Rolling Stock Irregularity

Investigation summary

What happened

On 29 January 2023, at about 1910 local time, Pacific National Pty Ltd freight train 82P7 was travelling west at about 100 km/h on the down line near Marmor, Queensland. As the train approached a level crossing, the axle of the leading wheelset on the third bogie of the sixth wagon fractured. Both wheels derailed into the centre of the track and travelled in the derailed condition over the points and crossings. Subsequently, the rear 8 wagons of the train separated and piled up over the level crossing. The front half of train 82P7 came to a stop around 1.3 km from the point of derailment. 

Around the same time, train 9F02 was travelling in the up direction towards Marmor and passed the remaining signal between itself and train 82P7. The driver of train 9F02 observed the dust generated by the wreckage of train 82P7 and made an emergency brake application. This prevented train 9F02 from encountering the main wreckage of train 82P7. Nevertheless, train 9F02 collided with a container, still attached to the remaining front portion of train 82P7, that was fouling the up line. There were nil injuries to either train crew but both trains were substantially damaged.

What the ATSB found

The ATSB found that the derailment of train 82P7 and subsequent collision with train 9F02 was the result of a fractured axle. It was very likely that impact damage, sustained by the axle some time before the accident, initiated a fatigue crack that propagated until failure, resulting in the derailment. 

The design of the fractured axle (NB) had a 154 mm diameter centre section. Axles conforming to this design presented a greater risk of failing as a result of a damage‑initiated fatigue crack compared with an alternate design used by Pacific National, which had a 165 mm diameter centre section. 

The risk controls used by Pacific National to address the greater risk of failure posed by the NB axle design did not provide the best opportunity to ensure the removal of axle barrel damage capable of initiating a crack or to ensure axles with growing cracks were removed from service prior to failure. Despite this, it was not possible to establish if the damage that initiated the fatigue crack, or the growing fatigue crack, was present at the most recent wheelset overhaul.

The ATSB also found that Pacific National did not ensure its Asset and Infrastructure Services group, which was responsible for the management of rolling stock, performed risk management activities in accordance with the documented procedure. Specific areas where procedures were not followed related to the use of risk registers and risk management training. This was a missed opportunity to improve the group’s ability to systematically manage risks.

Lastly, the Association of American Railroads standard S-659 allowed blending repair of surface damage on axle barrels, with limitations to the number and total area of repairs. These limitations had been implemented as though applicable for each visit to an overhaul facility, rather than over the life of the axle, meaning that cumulative repairs over multiple overhaul visits were not being tracked. As a result, it was possible for the limits to be exceeded increasing the risk of axle failure.

What has been done as a result

Pacific National phased out all NB axles by 15 August 2024. 

Pacific National’s operational and Health, Safety, Environment, and Sustainability risk register was redeveloped and a new consolidated register uploaded to a single system. Pacific National also held risk workshops to review and validate risk information. Furthermore, a central repository for all completed operational task-based risk assessments has been established providing a focus area to improve the way Pacific National reviews and monitors risk assessment actions and change management activities.

Pacific National's Health, Safety, Environment, and Sustainability management system for risk management has been updated with new governance documents and tools. To support the implementation of the new documents and tools, an e-learning module has been developed to step frontline leaders through the risk management framework. 

Pacific National is also implementing an enhancement to its rolling stock database wheelset completion sheets. The enhancement includes a new field on the completion sheet that records the cumulative number of repairs completed on the axle. This will enable Pacific National and overhaulers to ensure limits are not exceeded. The enhancement was implemented on 29 January 2025.

Safety message

To ensure the safety of its operations, a rolling stock operator must eliminate or minimise risks to safety so far as is reasonably practicable. This is achieved through systematic risk management, a critical activity where risks are identified, assessed, eliminated, or controlled. An operator’s procedures codify the expected approach to risk management. Operators are required not to just have procedures in place, but to ensure they are followed in all areas of their operation. This can be achieved through formal training and review. 

ONRSR expects ongoing monitoring and review of the identified risks and the adequacy of the control measures used to manage them through the use of risk registers. Risk registers ensure that there is a mechanism promoting re-evaluation of a risk where controls have been implemented to ensure the controls are effective.

Standards help industry improve safety, reduce costs, and increase productivity and efficiency. When adopting a standard, or incorporating elements of a standard in organisational procedures, organisations are reminded to verify that there are mechanisms in place to ensure that compliance can be achieved.

Summary video

The occurrence

Derailment of train 82P7

On 29 January 2023, at about 1910 local time, Pacific National Pty Ltd freight train 82P7 was travelling west on the Aurizon Network Pty Ltd network at about 100 km/h on the down line near Marmor, Queensland. At 1910:05, as the train approached the Bills Road level crossing, the rear 8 wagons separated from the train, which disconnected the brake pipe, resulting in application of the brakes. At around the same time, the driver, unaware of the separation, reported that the train did not respond as expected when the throttle was applied and they noted a slight drag. The driver stated they checked the locomotive mirrors, noticed sparks coming from the train, and made a brake application. The brake application by the driver was recorded 5 seconds after the brake pipe pressure started to drop following its disconnection. At 1910:29, as the train was slowing, the driver broadcast an emergency call over the ultra‑high frequency radio. After stopping at 1911:03, it was determined that the 8 rear wagons from train 82P7 had derailed, significantly damaging points, crossings, level crossing equipment, and overhead wiring stanchions (Figure 1).

Figure 1: Main wreckage site of train 82P7 at Bills Road level crossing

Source: ATSB

Collision with train 9F02

At about the same time as, or just prior to, the emergency call from train 82P7, the Aurizon network controller, located in Rockhampton, called Aurizon Operations Ltd coal train 9F02, which was travelling east on the up line, via radio regarding a loss of signalling detection at the points near the Bills Road level crossing. Train 9F02 had recently passed signal MR15, indicating a green proceed signal. This was the last signal for trains travelling in the up direction before the signals associated with the level crossing. Around this time, the crew of train 9F02 noticed a cloud of dust emanating from a train on the down line ahead. The driver of train 9F02 began to apply the emergency brake but train 9F02 collided with a displaced container still attached to a wagon of train 82P7, which was fouling the up line. Train 9F02 stopped adjacent to a different container (Figure 2). It did not reach the main wreckage of train 82P7, located near the Bills Road level crossing (Figure 3). Train 9F02 sustained significant impact damage to the driver’s side of the cab on the lead locomotive and along the side of the train.

Figure 2: Damage to leading locomotive of train 9F02

Source: ATSB

Figure 3: Schematic of the track section near Marmor, Queensland 

Source: Aurizon Network Pty Ltd, annotated by the ATSB

Onsite inspection

During onsite inspections, the ATSB found an axle from the sixth wagon (RNCY137-T) on train 82P7 had fractured (Figure 4). This evidence correlated with rail-wheel field‑side¹ marks found on the rail head (Figure 5), identified as a point of derailment, situated before the signalling infrastructure and the points (Figure 3). The marks commenced on the field-side of the rail head and ran inwards towards the rail gauge face between both rails. There was no other evidence of derailment found on the approach to the point of derailment.

Figure 4: Damaged bogie of RNCY137-T showing half of the fractured axle

Source: ATSB

Figure 5: Wheel marks identified on the left and right rail head at the point of derailment 

Source: ATSB

Context

Track information

The bi-directional duplicated narrow-gauge track² between Callemondah and Rocklands, Queensland, on the Blackwater system consisted of 60 kg/m rail, fixed to concrete sleepers with resilient fasteners. The track section was electrified with overhead line equipment. The rail infrastructure manager was Aurizon Network Pty Ltd, who operated the section by remote control signalling, with train movements controlled from Rockhampton. In the up direction, approaching the Marmor township, the track was a heavy descending grade towards signal MR15.

Train and crew information 

Train 82P7

General

Train 82P7 was a superfreight type train operated by Pacific National, which originated at Moolabin yard in Brisbane, and was destined for Townsville terminal. The train consisted of a leading Pacific National locomotive (PN10) and 16 intermodal freight wagons. Each wagon was a ‘triple-pack’ wagon, comprised of 3 platforms and 4 bogies (Figure 6). Each bogie was fitted with 2 wheelsets.³ The total length of the train was 685.32 m with a gross mass of 1,366.397 tonnes. Train 82P7 was crewed by a single traction-qualified and route-competent locomotive driver.

Figure 6: Schematic of a triple-pack wagon on train 82P7

Source: ATSB

Pacific National axle designs

Pacific National had 4 different axle designs traveling on narrow-gauge tracks, 2 types each for ‘K’ class and ‘L’ class axles.⁴ Narrow-gauge ‘L’ class axles were relevant to this accident and included:

• ‘full’ axle-barrel-diameter axles, designated 7L7N:

The radial dimensions of these axles broadly corresponded to the dimensions of the Association of American Railroads (AAR) ‘L’ class raised wheel seat roller bearing axles for freight cars (AAR, 2016). The longitudinal dimensions differed, as the 7L7N axle design was suited to narrow-gauge track, while the AAR ‘L’ class design was applicable to standard-gauge track.

• ‘reduced’ axle-barrel-diameter axles, designated 7L7NB:⁵

The 7L7NB design (‘NB’ axle), was designed in 2004, for carrying 20‑tonne axle loads. The NB axle had a reduced barrel diameter as compared with the 7L7N axle design. 

The design drawing for the NB axle (Figure 7), listed the diameter of the centre section of the axle as 154 ± 1 mm. This constant-diameter centre section was 150 mm long. The axle then tapered out to a diameter of 170 ± 1 mm over 366 mm, followed by a radius to transition to the wheel seat, which had a diameter of 203 + 0.05 mm (Figure 7 ‘E’). The total axle length was 1,816 mm. In contrast, the 7L7N axle had a greater diameter of 165 ± 1 mm for a 152 mm long constant‑diameter centre section, tapering out to 181 ± 1 mm near the wheel seat. The critical location of the NB axle barrel, where the margin of safety⁶ was smallest, was located at the transition between the constant‑diameter centre section and the taper.   

Figure 7: Schematic of 7L7NB (NB) axle 

Source: Pacific National, annotated by the ATSB

Train 9F02

Train 9F02 was a loaded Aurizon Operations Ltd coal train, originating at Kabra and destined for Callemondah. This train consisted of 2 leading locomotives, 2 remote locomotives, and 100 wagons. The train was 1,586 m long and 10,452 tonnes. Train 9F02 was crewed by 2 traction-qualified and route-competent locomotive drivers.

Recorded information

Data from the locomotive event recorders including time, speed, control positions, and the condition of various locomotive system parameters, was obtained from train 82P7 (both leading locomotives) and train 9F02. While rearward facing footage from one of the remote locomotives of train 9F02 was available, forward-facing footage from the lead locomotive was unavailable as the unit was not functional at the time of the accident. There was no evidence that train speed, handling, or operational performance contributed to the derailment. Voice recordings of the rail network operations to train communications were also provided. 

A record of the universal traffic control system⁷ was obtained. The derailment likely occurred at 1910:02.3, based on the first recorded indication of an issue at 1910:12.3 when points near Bills Road lost detection, the location of those points, the location of the derailment markings, and the recorded speed of train 82P7.

The universal traffic control system also recorded the status of signal MR15, the last signal for train 9F02 before it encountered the wreckage of train 82P7. When passed by train 9F02 at 1910:00, signal MR15 indicated a green proceed signal. Two seconds later, following the passage of train 9F02, the signal restored to a red (stop) indication, as designed. Figure 8 shows the locations of both trains at the time when MR15 restored to a red indication.  

Figure 8: Location of train 82P7 and train 9F02 when signal MR15 restored to red

The length of the blue and orange lines indicates the full length of train 82P7 and train 9F02, respectively. Source: Google Earth, annotated by the ATSB

Accident site information

The accident site extended over 2.5 km from the point of derailment, around 400 m east of the Bills Road level crossing, to the trailing end of train 9F02 (Figure 9). The ATSB’s onsite examination identified the point of derailment to be at 594.401 track km⁸ (Figure 3). For the Raglan to Marmor section of track, no relevant track faults were identified during the inspection following the accident. Furthermore, the track cant⁹ and gauge measurements were within specification. 

Figure 9: Overview of accident site

The length of the blue and orange lines indicates the full length of train 82P7 and train 9F02, respectively. At this time train 82P7 had separated into 2 sections represented by the 2 separate blue lines. Source: Google Earth, annotated by the ATSB

The track infrastructure sustained extensive damage from 594.401 track km to 595.510 track km, including damage to the points, level crossing equipment, and overhead line equipment. The main wreckage site (Figure 1), including the derailed rear 8 wagons of train 82P7, was located near the Bills Road level crossing at 596.710 track km.

Train 9F02 came to a stop at 594.995 track km, shortly beyond a stationary container fouling the down line (Figure 2). Damage was sustained by both leading locomotives and the first 29 wagons of train 9F02. Also located in this area, off the tracks, was the right¹⁰ half of the fractured axle from train 82P7 (Figure 10).

Figure 10: Location of right half of fractured axle from train 82P7

Source: ATSB

The locomotive and leading wagons of train 82P7 had come to rest at 595.755 track km, about 1,300 m from the point of derailment. The left half of the fractured axle was observed within the 3rd bogie, connecting platform 2 and 3 of wagon RNCY137‑T, the 6th wagon in train 82P7 (Figure 4). This bogie and both halves of the fractured axle were taken for further examination.

Test and research

Examination of the fractured axle

The recovered fractured axle was identified as an NB axle with serial number 7L7NB4726. This was the leading axle on the 3rd bogie of the 6th wagon behind the locomotive (axle labelled R5 in Figure 6). Pacific National completed a post‑derailment inspection of the fractured axle, the sibling axle, and the bogie, which was observed by the ATSB. While the wheels and bogie were significantly damaged from the derailment, no pre‑existing concerns were identified with these components, other than the axle fracture. Paint had eroded from the surface of the barrel of both the fractured axle and its sibling axle.

The axle had fractured around 95 mm to the right of the centreline (Figure 11). About 200 mm of axle material, including both sides of the fracture surface, was sectioned from the axle and examined at the ATSB technical facility in Canberra, Australian Capital Territory. The fracture surface exhibited progression marks,¹¹ originating at a location on the circumference of the axle, consistent with fatigue fracture resulting from rotational bending. The indications of fatigue crack growth extended over around 60% of the axle cross-section, with a relatively small area of overstress failure, indicating low nominal stresses.¹² Around 50% of the fracture surface exhibited surface oxidation producing a darker appearance. The circumference of the fracture surface was extensively damaged, such that it was not possible to identify a crack initiating feature. 

The surface condition of the retained axle sections exhibited derailment damage in the form of scuffs and surface damage. The barrel surface was inspected for additional surface breaking cracks using magnetic particle inspection¹³ at the ATSB facility. There were no indications of additional cracks on the retained sections of the axle. Analysis of the axle material microstructure, hardness, and elemental composition found that the material was consistent with specification. 

