Safeworking incident involving MTM trains 3148 and 7255, Ferntree Gully, Victoria, on 25 February 2024

The occurrence

Background

The incident occurred in a single line section between Ferntree Gully (FTG) and Upper Ferntree Gully (UFG) Railway Stations. These stations are located on the Melbourne metropolitan rail network on the Belgrave line (Figure 1). 

Figure 1: The Belgrave line from Ringwood

Source: Public Transport Victoria annotated by the Office of the Chief Investigator (OCI)

As part of the Victorian Government’s Level Crossing Removal Project (LXRP), level crossing removal works were being carried out at Bedford Road in Ringwood. The works affected train operations between Ringwood and Belgrave. Belgrave trains from Melbourne were being terminated at Ringwood and trains from Belgrave towards Melbourne were being terminated at Bayswater. Buses replaced trains between Ringwood and Bayswater.

Prior to the incident

At about 0935 local time on 25 February 2024, passenger train 3109 departed Bayswater railway station for Belgrave. At 0936, train 7255, a non-revenue service (not taking passengers), was provided a proceed aspect at signal BAY306 located about 500 m on the Ringwood side of Bayswater station to travel towards Belgrave. 

At about 0939, train 7255 passed through Bayswater station with signals at proceed and without stopping, following train 3109. Train 7255 was not scheduled to depart Bayswater station until 0951 and therefore left about 12 minutes ahead of its timetabled departure from Bayswater. Train 3109 continued ahead of train 7255 and arrived at UFG station at 0944.

The incident

Train 7255 passed through Boronia station at about 0942 and then through FTG station and departure home signal[1] 2R at about 0945 (Figure 2). Signal 2R displayed a medium speed warning which indicated that the line ahead was clear, but that the next signal was at stop. Medium speed at this location was 40 km/h.

Figure 2: Signalling arrangement between Bayswater and UFG

Source: Metro Trains Melbourne annotated by the OCI

Train 7255 then entered the single line section between FTG and UFG. At about 0947 the train stopped on the single line at signal L1161 which displayed a stop indication (Figure 3). Under network rules and procedures, the signal could have been passed and the train continue under caution. However, the driver advised that they decided to wait because they were aware that train 3109 was ahead and had probably not yet exited UFG.

Figure 3: Signal L1161 on the approach from FTG, annotated to show at stop

Signal L1161 has been annotated to show the signal aspect when at stop. Source: Still frame taken from Metro Trains Melbourne training video, annotated by the OCI

At around the same time, the station officer[2] at UFG returned to the signal panel after preparing a meal in the nearby office kitchen and observed the red illumination at track circuit 2RBK (Figure 4). 

Figure 4: Photograph of signal panel taken by station officer at 0947

Note 1: The distance between signals L1161 and 2L was approximately 830 track-m. Train 7255 was about 72 m long and therefore able to stand at signal L1161 without encroaching on the track circuit in advance of signal 2L. Hence, 2L was able to show a proceed aspect. Note 2: The signal panel was not capable of displaying an indication for signal 6 (L1161) when the trackside signal showed a stop aspect. Source: MTM, annotated by the OCI

Unaware that the red illumination was caused by the presence of train 7255 which was now stationary at signal L1161, the station officer, using switches on the panel, made an unsuccessful attempt to change the UFG departure signal (signal 18) to proceed in preparation for train 3148 (which was approaching from Upwey) to travel to FTG.

At 0950, train 3148 arrived into platform 1 at UFG. At 0951 train 3109 departed the station platform 2 towards Belgrave.[3] Train 3148 was then to depart UFG towards FTG but was held at platform 1 by departure signal 18 which continued to display a stop indication (Figure 5).

Figure 5: Home departure signal 18 at UFG platform 2 shown at stop

Source: Office of the Chief Investigator

The station officer recalled seeing a train at Bayswater station on the station CCTV. As train 7255 was not due to depart Bayswater until 0951, the station officer assumed that the train at the Bayswater station was train 7255. The train sighted was likely to have been train 3111, which had arrived at Bayswater station at 0951 and was due to depart the station at 1006.

Believing departure signal 18 would not clear because of a recurring track fault, the station officer contacted Metrol[4] and sought permission to issue a caution order[5] to the driver of train 3148. The Metrol train controller advised that the station officer had the authority to issue a caution order as they were the controlling signaller for both ends of the single line section. At 0953 a signal fault was logged by Metrol for the suspected fault advised by the station officer.

At 0954, the station officer issued a caution order to the driver of train 3148[6] to allow the train to pass signal 18. The caution order allowed the driver to proceed at no more than 25 km/h past signal 18 at stop and towards FTG. 

At 0958 the train departed and on reaching signal 18 tripped at the train stop[7] and came to a stop a short distance past the signal. The driver then reset the train’s systems to allow the train to proceed into the single line section towards FTG. This was the normal practice when a train stop was tripped after a train was allowed to proceed under a caution order.

As train 3148 proceeded towards FTG and the stationary train 7255, it did not exceed 20 km/h. After the train had travelled about 350 m, the driver sighted train 7255 stationary at signal L1161 and brought train 3148 to a stop at about 1001. Trains 3148 and 7255 were facing each other and about 300 m apart. Drivers of both trains contacted the station officer at UFG to advise of the situation. It was a clear day and visibility was good. 

No injuries or damage were reported. The incident resulted in significant delays to train operations on the Belgrave line.

Context

Melbourne metropolitan rail network

Overview

Metro Trains Melbourne (MTM) was the metropolitan train franchisee and accredited rail transport operator. MTM’s responsibilities included the operation and maintenance of the rail system assets, including the signalling system. 

