius bend. They managed to continue upright into the start of a right hand 220 m curve radius bend as they accelerated towards 114 km/h. As the locomotives reached the exit transition of this 220 m right-hand curve, centrifugal force lifted the right hand wheels and overturned the locomotives to the left side of the track. The locomotives separated and slid approximately 100 m before coming to rest 13 m apart.
The brake cylinder pressure remained at 0 kPa until the locomotives derailed and separated. When this happened, the brake cylinder pressure recovered as a result of No.4 air pipe being separated between the locomotives and air releasing from this pipe. This was evidenced by the brakes re-applying on the locomotives when they came to rest (purple line in Figure 16).
In the train crew’s attempts to gain control of the locomotives, the SDIS interface did not allow the train crew to change locomotive 5034 to Lead as the locomotives were already moving faster than 0.8 km/h. The inability to change locomotive status through the SDIS was a mechanism to prevent conflict once locomotives were moving.
At this point in time, there was only one way the train crew could have re-established control of the locomotives. However, the train crew were not aware of the forced lead function which would have allowed them to take control of the locomotives.
Forced lead function
This was a known method of placing locomotives into Lead status. In Lead status the driver has operational control of the locomotive and any other locomotive when in a multiple-unit configuration. The forced lead function could be applied by placing the generator field switch to on and moving the reverser handle in any direction. The instructions on how to do this were in some of Aurizon’s procedures however, the train crew were not aware of it.
The forced lead function was not included in the bank working instruction, however it was contained in Aurizon’s locomotive training material for 5020 class locomotives, specifically, Aurizon’s C40aci Locomotive Module 3, Section 2 Participant’s Handbook (v1.0).
While it was contained in the training material, there was no written or practical assessment that ensured the train crew would be tested on it.
It is likely that had the train crew had knowledge of and been trained in the forced lead function, it would have prevented the runaway from escalating. The train crew could likely have regained control of the locomotives shortly after the start of the runaway. As a control mechanism to allow the train driver to regain control of the locomotive, it would be reasonable to have this function taught to train crew as an emergency response mechanism.
The ONRSR released a safety message: Wabtec Air Brake System – advice to Rail Transport Operators on 18 February 2021. It required Rail Transport Operators to ensure their crew were aware the Wabtec Air Brake System installed on locomotives did not allow the cab setup to change from Trail to Lead once the locomotive is moving. Also that this feature could be overridden using the forced lead function.
Emergency egress
The Operators’ Manual for 5020 class locomotives provides a section on emergency egress which states:
Emergency egress from the Operator’s cab is by sliding open either of the side windows of the cab. This means of escape should only be used in an emergency where safe exit via the vestibule cab and the platform side doors is not available.
When the locomotives derailed, they tipped to their left side, and came to rest.
The egress options available to the train crew at this time were via the vestibule cab and platform side doors or via the right-side window which was now directly overhead. The train crew attempted to break open the front windscreen to exit the cabin but were unable to do so. The windscreens of the 5020 class locomotive were a high impact resistance tinted glass.
There was a similar scenario in the Derailment of freight train near Julia Creek, Qld on 27 December 2015. A 2800 class locomotive tipped on the right side. The train crew attempted to exit through the front windscreen but were unable to break it open with an emergency hammer. The crew decided to exit the cab through the side window. The emergency hammer was not intended for breaking the front windscreen, it was to break the side windows in the event they did not slide open.
The option to exit through the vestibule cab and platform side doors was not used at the time. Driver B exited through the side window as it was the most direct path out.
At interview, driver A expressed the desire to get out of the cab after it had tipped. After repeated unsuccessful attempts to break the front windscreen with the heel of their boot, driver A chose to follow the path out the side window that driver B had taken earlier.
With the locomotive on its side, exit via the vestibule and by the side window required the train crew to climb up using internal structures. Exiting via the vestibule also required passing through doors, which to open, likely added further complexity and risk to the escape route.
In an emergency, when a person has a heightened level of stress, activities that require complex thought or action only increases stress. Leaving the cab after an accident should be as easy as possible.[23] The most direct and simple path is likely the path the person will choose to escape.
With the width of a 5020-class locomotive at 2.94 m, the train crew climbed upwards and out through the side window. This increased their risk of injury of fall both while climbing out of the cab and then coming down from the side of the locomotive to the ground.
Had the train crew been seriously injured and unable to egress the cab without assistance, emergency services would also have had difficulty accessing the cab. In situations where a critically injured person requires attention in a timely manner, the access/egress provisions to the locomotive cab while on its side were not suitable.
The Rail Industry Safety and Standards Board (RISSB)[24] developed rollingstock standard AS 7522 Access and egress. It was first released on 23 August 2012 with the latest edition published on 23 March 2021. The standard provides the following information with regarding emergency evacuation from locomotive rollingstock:
‘Enclosed cabs of rollingstock shall be fitted with sufficient emergency exits to provide escape paths to the vehicle exterior when the vehicle is upright and when overturned on the side.’