Figure 11: Failure location and fracture surface appearance of fractured axle

Source: ATSB

History of the fractured axle

The subject axle was manufactured in October 2004 by the Commonwealth Steel Company, also known as Comsteel. The axle underwent a bearing turn¹⁴ on 5 September 2013, a wheel disc was replaced on 17 March 2015, and the axle underwent another bearing turn on 5 September 2018. These rolling stock maintenance events occurred at an approved wheelset overhaul facility (overhauler), where the condition of the axle barrel would have been inspected.

Following the failure of a Pacific National axle in December 2019 (see Previous NB axle failure due to fatigue), Pacific National commenced a program of axle inspections, which included magnetic particle inspection of all NB axles on lower-duty wagons. Lower-duty wagons were intermodal freight wagons operated on the Queensland North Coast line with variable loading up to a maximum axle load of 20 tonnes. There was no record of magnetic particle inspection performed on the subject axle between the commencement of the program and 23 August 2021, when Pacific National reported that the program was completed. 

On 11 October 2021, the axle was involved in a derailment while fitted to a lower-duty wagon (RNCY147‑E). The derailment occurred at low speed in a yard during the assembly/shunting of a train as it travelled over points. As specified in Pacific National procedures, the wheelsets involved in the derailment were removed and sent to an overhauler. The ‘why done description’ in Pacific National’s rolling stock database (Maximo) for this work order was ‘Derailment Damage’. On 9 December 2021, a Pacific National Wheelset Production Sheet¹⁵ checklist was populated for the axle. The overhauler selected ‘No Defects’ in the ‘Inspect & Repair on Axle Barrel Defects’ section and ‘Not Required’ in the ‘MPI [magnetic particle inspection] Completed on Repairs’ section. Nevertheless, the axle was subjected to magnetic particle inspection in accordance with the relevant Pacific National procedure; the finding was ‘No Cracking Found’.

On 7 January 2022, the axle was fitted as the 5th wheelset on lower-duty wagon RNCY137-T, the wagon it was fitted to at the time of this accident. Prior to the installation of the subject axle, the axles fitted to wagon RNCY137‑T were visually inspected, as per Rolling Stock Notice¹⁶ E 20‑004V2, on 22 April 2021 and underwent an ‘A’ Inspection (see Scheduled inspections) on the following day, with no issues reported. 

The wagon meter reading, which indicated the total kilometres travelled, for wagon RNCY137‑T, now fitted with the subject axle, on 12 January 2022 was 3,260,009 km. On 26 April 2022, wagon RNCY137‑T underwent a ‘P’ inspection (see Scheduled inspections). The 2 axle‑related line items on the ‘P’ inspection checklist were ticked as completed, indicating no issues were identified with any of the 8 wheelsets fitted to the wagon. As of 28 January 2023, the meter reading for wagon RNCY137‑T was 3,451,133 km. The axle fractured the next day, on 29 January 2023, this was around 15 months after the yard derailment.

Wayside monitoring relating to the fractured axle

While the section of track where train 82P7 derailed was managed by Aurizon Network Pty Ltd, the train also travelled on track managed by Queensland Rail. Wayside monitoring equipment, located along Queensland Rail managed track between Moolabin yard and Gladstone, recorded parameters including train speed, wagon tonnage, bogie tonnage, axle tonnage, wagon side-to-side imbalance, wagon end-to-end imbalance, wheel impact loads, and bearing and wheel temperatures. The system did not generate any reports in response to the passage of train 82P7 on the accident journey. Train 82P7 did not travel over any wayside monitoring systems between Gladstone and Marmor, the region of track managed by Aurizon Network Pty Ltd. Therefore, a review of data sourced from wayside monitoring equipment for the accident journey did not reveal a condition with wagon RNCY137‑T that contributed to the axle failure, or subsequent derailment.

In the year prior to the axle failure, the passage of wagon RNCY137‑T triggered weighbridge¹⁷ alarms on the following 5 occasions. The subject axle, number 5 on bogie 3, is accentuated in bold:

• 1 May 2022 – wagon load was 133.83 tonne, bogie 3 exceeded 40‑tonne limit by 0.36 tonne, axle 5 exceeded 20‑tonne limit by 0.52 tonne.
• 15 July 2022 – wagon load was 109.60 tonne, bogie 2 exceeded 40‑tonne limit by 0.55 tonne, axle 3 exceeded 20‑tonne limit by 0.28 tonne, axle 4 exceeded 20‑tonne limit by 0.28 tonne.
• 1 September 2022 – wagon load was 100.21 tonne, bogie 3 exceeded 40‑tonne limit by 2.38 tonne, axle 5 exceeded 20‑tonne limit by 1.28 tonne, axle 6 exceeded 20‑tonne limit by 1.10 tonne.
• 28 September 2022 – wagon load was 142.27 tonne, axle 5 exceeded 20‑tonne limit by 0.20 tonne.
• 29 September 2022 – wagon load was 145.10 tonne, bogie 2 exceeded 40‑tonne limit by 0.16 tonne, axle 4 exceeded 20‑tonne limit by 0.41 tonne, bogie 3 exceeded 40‑tonne limit by 0.20 tonne, axle 5 exceeded 20‑tonne limit by 0.02 tonne, axle 6 exceeded 20‑tonne limit by 0.17 tonne. 

The recorded wagon load on the alarm reports appeared to be the sum of the loads recorded for all 8 axles fitted to the wagon and on none of the 5 occasions was the whole wagon load more than the maximum allowable limit of 160 tonnes. Pacific National’s records for the same period found that the largest loading recorded for the wagon was 142 tonnes. That is, there was no record of the wagon being loaded above the maximum allowable limit. When asked about the axle loading alarms, Pacific National stated that ‘isolated events of overload’ should not be damaging to the axles given the margin of safety in the design. 

Axle barrel fatigue prevention

General approach

Engineering structures and components are generally designed such that applied loads do not produce local stress levels that result in plastic deformation or failure, that is, the stresses are below the elastic limit of the material. Nevertheless, components, including steel railway axles, subject to cyclic loads may eventually fail even when the stress does not exceed the elastic limit by the phenomena known as ‘fatigue’. 

Fatigue is the process of cumulative damage resulting from repeated fluctuating loads. The accumulated damage results in initiation and subsequent propagation of a crack, or cracks. Railway axles are a safety‑critical component exposed to a high number of loading cycles during a service life that can exceed 30 years (Lunden and others, 2009, June 22-25). Each revolution of the wheelset is considered a loading cycle and railway axles were among the first train components to give rise to fatigue problems (British Standards Institute, 2009). 

Preventing and managing fatigue in axles can be achieved through the following means: 

• Limiting the stress in the component: 

A concept in engineering design is ‘fatigue limit’. The fatigue limit is the maximum stress amplitude range that a material can withstand over an (in theory) infinite number of cycles without failure. In the context of rail axles, if the cyclic stresses applied to an undamaged axle are below a permissible value, usually defined in a standard, then it would be expected that the axle should achieve its design lifetime before a fatigue crack would initiate. A safety margin is typically built into the design, by sizing the axle appropriately. 

• Management of stress concentrators: 

Even when a component is designed such that the applied cyclic loads do not produce stresses that exceed the fatigue limit of the material, a fatigue crack can initiate. This will occur at a stress concentrating feature. Lunden and others (2009, June 22-25) stated that the fatigue strength of an axle may be reduced by material defects and by corrosion and surface damage, for example, from flying ballast. When damage is present on an axle barrel it creates a local region of higher stress where the fatigue limit of the material can be exceeded, such that, given sufficient cycles a fatigue crack will initiate. The more severe the stress concentrator, the less cycles before crack initiation. To prevent cracks initiating, axle barrels can be inspected for stress concentrating ‘marks’ at regular intervals. Once identified, these marks can be ‘blended’, a process where material is removed such that the smooth contour of the axle is restored. While the load-bearing cross‑sectional area of the axle is reduced by this process, there is usually a safety margin within the design allowing for some section reduction without leading to stresses exceeding the fatigue limit. In most circumstances following blending, a non‑destructive crack detection test, for example, magnetic particle inspection, is performed on the blended area to ensure that an unacceptable crack has not already initiated from the now‑removed stress concentrator. 

• Removal of cracked axles: 

Not all ‘marks’ with the potential to initiate a fatigue crack will be identified and removed prior to a fatigue crack initiating. Accordingly, it is prudent to regularly inspect axles for growing cracks through non‑destructive means. Most frequently, the inspection interval is defined as the distance that can be safely travelled between 2 crack detection tests (Beretta and others, 2004). This interval is half the propagation life (Zerbst and others, 2005), which is the number of loading cycles between an initial crack size, frequently selected based on the probability of its detection, and the critical crack size, where failure is imminent. This lifetime, for a particular axle design, may have been established through industry experience or through engineering evaluation using finite element analysis.¹⁸ Inspection intervals smaller than half propagation life can be selected, such that there would be a second chance to detect a growing crack, should it be missed at the first inspection opportunity (Zerbst and others, 2005).

Fatigue crack prevention at Pacific National

Introduction

To ensure axles were not operated at loads where the fatigue limit of the axle barrel material was exceeded, the axles used by Pacific National were designed to meet accepted international standards. Furthermore, axles were subjected to inspection and maintenance programs to manage the risk of failure and ensure safe operation. These inspection programs involved sequences of scheduled inspections, at regular intervals, with differing scope, ranging from visual-only to comprehensive axle inspection and overhaul.

Overhaul process

Pacific National stated that the average kilometres travelled by a wheelset between visits to an overhaul facility was around 500,000 km. Wheelsets were sent to an overhauler for numerous reasons including, but not limited to: 

• excessive wheel wear, for example, an excessively thin flange 
• wheel damage, for example, a flat spot identified on a wheel 
• bearing inspection
• the axle had been involved in a derailment
• the axle had been in-service for the maximum allowed range (km) specific to axle type and required magnetic particle inspection
• barrel damage had been identified during visual inspection
• planned changeout. 

Pacific National used a ‘WHY_MADE_CODE’ in its rolling stock management database to indicate the reason a wheelset would be sent to an overhaul facility. In the 10 years prior to 2023, there were 9,005 entries where axles were assigned a WHY_MADE_CODE. A total of 34 unique codes were applied. Code 55, which corresponded to the description ‘Axle damaged between wheels’, was used on 5 occasions.

When a wheelset entered an overhaul facility, a checklist known as Pacific National Wheelset Production Sheet would be completed for each axle. The checklist detailed the actions required to qualify a wheelset to be returned to service. The overhaul process relating to the barrel of the axle commenced with inspection of the surface between the wheel seats to identify indications of barrel damage. 

If no marks were identified, the axle would undergo magnetic particle inspection to ensure there were no cracks. If magnetic particle inspection revealed a crack, the axle was to be condemned. If the axle was free from cracking, and met all the non‑barrel‑related requirements, it was able to be fitted with bearings and wheels for return to service. 

If marks were identified on the axle barrel, the number and the depth of the indentations would need to be assessed. Where the number of marks or an indentation depth exceeded the maximum, the axle was to be condemned. If all marks were shallower than the applicable maximum depth for that axle design, and there were less than 25 marks, the barrel could be repaired by blending.

One overhauler advised the ATSB that they performed a dimensional tolerance check following blending repair to ensure the constant-diameter centre section of the axle was not thinned beyond the tolerance of the design drawing. Following blending, the axle would be checked for the presence of cracks with magnetic particle inspection. Figure 12 shows a diagram summarising the barrel-related actions during overhaul. There were also many non‑barrel‑related criteria, not described in this report, that needed to be satisfied for an axle to be returned to service.

Figure 12: Diagram illustrating the barrel-related action during axle overhaul

Source: ATSB

Identification and characterisation of axle barrel damage at overhaul

Identification of barrel marks at overhaul was performed once the bearings and wheels were removed from the axle, the paint was stripped, and the axle positioned under appropriate lighting. One overhauler stated that it was possible to identify marks on an axle as they were faceted indents that caught the light. Conversely, the overhauler stated that, without the paint stripped and good lighting, it would not be possible to identify a typical mark, which was around 0.5 mm deep. The overhauler estimated that around 97% of wheelsets that entered an overhaul facility required blending repair. During a visit to a different overhaul facility, it was observed by a transport safety investigator that, for a painted axle, it would be very difficult to differentiate between a chip in the paint and a 0.5 mm deep indent. Another rolling stock operator stated that damage was not visible without paint removal.

Once marks were identified, a depth gauge was used to characterise the depth of the damage to determine if the axle could be repaired, or if it would be condemned. The overhauler stated that it was possible to characterise depth to the nearest hundredth of a millimetre. This overhauler did not perform quality assurance checks or consistency checks on test pieces containing known numbers of marks with known depth. There was also no assessment made by the overhauler regarding the consistency of defect identification and characterisation between workers. This was unlike magnetic particle inspection where practitioners used test pieces to ensure they could detect cracks and held qualifications aimed at assuring some baseline level of practitioner consistency.

Cumulative blending of axles

Pacific National had adopted rule 1.1.12.1 of the AAR Manual of Standards and Recommended Practices Wheels and Axles, G-II [S-659] (AAR, 2019), which specified that no more than 25 blends were allowed on an axle and the total blended area could not exceed the lesser of 20% of the axle barrel surface area and 200 square inches. The AAR standard stated that if the limits were exceeded an axle would either need to be machined¹⁹ or condemned.

While the textual interpretation of this rule, confirmed by the AAR, was that the limitation applied over the life of the axle, one overhauler stated that they had interpreted this to mean for each visit to an overhaul facility. In addition, 2 other overhaulers were found to have no means to ensure compliance with these rules. The number of blends, or blended area, was not a parameter recorded in the Pacific National rolling stock database or on a wheelset production sheet. Therefore, it was not possible for the overhaulers to know the total number, or total area, of blending repairs made to an axle during all previous visits to an overhaul facility. Rule 1.1.12.1 applied to all Pacific National axles, including the NB axles. 

Narrow-gauge ‘L’ class axle condemnation records

Pacific National provided records of all condemned narrow-gauge ‘L’ class axles for the 10 years prior to January 2023. When an axle was condemned, a free text field description could be populated to indicate the reason. These descriptions were categorised by the ATSB, as shown in Table 1, and it was observed that axles were predominantly condemned for wheel seat issues, not barrel damage.

The number of axles condemned increased after 2017, with substantially more axles condemned in 2018, 2019, and 2020, as compared with the preceding years. Although, over the next 2 years, 2021 and 2022, only a single axle was condemned. There was no update to the Pacific National procedures relating to axle barrels, specifically Wagon Maintenance Manual (WMM) 09-03 Axles,²⁰ around 2017, to explain why more axles were condemned in 2018, 2019 and 2020.

In the data, 2 axles were categorised by the ATSB as ‘cracked’. The free text field descriptions associated with these axles were ‘axle cracked’ and ‘CRACKED AXLE’, for the 2019 and 2022 entry, respectively. The descriptions did not specify where the axle was cracked and other descriptions in the records, such as ‘cracked bearing journal’, indicated that cracks could be found in areas of the axle other than the barrel. Therefore, it was not possible to state conclusively that these axles were condemned for axle barrel cracking.