For about 4 weeks leading up to the incident, there were no direct train services between Melbourne and Belgrave due to the level crossing removal works at Bedford Road, Ringwood. On the day of the incident the level crossing removal works were continuing and trains from Melbourne, which would normally travel to Belgrave were terminated at Ringwood and then returned to Melbourne. Trains from Belgrave which would normally travel to Melbourne were terminated at Bayswater and then returned to Upper Ferntree Gully (UFG). Buses had replaced trains between Ringwood and Bayswater.

The Belgrave Line

The incident occurred on the Ringwood to Belgrave line on the MTM rail network, in the single line section between Ferntree Gully (FTG) and UFG stations (Figure 6). FTG is about 35.8 rail km from Flinders Street Station in central Melbourne.

Figure 6: MTM station map - Belgrave line, east of Melbourne

Source: Office of the Chief Investigator

Train control on the metropolitan network

Overview

Metrol was the central signalling and train control centre for the Melbourne suburban rail network. Train controllers and signallers based at Metrol were able to control the points and signals within central Melbourne and some outer suburban areas. Metrol also controlled passenger information and coordinated emergency response. 

Outside the areas of Metrol’s control, train movements were managed by signallers or station officers located either in dedicated signal boxes or operating signal control panels at suburban railway stations. The Ringwood station signal box and UFG station signal box controlled local areas using signal control panels at each station.

There were also several sections of track on the metropolitan network known as ‘dark territory’. When a train was in dark territory, the signalling system did not pass train location information to a signal box. Trains within dark territory were controlled by the signals located within that section without intervention from Metrol controllers or locally based signallers. 

Fleeting signals

Controlled signals that were capable of being set to operate automatically and show a proceed indication when a section ahead was clear of rail traffic were termed fleeting signals. The provision of a fleeting signal at the entrance to a single line section was in accordance with MTM’s engineering standard for signal box workstations (2018). The standard advised that fleeting was used to provide the ability for signaller workload to be minimised during periods where direct control of the Home Signal was not required.

Train control on the Belgrave line

Overview

The Belgrave line between Ringwood and Belgrave was comprised of 3 control sections:

• local signalling between Ringwood and Bayswater by the Ringwood signal box
• a section of dark territory (with automatic signalling)[8] between the Bayswater and FTG and including Boronia
• local signalling between FTG and Belgrave by the UFG signal box.

Ringwood signal box 

The Ringwood signal box controlled train operations on the Lilydale line, the Belgrave line as far as Bayswater and the section between Ringwood and Blackburn. Three separate signal panels controlled the three sections. Station staff operated customer information system equipment from a separate room at the station. 

During the level crossing removal works, Ringwood signallers were signalling train movements at Bayswater and Ringwood, including turning around trains that terminated at Bayswater and Ringwood for their return trips to Belgrave and Melbourne respectively. 

Two signallers were rostered for duty at Ringwood signal box on the morning of the incident. The Ringwood signallers operated the signalling panels in two-hour shifts, rotating between signalling and their other duties. The first signaller started work about 0600 and handed over to the second signaller about 0800. 

On the morning of the incident, the train to become train 7255 was to have a change of direction (back towards UFG) at the crossover located about 500 m on the Ringwood side of Bayswater station (Figure 7). The train was provided with a proceed indication at signal BAY306, took the crossover and travelled towards platform 2 of the Bayswater station. 

Figure 7: Track and signalling layout at Bayswater

Source: Metro Trains Melbourne, annotated by the OCI

The platform 2 departure signal BAY310 was set to ‘fleeting mode’. This feature allowed the signal to provide a proceed indication as soon as the track ahead was clear of rail traffic. This also meant that trains could be provided a proceed indication in advance of their timetabled departure times. On the day of the incident, signal BAY310 displayed a proceed aspect when train 7255 approached the signal. This allowed the driver to pass the signal without stopping at platform 2 at Bayswater station and in advance of its scheduled departure time and proceed towards FTG.

Upper Ferntree Gully signal box

Control panel

The signal control panel at the station showed the signal aspects and the position of the points (Figure 8). Installed in 1962, the incandescent indicators on the panel illuminated red when sections of track were occupied but did not display a corresponding train number to show which train occupied the section. 

Switches, used to set points and signals were positioned close to the bottom of the panel. The panel was used to control points and signals between FTG station and the line’s terminus at Belgrave station and was one of only five such panels operating on the MTM network. 

Figure 8: UFG station signal control panel

Source: Office of the Chief Investigator

Train entry into section between Ferntree Gully and Upper Ferntree Gully

Departure home signal 2R, located at platform 2 of FTG station for outbound trains, controlled entry onto the single line section between FTG and UFG. Controls for that signal were on the signal control panel (Figure 9).

Figure 9: No. 2 control switch on the UFG signal control panel

Source: Office of the Chief Investigator

Signal 2R could be set to fleeting for train movements towards Belgrave by setting the control switch on the signalling panel to the ‘R’ position. The switch was in this position and set for fleeting when train 7255 approached platform 2 at FTG. Once train 3109 had cleared the single line section and arrived at the platform at UFG station, signal 2R provided a proceed indication which allowed train 7255 to enter the section at about 0945. 

Other positions for the control switch were ‘L’ and ‘N’ (Normal). With the switch in the ‘L’ position, the points at the Ferntree Gully end of the single line section were set to allow trains to travel towards Melbourne and signal 2L would show a proceed aspect if the track section ahead was clear of rail traffic. In the ‘N’ position, signals 2R and 2L would show a stop aspect and the points would remain in the last position used. With either the 2R or 2L position selected, signals 2R or 2L respectively would operate in fleeting mode, and continue to operate in fleeting mode until the switch position was changed by the signaller.

The settings of the signalling control panel at UFG were not recorded.

CCTV and passenger information systems

At UFG, a control desk was situated in the same room as the signal control panel. Monitors located on the control desk showed real time CCTV images of other stations on the Belgrave line (Figure 10). 