The 5020-class locomotive was built prior to these standards being released when consideration of emergency egress when the locomotive is overturned on the side was not an Australian Standard. However, the risks to the train crew attempting to exit a cab that has overturned on its side warrants a review of the emergency egress provisions.
__________
Findings
|
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.
Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
|
From the evidence available, the following findings are made with respect to the Uncontrolled runaway and derailment of banking locomotives near Kankool on 3 June 2020
Contributing factors
- During process of changing ends, the driver likely inadvertently depressed the Independent Brake Handle, at the same time as placing locomotive 5031 into Trail Cut-out mode. This released the automatic air brake application on both locomotives
- The park brakes were ineffective in holding the locomotives on the grade in Ardglen Yard (Safety issue)
- The banking locomotives started to roll away after the train crew left the cab of locomotive 5031. The train crew were then unable to establish control once the locomotives started rolling and the banking locomotives rolled approximately 3 kms before derailing at 366.529 km near Kankool
- Aurizon did not ensure train crews had a consistent understanding of how to safely change ends on banking locomotives (Safety issue)
- The train crew had not been trained to use forced lead function which would likely have allowed the train crew to regain control of the locomotives (Safety issue)
Other factors that increased risk
- Aurizon had not fully considered emergency egress from a locomotive overturned on its side. This increased the risk of further injury and could also have prevented emergency services from accessing personnel within the locomotive in a timely manner
Safety issues and actions
|
Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.
Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report.
All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.
The initial public version of these safety issues and actions will be provided separately on the ATSB website on release of the final investigation report, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website after the release of the final report as further information about safety action comes to hand.
|
Safety description: The park brakes were ineffective in holding the locomotives on the grade in Ardglen Yard
Safety description: Aurizon did not ensure train crews had a consistent understanding of how to safely change ends on banking locomotives
Safety description: The train crew had not been trained to use forced lead function which would likely have allowed the train crew to regain control of the locomotives
Sources and submissions
Sources of information
The sources of information during the investigation included the:
- Train crew on board incident locomotives
- Aurizon
- Australian Rail Track Corporation
- Wabtec
- Office of the National Rail Safety Regulator
References
Australian Standard 2014, AS7510.1:2014 Braking Systems Part 1 Locomotive Rollingstock.
Australian Standard 2021, AS7522:2021 Access and egress.
General Electric Company 2010, GEJ-7045 Operating Manual C44-ACi Locomotive for Queensland Rail National Coal
Rail Industry Safety and Standards Board 2021, Glossary of Terms. Accessed at: www.rissb.com.au/glossary
UGL Rail 2010, C44acHi Locomotive Operator’s manual, Volume 1 Revision 00.
US Department of Transportation Federal Railroad Administration 1998, Human Factors Guidelines for Locomotive Cabs DOT-VNTSC-FRA-98-8
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
- Aurizon
- Australian Rail Track Corporation
- Transport for NSW
- Office of the National Rail Safety Regulator.
Any submissions from those parties will be reviewed and, where considered appropriate, the text of the draft report will be amended accordingly.
About the ATSB
Australian Transport Safety Bureau
About the ATSB
The ATSB is an independent Commonwealth Government statutory agency. It is governed by a Commission and is entirely separate from transport regulators, policy makers and service providers.
The ATSB’s purpose is to improve the safety of, and public confidence in, aviation, rail and marine transport through:
- independent investigation of transport accidents and other safety occurrences
- safety data recording, analysis and research
- fostering safety awareness, knowledge and action.
The ATSB is responsible for investigating accidents and other transport safety matters involving civil aviation, marine and rail operations in Australia, as well as participating in overseas investigations involving Australian-registered aircraft and ships. It prioritises investigations that have the potential to deliver the greatest public benefit through improvements to transport safety.
The ATSB performs its functions in accordance with the provisions of the Transport Safety Investigation Act 2003 and Regulations and, where applicable, international agreements.
Rail safety investigations in New South Wales and Victoria
Most transport safety investigations into rail accidents and incidents in New South Wales (NSW) and Victoria are conducted in accordance with the Collaboration Agreement for Rail Safety Investigations and Other Matters between the Commonwealth Government of Australia, the State Government of NSW and the State Government of Victoria. Under the Collaboration Agreement, rail safety investigations are conducted and resourced in NSW by the Office of Transport Safety Investigations (OTSI) and in Victoria by the Chief Investigator, Transport Safety (CITS), on behalf of the ATSB, under the provisions of the Transport Safety Investigation Act 2003.
- Office of Transport Safety Investigations (OTSI) is an independent statutory body which contributes to improvements in the safety of bus, ferry and rail passenger and rail freight services in NSW by investigating safety incidents and accidents, identifying system-wide safety issues and sharing lessons with transport operators, regulators and other key stakeholders. Visit www.otsi.nsw.gov.au for more information.
Purpose of safety investigations
The objective of a safety investigation is to enhance transport safety. This is done through:
- identifying safety issues and facilitating safety action to address those issues
- providing information about occurrences and their associated safety factors to facilitate learning within the transport industry.
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action.
Terminology
An explanation of terminology used in ATSB investigation reports is available on the ATSB website. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue.
|