In the 10 years’ worth of data, 11 out of 94 condemned axles were categorised as condemned for barrel damage by the ATSB based on the free text field description. Over this period, changes were made to axle inspection and maintenance procedures. Up until April 2020, all ‘L’ class narrow-gauge axles were designated 7L7N axles. After this, the NB axles were differentiated from ‘full’ axle-barrel-diameter axles, although the exact date in April when this occurred was not known. Of the 5 axles condemned for barrel damage in 2020, one was an NB axle, one was a ‘full’ axle-barrel-diameter axle, and the axle type of the remaining 3 was unknown as they were condemned prior to April. In the following year, 2021, no axles were condemned.

Table 1: Number of axles condemned between 2013 and 2022

Previous NB axle failure due to fatigue

On 23 December 2019, 5 wagons of train 9231, transporting zinc concentrate and copper anodes, derailed on the Mount Isa line, near the township of Mingela, Queensland. These were bulk wagons where axles would be loaded to the 20-tonne maximum for half their journey time and unloaded (empty) for the other half. 

An NB axle, referred to as the Mingela axle, fitted to one of the derailed wagons was found to have fractured near the centre section of the barrel (Figure 13). Pacific National had never before experienced an in-service failure of a 7L7N or NB axle. The fracture surfaces exhibited progression marks followed by overstress fracture. The progression marks were estimated to extend across around 70% of the axle cross-section. 

Pacific National commissioned an examination of the fractured Mingela axle, which stated that, while it was suspected that the fatigue crack may have been initiated by ‘a small indentation caused by being struck by a piece of ballast’, examination could not confirm the presence of such an indentation. Magnetic particle inspection performed on the fractured axle did not detect additional indications of cracking on the barrel. The axle was found to meet the compositional and mechanical requirements of the specified material. The report also noted that the axle had been involved in a stationary immersion and derailment event in January 2019 (around 11 months prior to the failure) where floodwaters lifted the stationary train off the tracks. 

Figure 13: Fracture location and surface appearance of Mingela axle fracture 

Source: Pacific National and Bureau Veritas, annotated by the ATSB

Response to previous NB axle failure 

Risk assessment and investigation

In response to the Mingela axle failure, Pacific National undertook several activities over a 13-month period. These activities were directed by the Asset and Infrastructure Services group (AIS group), which held responsibility for the management of rolling stock and related procedures. The AIS group initiated a formal risk assessment according to its local procedures and commenced populating its risk assessment template on 13 January 2020. Six team members were listed on this first revision of the template, revision A.

Pacific National’s associated investigation report for the event completed senior review and sign‑off on 4 February 2020. During the investigation, Pacific National consulted another rolling stock operator, Aurizon, which had used a narrow-gauge axle with a similar design to the NB axle on bulk wagons. Aurizon had experienced in‑service fatigue cracking and failure of axle barrels (see Similar occurrences). The barrel dimensions between the wheel seats were identical for both designs. The axle length, however, was 1,897 mm for the Aurizon axle, as compared with 1,816 mm for the NB design. Aurizon observed initiation of a fatigue cracks from small instances of impact damage attributed to ballast strikes.

Analysis of the Aurizon axle design showed that it did not meet the requirements of the 2009 version of British Standard European Norm (BS EN) 13103 Railway applications - Wheelsets and bogies - Non-powered axles - Design method.²¹ Aurizon reportedly stated that the axle was found to have a margin of safety less than 1 and be operating in the ‘fatigue zone’. 

Pacific National concluded the root cause of the Mingela axle failure was fatigue cracking and determined that:

The design of the Bradken 7L7N axle²² is more than likely inadequate for long term operation at 20T [20 tonnes] axle load.

This axle design is likely to be susceptible to rapid onset of fatigue cracking in the presence of very minor damage, such as that caused by ballast strikes.

The investigation report listed 13 proposed action items to prevent the recurrence of a similar incident. These 13 action items were accepted by Pacific National and input as action items in the Pacific National action tracking database, known as ‘The Shed’.

The AIS group produced revision B of its risk assessment template on 10 February 2020, revision C on 9 September 2020, and the most recent revision prior to the subject accident, revision D, on 19 October 2020. The sign‑off facilitator was the only team member listed for all 4 revisions of the risk assessment template and was the sole team member listed in the most recent revision of the template. The sign‑off facilitator left Pacific National in April 2021. 

Many elements of the risk assessment template were not completed strictly in accordance with the template guidance. The template contained 17 risk controls considered by Pacific National, 14 of which appeared to have been accepted for implementation. While there was significant overlap between these 14 risk controls and the 13 action items from the investigation report, there was not a direct one-to-one correlation of items. Documentation of the proposed amendments to existing risk controls, or additional risk controls, in the risk assessment template did not include detailed explanations or justifications on how each control was expected to reduce risk.

The most recent update to the risk assessment template, revision D, included many incomplete fields. Most notably, the ‘Risk Control Review’ fields, where a responsible person and a due date were to be listed, had not been completed for any control item. Additionally, the risks identified during the NB axle risk management activity had not been entered into a risk register.

The overall intent behind the risk control items introduced by the AIS group was to reduce the risk posed by NB axles. The risk levels were outlined in a risk matrix contained within the template (see Appendix A – Risk matrix in the Asset and Infrastructure Services group template) where the greatest possible risk corresponded to a risk rating of ‘Very High (1)’ and the lowest risk corresponded to a risk rating of ‘Very low (25)’. 

The scenario used by the AIS group when determining the risk rating was a fractured NB axle with the risk outcome: ‘derailment resulting in single fatality’. The risk template included the following relevant consequence descriptions (safety and health):

Major:

Third party/general public An event resulting in multiple fatalities due to third party error

Critical: 

Employee/contractor An event that results in one or more fatalities

Third party/general public: An event that results in one or more fatalities due to Asciano²³ [Pacific National] error or failure

The consequence selected by the AIS group for its identified scenario was ‘Major’, and this remained unchanged for all 14 of the accepted risk controls. The template showed that the AIS group determined that the likelihood of the inherent risk (without controls) was ‘Possible’ leading to a risk rating of ‘High (8)’. A number of the proposed risk controls were to reduce the likelihood to ‘Unlikely’, which resulted in a reduction in the risk rating to ‘Medium (12)’.

Pacific National considered replacing all NB axles with full-thickness axles during the risk assessment activity. Replacement of NB axles was determined to reduce the risk of the fractured axle, derailment, and fatality scenario to ‘Low (16)’. Although this was accompanied by an associated business risk, resulting from service disruption and cost, which was assigned the risk rating ‘Medium (13)’.²⁴ In the risk analysis template, it was stated that the ‘inspection regime’ devised to control for the NB axle failure scenario was selected rather than the option to ‘replace’ all NB axles. 

The action/control items and changes to axle barrel risk controls were implemented over the period from 13 January 2020 to 15 February 2021. The 13 action items and 14 control items are not described in detail individually in this report. Instead, the following sub‑sections describe the development of axle barrel‑related risk control in response to the Mingela axle fracture leading to the axle barrel‑related risk controls current at the time of the Marmor axle fracture. 

Wagon loading limitation

Prior to the Mingela axle fracture, NB axles were used on bulk wagons and lower‑duty wagons. Following the Mingela axle fracture, a risk control was introduced restricting NB axles to service on lower‑duty wagons. Pacific National recorded that NB axles were only fitted to lower‑duty wagons by 28 May 2020. While no comparative analysis was performed between the 2 loading scenarios, Pacific National advised the ATSB that the loading on lower‑duty wagons was less severe than on bulk wagons. 

Engineering evaluation of the NB axle design

Following the Mingela axle fracture, Pacific National commissioned an engineering evaluation, dated 29 July 2020, of its NB axle design to: 

• Determine if the axle design complies with the current version of BS EN 13103 at its rated capacity; and

• Understand the impact of operational axle loading on the associated fatigue life. In cases, the actual operational loading may be substantially less than the axle rating

The standard used for the evaluation was BS EN 13103-1:2017. The calculation of axle stress in reduced gauge track (metric or close to a metre) axles, applicable to NB axles, was unchanged from the previous version of the standard, BS EN 10103:2009. The report supplied to Pacific National stated that the NB axle was found to meet the requirements of the standard from a ‘stress perspective’. This assessment involved calculating the stress for each section of the axle and comparing it with maximum permissible stresses. While the calculation of the stress in the axle sections was verified, the ATSB found that the process followed to determine the maximum permissible stresses did not use materials test data as outlined in the standard.

The evaluation reported that the critical location, described as the ‘most highly stressed’ location, was the transition between the constant diameter centre section and the outward taper (Figure 7). The stress calculated at this location was 154 MPa and corresponded to the location with the lowest margin of safety, 1.17. In comparison, the calculated stress at this location for the 7L7N design was 125 MPa and the margin of safety was 1.44, when calculated using the same maximum allowable stress value.

The engineering evaluation stated that the fatigue life of the NB axle ‘was found to exceed 30 years of operation in the undamaged or as manufactured condition’. The critical crack depth²⁵ was stated to be 36 mm for the constant-diameter centre section of the NB axle design (Figure 14). A crack that had progressed to this depth would correspond to a crack length of 155 mm on the curved surface of the axle and a chord length of around 130 mm.

Figure 14: Representation of a critical-depth fatigue crack in an NB axle

Source: ATSB

The report also provided crack initiation intervals and crack growth intervals generated using finite element analysis. While the evaluation was in response to a failure of an NB axle fitted to a bulk wagon, the analysis considered an NB axle subject to loading and track curve profiles indicative of the route between Brisbane and Cairns, used by lower‑duty wagons, for 2 lateral loading conditions, 50 kN and 75 kN. Lateral loading was the term used in the engineering evaluation to describe wheel/rail horizontal force perpendicular to the rail on the side of the more heavily-loaded journal. 

Crack initiation interval estimates (Table 2) were produced for 2 notch sizes, not greater than 0.2 mm and not greater than 3 mm. The term crack initiation interval was not explicitly defined in the report, instead the phrase ‘life of the axle to the point of small crack initiation’ was used and this likely meant crack initiation interval in kilometres travelled. For example, analysis predicted that, if there was a hemispherical surface notch with a radius of not greater than 0.2 mm in an NB axle barrel, the axle could travel 654,000 km before the notch would initiate a small crack, in the case where the lateral load was 50 kN. In this example the initiated crack would have a length of around 0.4 mm on the axle barrel surface and would not necessarily be reliably detectable with non-destructive techniques.

Table 2: Distance travelled till crack initiation

The crack growth intervals, or the distance it would take a chordal crack, of depth 1 mm, 2 mm, and 3 mm, to propagate to the critical depth of 36 mm was modelled for the same Brisbane to Cairns route for the 2 lateral loading conditions (Table 3). For example, the analysis predicted, for the 50 kN lateral load condition, a 2 mm deep chordal crack, which would appear 35 mm long on the axle surface, would grow to a depth of 36 mm after the wheelset travelled 397,000 km. Such a crack would appear 155 mm long on the axle surface.

 Table 3: Distance travelled for a chordal crack to propagate till critical depth

Scheduled inspections

Changes were made to the scheduled inspection of NB axles following the Mingela axle fracture. The wagon maintenance schedule applicable to wagons fitted with NB axles included 3 inspection types, ‘P’, ‘A’, and ‘B’ inspections, at 250,000 km, 500,000 km, and 1,500,000 km intervals, respectively. Through this schedule, a wagon and the installed wheelsets would be subject to inspection every 250,000 km in the repeating sequence P, A, P, A, P, then B. 

At the time of the Mingela axle failure, Pacific National procedure WMM 09-03_08 Axles (version date 29 September 2009) detailed the requirements to be met at the different types of inspections with respect to the condition of the axle barrel.

On 4 February 2020, Pacific National issued Rolling Stock Notice E 20-001V2 which:

• Reduced the allowable depth for damage to be blend repaired from 3 mm to 1 mm for NB axles.
• Introduced the requirement for wagons with NB axles fitted to be lifted up from the bogies at ‘P’ and ‘A’ inspections to allow rotation of the axles and provide access to clean and visually inspect the full circumference of the axle barrel. Previously this was not a requirement.
• Reiterated that the visual inspection of the axle barrel, which would occur at on-train, ‘P’, ‘A’, and ‘B’ inspections, between the wheel seats shall be conducted for the presence of cracking, transverse or circumferential scoring, grooves, gouges, scratches, chisel marks, or similar indentations. Axles identified with surface defects were to be removed from the bogie. Wheelsets removed for damage were to have the area(s) of damage highlighted before dispatch to an overhaul facility for repair. Pacific National reiterated that procedures did not allow for any marking of any depth to remain unblended and expected all damage to be identified for repair. 

On 15 February 2021, Pacific National updated its procedures again releasing WMM 09‑03_09 Axles, which:

• Reduced the allowable depth for damage to be blend repaired to 0.5 mm for NB axles.
• Specified that NB axles could not be machined.
• Changed the requirement to comply with the entirety of Section 1 of AAR Manual of Standards and Recommended Practices Wheels and Axles, G-II [S-659], to a requirement to meet only specific referenced rules.
• Introduced an interval-based requirement for an NB axle to be removed from bogies and cleaned of paint to enable magnetic particle inspection at ‘B’ inspections, every 1,500,000 km. 

In the risk assessment template, the introduction of the interval-based magnetic particle inspection was associated with values sourced from the engineering evaluation. Specifically, the total time ‘from defect to failure’ was considered. This was a combination of a crack initiation interval and a crack growth interval. The initiation interval Pacific National selected was a ‘notch radius less than 0.2 mm time to crack propagation’ and most closely aligned with the value of 654,000 km in Table 2. The growth interval was described as ‘growth to critical – initial depth 2 mm’ and most closely aligned with the crack growth interval of 397,000 km in Table 3. The combined total was 1,051,000 km. Also included in the risk assessment template was an estimate that magnetic particle inspection would occur every 1,000,000 km. Pacific National was not able to provide an explanation as to how these 2 values (1,051,000 km and 1,000,000 km) exactly related to each other and to the introduction of the interval‑based magnetic particle inspection at the ‘B’ inspection, every 1,500,000 km.

While Pacific National updated its axles procedures again on 17 May 2021, with the release of WMM 09-03_10 Axles, there were no changes related to axle barrel inspection introduced with this version. This version was current at the time of the Marmor accident. Section 2, titled ‘Workshop inspection and repair’, contained the following parts relating to axle barrels:

2.2.5       Axles Barrel S-659 Rule 1.1.11 & 1.1.12

2.2.5.1     Bogie with 7L7NB wheelsets shall be removed from wagons at A and P inspections to enable thorough inspection of full circumference of axles. 

2.2.5.2     At B inspections, 7L7NB wheelsets shall be removed from wagons with barrels cleaned of paint to enable MPI inspections. Barrels shall be repainted post MPI.

2.2.5.3     7L7NB axles are required to have barrel cleaned of paint to enable MPI inspection for all scopes of wheel set overhaul. The barrel shall be repainted post MPI.