Figure 10: UFG control desk equipment

Source: Office of the Chief Investigator

Station staff could manipulate the CCTV images depending on the station they wished to view. A television monitor for the Passenger Real-Time Information Dissemination Equipment (PRIDE), an electronic timetable and announcement system that provided information to passengers, were also located on the control desk and displayed the location of trains to station staff (Figure 10). However, the PRIDE system could not be relied upon for signalling purposes as it did not always accurately indicate where trains were situated.

The PRIDE system in the Bayswater to Belgrave area relied on the Train Location Provider (TLP) system to indicate the location of trains. TLP used the timetable to update Train Description Numbers (TDN) once trains reached their destinations. In cases where the TLP could not determine a TDN from the timetable, it allocated an undescribed TDN (‘U’ Number) to the train. 

Because the TLP could not identify train 7255 when it left Bayswater to travel to UFG, the train was allocated a ‘U’ number (U076) within the PRIDE system. The train was shown located in the single line section between FTG and UFG (Figure 11). The PRIDE system also displayed scheduled departures for trains leaving Bayswater. At 0947 it indicated that train 7255 was scheduled to depart at 0951.

Figure 11: Screenshot of a recording of the PRIDE system at 0947, 25 February

Source: MTM, annotated by Office of the Chief Investigator

Communications

Telephone equipment on the UFG control panel was available to communicate with Metrol and Ringwood station staff. In the hours before the incident on 25 February, there were no telephone communications between the Ringwood signallers and the UFG station officer.

Drivers operating trains on the Belgrave line could communicate with UFG on the Digital Train Radio System and these conversations were recorded. On the day of the incident the driver of train 3148 contacted the station officer using his MTM‑issued mobile phone. These conversations were not recorded.

Staffing at Upper Ferntree Gully signal box

On the morning of 25 February and at the time of the incident, the station officer was working alone. Two other members of staff had been rostered to work at UFG that morning. One was scheduled to start at 0800 but was relocated to another station. The other was due to start at 1000 but arrived late as the train they were on was delayed by the incident. It was not uncommon for UFG to be staffed by one person. 

In the 4 weeks up until the day of the incident, of the 205 rostered shifts for all staff, 39 (19%) were not attended by the rostered staff member owing to sick leave, position vacancies, staff redeployed to cover absentees at other stations, training, and meetings. Five of the 10 positions that performed signalling duties at UFG were vacant at the time of the incident. 

Train location management and transfer 

Belling equipment and signals

Train operations on the MTM network outside of the Metrol controlled area were managed locally by various signalling control methods. In most cases the transmission of train numbers^[9] in the outer suburban network occurred electronically via the Train Number Transmitter (TNT) system. TNT required manual intervention by the signaller at each interlocked location to send train numbers onward to the next location. 

On the Belgrave line, signallers at Ringwood would typically inform signallers at UFG of the movement of trains using a belling system (Figure 12). 

Figure 12: UFG belling equipment

Source: Office of the Chief Investigator

MTM specified bell signal codes that were to be sent to the receiving signal box depending on the composition of the train (passenger train, ballast train, locomotive only). Specific codes were also required to repeat and cancel previous signals.

The Ringwood signaller would send a bell code to UFG when a train departed Bayswater and moved out of the Ringwood area of control. The receiving staff at UFG would send a reply bell code acknowledging the receipt of the original bell code. The system did not allow for train number information to be transmitted. 

The times that bell signals were transmitted was not recorded either electronically or by hand in the Ringwood signal box train register book, and the use of the belling system that day could not be verified. The Ringwood signaller on the day of the incident reported that they sent a bell signal to UFG signal box when train 3109 departed Bayswater station. However, they did not send a bell signal when train 7255 departed as they had not seen it depart on either the CCTV or the signal panel. They recalled being occupied performing other duties.[10] 

Annunciator bell

An annunciator bell was installed in the UFG signal box to provide an automatic audible notification that a train was approaching the station. 

The annunciator bell was designed to ring once when a train departed Boronia station towards FTG and occupied a specific track circuit (track circuit in advance of signal L1053). However, the bell would only ring if the section of track between signal L1119 and signal 2R at Ferntree Gully was clear of rail traffic (Figure 13).^[11] The station officer at UFG was not required to acknowledge receipt of the annunciator bell and its activation was not recorded.

Figure 13: Schematic of track and signals relevant to the incident location

Source: Metro Trains Melbourne, annotated by the OCI

Train register book

The signal boxes at UFG and Ringwood stations were both equipped with train register books. The train register books were used by the signallers to record activities relating to rail traffic and signals, including the movement of rail traffic. Section 26 of the Book of Rules and Operating Procedures (PTC 1994, incorporated into the MTM safety management system) required that information recorded in the train register include:

• the running of trains – details relating to the late running or alterations to the running of trains
• signaller ceasing duty – when finishing a shift, the signaller must sign off in the register under the last entry
• trains at stations – if a train occupies the platform at a station for more than 1 minute
• the time which electric bell signals were received (entered in the 'Train departure received' column)
• if a train is detained at a signal, the actual time and reason for detention must be recorded
• if a train is detained at a home signal, a notation must be made in the 'Remarks' column of the train register book stating the action taken by the signaller.

The Book of Rules also instructed signallers to advise the signaller on each side when leaving the signal box or signalling instruments and instructed supervising officers to check the train register book on each visit to a signal box.

Bell signals for trains departing Bayswater after about 0330 on the morning of the incident were not recorded in the UFG train register book (see Belling equipment and signals). Bell signals advising the departure of trains towards Upper Ferntree Gully from Bayswater were recorded correctly for all trains in the UFG register for only 15 of the 53 days of train operations prior to the day of the incident.

Review of the UFG train register book for the weeks preceding the incident showed that the train register book often contained entries that deviated from MTM procedures, including details of messages received not recorded, records of no-belling not recorded and details of signallers signing on and off not being recorded correctly.

Safeworking and caution orders

Train management

The safeworking system used at the incident location was known as Automatic and Track Control (ATC). Under ATC the authority to enter a section of track was given by signals located at the end of each section and arranged so that only one signal could be set to 'proceed' at a time. Once a train was in the section, a train travelling in the opposite direction could not be signalled to enter. Intermediate signals inside each section allowed multiple trains running in the same direction to enter the single line section. 

Caution orders

Procedure

The safeworking of trains was governed by the Book of Rules. On the MTM network procedural safeworking was used when the signalling system failed. It permitted the ongoing operation of the network through the use of caution orders. A caution order was issued by a train controller^[12] or signaller and it gave a train driver authority to pass a signal at stop in accordance with network rules. 

The safeworking system in place at UFG specified that the signaller was to complete a caution order form and hand it to the driver. The signaller was expected to ensure the points ahead of the signal were correctly set and that there were no trains in the section prior to the issuing of the caution order. The signaller was also required to note in the train register book^[13] when a caution order was issued and, when the train departed, advise the train controller^[14] and signaller in the area ahead.

The issuing of a caution order in this incident

Train 3148 was held at the platform at UFG by home departure signal 18 which displayed a stop indication. Due to their belief that the departure signal 18 would not clear because of a recurring track fault, the station officer issued a caution order to the driver of train 3148 to allow the train to pass signal 18 (Figure 13).^[15]

Operating procedures did not require the UFG signaller to seek authorisation when issuing an ATC caution order. 

Figure 14: Caution order provided to the driver of train 3148

Source: MTM, redacted by the OCI

The station officer at Upper Ferntree Gully

The station officer on duty at UFG on the day of the incident was performing the functions of a signaller. They had been carrying out signalling duties for about 6 months since completing their training for the UFG signal box. Prior to undertaking the functions of a signaller, they were engaged in customer service roles. The station officer was medically fit for duty. The station officer undertook mandatory drug and alcohol testing after the incident, returning negative results.

The station officer had not been rostered to work from 17 to 21 February, although they had attended training on 19 February. From 22 February to the day of the incident, the station officer began early morning shifts, commencing at about 0315 each day. The station officer was rostered to start work at 0315 on the day of the incident, which was their fourth early morning shift start in a row. 

Station officer responsibilities included the signalling of trains and other safeworking duties, providing information to passengers via the public address system and dealing with passenger ticketing and enquiries. 

Signaller training

Signallers working the UFG signal box were required to be qualified in the ATC safeworking system and for signalling specific to the location. New signalling staff at UFG learnt how to use the signalling panel by shadowing a qualified member of staff and operating the panel under supervision. 

The examination for the UFG panel listed 28 ‘topics of questions’ which required the station officer to demonstrate, amongst other criteria, that they could safely operate the signal panel and explain actions required when equipment failed. The checklist did not include a demonstration of how to use the train register book. 

The station officer on duty at the time of the incident held the relevant competencies for UFG, having successfully passed both the ATC and the examination to operate the UFG panel.

Prior to the COVID-19 pandemic, safeworking refresher training specific to the UFG signal box was conducted with staff performing signaller duties, however this was postponed because of the pandemic and had not been reinstated.

Reported signalling faults

A record of reported signalling faults (excluding graffiti on signal signage) affecting the single line section between FTG and UFG in the 2 weeks before the incident is shown in Table 1. The fault that occurred on 21 February 2024 would likely have resulted in the UFG signalling panel indicating that the single-track section was occupied by a train when it was not. This signalling fault was rectified on the same day.

Table 1: Signalling faults affecting the incident location

Date	Location	Table header
11/2/2024	Ferntree Gully	Signal L1119 reported as failed to clear. The investigation did not identify a root cause.
14/02/2024	Upper Ferntree Gully	Loss of power to signalling assets resulting in a Technical Proceed Authority Exceeded [1] event on Signal L1161 (UFG 6).
21/02/2024	Upper Ferntree Gully	A6 track circuit identified to be intermittently failing due to blown spark gaps. The spark gap is an electrical safety device that is designed to connect an overhead structure to the rail in event of a lightning strike or defective insulator.   Connection to rail can have an adverse effect to the track circuit operation.

Source: MTM

[1]    A Proceed Authority Exceedance is when a train exceeds the Limit of Authority. In this instance a loss of power resulted in a signal reverting from a proceed aspect to a stop aspect. The signal aspect changed from proceed to stop as a train approached and without enough time for the train to be stopped before reaching the signal. 

Risk management

Risk of train-to-train collision

MTM had identified two trains in the same section as being a risk source for a train‑to‑train collision, and ‘human error’ as a cause/precursor for that risk source. The level of risk had been estimated for the whole MTM network rather than specific sections of line. 

At the time of the incident, MTM had noted the following controls relating to cause of human error:

• fatigue management policy and standard, supported by local plans
• speed restrictions
• station staff (some acting in a signaller role) compliance to Book of Rules and Operating procedures
• signaller / Metrol training
• route risk analysis when change to rail operating environment
• asset strategy (Signalling).

The MTM train to train collision between Metro Trains risk register included ‘RTPOTS (Real time position of train) for a train position visual aid (verification only)’ as a proposed control. This control was classified as closed, although was unavailable at Upper Ferntree Gully. 

MTM had not undertaken a risk assessment for train collision specific to the section between UFG and FTG, and there was no requirement for a location specific risk assessment in the MTM SMS.

In May 2023 MTM undertook a train collision risk review^[16] during which consultation occurred with relevant key stakeholders with the intent ‘to provide clarity and improve accountability and captured key risk scenarios and causes.’