2.3          Axle NDT²⁶ Following Derailment

2.3.1       If a defect is detected on the axle surface, the full surface area of the axle shall be tested by MPI or radial ultrasonic procedures

2.3.2       If wheels do not require removal, the axle shall be tested using angled probe ultra-sonic procedures to inspect the wheel-seats, and near and far end scans in both directions. Ultrasonic Inspection shall be conducted per AS1065-1988²⁷ for forgings.

Note: Wheelsets involved in derailments shall be suitably identified.

2.4          Recording and Reporting

2.4.1       An electronic record is to be kept by the service provider of axle inspection & testing including axle number, date of inspection, inspection and test results for each axle for a minimum period of 12 years.

2.4.2       All defective axles shall be separately recorded with a full description and location of the defect(s), together with a report on the axle’s history and any other relevant information.

2.4.3       Inspection records shall be provided to Pacific National upon request.

Section 3, titled ‘Axle repair - General’, contained the following parts relating to axle barrels:

3.1          Repair Axle Barrel Defects

3.1.1       Refer to S-659 Rule 1.1.12

Note: 7L7NB axles are limited to damage having 0.5mm maximum depth. Damage with a depth greater than 0.5mm shall result in the axle being scrapped.²⁸ 7L7NB axles have no allowance for machining. 

The rules of AAR Manual of Standards and Recommended Practices Wheels and Axles, G-II [S-659], referenced by Pacific National, stated:

1.1.11 Welding on axles is not permitted, and any axle showing welding or cutting torch damage is scrap. Only electrochemical metal deposition processes, covered in Rule 1.2.6, are approved repair techniques.

RULE 1.1.12 Axle Surface Defect Repair

The axle body must be cleaned to ensure that the body is sufficiently free of rust, oil, paint, and dirt to enable visual and magnetic particle inspection.

1.1.12.1 All axles with surface defects 1/8 in.²⁹ deep or deeper must be scrapped or repaired using the full-body machining technique according to paragraph 1.1.2 or 1.1.12.3. All cracks must be removed and blended smoothly into the contour of the axle body. Surface defects such as nicks, gouges, or deep scratches less than 1/8 in. deep, having features with less than a 2-in. radius must be removed and blended smoothly into the contour of the axle body. Repairs that result in a radius less than 2 in. are not blended smoothly into the contour of the axle body and are not acceptable.

The following criteria must be met:

• Surface roughness of such repairs shall not exceed 90 microinch Ra.

• Repairs to circumferential defects such as those caused by brake rod interference may cover the entire axle circumference but can be no more than 6 in. wide.

• Removal must be performed such that all marks are aligned with the length of axle.

• Operations must not produce discoloration at any time during the process.

• No more than 25 such repairs shall be allowed to each axle.

• Repairs cannot be joined for the purpose of reducing the total number of repairs.

• In no case shall grinding repairs exceed 20% of the surface area of the axle body or 200 in², whichever is less.

• Final-step grinding media must be 80 grit or finer when finishing by hand or 120 grit or finer when using power tools.

• If a multi-step finishing process is employed, more aggressive media (rougher) may be used in the initial step provided the final-step finishing removes all evidence of the rougher medium.

Axles that fail to meet these criteria must be machined in accordance with paragraph 1.1.12.3 or scrapped.

1.1.12.2 All repairs on axles that have been in service must be magnetic-particle-tested by the wet method and shall be completely free of defects.

1.1.12.3 Axle bodies may be machined, providing surface defects can be removed without going below specifications. The surface roughness of the machined body shall not exceed 250 microinch Ra. Any axle body that has been machined must be magnetic-particle-tested by the wet method after machining and shall be completely free of defects.

1.1.12.4 Dust guard repairs should be treated in the same manner as the axle body repairs with the following exceptions:

• Dust Guard surface defects with less than 1/8-in.-deep circumferential V-notch condition must be corrected by grinding to 1/8-in. radius or more and may be corrected by filing, sanding, or machining to remove the defect.

• If the dust guard area is corrected per the above procedure to be considered a fitted application, care must be exercised to ensure that the affected area is completely sealed to prevent water and/or contamination from entering the journal filet area.

The requirements of Pacific National axle procedures were implemented using inspection checklists. The check-box items relating to the axle barrel on the ‘P’, ‘A’, and ‘B’ inspection checklists, current at the time of the accident, are contained in Table 4. The ‘A’ and ‘B’ checklists stated the 3 mm depth limitation for blending applicable to 7L7N axles but did not state the 0.5 mm depth limitation applicable to NB axles.

Table 4: Axle barrel‑related check-box items for the ‘P’, ‘A’, and ‘B’ inspection checklists

Non-ongoing axle inspection program

Pacific National initiated a program of one-off inspections of NB axles in response to the Mingela axle failure. This included a magnetic particle inspection program to identify cracked axles and a visual inspection program to identify barrel damage.

The magnetic particle inspection program was initiated on 9 January 2020, when Pacific National issued Rolling Stock Notice E 20-003. This program was initially limited to a sample of NB axles. Pacific National could not confirm the sample size and the broader population from which the sample originated. Rolling Stock Notice E 20-003 included an MPI/Damage Inspection Record pro forma that was to be completed and emailed to the relevant group within Pacific National. One record of the pro forma, containing the results for 23 axles, all of which required blending repair, was provided to the ATSB. Damage with depth ranging from ‘under 3 mm’³⁰ to ‘0.01 mm’ deep was recorded. As magnetic particle inspection would require removal of paint, identification of damage during the one-off magnetic particle inspection program would have occurred under conditions similar to those for a ‘B’ inspection. Accordingly, the records indicated that damage with depth as small as 0.01 mm could be identified under ‘B’ inspection conditions. 

On 3 February 2020, version 2 of Rolling Stock Notice E 20-003 was issued specifying that magnetic particle inspection was to be conducted on all NB axles. Pacific National indicated that magnetic particle inspection of all NB axles was completed in August 2021. Inspection records conforming to the pro forma could not be provided by Pacific National for all axles. In the time between when version 1 of Rolling Stock Notice E 20-003 was issued and the completion of the program, the depth of damage that was acceptable for blending was reduced twice (see Reduction in acceptable blend depth).

The visual inspection program was initiated on 4 February 2020, when Pacific National issued Rolling Stock Notice E 20-004V2. This program required visual inspection of the barrels of all NB axles. Rolling Stock Notice E 20-004V2 stated that this inspection could be conducted as an ‘on-train’ inspection and detailed that any cracking, transverse or circumferential scoring, groove, gouges, scratches, chisel marks, or similar indentations were unacceptable defects. Axles identified with such marks were to be removed from service, the areas of damage were to be indicated, and the axle dispatched to an overhauler. Rolling Stock Notice E 20-004V2 included an Axle Damage Inspection Record pro forma that was to be completed and emailed to the relevant group within Pacific National. Pacific National indicated that visual inspection of all NB axles was completed as of 19 October 2020; however, it was unable to provide any completed inspection records conforming to the pro forma. 

Pacific National was asked to provide evidence that, during visual inspection, inspectors were able to detect all damage on the axle. The evidence provided was not related to on‑train, ‘P’, or ‘A’ inspections and did not demonstrate that all marks were identified at these inspections. Instead, records relating to the non-ongoing magnetic particle inspection program were provided, where the wheelset would have been removed from the bogie at an overhaul facility in a manner consistent with a ‘B’ inspection. 

Wayside monitoring limitation

As part of the response to the Mingela axle failure, Pacific National modified its response to a particular wheel impact load alarm issued by the Queensland Rail wayside monitoring system. If a wheel impact load alarm greater than 196 kN was issued, Pacific National would schedule the wheelset to be removed from its position and sent to an overhaul facility no later than 20 weeks following the alarm. 

Pacific National stated that the wheel impact load detector alarms were related to physical defects or damage present on wheels and were not a representation of the axle loads. For example, a load alarm could indicate a 10 mm size wheel flat³¹ or spall³² on a wheel and did not necessarily indicate that the axle, bogie, or wagon was overloaded. 

Reduction in acceptable blend depth

On 3 February 2020, when Rolling Stock Notice E 20-003V2 was issued, the damage depth prompting an NB axle to be condemned was reduced from the AAR standard of around 3 mm to 1 mm. This requirement to condemn NB axles if barrel damage was found with depth greater than 1 mm was also listed in Rolling Stock Notice E 20‑001V2, released on 4 February 2020. Rolling Stock Notice E 20‑003V2 and Rolling Stock Notice E 20‑001V2 expired on 2 August 2020 and 4 August 2020, respectively. On 15 February 2021, the damage depth prompting an NB axle to be condemned was further reduced to 0.5 mm with the publication of revision 9 of WMM 09‑03 Axles. 

These changes to the barrel damage depth at which an NB axle was to be condemned, were not included in the 13 action items in the Mingela axle failure investigation report, nor where they described as part of the 14 accepted risk controls detailed in the risk assessment template. Pacific National was not able to provide the rationale for the depths it selected beyond the statement that condemning axles with shallower damage would be more conservative. 

Machining axles

Prior to 15 February 2021, Pacific National procedures contained the requirement to comply with the entirety of Section 1 of AAR Manual of Standards and Recommended Practices Wheels and Axles, G-II [S-659]. This standard allowed an axle to be machined if the cumulative damage limits were exceeded, provided none of the damage exceeded the 3 mm depth limit. After this date, with the publication of revision 9 of WMM 09‑03 Axles, Pacific National specified that NB axles ‘have no allowance for machining’. As with the reduction in acceptable blend depth, this change to risk controls was not included in the 13 action items in the Mingela axle failure investigation report, nor were they described as part of the 14 accepted risk controls detailed in the risk assessment template.

Organisational information

Pacific National

Risk management procedures

PN-PRO-SAF HSE Risk Management Procedure, issued 18 November 2022, was Pacific National’s procedure for risk management at the time of the accident. The purpose of the document was to outline the requirements for identifying, assessing, and recording Health, Safety, Environment, and Sustainability (HSE) risks within Pacific National. It detailed the processes, tools, and requirements for HSE risk management. There were 5 steps outlined in the risk management process:

• Establish Context: 

Defines the parameters within which risks must be managed and sets the scope for the rest of the risk management process.

• Risk Assessment: 

Hazard identification – develop a comprehensive list of HSE hazards/aspects; and 

Risk assessment – assess likelihood and consequence, determine cause, and identify existing preventative and mitigating controls.

• Risk Control: 

Risk evaluation (select, implement, and monitor the effectiveness of specific risk controls following the hierarchy of control); and

Risk treatment (assign, implement and monitor action plans for further mitigation of HSE risks to SFAIRP).³³

• Risk Monitoring and Review Risk

Monitor, review, and update (review progress and developments, check actions effectiveness, identify new risks)

• Risk Communication and Reporting

Review, and report the risk profile biannually to the HSE Executive Committee. 

There were 5 risk assessment processes listed for identifying and assessing risks. This enabled Pacific National to undertake a level of risk assessment commensurate to the context, type, and scale of a particular risk. These processes were:

• Bow Tie Risk Assessment – this provides for a formal, more rigorous level of risk identification by identifying causal pathways and controls for specific risk events; this process underpins the Pacific National approach to Critical Risk Management.

• Formal Risk Assessment – this provides for a formal, more rigorous level of risk identification and treatment.

• Safe Work Method Statement (SWMS) – addresses high risk work activity risk in a logical sequence, identifying hazards and describing risk control measures.

• Take 3 – this provides for an individual level task related risk assessment.

• Hazard Reporting – outlines the process for hazard reporting and resolution.

Guidance in the procedure pertaining to the ‘Formal Risk Assessment’ stated that the main technique for this type of assessment was a workplace risk review and control (WRRC). The procedure also stated that ‘risk reduction action plans’ were to be developed when existing risk controls were inadequate or inadequately implemented, or if additional risk controls were identified that required implementation. These plans were to be documented in the WRRC and raised in Pacific National’s action tracking database.

The procedure required ‘Each Operation’ to maintain a risk register in a risk management software package provided by the Camms Group.³⁴ The risks recorded in the risk register were to be reviewed and validated when a WRRC was conducted. The operational risk register (Camms) was to be monitored, reviewed, and updated when a new scenario or hazard was identified. 

Control owners³⁵ were tasked with reviewing the effectiveness of the risk controls they were allocated. The effectiveness review was to be provided to the risk owner³⁶ to inform their review. Reviews were to be conducted every 6 or 12 months depending on the criticality of the risk.

Pacific National’s risk management procedure also outlined the training and competency requirements for conducting activities contained in the procedure. The ‘Pre-requisite competency’ for conducting the ‘Formal Risk Assessment’ activity was ‘completion of the Pacific National risk management module’ for which the manager was considered ‘Responsible’.

Risk management in the Asset and Infrastructure Services group

Within Pacific National, the management of rolling stock and related procedures, including the assessment and incorporation of new practices, was the responsibility of the AIS group. This group routinely performed formal risk assessments for issues associated with rolling stock infrastructure. The AIS group used a Pacific National template, first created in 2012, to document its formal risk assessments. The guidance text in the template included the following information:

• Team Members where possible are to include one person who is trained in conducting risk assessments to facilitate the process and at least one person involved in the process being assessed.

• The risk assessment must be registered on the relevant risk assessment register and a summary of the assessment included in the operational or site risk register.

The template allowed the group to: 

• establish the context and define the scope of the risk assessment 
• identify a list of hazards and assess the risk of those hazards by assigning a likelihood and consequence level before and after controls were introduced 
• select controls and assign a responsible person with ensuring the implementation of each control. 

There was also a ‘Risk Control Review’ section with ‘Responsible Person’ and ‘Due Date’ fields. Instructions for this section stated the ‘responsible manager for the risk assessment must arrange for a review of the risk assessment to ensure all additional controls have been fully implemented and are effective in controlling risk’. There was no field for detailing how the effectiveness of a particular control was to be evaluated.

Outcomes of the AIS group risk assessment activities included the implementation of risk control measures. The implementation of risk controls was on most occasions tracked through Pacific National’s action tracking database. For example, an update to a procedure document would be created as an action in the database and listed as complete when the updated version of the document was issued. The AIS group did not maintain a risk register, nor did the risk management activities conducted by the group appear to interface with the operational risk register. When asked about the group’s use of a risk register, Pacific National stated that the requirement was not consistently communicated across all areas of the operation and, while some different business units did compile their own registers, the AIS group did not. 

While the members of the AIS group held diverse engineering and rail-related qualifications, Pacific National was able to provide a record for only one member of the group as having completed a Pacific National specific risk management qualification. This qualification was completed in 2014 and, while the worker was involved in developing revision A of the formal risk assessment undertaken in response to the Mingela axle failure, they were not the ‘Responsible Manager’ or the ‘Sign off Facilitator’. When asked about risk management training programs available to, or likely to be completed, by members of the AIS group, Pacific National stated that risk assessment training at that time was peer-to-peer and read-and-interpret training.

Regulator’s risk management expectations

It was a legislative requirement of accreditation that a rail transport operator have a systematic approach to managing safety risks, known as a safety management system. The Office of the National Rail Safety Regulator (ONRSR) provided a guideline for safety management systems, which needed to include risk management systems and procedures (ONRSR, 2019). ONRSR’s minimum expectation relating to risk management systems and procedures were: 

• Scope, context and criteria for the management of safety risks arising from the RTO’s [rail transport operator’s] railway operations; 

• Comprehensive and systematic assessment of safety risks arising from the RTO’s railway operations, including risk identification, analysis and evaluation; 

• Tracking of any risk treatment activities required through to implementation and closure; 

• Ongoing monitoring and review of the identified risks and the adequacy of the control measures used to manage them. 

• Recording and reporting of risk management activities and their outcomes to the duty holders and governing bodies within the RTO; and 

• Communication and consultation arrangements to ensure relevant stakeholders and subject matter experts are involved at all stages of the risk management process. 

ONRSR went on to specify, under ‘Recording and Reporting’ that an operator will have systems and procedures to require:

• A record of the following information in a risk register or supporting documentation:

  - the risks identified; 

  - the individual within the RTO organisation that owns each risk; 

  - the potential causes of each risk; 

  - the potential consequences of each risk;

  - the control measures considered to eliminate or minimise the risk;

  - reasons for selecting certain control measures and rejecting others;

  - the relationship between control measures and their associated risk(s); 

  - references to other locations in the SMS [safety management system] where further details on control measures can be found; 

  - the individuals within the RTO organisation or the interfacing party with responsibility for implementing control measures; 

  - the magnitude and severity of the consequences should the risk be realised; 

  - the likelihood of the consequences materialising; 

  - the resultant level of risk; 

  - any uncertainties or assumptions made in the analysis, particularly in relation to assigning likelihood, severity and risk levels; 

  - the date each risk was last assessed or reviewed; and 

  - the status of each risk, including a demonstration of whether risks are reduced SFAIRP [so far as is reasonably practicable].

• The risk register to be treated as a live document and used as a reference point for managing safety; 

• Risk assessments conducted at a local level to link into the organisation-wide risk assessment processes;… 

Under ‘Monitoring and review’ ONRSR specified that an operator will have systems and procedures to:

…Describe how risks are to be reviewed, which as a minimum should involve: 

  - a review of the accuracy of the risk assessment, including the effectiveness of existing control measures;… 

ONRSR published a safety message reiterating operator risk register requirements under Rail Safety National Law (ONRSR, 2025, August 26). In it ONRSR highlighted ‘missing information, reasons and justifications’ as a ‘poor practice’ it has observed. ONRSR provided the specific example:

vague or unclear reasoning such as a 'likelihood' score of '4' becomes '2' with implementation of control 'XYZ' but no explanation how the control will reduce the risk

An example of ‘good practice’ included when it was ‘clear how controls listed will be effective in mitigating the risks’. 

Similar occurrences

ATSB investigation RO-2017-013 related to the derailment of bulk acid train 9T90, near Kimburra, Queensland, on 28 September 2017. The derailment, located on the Mount Isa line, resulted from an axle failure. A fatigue crack of a detectable size was present in the axle at the time of the previous routine axle inspection, but was not detected and failed in-service. On 15 August 2018, a second derailment resulting from an axle failure associated with the same rolling stock operator and line, was included in the scope of the investigation. During the investigation, the ATSB conducted a review of past axle failures experienced by the operator, identifying 3 additional instances. All failed axles were of the same design fitted to bulk wagons. 

Following each failure, the operator incrementally implemented safety actions. The operator performed fleet-wide magnetic particle inspections of the axles with this design and where an axle with cracks was detected, it was removed from service. The ATSB’s investigation identified that the axle design was susceptible to fatigue cracking due to relatively minor damage that was not reliably detected prior to failure. Relatively minor damage in this report was associated with a damage depth of 0.2 mm. 

Ultimately, the operator undertook a program to replace all axles conforming to the susceptible design with a new axle design, which had a 165 mm diameter centre section. During the replacement period, the susceptible axles were to undergo magnetic particle inspection after no more than 65,000 km travelled.

The operator commissioned a finite element analysis of the susceptible design, which computed a critical crack depth of 110 mm (over half the axle diameter) when under self‑weight bearing of a full 20-tonne tanker (bulk wagon) and centrifugal loading. The critical crack depth was consistent with the depth of the failed axles. 

Safety analysis

Introduction

On 29 January 2023, at about 1910 local time, an axle on Pacific National freight train 82P7 wagon RNCY137-T failed resulting in a derailment and separation of 8 wagons over a level crossing. Train 9F02, travelling in the opposite direction, collided with a container from the front portion of train 82P7 that was fouling the up line.

The investigation found there were no technical faults with the trackside infrastructure and the condition of the bogie and wagon did not contribute to the axle failure. Similarly, there was no evidence that train speed, handling, or operational performance contributed to the derailment. 

This analysis will examine the reason for the axle fracture, the greater risk presented by the NB axle design and the effectiveness of axle barrel fatigue risk controls associated with the NB design. It will also discuss the risk management processes used by those responsible for rolling stock, successive blending repairs of all axles, and the recent inspections of the subject axle. 

Failure of axle serial number 7L7NB4726

The appearance of fracture surfaces on the failed axle was consistent with fatigue crack growth followed by overstress failure. The nature of the fatigue growth, starting from the circumference and progressing through over half of the axle cross-section, was consistent with rotational bending subject to low nominal stresses. This would be the anticipated loading scenario for a rail axle, a rotating component, subject to many cycles at low nominal stress. 

Analysis of the axle material microstructure, hardness, and elemental composition found that there was no evidence to indicate an issue with the material. Consequently, an issue with the material was excluded as a reason for the axle failure. 

If the fatigue life of the failed axle was finite, a fatigue crack may have initiated in the absence of a stress concentrating feature. An engineering evaluation of the NB axle design, which referenced BS EN 13103‑1:2017, found that the stress calculated for each section of the axle was below the maximum permissible stress indicating infinite fatigue life. While calculations were validated, review of this evaluation by the ATSB found that the methodology used to determine maximum permissible stress did not use material test data as described in the standard. Furthermore, analysis of an axle design from another operator was found not to meet BS EN 13103:2009 even though the same formulae for stress calculations would have been used and the design dimensions were almost identical. This analysis was not available to the investigation to understand why 2 very similar designs achieved different outcomes. Accordingly, there was insufficient evidence to conclude that the NB axle design likely had finite fatigue life in the undamaged condition at the operational loads. 

The historic loading of the fractured axle was explored as a reason why a crack may have initiated on this axle, or as a reason why a crack grew to a critical size in service. The axle had triggered weighbridge wayside alarms on 4 occasions in the year prior to the accident. Depending on the distribution of goods in the wagon, it was possible that the wagon load will not be evenly distributed over the 8 axles of the triple-pack, potentially resulting in axle load above alarm levels. Nonetheless, Pacific National’s records indicated that the wagon, to which the axle was fitted, was not loaded above the allowed wagon load limit in the year leading up to the accident. Therefore, it was likely the axle was not consistently operated in excess of its 20-tonne design load. Furthermore, other axles triggered load alarms within this period, and they did not fail. Pacific National stated that ‘isolated events of overload’ should not damage the axle as it had a safety margin of 1.17 when assessed in accordance with BS EN 13103‑1:2017. As previously discussed, there was some uncertainty associated with this assessment. Periods of higher loads could be associated with periods of faster crack growth, but it was not possible to correlate these 4 alarms, or any other known events, with features on the fracture surface. Overall, there was insufficient evidence to indicate that overloading of the axle contributed to the failure.

The circumference of both halves of the fracture surface was substantially damaged, presumably, once the axle failed but remained attached to the bogie by the bearings and was dragged along between the rails. Consequently, the location on the fracture surface where the fatigue crack appeared to originate was destroyed and an initiating feature could not be identified and characterised. Nevertheless, historical evidence of axle fractures has shown that:

• cracks have been detected on 154 mm dimeter axle barrels and were observed to originate from surface marks acting as crack initiating features
• there was an example (RO-2017-013) of a failure in a similar axle design where the initiating feature, a 0.2 mm deep instance of surface damage, was able to be identified and characterised
• a reduction in fatigue strength resulting from surface damage is acknowledged in the literature
• Pacific National attributed cracking in NB axle barrels to ballast strike damage. 

Therefore, it was very likely that the fatigue crack initiated from damage to the barrel surface.

NB axle design and failure risk

The NB axle was designed in 2004 as a reduced diameter (154 mm) version of the 7L7N axle (165 mm barrel diameter). This appeared to be a narrow-gauge version of the standard Association of American Railroads (AAR) ‘L’ class axle. The standard BS EN 13103:2001, current at that time, did not consider wheelsets for reduced gauge track (metric or close to a metre). Nevertheless, as discussed above, there was insufficient evidence to conclude that the NB axle design had finite fatigue life in the undamaged condition at the operational loads. 

Up until the accident, after around 20 years of an expected 30-year service life, there were 2 axles condemned for being cracked, one of which was positively identified as an NB axle, the other was either NB or 7L7NB. There was insufficient information to establish whether these 2 axles were cracked in the region of the axle barrel. Pacific National had only experienced one previous in-service axle failure resulting from fatigue (Mingela) and this was an NB axle. When the other operator’s data was included, there had been a total of 6 in-service failures of 154 mm barrel-diameter axles resulting from fatigue, prior to this axle failure. Notably, these were axles fitted to bulk wagons. The conflicting design assessments and the limited data relating to fatigue cracks in NB axles meant that the ATSB was unable to establish whether or not the NB axle design met the requirements of the BS13103:2009/BS EN 13103-1 standard and would be expected to meet a 30-year expected fatigue-free life.

While it was possible that NB axle design met the standard, Pacific National’s investigation into the Mingela derailment found that the NB axle design was likely inadequate for long term operation at 20-tonne axle load (bulk). They believed that the NB design was susceptible to fatigue cracking in the presence of very minor damage. Accordingly, NB axles were removed from bulk wagons. In contrast, the 7L7N design was allowed to continue in service on bulk wagons, indicating that the 7L7N design was deemed suitable for this application. 

Similarly, when investigating the other operator, the ATSB concluded that the operator’s 154 mm barrel diameter axle design was susceptible to fatigue cracking due to relatively minor damage that could not be reliably detected prior to failure. This operator elected to replace these axles with a larger diameter axle (165 mm diameter), indicating the larger diameter axle design was less susceptible to failure resulting from barrel damage‑initiated fatigue cracking.

Comparison of axle stresses in the NB design and the 7L7N design using the BS13103:2009/BS EN 13103-1 standard confirmed that the maximum stress in the critical location was greater for the NB design, as compared with the 7L7N design. Ultimately, the NB axle design presented a greater risk of failure resulting from a barrel‑damage-initiated fatigue crack, as compared with the 7L7N axle design. 

Effectiveness of NB axle risk controls

Following the axle failure at Mingela, Pacific National identified and assessed the risk posed by the NB axle design. The risk rating for an axle failure was found to be high, necessitating a formal risk assessment. To manage the risk, Pacific National implemented or modified risk controls associated with NB axle operating load; inspection for, and removal of, crack initiators; and inspection for axles with growing cracks. The level of detail provided when documenting the proposed risk controls in the risk assessment template was not always sufficient to determine how each control was expected to reduce risk. Means to determine or demonstrate the effectiveness of the risk control was also undocumented. Vague or unclear reasoning was raised by the Office of the National Rail Safety Regulator (ONRSR) as a poor practice it has observed in the rail industry more generally. The ATSB has attempted, were possible, to assess the effectiveness of the risk controls.

Other elements of risk management, such as record keeping, the introduction of controls that did not appear to relate to fatigue cracking, and determination of risk levels, contributed to the ATSB’s overall assessment as to the effectiveness of the risk controls. 

Operating load

Pacific National restricted the NB axles to use on lower-duty wagons. The loading on lower-duty wagons was believed to be less severe than the loading associated with bulk wagons, although there was no comparative assessment to understand how much the severity was reduced. The previous in-service axle failures of 154 mm diameter axles attributed to barrel-damage initiated fatigue occurred in axles fitted to bulk wagons, suggesting that these loading conditions were conditional to the formation of fatigue cracks. This accident, however, involved failure of an NB axle fitted to a lower-duty wagon, indicating that failure could occur for the loading conditions associated with this wagon type. Ultimately, the ATSB was unable to comment to what extent limiting the NB axle to lower-duty wagons reduced risk.

Detection and removal of crack initiators 

Pacific National intended its scheduled ‘P’, ‘A’, and ‘B’ wagon inspections to be an opportunity to identify barrel damage before an NB axle had travelled far enough for a fatigue crack to initiate. Pacific National required, and expected, through its sequence of inspections, taking place every 250,000 km, that visual inspection would identify all damage, every damaged axle would be sent to an overhaul facility, and the damage would be blended. This was notionally possible given the resolving capacity of the human eye, about 0.1 mm (Petersen and McLaughlin, 2021), was on the same order of magnitude as the size of typical barrel damage, 0.5 mm. Furthermore, the wagons were to be lifted from the bogies to allow for circumferential access to ensure the whole axle barrel was inspected. 

It was expected that the code ‘Axle damaged between wheels’ would be applied when an axle was identified with barrel damage at a ‘P’ or ‘A’ inspection and sent for overhaul. The records revealed that, in the 10 years prior to the accident, there were only 5 occasions where axles were sent to an overhaul facility with this code. The very low numbers of axles identified with barrel damage at ‘P’ and ‘A’ inspections did not appear consistent with the statement made by an overhauler that around 97% of axles that entered an overhaul facility required blending. This statement indicated that most axles sustained damage requiring blending between overhaul visits occurring, on average, every 500,000 km. Furthermore, an overhauler, an ATSB investigator, and another operator indicated that it would be very difficult to identify the typical presentation of barrel damage without paint removal and appropriate lighting, which may account for the low number identified during scheduled inspections. As such, Pacific National’s expectation that all barrel damage was identified every 250,000 km was not supported by the evidence. 

In contrast to ‘P’ and ‘A’ inspections, visual inspection of an axle at an overhaul facility would take place under specified lighting conditions once paint was removed from the barrel. While an overhauler stated that all marks could be identified at a facility, they did not have in place measures to verify the consistency of damage identification. Measures to ensure operator consistency, such as using test pieces, are often associated with non‑destructive evaluation techniques, such as magnetic particle inspection. Despite this, given that around 97% of axles that entered an overhaul facility required blending, it was likely that all damage to NB axles had the potential to be identified, and depth measured, on average every 500,000 km, and at most every 1,500,000 km. Ultimately, the evidence indicated that crack initiators (damage) were likely to remain present on NB axles longer than Pacific National assumed when assessing the level of risk (500,000 km to 1,500,000 km, as compared with 250,000 km). 