The review identified ‘Incorrect authority’ as a train collision risk factor. Preventative controls documented by MTM for this risk factor included:

• double validation of instruction given (caution order)
• signalling control system (e.g. TCMS (Train Control Management System), Sigview, Railview’^[17]
• ensure section is unoccupied before providing authority to proceed
• nominated safe speed to proceed.

Fatigue

A fatigue risk register for UFG (MTM 2022a) identified ‘insufficient staff’ as a cause for the risk of fatigue, however no controls had been documented in the register against this cause. ‘Insufficient break time (or allocated)’ had also been identified as a cause. The MTM Fatigue Risk Management Plan Station Operations (2023c) had been listed as a control against the cause of insufficient break time. However, the plan did not reference break times within shifts. There was no evidence that MTM had assessed the risk of station officer fatigue caused by working a shift without a break.

Level crossing removal project (LXRP)

On 5 December 2023 MTM undertook a risk assessment workshop to assess the running of a fleet of trains between Belgrave and Bayswater during the LXRP works. The scope of the workshop was defined as:

Risk assess SW3688 Captive Fleet Operations and the associated occupation (BED03 Commissioning Occo), including Captive Fleet Running, which includes deviations from ensuring overhead mainline traction section is supplied by two circuit breakers from independent substations as required by MTM A1531 Electrical Networks Systems Standard, Cl9.4..5.

The context of the workshop was described as ‘The proposed works are noted to pose risks to assets and network operations.’ The workshop involved representatives from operations, signalling and other engineering disciplines and from MTM’s human factors section.

The workshop recorded the following 7 risk events:

• failure of a single circuit breaker, cutting power resulting loss of power to track
• train services unable to be delivered
• damaged or vandalised trains unable to be replaced (due to the occupation), resulting in reduced numbers of captive fleet trains
• train drivers experiencing issues with the positioning of trains (i.e. station platforms) resulting in impeded train onboarding and/or passenger trips and falls
• 3 car captive fleet trains beating level crossing times, resulting in train to vehicle collision
• failure of equipment causing delays to operations/handback or train breaching occupation area
• train driver disruptions and potential industrial relations issues.

No changes were made to the configuration of the signalling in the applicable area as a result of the risk assessment.

MTM had previously identified ‘human error’ as a cause/precursor to two trains being in the same section (MTM 2023b) and had identified ‘Route risk analysis when change to rail operating environment’ as a risk control. While the workshop conducted on 5 December 2023 considered the 7 risk events noted above, it did not identify risk factors that may have affected the signallers’ ability to undertake the signalling of trains between Bayswater and Belgrave during the LXRP works. 

MTM audit of signal boxes and signallers 

MTM had an assurance program that audited both individual signallers and signal boxes. Those performing signalling duties were scheduled to be audited every 12 months. Signallers were often qualified to operate more than one signal box, and the location of signaller audits could be undertaken at any signal box at which they were qualified to work. Some signallers working at UFG were overdue their 12-monthly audit. 

Signallers were also audited by MTM in their safety critical communication skills at least once per year. The station officer on duty at UFG had completed their training about 6 months prior to the incident and had not yet been audited. 

Separate audits of the signal boxes (not specific to individual signallers) were also scheduled to be undertaken by MTM about every 12 months. Both individual and signal box audits could include inspection of the train register book within their scope. 

Prior to the incident, 6 audits of the UFG signal box had been conducted by MTM since 17 May 2019, with the most recent on 9 July 2023. Two of these 6 audits, conducted in 2019 and 2020, recorded non-conformances associated with filling in the train register book. No non-conformances in relation to the train register book had been recorded by MTM since 2020.

MTM had also instituted a program of signal box audits specifically focused on occupations, such as when line engineering works were being undertaken at night. Fourteen audits of the UFG signal box were undertaken between 7 October 2020 and the time of the incident that were specific to occupations on the Belgrave line. The last occupation audit at the signal box had been undertaken on 12 August 2023. Four of these MTM audits recorded non-conformances in relation to the recording of occupation information into the train register book. The last non‑conformance prior to the incident had been made in January 2023. 

In addition to audits, ad hoc checks were undertaken by Rail Incident Controllers who visited signal boxes.

Trains and drivers

The trains involved in the incident were train 7255, which was not in service and travelling from Bayswater to UFG where it was to be stabled, and train 3148, a scheduled passenger service between Belgrave and Bayswater. Trains 7255 and 3148 were introduced to the timetable on 5 February 2024, along with other timetable changes, as a result of the level crossing removal works.

Both trains were comprised of 3-car Alstom X’Trapolis sets. Train 7255 was empty of passengers. Train 3148 had about 15 passengers on board.

Both drivers had booked on for duty on the morning of the incident. Both drivers were qualified and experienced on the Belgrave line.

Related occurrences

On 31 May 2022, the UFG station signaller issued a caution order to a train driver giving permission to depart. The signaller had commenced to set the points but did not check that they were set prior to issuing the caution order. The duty station master realised that the points were not set properly and advised the driver not to depart. It was determined that the caution order was issued 6 seconds prior to the points being set. 

The findings from the MTM investigation (MTM 2022b) included:

• consistent track faults affecting the Belgrave Line
• increase in errors and incidents over the preceding 8 weeks
• increased vacancy rate across stations staff in the Burnley Group. 

Actions identified by MTM to prevent recurrence included:

• reinstate refresher training
• round table workshop of key stakeholders to explore a Safety Improvement Plan for UFG panel
• review of the resource plan for Burnley Group including Occupation planning. 

Safety analysis

Introduction

This safeworking incident involved opposing trains concurrently being in the single line section between Ferntree Gully (FTG) and Upper Ferntree Gully (UFG). Train 7255 had entered the section departing FTG station under normal signal proceed indications and then stopped mid-section awaiting a signal to clear. Unaware that train 7255 was in the section, the station officer at the UFG signal box issued a caution order to train 3148 giving its driver permission to pass the station departure signal (which was at stop) and proceed towards FTG. After entering the single line section, the driver of 3148 observed train 7255 ahead and stopped their train about 300 m clear of 7255. 