While Pacific National was not able to provide the rationale for selecting the value of 1 mm (in early 2020), and later 0.5 mm (in early 2021), as the acceptable blend depth for NB axles, these limits were more conservative than the AAR standard, about 3 mm. A potential foreseeable effect of reducing the depth of damage allowed to be blended was an increase in the number of condemned axles due to excessively deep barrel damage. Such an effect was not observed in the condemnation data collected over the past 10 years. The data showed that, while there were more narrow-gauge axles (NB and 7N7N) condemned for barrel damage in 2020, the increase, from 4 in 2019 to 5 in 2020, did not appear substantial. Additionally, only one of the 5 axles could be positively identified as an NB axle. Furthermore, in 2021, the year where the lowest acceptable blending depth was implemented for NB axles, no axles were condemned. Instead, the data showed that axles, whether of the NB or 7L7N type, were very seldom condemned for unacceptably deep barrel damage, only 11 in 10 years. As a result, the impact of these changes to the risk of fatigue cracking in NB barrels could not be quantified. 

During the investigation, the ATSB identified that Pacific National and overhaulers did not have a means to ensure compliance with the limitation on the number of blends and blended area specified in the AAR Manual of Standards and Recommended Practices Wheels and Axles. This was a requirement of Pacific National’s procedure WMM 09-03 Axles, published 2009, and was still a requirement at the time of the accident. Overhaulers had implemented the standard as though the limits were applicable for each visit to an overhaul facility and not over the life of the axle. 

Blended or machined NB axles presented a greater risk of fatigue cracking than unblended axles as their cross-sections had been reduced. As the risk controls for NB axles changed, this introduced the potential for NB axles to be in service that met the controls previously acceptable, but which were no longer considered an acceptable risk. For example, there was the potential that NB axles were in service that had blends between 0.5 mm and 3 mm deep, as previously allowed. Similarly, it was possible that machined NB axles were in-service after machining of NB axles was prohibited. As records of blending repair and axle machining did not accompany the axle between overhaul visits it was not possible to identify and remove the axles that would no longer represent an acceptable risk. There was no evidence that Pacific National considered the previous blending allowance for NB axles or considered removing NB axles that had already been machined, as these risk controls were not documented or assessed as part of its formal risk assessment activity. 

At the time of the subject axle failure, there were different depths of allowed blend applicable to NB and 7L7N axles. The 3 mm depth, applicable to the 7L7N axles was contained on both the ‘A’ and ‘B’ inspection checklist, while the 0.5 mm depth applicable to NB axles was not listed. Although there was no evidence of examples where NB axles mistakenly had damage greater than 0.5 mm deep blended, it was noted that, where different inspection values apply to different items, it is advantageous to list both conditions.

Detection and removal of growing cracks

Pacific National used magnetic particle inspection to manage the risk that a crack had initiated and was growing through an NB axle potentially leading to failure in service. In its risk assessment template, Pacific National associated its magnetic particle inspection interval with a ‘crack life’, which included both crack initiation (654,000 km) and crack growth (397,000 km). This differed from an accepted approach used to inspect for fatigue cracks, where an inspection interval was, at most, half the propagation life, or period of crack growth (once the crack is of detectable size). The crack initiation time is not included as, generally, the crack will not be detectable for that time. For the crack growth interval selected by Pacific National, 397,000 km, a more appropriate magnetic particle inspection interval would be less than 200,000 km. This can be contrasted with the likely interval between visits to an overhaul facility where magnetic particle inspection would occur, which was on average every 500,000 km and at most every 1,500,000 km. 

Inspection records and task completion

The ATSB identified that the failed axle associated with this accident was not subject to magnetic particle inspection as part of the non-ongoing inspection program, despite it being part of the target population and the task being recorded as completed. In addition, Pacific National was not able to provide completed pro forma sheets associated with the non-ongoing visual inspection program but was able to provide a record of overall task completion in its rolling stock database. The ATSB did not audit the history of all NB axles to determine if any other axles missed inspection as part of ongoing and non‑ongoing programs and, as such, task completion more broadly was not verified.

Wayside monitoring risk control

The ATSB was unable to determine the effectiveness of the wayside monitoring risk control implemented in response to the risk posed by barrel-damage‑related fatigue cracking in NB axles. Wheel impact alarms did not appear to be a means of identifying developing issues with axle barrels. Instead, they were a means of identifying wheel defects. While this risk control could serve to decrease the average time between visits to an overhaul facility, it was not documented in detail and it was not clear how the introduction of this control addressed the axle barrel fatigue risk. 

Assessment of the level of risk

For risk controls to be effective they must reduce either the likelihood or the consequence of a risk to an acceptable level. The risk most relevant to this investigation, identified by Pacific National, was an axle failure scenario, which was assessed to have a consequence level of ‘Major’. This was the consequence level associated with fatalities due to third party error. A Pacific National axle failure would not usually be considered a third party error and the consequence level ‘Critical’ more closely reflected the scenario where a Pacific National axle failure led to a fatality. When this consequence level was applied to the risk assessment for an NB axle failure, with the implementation of the additional controls, the resulting risk level was high, as compared with medium, the rating that was recorded in the template. 

Pacific National had compared the risk level associated with an NB axle failure in service with additional controls (recorded as medium), with a scenario where all NB axles were replaced. In the replacement scenario, the axle failure risk was reduced to low, but the consequential business risk generated was medium. Pacific National had accepted what appeared to be the medium risk of axle failure associated with the continuation of NB axles in service, albeit with the implementation of additional risk controls, instead of the medium risk to business associated with axle replacement. When the amended consequence was considered, Pacific National was found to have accepted a high risk of axle failure instead of the medium business risk. Accordingly, Pacific National was operating at a greater risk level than it had recognised. 

Summary

In the process of evaluating the risk controls associated with NB axle failure, the ATSB identified that:

• axle barrel damage was not able to be identified as frequently as Pacific National had expected
• there was no means to prevent exceeding the cumulative blend limits 
• the allowable blend depth associated with NB axles was not listed on the inspection checklist
• the magnetic particle inspection interval selected by Pacific National included crack initiation interval, meaning it was less conservative than an accepted approach
• an inspection that was listed as having been completed was found not to have been completed for the accident axle
• records required by Pacific National were not available
• the selected consequence level meant that, following implementation of the additional risk controls, Pacific National was operating with greater risk than it had intended to accept. 

For these reasons, the risk controls implemented by Pacific National did not represent the best opportunity to ensure the removal of axle barrel damage capable of initiating a crack or to ensure axles with growing cracks were removed from service prior to failure. Nonetheless, as it was not possible to determine if the damage that precipitated the fatigue crack, or that a developing fatigue crack was present at the most recent overhaul (see Inspection of accident axle), the issues with the risk controls implemented by Pacific National were not found to contribute to the accident.

Risk management within the Asset and Infrastructure Services group 

Within Pacific National, the management of rolling stock and related procedures, including the assessment and incorporation of new practices, was the responsibility of the Asset and Infrastructure Services group (AIS group). This group routinely performed formal risk assessments for issues associated with rolling stock infrastructure. Pacific National procedures at the time of the Marmor accident specified the use of the workplace risk control technique (WRRC) under certain conditions and required associated action plans to be populated in Pacific National’s action tracking database. Instead, the AIS group’s local practise, still current at the time of the Marmor failure, was to use a 2012 risk assessment template to conduct its formal risk assessments. Though it was AIS group practise to create action items to implement controls in the tracking database and record when the action items were complete. 

There was broad alignment between the risk management steps outlined in the Pacific National risk management procedures and ONRSR’s minimum expectation for risk management systems and procedures. The template used by the AIS group had the capability to perform many of the expected risk management processes. There were fields in the template where users could establish context; perform a risk assessment, including assess likelihood and consequence, determine cause, and identify existing preventative and mitigating controls; and document risk controls. While the template contained ‘Risk Control Review’ fields, these were limited to a field for listing a responsible person and a due date. As such, the template did not provide a designated space for detailing how a control was to be reviewed or shown to be effective at controlling risk. For this reason, the template did not encompass all 5 risk management steps outlined in the Pacific National risk management procedures.

In the most recent version of the Mingela risk assessment the ‘Risk Control Review’ fields were unpopulated. Additionally, the AIS group had not created trackable action items to review and monitor the ongoing effectiveness of the controls it had implemented. Blank fields was an example highlighted by ONRSR in its 2025 safety message relating to risk registers as a poor practice (ONRSR, 2025, August 26). As there were no further updates made to the template between 19 October 2020, version D, and when the document was accessed by the ATSB in 2023, it was unlikely that this vital element of the risk assessment process was going to be performed. The ATSB only examined the Mingela risk assessment and, as a result, it was unknown what proportion of the AIS group’s risk assessment contained completed ‘Risk Control Review’. Nevertheless, one of ONRSR’s minimum expectations relating to risk management was to describe how and when risks were to be reviewed, including the effectiveness of existing controls. As the template did not have a specific field to detail how a control was to be reviewed it was unclear how this expectation was satisfied by the AIS group.

The AIS group did not make use of a risk register, which was a requirement of the 2012 template, a requirement in Pacific National’s risk management procedures current at the time of the Marmor accident, and an expectation of ONRSR. This meant that, both internal and external to the AIS group, there was limited ongoing visibility of the status of risk assessment activities. For example, if the NB axle failure risk had been listed in a monitored risk register, there may have been a prompt to review the effectiveness of the risk controls. At which point, some of the limitations of the controls could have potentially been identified and rectified. Beyond the publication of the risk management procedure, Pacific National did not ensure that the AIS group created and maintained a risk register such that the risk management activities of the group were able to interface with the broader operational risk register. 

While the members of the AIS group held diverse engineering and rail-related qualifications, Pacific National was able to provide a record for only one member of the group having completed a Pacific National specific risk management training. This qualification was completed in 2014 and, while the worker participated in the risk assessment prompted by the Mingela axle failure, they were not the ‘Responsible Manager’ or the ‘Sign off Facilitator’. The remainder of the risk management training in the AIS group was informal read-and-interpret and peer-to-peer training.

Pacific National’s risk management procedure at the time of the Marmor accident stated that the ‘Pre-requisite competency’ for conducting the ‘Formal Risk Assessment’ activity was completion of the Pacific National risk management module for which the manager was considered ‘Responsible’. It was not clear if the training and competency requirements outlined in the 2022 procedures were satisfied by this single worker’s 2014 Pacific National risk assessment qualification. Furthermore, even if this did satisfy the requirements, given this worker was the only member of the AIS group with the qualification, they would have needed to be involved in every formal risk assessment undertaken by the group. Consequently, there was no assurance that those involved in risk management processes had the appropriate skills and knowledge for assessing, prioritising, and mitigating identified risks in accordance with Pacific National procedures.

In summary, Pacific National did not ensure its AIS group performed risk management activities in accordance with the procedure, which limited its ability to systematically manage risks that were the responsibility of the AIS group. 

Successive blending repairs 

Specific rules in the AAR Manual of Standards and Recommended Practices Wheels and Axles, adopted by Pacific National in its Wagon Maintenance Manual, limited the number (to 25) and area of blends on rail axle barrels over the life of the axle. These limitations applied to all Pacific National axles. Presumably, the limits established by the AAR were intended to reduce the risk of an excessively blended axle returning to service, resulting in premature failure. However, one overhauler confirmed they had interpreted the limit as applicable for each visit to an overhaul facility, instead of over the life of the axle. Likewise, 2 other overhaul facilities used by Pacific National did not have a means to demonstrate compliance with this requirement.  

As there were no records of cumulative blends, it was not possible to determine whether the accident axle had been blended in excess of the AAR limits. Accordingly, excessive blending was not found to contribute to the accident.

Nevertheless, it is important to highlight that the AAR limitations relating to blending repairs were not restricted to NB axles, narrow-gauge operations, or Pacific National. Any rolling stock operator which has adopted this rule will require a means to track the number of blends and blended area over successive visits to an overhaul facility to ensure that the limits are not exceeded. 

Inspection of accident axle

As part of its non-ongoing inspection programs, commenced in early 2020, Pacific National reported that the axle would have undergone visual inspection by October 2020 and magnetic particle inspection by August 2021. While there was no pro forma record of either inspection, the uncertainty regarding these inspections was not found to contribute to the accident, as the axle was subsequently inspected at an overhaul facility. This took place around 11 months before the axle failed, following a yard derailment event in October 2021, when the axle underwent visual inspection for barrel damage and magnetic particle inspection for cracks. 

Records showed the axle did not undergo blending repair at this time, indicating that no damage or marks were identified during the visual inspection. This was unexpected as, prior to the derailment, the axle had last entered an overhaul facility for a bearing turn in September 2018. Assuming the axle travelled similar distances per year in the lead‑up to the 2021 derailment, as was travelled in the known period between 12 January 2022 and 28 January 2023, it was estimated that the axle would have travelled around 600,000 km between the 2018 bearing turn and the derailment. This was more than the average kilometres travelled by an axle between visits to an overhaul facility and it was estimated that around 97% of axle barrels required blending at overhaul. This axle, despite the derailment, was recorded to be one of the few that exhibited no barrel damage.

The axle was found to be crack-free during the 2021 overhaul following the derailment. Though it was noted that, if damage capable of initiating a fatigue crack was sustained during a derailment event and the damage was not identified and removed, many loading cycles would be required for a fatigue crack to initiate and grow to a size detectable with magnetic particle inspection. Accordingly, the magnetic particle inspection of axle barrels following a derailment would be a means to detect cracks already growing through an axle and not cracks resulting from the derailment. 

Around 7 months before the axle failed, the wagon to which the axle was fitted was subject to a ‘P’ inspection. At this inspection it was a requirement that all damage to the axle barrel be identified. As discussed previously in this analysis, it was not demonstrated that the average mark could be identified at this level of inspection. Nevertheless, if marks were identified, the axle should have been removed from service. As the axle remained in service following this inspection, the conclusion was that no damage was identified on the axle barrel, though damage may have been present.

As the origin of the fatigue crack was destroyed during the accident, the ATSB could not determine when the damage that likely initiated the crack was sustained and if this was detectable at the last overhaul.

Findings

From the evidence available, the following findings are made with respect to the Derailment of freight train 82P7 and subsequent collision with coal train 9F02, 3 km east of Marmor, Queensland, on 29 January 2023. 

Contributing factors

• It was very likely that impact damage to the axle initiated a fatigue crack that propagated until failure and resulted in the derailment of train 82P7.
• The 154 mm barrel diameter NB axle presented a greater risk of failing as a result of a damage-initiated fatigue crack, as compared with the 165 mm barrel diameter axles (7L7N).

Other factors that increased risk

• The risk controls used by Pacific National to address the greater risk of failure posed by 154 mm barrel diameter (NB) axles did not provide the best opportunity to ensure the removal of axle barrel damage capable of initiating a crack or to ensure axles with growing cracks were removed from service prior to failure. (Safety issue) 
• Pacific National did not ensure its Asset and Infrastructure Services group performed risk management activities in accordance with the documented procedure, specifically regarding the use of risk registers and training. This limited its ability to systematically manage risks that fell within the scope of the Asset and Infrastructure Services group. (Safety Issue)
• Association of American Railroads standard S-659 allowed blending repair of surface defects on axle barrels, with limitations on the size and number of repairs. In some cases, these limitations had been incorrectly interpreted as applicable for each visit to an overhaul facility, rather than over the life of the axle. Cumulative repairs over multiple overhauls were also not being tracked.

Other findings

• It was not possible to determine if the damage that precipitated the fatigue crack, or the developing fatigue crack, was present at the most recent wheelset overhaul.

Safety issues and actions

The risk controls addressing the greater risk of failure posed by NB axles

Safety issue number: RO-2023-001-SI-01

Safety issue description: The risk controls used by Pacific National to address the greater risk of failure posed by 154 mm barrel diameter (NB) axles did not provide the best opportunity to ensure the removal of axle barrel damage capable of initiating a crack or to ensure axles with growing cracks were removed from service prior to failure.

Asset and Infrastructure Services group risk management activities were not consistent with Pacific National policy

Safety issue number: RO-2023-001-SI-02

Safety issue description: Pacific National did not ensure its Asset and Infrastructure Services group performed risk management activities in accordance with the documented procedure, specifically regarding the use of risk registers and training. This limited its ability to systematically manage risks that fell within the scope of the Asset and Infrastructure Services group.

Safety action not associated with an identified safety issue

Additional safety action by Pacific National

Pacific National is implementing an enhancement to the rolling stock database (Maximo) wheelset completion sheets. The enhancement includes a new field on the completion sheet that records the cumulative number of axle grind repairs (blends) completed on the axle. This will enable Pacific National and overhaulers to ensure no more than 25 grind repairs (blends) are completed on the axle. The enhancement was implemented on 29 January 2025.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Association of American Railroads
• Aurizon Operations Ltd 
• Aurizon Network Pty Ltd 
• the driver of train 82P7
• the lead driver of train 9F02
• Institute of Railway Technology, Monash University
• Office of Transport Safety Investigations (NSW)
• Office of the National Rail Safety Regulator
• Pacific National Pty Ltd
• Queensland Rail
• the recorded data from the locomotives, including video footage
• the rail wheelset overhaulers
• the non-destructive inspection testing provider
• the engineering services provider.

References

Association of American Railroads. (2016). AAR Manual of Standards and Recommended Practices Wheels and Axles (M - 101). 

Association of American Railroads. (2019). AAR Manual of Standards and Recommended Practices Wheels and Axles (G-II [S-659]). 

Beretta, S., Carboni, M., Cantini, S. and Ghidini, A. (2004). Application of fatigue crack growth algorithms to railway axles and comparison of two steel grades [Special issues paper]. Proceedings of the Institution of Mechanical Engineers Part F Journal of Rail and Rapid Transit, 317-326. https://doi.org/10.1243/0954409043125888

Bracciali, A. (2016). Railway Wheelsets: History, Research and Developments. International Journal of Railway Technology, 5(1), 23-52. https://doi.org/10.4203/ijrt.5.1.2

British Standards Institute. (2009). Railway applications - Wheelsets and bogies - Non-powered axles - Design method (BS EN 13103:2009). 

Lunden, R., Vernersson, T. and Ekberg, A. (2009, June 22-25). Railway Axle Design - to be Based on Fatigue Initiation or Crack Propagation? [Paper presentation]. 9th International Heavy Haul Conference, Shanghai, People's Republic of China. 

Office of the National Rail Safety Regulator. (2019). ONRSR Guideline Safety Management Systems (Document ID: ONRSR-1963997744-218, Version 2.1). 

Office of the National Rail Safety Regulator. (2025, August 26). Safety Message – Risk registers. https://www.onrsr.com.au/safety-essentials/safety-messages/safety-message-risk-registers

Petersen, J., and McLaughlin, S. (2021). Laboratory Exercises in Microbiology. Queensborough Community College [Online text]. https://bio.libretexts.org/@go/page/15942     

Rail Industry Safety and Standards Board. (2020). Wheel defects Code of Practice. 

Rail Industry Safety and Standards Board. (2024). Glossary of Terms. Rail Industry Safety and Standards Board. Last Update 30 September 2024, Accessed 30 September 2024. https://www.rissb.com.au/glossary/

Zerbst, U., Mädler, K. and Hintze, H. (2005). Fracture mechanics in railway applications––an overview. Engineering Fracture Mechanics, 72(2), Pages 163-194. https://doi.org/https://doi.org/10.1016/j.engfracmech.2003.11.010.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the train crews
• Office of the National Rail Safety Regulator
• Pacific National Ltd
• Aurizon Holdings Ltd 
• the rail wheelset overhaulers
• the engineering services provider.

Submissions were received from:

• Office of the National Rail Safety Regulator
• Aurizon Holdings Ltd
• a rail wheelset overhauler.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Risk matrix in the Asset and Infrastructure Services group template

Risk matrix

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. About ATSB reports ATSB investigation reports are organised with regard to international standards or instruments, as applicable, and with ATSB procedures and guidelines. Reports must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2026   Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

1. ^    The side of the rail opposite the gauge face (the inner side of the running rail head).
2. ^    Narrow gauge is nominally 1,067 mm.
3. ^    A conventional wheelset is the combination of a rotating axle; 2 wheels, fitted to the axle with an interference fit on ‘wheel seats’ machined on the axle; and 2 bearings, mounted on ‘bearing journals’ machined on the axle (Bracciali, 2016). 
4. ^    Axle classes, such as ‘K’ and ‘L’ are determined by the finished diameter of the bearing journal.
5. ^    The distinct 7L7NB designation for ‘reduced’ axles was introduced in 2020, until this time all narrow-gauge ‘L’ class axles were designated 7L7N.
6. ^    Margin of safety: the ratio between maximum permissible stress and axle stress.
7. ^    Universal traffic control (UTC): a system that assists network control officers to safely route and monitor the movement of trains.
8. ^    Track kilometre (track km) refers to the distance along a track from a known location. For example, the track km in this report represented kilometres from the start point at Rocklands, Queensland.
9. ^    Generally, the term cant or superelevation is used for intended height difference in the rails (that is, where the track is inclined in a curve), and the term ‘cross level’ is used for unintended height difference (that is, due to track irregularity) (RISSB, 2024).
10. ^   Left and right designation for the wheels on a wheelset were not based on direction of travel. Instead, left and right wheels were determined based on position relative to the braking end of the wagon.
11. ^   Progression marks are fracture surface features that indicate successive positions of an advancing crack front.
12. ^   Nominal stress, also known as engineering stress, is calculated by dividing the applied force by the original cross‑sectional area of a material before any deformation occurs. When indications of fatigue crack growth represent a large proportion of the fracture surface, the component loading would be consistent with low nominal stresses. Whereas, when indications of fatigue crack growth only represent a small fraction of the whole fracture surface, the component loading would be consistent with high nominal stresses.
13. ^   Magnetic particle inspection is a form of non-destructive test. Using this method, the application of a magnetic field to the area of inspection draws a ferromagnetic liquid into any cracks, making them more visible.
14. ^   A bearing turn is where the wheelset has a bearing replaced.
15. ^   A production sheet was a document that accompanied an axle through overhaul, where the condition of the axle was recorded.
16. ^   Rolling Stock Notices were internal Pacific National documents and were the main mechanism by which safety critical information was communicated to groups.
17. ^   Weighbridge wayside monitoring devices are designed to capture and record axle weight as vehicles pass.
18. ^   Finite element analysis is a mathematical computer modelling technique to simulate how a material or a design responds to defined parameters such as external forces.
19. ^   The term ‘machining’ in the Wagon Maintenance Manual meant re-profiling the entire surface of the axle. In contrast, blending was local abrasion of the axle surface to remove damage. 
20. ^   The Wagon Maintenance Manual was the document which specified the requirements for Pacific National wagons and had a specific section pertaining to axles.
21. ^   The 2001 version of BS EN 13103, current when the Aurizon and NB axles were designed, only included calculations applicable to standard-gauge wheelsets. In contrast, the 2009 version, BS EN 13103:2009, contained an appendix applicable to wheelsets for ‘reduced gauge track (metric or close to a metre)’, which more closely reflected narrow gauge. BS EN 13103:2009 was subsequently withdrawn and replaced with BS EN 13103-1:2017 Railway applications - Wheelsets and bogies Part 1: Design method for axles with external journals. 
22. ^   The axle design meant in this text was the ‘reduced’ axle-barrel-diameter axle design, which was later designated 7L7NB and is referred to as an NB axle in this report.
23. ^   Asciano was a previous formal company name for the entity Pacific National.
24. ^   The lower the risk rating number corresponded to greater risk. Therefore, while both scenarios represented medium risk in the template, medium (13) was lower risk than medium (12). 
25. ^   The critical crack length, which for a rail axle was the depth of the crack through the axle cross-section, indicated the transition from the stable crack growth regime to the unstable crack growth regime, which was typically followed by catastrophic fracture or failure.
26. ^   Non-destructive testing.
27. ^   AS indicated Australian Standard.
28. ^   Scrapped has been used interchangeably with the term condemned.
29. ^   1/8 inch was converted to 3.175 mm, and rounded down to 3 mm.
30. ^   At this time a mark of up to 3 mm depth was allowed to be blended on an NB axle.
31. ^   Wheel flats occur when wheels lock-up under braking and slide or skid along the rail while the train is in motion. The heat generated when skidding will affect the underlying material. If the temperature is high enough and is followed by rapid cooling, the material will transform into a hard, brittle metallurgical phase called martensite. Cracks will start to generate in and/or around the martensitic region when the wheel starts rolling again. This will eventually lead to further wheel damage such as spalling (RISSB, 2020).
32. ^   Spalling occurs when pieces of metal break out of the wheel surface in one or several places resulting from the fracture under loading of hard and brittle martensitic material (RISSB, 2020).
33. ^   SFAIRP meant ‘so far as is reasonably practicable’ and is formally defined in Rail Safety National Law.
34. ^   Camms Group was a provider of software tools to facilitate management of governance, risk, and compliance. Pacific National referred to its risk register that used the Camms Group software as ‘Camms’.
35. ^   The control owner was the person responsible for risk event controls recorded in the Camms risk register and assuring their effectiveness.
36. ^   The risk owner was the person allocated responsibility for the accuracy of a risk event recorded in the Camms risk register.

Safety summary

What happened

On 6 January 2021, loaded Pacific National freight train 3YN2 was operating between Broken Hill and Newcastle, New South Wales. Just before 0914, a contractor working near the rail line, noticed a wagon on train 3YN2 was dragging on the rail. This was reported to representatives from the rail infrastructure manager and the crew of 3YN2 were directed to stop their train. The train stopped between Euabalong West and Kiacatoo with a crack found through the underframe of the 32nd wagon. The air tank was resting on the rail and it was later found that three level crossings had been struck by the wagon. There was superficial damage at the level crossings and no reported injuries.

What the ATSB found

Train 3YN2 departed Broken Hill with an existing crack in the underframe of wagon NDHX14836G. This crack progressed during the journey with the underframe of the wagon striking three level crossings. The underframe of NDHX14836G likely fractured due to a fatigue crack at a weld on the lower edge of the sill. This defect was likely detectable for a period of time prior to the occurrence. The train had undergone the required maintenance inspections however these were not sufficient to identify the cracking at a location of known risk prior to the structural failure.

What has been done as a result

Following the occurrence Pacific National released a rolling stock safety notice detailing the failure and requiring an inspection of all affected wagons within the class wagon.

Pacific National advised the following actions have been planned to prevent recurrence:

• Develop a lifecycle asset management strategy for affected class of wagons (NDHX/ICX) with a butt weld.
• Complete a risk assessment to assess the limitations of NDHX wagons and requirements for ongoing use.
• Review the wagon maintenance manual associated with the inspection of the wagon underframe to include details for ICX class wagons.
• Review and adjust the current non-destructive strategy applied across Pacific National’s fleet of wagons.

Safety message

The incident highlights the importance of managing ageing assets to ensure continued safe operation through the lifecycle of the asset. Rolling stock operators should ensure that their maintenance and inspection regimes effectively monitor and detect conditions that might escalate and contribute to accidents.

The investigation

The occurrence

On 5 January 2021, two Pacific National (PN) train drivers (crew 1 and crew 2) were assigned to shunt and attach 17 wagons from within the CBH Resources - Rasp Mine at Broken Hill to the rear of freight train 3YN2. 

During the shunting movement, a roll-by inspection^[1] was performed by crew 1. Between 1905^[2]  and 2020, crew 1 completed a general examination (GX) of the 17 wagons. The inspection was completed without incident and a brake certificate was issued.

On 6 January 2021, train 3YN2 departed Broken Hill bound for Newcastle, New South Wales. The train consisted of three locomotives and 44 wagons with a total length of 977 m. The train departed Broken Hill at 0149 and a roll-by inspection was performed from both sides by crew 1 and crew 2 without incident.

Just before 0914, a contractor working near the rail line noticed a broken wagon on 3YN2 was dragging on the rail. This was reported to a track worker located at Parkes, who passed the message on to the network controller at Junee. At 0915, the network controller contacted the crew of train 3YN2 and directed them to stop and inspect their train.

The crew stopped to inspect the train between Euabalong West and Kiacatoo. The crew identified that the wagon frame on the 32nd wagon (NDHX14836G) had failed and the air tank was resting on the rail near 583.900 km^[3] (Figure 1 and Figure 2). The wagon was loaded with two containers carrying zinc (Zn) concentrate at the time which remained secured to the wagon.

Inspection post incident identified superficial scrape marks on the rail and at three level crossings between 595.518 km and 583.900 km. There was no reported damage to the sleepers or rail fasteners from the failed wagon. There were no reported injuries.

Figure 1: Path of 3YN2

Source: Geoscience Australia, modified and annotated by OTSI

Figure 2: Rolling stock irregularity  

Wagon NDHX14836G shown with centre of the wagon sagging under the load of the 20 ft containers. Inset image shows the fracture in the underframe and an air tank resting on the rail. 

Source: Pacific National, modified and annotated by OTSI

Context

Wagon

Wagon NDHX14836G was designated as a sleeper carrying wagon with a tare mass of 20 t and a maximum capacity of 60 t. Previously the wagon was designated NQHX (container flat wagon)^[4] before it was converted to a sleeper carrying wagon in 2009. In 2010 this modification was reverted and the wagon returned to original use, however, this was not communicated effectively to the various rail infrastructure managers.  

The wagon was manufactured as an ICX class wagon with the centre sill forming the load bearing structure (Figure 3). This class of wagon was manufactured from approximately 1968 onwards and PN had a total of 136 ICX class wagons in operation at the time of the incident (Table 1).

Figure 3: ICX class wagon underframe and cracking locations

A side and top down view of the wagon and underframe structure. The centre sill runs the length of the wagon and supports the load.

Source: Pacific National, modified and annotated by OTSI

Table 1: ICX class

Historically, cracking had been detected on some ICX class wagons at butt welds along the centre sill lower flange at a change in material thickness (Figure 3). Repair procedures had been developed with doubler plates^[5] fitted if cracking was detected.^[6] The location of the previous cracking was along the centre sill but not at the location of the fracture on NDHX14836G.

Maintenance

Wagon NDHX14386G was under a unit train maintenance (UTM) regime requiring the wagon to be inspected every 56 days (maximum 7-day tolerance) in accordance with the Wagon Maintenance Manual (WMM 01-01 and WMM 01-18).