The analysis discusses:

• Issuing of the caution order
• Validation of the caution order
• Train information at UFG
• Fleeting signals
• Belling systems
• Network rules and procedures
• Risk management of the level crossing removal project
• Reduced speed as a risk mitigation
• Recording of communications.

Issuing of the caution order 

The station officer’s belief that the section between UFG and FTG was clear of other trains was probably initially established by their expectation that train 7255 was not due to be in the section. When train 3148 arrived from Belgrave at about 0950, train 7255 was scheduled to have not yet departed Bayswater. The station officer had also not heard any bell signals that may have alerted them to the earlier departure of 7255.

The station officer’s subsequent assessment of information was probably influenced by confirmation bias. This type of bias is when information is perceived in a way that confirms an existing assumption or information is discarded if it is contrary to that assumption.

The presence of a train was indicated on both the UFG signal control panel and the Passenger Real-time Information Dissemination Equipment (PRIDE) display although neither identified the number of the train. In contrast, the PRIDE system showed the scheduled departure of 7255 from Bayswater as 0951. Further, the station officer observed a train at the Bayswater platform on the CCTV and based on the schedule, assumed that the train still at the Bayswater station was train 7255.

In processing the available information including the display information, the station officer concluded that the train detections shown on the signal panel was the result of a system fault rather than indicating the presence of a train. The station officer was aware of a fault that occurred on 21 February where a track occupancy was indicated between FTG and UFG but no trains were present. 

The station officer called Metrol to confirm that a caution order could be issued, and to report the perceived fault. Although the Metrol controller was probably intending to simply confirm to the station officer that they had the authority to issue a caution order, the conversation probably reinforced with the station officer that they were correct to be issuing the order. 

The station officer was in the latter part of their shift, had been working alone (increasing workload) and their sleep patterns in the days prior to the incident were consistent with an elevated likelihood of fatigue. However, there was insufficient evidence to conclude that fatigue contributed to this event.

Contributing factor The station officer at Upper Ferntree Gully issued a caution order for train 3148 to enter the single line section between Upper Ferntree Gully and Ferntree Gully while train 7255 was in that section. The station officer believed the section was clear of other trains and the failure of signals to clear for train 3148 was due to a system fault.

Validation of the caution order

The station officer at UFG was working alone on the morning of the incident. Other staff had been rostered to work at UFG but had become unavailable for that shift. It was not uncommon for UFG to be staffed by one person, placing additional load on the individual at times of higher operational activity. 

MTM had previously identified that ‘double validation’ of instructions was a control to assist in the mitigation of risks associated with single person errors. Checking by a second person was reflected in the caution order form that called for signing by the signaller and the train controller. However, for the section under UFG signalling control (and some other similar sections on the network), it was normal for a station officer to perform all the signalling duties and there was not a separate train controller. That meant that caution orders at these locations on the network could be issued without second person validation, removing a risk control to reduce the likelihood of a single person error.

Contributing factor At Upper Ferntree Gully (and some other parts of the MTM network), the issuing of a caution order did not require validation by a second person. (Safety issue)

Train information at Upper Ferntree Gully

UFG signal box was equipped with a range of equipment and systems for the management of trains within its control area. The primary train monitoring facility was an older style signal panel which showed detected trains between FTG and Belgrave. However, unlike much of the modernised parts of the MTM network, the panel did not provide train specific identification of detected trains shown on the panel.

In the absence of this direct train identification information, there was a reliance on other information sources and administrative procedure to maintain an awareness of the location of each train in the control area.

Other factor that increased risk The signal control panel at the Upper Ferntree Gully signal box did not provide direct train-specific identification information for the monitoring of trains between Ferntree Gully and Belgrave. Compared to modern systems, this placed a higher reliance on procedural systems.

Fleeting signals

Some signals have a facility to be set to fleeting for operational reasons and to minimise signaller workload during periods where direct signaller control of the signal is not required. Fleeting allows signals to operate automatically and clear to proceed when the required sections ahead are clear of trains.

In this instance, the departure signals at both Bayswater (controlled by Ringwood) and FTG (controlled by UFG) were set to fleeting. Train 7255 was able to pass through Bayswater station towards FTG without stopping, ahead of schedule and without the awareness of the Ringwood signal box. Then, at FTG, train 7255 was able to proceed into the single line section towards UFG without the awareness of the station officer at UFG.

It was not uncommon for non-revenue service trains to depart towards Belgrave on receiving a proceed aspect rather than wait for their scheduled departure times.

Other factor that increased risk The departure signals at Bayswater and Ferntree Gully stations were set to fleeting which meant the Upper Ferntree Gully-bound train 7255 could depart both stations without signaller intervention or awareness.

Belling systems

Bell signals from Ringwood

A belling system was used to communicate a train’s departure from Bayswater towards FTG. The belling process involved the sending of a bell signal to UFG by the Ringwood signaller and acknowledgement by a return bell from the UFG station officer. 

The departure of train 7255 was not accompanied by a bell signal by Ringwood to UFG. This removed a potential indicator to the station officer that train 7255 had departed early. 

The belling for other trains departing Bayswater towards FTG could not be confirmed due to the absence of recording. It is possible that the disrupted operations associated with the level crossing removal works impacted the normal belling routine of the Ringwood signal box. The track closure associated with the works resulted in shuttle operations between Bayswater and Belgrave and changes to a routine activity.

Other factor that increased risk A bell signal was not sent by the Ringwood signal box to the Upper Ferntree Gully signal box to notify Upper Ferntree Gully of the departure of train 7255 from Bayswater towards Ferntree Gully.

Annunciator bell

An annunciator bell at UFG station was designed to automatically ring when a train departed Boronia station which was located in dark territory. The system used train detection on track circuits and was designed for the bell to be inhibited if the section between signal U2R (L1119) and signal 2R was not clear. 

The signalling log showed that the section of track between signal U2R and signal 2R was probably occupied by train 3109 (travelling ahead of 7255) when train 7255 entered the circuit to trigger the annunciator. It is therefore probable that the annunciator did not ring, removing a potential audible indication of an approaching train. 

Other factor that increased risk The annunciator bell, installed at Upper Ferntree Gully to advise the station officer of a train’s departure from Boronia station towards Ferntree Gully did not ring for train 7255. This was a result of a design feature of the system and train 7255 following closely behind train 3109.

Network rules and procedures

Application of procedure

The train register book was an important tool used in signal boxes to record information about the movement of rail traffic, with each train movement logged by hand. At UFG signal box, the train register also recorded the times that bell signals were received from the Ringwood signal box. 

During the station officer’s shift that morning, there were no times recorded for the receipt of bell signals for the departure of trains from Bayswater were not recorded for any train. Review of records for the previous weeks also suggest missing bell signal entries on several occasions and other deviations from MTM procedure.

Record keeping at Ringwood did not require Ringwood to record the time the bell signal was sent to UFG nor the acknowledgement from UFG. Due to the absence of records, the effectiveness of the belling exchange could not be determined.

It was also identified that signallers at Ringwood and Upper Ferntree Gully were unaware of the correct bell code patterns to use when bell codes were to be sent between the signal boxes. 

Other factor that increased risk Procedures associated with movement of trains between Bayswater and Upper Ferntree Gully were inconsistently applied and gaps in protocols and record-keeping probably impacted the effectiveness of the systems. (Safety issue)

Internal audit of signal box procedure application

Review of train register books and MTM internal audit records indicated that audits did not routinely detect and rectify deviations from MTM network rules. In particular, the time bell signals were received were often not recorded. 

The MTM assurance program also included the annual auditing of persons undertaking signalling duties on the network. An analysis of audit records revealed that several staff members undertaking signalling duties at UFG were overdue for their annual signalling audit.

Other factor that increased risk MTM assurance and audit processes for signal box management was ineffective in addressing deviation from MTM train control processes on the Belgrave line.

Risk management of the level crossing removal project

Train operations in the section were disrupted due to level crossing removal project (LXRP) works between Ringwood and Bayswater. This meant that for several weeks trains were only operating between Baywater and Belgrave, and trains returning from Belgrave would be terminated at Bayswater and their direction changed for the return journey.

MTM conducted a risk assessment for the LXRP works and train operations between Bayswater and Belgrave. However, this assessment did not consider factors associated with the disruption which may have affected the signalling of trains between Bayswater and UFG. As a result, additional risk controls were not considered.

Other factor that increased risk A risk assessment conducted for the level crossing removal did not consider factors that may have affected the signalling of trains between Bayswater and Upper Ferntree Gully.

Reduced speed as a risk mitigation

Travel under a caution order required the train to be driven at a speed not exceeding 25 km/h and so that it could be stopped in half the distance that could be seen ahead. In this instance, the driver of train 3148 proceeded at a speed less than 20 km/h and consistent with this requirement. 

The outcome was assisted by train 7255 remaining stopped at the mid-section automatic signal that was at stop. This signal could have been passed under certain conditions, which included not exceeding 25 km/h, although in this instance the driver decided to wait. Had 7255 proceeded, the procedural maximum closing speed of the 2 trains would have been 50 km/h.

The caution and actions exercised by both train drivers mitigated the risk of a train‑to‑train collision despite two trains being in the same section.

Recording of communications

The investigation noted that several safety communications and operator activities undertaken by the signallers and station officers at Ringwood and UFG were not recorded. Signalling and control panel activities at UFG including the setting of points and signals, and the operation of the belling equipment and the annunciator bell were not recorded. The operation of the belling equipment at Ringwood station was also not recorded. The investigation also noted that communication between the driver of train 7255 and the station officer on the day of the incident was not recorded. 

As a result of an incident at UFG in 2015 (ATSB 2015) MTM advised that they would ‘consider a system modification to capture all safeworking communications at UFG’. The recording of safety communications provides significant benefits when determining the circumstances surrounding an incident and may mitigate the likelihood of similar incidents.

Other finding Several safety critical communications and signalling operations were not recorded at Ringwood or Upper Ferntree Gully signal boxes.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.  Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the safeworking incident involving MTM trains 3148 and 7255 at Ferntree Gully, Victoria, on 25 February 2024.

Contributing factors

• The station officer at Upper Ferntree Gully issued a caution order for train 3148 to enter the single line section between Upper Ferntree Gully and Ferntree Gully while train 7255 was in that section. The station officer believed the section was clear of other trains and the failure of signals to clear for train 3148 was due to a system fault.
• At Upper Ferntree Gully (and some other parts of the MTM network), the issuing of a caution order did not require validation by a second person. (Safety issue)

Other factors that increased risk

• The signal control panel at the Upper Ferntree Gully signal box did not provide direct train-specific identification information for the monitoring of trains between Ferntree Gully and Belgrave. Compared to modern systems, this placed a higher reliance on procedural systems.
• The departure signals at Bayswater and Ferntree Gully stations were set to fleeting which meant the Upper Ferntree Gully-bound train 7255 could depart both stations without signaller intervention or awareness.
• A bell signal was not sent by the Ringwood signal box to the Upper Ferntree Gully signal box to notify Upper Ferntree Gully of the departure of train 7255 from Bayswater towards Ferntree Gully.
• The annunciator bell, installed at Upper Ferntree Gully to advise the station officer of a train’s departure from Boronia station towards Ferntree Gully did not ring for train 7255. This was a result of a design feature of the system and train 7255 following closely behind train 3109.
• Procedures associated with managing trains between Bayswater and Upper Ferntree Gully were inconsistently applied and gaps in protocols and record‑keeping probably impacted the effectiveness of the systems. (Safety issue)
• MTM assurance and audit processes for signal box management was ineffective in addressing deviation from MTM train control processes on the Belgrave line.
• A risk assessment conducted for the level crossing removal did not consider factors that may have affected the signalling of trains between Bayswater and Upper Ferntree Gully.

Other findings

• The driver of train 3148 drove at a speed less than 20 km/h after being issued the caution order and in accordance with MTM procedures. This mitigated the risk of a train‑to‑train collision despite two trains being in the same section.
• Several safety critical communications and signalling operations were not recorded at Ringwood or Upper Ferntree Gully signal boxes.

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.  Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the Rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.  Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Validation of the caution order

Safety issue number: RO-2024-001-SI-01

Safety issue description: At Upper Ferntree Gully (and some other parts of the MTM network), the issuing of a caution order did not require validation by a second person.

Application of procedure

Safety issue number: RO-2024-001-SI-02  

Safety issue description: Rules and procedures associated with managing trains between Bayswater and Upper Ferntree Gully were inconsistently applied and gaps in the recording protocols at Ringwood probably impacted the effectiveness of the administrative systems.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out to reduce the risk associated with this type of occurrences in the future.

Additional safety action by Metro Trains Melbourne

Metro Trains Melbourne has commissioned changes to the control circuitry to remove the capability of fleeting movements onto the single line section between Ferntree Gully and Upper Ferntree Gully.

Glossary

AS	Australian Standard
ATC	Automatic and Track Control
ATSB	Australian Transport Safety Bureau
Book of Rules	The Book of Rules and Operating Procedures 1994
CCTV	Closed-circuit television
DTRS	Digital Train Radio System
FTG	Ferntree Gully
LXRP	Level Crossing Removal Project
Metrol	Central control centre for the Melbourne suburban rail network
MTIA	Major Transport Infrastructure Authority
MTM	Metro Trains Melbourne
OCI	Office of the Chief Investigator Transport Victoria
PRIDE	Passenger Real-Time Information Dissemination Equipment
ONRSR	The Office of the National Rail Safety Regulator
RIM	Rail Infrastructure Manager
RTO	Rail Transport Operator
RTPOTS	Real time position of train
SMS	Safety Management System
SPAD	Signal Passed at Danger
TCMS TD	Train Control Management System Train Describer Number
TNT	Train Number Transmitter
UFG	Upper Ferntree Gully
VIDA	Victorian Infrastructure Delivery Authority

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• MTM staff
• station CCTV from Bayswater and Upper Ferntree Gully
• MTM train data logger recordings
• MTM radio and telephone communications
• MTM Customer Information System data.

References

ATSB (Australian Transport Safety Bureau) (2015) Rail Occurrence Investigation Report RO-2015-008 Signals Passed at Danger by passenger train TD3050, Victoria, on 12 April 2015, Australia.

Lim, J., & Dinges, D. F. (2010). A meta-analysis of the impact of short-term sleep deprivation on cognitive variables. Psychological bulletin, 136(3), 375–389.

MTM (Metro Trains Melbourne) (2018) Engineering Standard- Signalling, Signal Box Workstation Specification, L1-CHE-STD-072, Version 1.

MTM (Metro Trains Melbourne) (2019) Technical Note – Vital Blocking, L1-CHE-INS-062, Version 1, dated 26 July 2019.

MTM (Metro Trains Melbourne) (2021a) Train Collision Risk Review (Level 3 – Assurance), Document A1898, Version 3, dated 21 December 2021.

MTM (Metro Trains Melbourne) (2021b) Fatigue Risk Management Standard, Document A8174, Version 1.

MTM (Metro Trains Melbourne) (2022a) Risk Assessment Report - 05112022 Exposure to Fatigue - Stations, dated 08 April 2022.

MTM (Metro Trains Melbourne) (2022b) Detailed Incident Investigation Report, INX180022, Safeworking Breach at Upper Ferntree Gully, 31 May 2022.

MTM (Metro Trains Melbourne) (2023a) Burnley Group Operating Procedures, Document number A8253, Version 22.

MTM (Metro Trains Melbourne) (2023b) Risk Assessment Report, Top train collision risk review, Reference No. 217386, dated 17 May 2023.

MTM (Metro Trains Melbourne) (2023c) Station Operations – Fatigue Risk Management Plan, Document A6236, Version 3, dated 17 April 2023.

MTM (Metro Trains Melbourne) (2024) Signalling diagram 95/23, Heathmont to Belgrave, 3 January 2024.

Public Transport Corporation (PTC) Book of Rules and Operating Procedures (1994), Revision 7.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A confidential copy of the draft report was provided to involved parties and agencies. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Rail safety investigations in Victoria  Most transport safety investigations into rail accidents and incidents in Victoria and New South Wales (NSW) are conducted in accordance with the Collaboration Agreement for Rail Safety Investigations and Other Matters between the Commonwealth Government of Australia, the State Government of Victoria and the State Government of New South Wales. Under the Collaboration Agreement, rail safety investigations are conducted and resourced in Victoria by the Chief Investigator, Transport Safety (OCI) and in New South Wales by the Office of Transport Safety Investigations (OTSI), on behalf of the ATSB, under the provisions of the Transport Safety Investigation Act 2003. The Chief Investigator, Transport Safety (OCI) is a statutory position established in 2006 to conduct independent, no-blame investigation of transport safety matters in Victoria. OCI has a broad safety remit that includes the investigation of rail (including tram), marine and bus incidents. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.