Additionally, the wagon required inspection at intervals of 150,000, 450,000 and 900,000 km. Both the 56 day on train inspection and kilometre-based inspection referred to the same work instruction for the inspection of the underframe (Underframes, Body Work and Load Supports WMM 04-02).

The most recent maintenance records are shown in Table 2. The wagon had operated for 51 days since the last 56 day on train inspection and was not overdue at the time of the occurrence.

Table 2: Maintenance history

Train examination

Prior to departure the 17 wagons underwent a GX as required by the Train Inspection Manual (TIM 01-03). The examination was limited to the major components of the wagon but included checking the wagon body for structural damage. The GX was performed by crew 1 who held the required qualifications and had three years’ experience. There were no defects noted with wagon NDHX14836G.

Crew 2 who assisted with the roll-by inspection, held the appropriate qualifications and had approximately eight years’ experience.

Loading

The containers were loaded on to the 17 wagons at CBH Resources - Rasp Mine. The train consist and records for container mass indicated all wagons were within the permitted loading limits (60 t).

Loading records indicated wagon NDHX14836G was loaded with two 20 ft concentrate containers with a total mass of 59.54 t. Post occurrence the mass of the containers were weighed at 59.9 t,^[7] closely matching the loading records.

Similar occurrences

ATSB investigation (RO-2018-009)

On 21 April 2018, Pacific National intermodal freight train 6MP4 derailed near Glenalta, South Australia. It was found that there was a pre-existing structural crack on platform 2 of wagon RRYY01X that had not been identified during multiple train examinations and maintenance inspections. A combination of the pre-existing structural crack, in-train forces (compression and tension) and tight curves on a descending grade likely resulted in the derailment. A contributing factor and safety issue of this occurrence was:

Pacific National’s inspection processes did not identify key structural points for inspection on RRYY class wagons, including the susceptibility to cracking in the junction between container loading outriggers, pull rod boxed opening, and the bottom centre sill sections. This reduced the likelihood of cracks being detected. (Safety issue)

This wagon was of a different design and class to NDHX14836G, although, both were operated and maintained by Pacific National. The same work instruction was also utilised for the inspection of the underframes of RRYY and NDHX (ICX) class wagons (WMM 04-02). This inspection procedure was revised as part of the safety action to address the safety issue.

OTSI investigation (04588)

On 5 December 2012, crew performing a roll-by inspection of a SQYD wagon near Gulgong, New South Wales, detected a wagon sagging in the middle and almost dragging on the ground. The wagon struck and damaged the road surface on several level crossings before it was detected.

It was found that the underframe of wagon SQYD0060G failed at a transverse butt weld at the mid-point of the centre sill. The failure was the result of poor weld design, welding practices/techniques and inadequate non-destructive testing at the time of the weld.

The SQYD wagon was similar in design to the ICX class wagon but the two wagon classes were at different ends of the asset lifecycle. The SQYD wagons entered service in the 12 months prior to the occurrence while ICX class wagons were approaching end of life.

Safety analysis

Train 3YN2 travelled approximately 530 km before wagon NDHX14836G struck a level crossing at 595.518 km.  The wagon struck two more level crossings before the train was stopped at 583.900 km. The actions of the contractor reporting the defect prevented the escalation of this occurrence.

The wagon was found with a fracture extending across the bottom flange (underside) and up both vertical plates (web) at the mid-point of the centre sill. The lower portion of the fracture face was damaged by ballast strikes, particularly on the trailing edge (in the direction of travel) of the fracture.

Assessment of the fracture indicated that the fracture was at the mid-point of the centre sill transverse weld. A backing bar^[8] was present along the length of the weld although there was no obvious weld penetration. Oxidation was visible on the lower section of both vertical plates and the fracture face was worn (Figure 4). The presence of both oxidation and wear is consistent with fatigue cracking however there were no beach marks^[9] observed in this region. The remaining fracture face was free from oxidation and likely progressed quickly.

Figure 4: Wagon NDHX14836G fracture

Photograph shows the left and right sides of the centre sill.

Source: Pacific National and OTSI, annotations by OTSI

Train 3YN2 underwent the required maintenance inspection prior to departing Broken Hill on 6 January 2021. These inspections did not detect the existing fracture on the frame of NDHX14836G.

The GX inspection scope was limited although the partial fracture would likely have been visible during close inspection of the centre sill vertical plates (web). The investigation was unable to determine when the frame was partially fractured, the oxidation indicates a fracture was almost certainly present during numerous GX and roll-by inspections.

Maintenance records (Table 2) showed two of the three most recent 56 day on inspections (UTM) were completed in exceedance of the 7-day tolerance. The UTM maintenance plan was associated with the rake^[10] of wagons rather than individual wagon. If a wagon was moved from the rake it could have operated in exceedance of the maintenance plan, increasing the likelihood of a rolling stock irregularity progressing without detection.

Wagon maintenance manual WMM-04-02 provided guidance for the inspection of various wagon classes although did not specifically detail inspections of NQHX (NDHX) wagons. The guidance for inspecting the underframe was general and did not highlight the location of cracking as found on NDHX14836G. Additionally, there was no requirement for more detailed inspections of ageing assets.

The design and construction of the ICX class wagons varied with some wagons having a centre sill transverse weld at the mid-point on the lower edge of the sill. Design drawing provided as part of the investigation did not indicate the presence of the weld or provide details for the original weld specification. A weld at this location of high stress increases the risk of fatigue cracking and presented different risk profiles within the same wagon class.

Non-destructive testing consisting of magnetic particle inspection (MPI) was only required if a crack was visually detected. Without more advanced non-destructive testing, a crack would need to propagate to be visibly detectable on the surface before it may be addressed.

Findings

From the evidence available, the following findings are made with respect to the rolling stock irregularity involving freight train 3YN2.  

Contributing factors

• 3YN2 departed Broken Hill with an undetected crack on wagon NHDX14836G; the crack progressed and the wagon sagged under the load striking three level crossings.
• The centre sill of wagon NDHX14386G likely fractured due to fatigue cracking initiating at a transverse weld on the lower edge of the sill.
• Pacific National's maintenance and inspection regime was not sufficient to identify cracking at a location of known risk before the structural failure of wagon NDHX14836G.

Safety actions

Pacific National

Maintenance and inspection

On the day of the occurrence, Pacific National issued a Rolling Stock Notice (RSN E 21-002) requiring an underframe crack inspection on NDHX, NQHX and NQIX wagons. The visual inspection required:

• checking if there was a butt weld at the midpoint of centre sill
• checking for cracks on the underside of the centre sill at the location of the butt weld
• checking the vertical web plate for the presence of crack propagation
• confirming the presence of doubler plates and any cracking associated with the doubler plates.

A total of 134 wagons were inspected as of 21 January 2021 with no cracks identified at the centre sill. The last wagon was inspected on 27 May 2021 with no cracks identified. Wagon NDHX14836G was to be scrapped, reducing Pacific National’s number of ICX class wagons to a total of 135.

Pacific National advised that they have completed a risk assessment to determine the NDHX wagon limitations and ongoing monitoring program requirements and plans for ongoing use. The following actions are also planned in relation to this occurrence:

• Broken Hill maintenance depot to conduct a risk assessment associated with the inspection of underframe of ICX class wagons during time based and kilometre based inspections.
• Review facilities available at Broken Hill to provide maintenance personnel easier access to complete underframe inspections.
• Develop a lifecycle management strategy for NDHX/ICX wagon classes with a butt welds.
• Develop an asset management strategy for the identification and implementation of the appropriate wagon lifecycle strategies.
• Review wagon maintenance manual WMM 04-02 to include details for ICX class wagons.
• Review and adjust the current non-destructive strategy applied across Pacific National’s fleet of wagons.

Compliance with maintenance standards

In relation to the management of trains under unit train maintenance (UTM) strategies, a Rolling Stock Notice (RSN E 21-003) was issued on 18 January 2021. The notice advised of the transition from unit train maintenance (UTM) at the rake level (group of wagons) to the individual wagon level. This notice was distributed to asset management and maintenance personnel and detailed actions to be taken. This change was to ensure that wagons receive the correct inspection when required. Pacific National's maintenance management system was updated to reflect these changes and wagons with overdue maintenance activities were identified and prioritised for inspection.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Australian Rail Track Corporation
• Pacific National.

References

Pacific National (2015), Train Inspection Manual, General Train Inspection Procedure, TIM 01-03_05, 14 December 2015

Pacific National (2017), Wagon Maintenance Manual, Maintenance of Freight Wagons, WMM 01-01_05, 26 June 2017

Pacific National (2020), Wagon Maintenance Manual, UTM/ Block/ OK Spare/PM Inspection, WMM 01-18_07, 21 October 2020

Pacific National (2020), Wagon Maintenance Manual, Underframes, Body work and Load Supports, WMM 04-02_05, 1 July 2020

Rail Industry Safety and Standards Board (2021), Glossary of Terms. Accessed at: www.rissb.com.au/glossary/

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Australian Rail Track Corporation
• Office of the National Rail Safety Regulator
• Pacific National
• Transport for NSW.

Submissions were received from:

• Australian Rail Track Corporation
• Office of the National Rail Safety Regulator
• Pacific National.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Roll-by inspections are a visual inspection of moving rail traffic to identify equipment, loading security or other defects or failure.
2. Times shown in 24-hour time as Australian Eastern Daylight Time (AEDT).
3. The kilometre distance is measured from Platform 1, Central Station, Sydney, New South Wales.
4. A flat wagon specially equipped with approved securing devices for the transport of freight containers. The wagon may have a full width deck, with or without apertures, or be of skeletal construction.
5. A doubler plate is a section of steel that is welded to a larger section as part of a repair or to provide additional strength.
6. Between 1985 and 2004 two work instructions were released for the inspection and repair of centre sill fractures.
7. Containers were checked using a scale on the forklift utilised for unloading and unloading the containers post occurrence.
8. A backing bar is a piece of material positioned at the root of a weld to support molten weld material allowing for complete weld penetration.
9. Beach mark refers to markings on the fracture surface associated with fatigue cracking. Typically, the progression of a fatigue crack will leave concentric rings on the fracture surface that radiate from the point of origin.
10.  Rake refers to vehicles, usually not formed as a train, moved as a unit during shunting and marshalling. In this case the 17 wagons formed the rake for the unit train maintenance purposes.

Overview of the investigation

The occurrence

On 2 October 2020, at about 1117 Eastern Standard Time,^[1] a SCT Logistics freight train 3PG1 travelling from Port Germain, South Australia to Parkes, New South Wales, began to lose brake pipe air, resulting in the application of the brakes. The train subsequently came to a stand with the leading locomotive at about 904 track km, 90 km west of Ivanhoe, New South Wales.

In response to the loss of air, the driver and driver assistant (both employed by Momentum Rail) commenced an inspection of the wagons. However, they stopped before arriving at the back of the train as the driver considered the issue to be a computer error. They returned to the lead locomotive and the driver tried to restore the brake pipe air by resetting the electronic air brake system, which was unsuccessful. The driver assistant re‑inspected the wagons, finding and closing an open brake pipe tap on the back of the last wagon (ABSY2792Y). They reported this to the driver, but for differing reasons, the end of train marker was not checked or the number of the last wagon was not confirmed.

The train’s brake pipe air was restored, allowing the brakes to release. The driver reported to train control that the loss was due to an animal strike and the trip resumed. On arrival at the Darnick yard limit board (YLB), the previously issued train order (Kaleentha loop to Trida YLB) was cancelled and a new train order from Darnick YLB to Ivanhoe YLB was issued. The crew of 3PG1 did not check whether their train was complete at this location and the train controller did not request confirmation, as required by the Australian Rail Track Corporation train order working procedure.

However, due to concerns with not having checked the end of train marker, the driver assistant conducted a roll-by inspection as the train proceeded into the Ivanhoe loop. At that time, they identified that the train consist was incomplete and the last 4 wagons were missing. The crew concluded that the missing wagons were likely left behind at the point where the train had lost brake pipe air pressure, about 2 hours prior. The section of track with the 4 parted wagons was left without protection with another train waiting at Darnick to enter the occupied section.

Investigation activities

During the investigation, the ATSB:

• interviewed the train crew and network controller
• conducted analysis of data from the locomotive’s event recorder
• reviewed recorded communications between train control and the crew
• reviewed the track access and labour agreements in place between the involved parties
• reviewed the experience, training and competencies held by the train crew
• conducted analysis of possible contributors to the parting, including a review of the wagon inspection results and maintenance history
• analysed the practical actions required, including actioning applicable rules and procedures when train crews respond to a loss of brake pipe air event
• reviewed the tasks conducted post-occurrence to recover the lost wagon.

ATSB observations

From the investigation, the ATSB determined:

• The coupler locking block and knuckle on the leading end of wagon ABSY2792Y were worn, which very likely resulted in 4 rear wagons parting, and train 3PG1 subsequently loosing brake pipe pressure.
• The crew did not identify that the end of train marker was not present on the last coupled wagon or otherwise identify that the 4 rear wagons had parted. Instead, during an inspection of the train, the driver assistant closed an open brake pipe air tap on the back of the last coupled wagon, which allowed all the wagon brakes to release. Consequently, the train resumed the journey incomplete.
• The 4 parted wagons were left occupying the track section when the protection on the section of track (Kaleentha to Darnick) was removed. The crew of 3PG1 cancelled the existing train order without conducting a further inspection.
• The driver assistant was not experienced in the role they were undertaking. This, combined with having only partially completed the relevant driver qualification, contributed to them not recognising the potential reasons for an open air tap on the back of the last wagon, which included the risk that the train had parted. This likely compromised the crew's understanding of the occurrence and led them to incorrectly attribute the problem to a known cause.
• The lock blocks on three couplers, including the coupler that initiated the parting, were not replaced at previous 'B' inspections. However, the replacement was a requirement in SCT Logistics’ maintenance provider’s (Gemco Rail) procedures. Subsequently, the component was in use past its intended service life when the parting occurred.

Reasons for the discontinuation

The ATSB gives priority to transport safety investigations that have the potential to deliver the greatest public benefit through systemic improvements to transport safety.

Given the ATSB’s constrained resources, the ATSB considered it was unlikely that further investigation would identify systemic safety issues or identify opportunities for the enhancement of transport safety. Consequently, the ATSB has discontinued this investigation.

The ATSB has briefed SCT Logistics and Momentum Rail about its observations and potential learnings. However, it considered that broader communication of this information would not be of significant benefit to other parties.

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.

__________

1.  Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.

This investigation was conducted under the Transport Safety Investigation Act 2003 (Commonwealth) by the Office of Transport Safety Investigations (NSW) on behalf of the ATSB in accordance with the Collaboration Agreement. Released in accordance with section 25 of the Transport Safety Investigation Act 2003.

Safety summary

What happened

On 13 October 2020, TrainLink passenger service SN68, was operating from Moss Vale to Campbelltown, New South Wales with approximately 20 passengers on board.

The train driver stopped the train at Yerrinbool Station after being alerted to a small fire at the rear of the train. The fire was identified as coming from the vicinity of an axle bearing on the rear wheelset of the train. The passengers were evacuated onto the platform and the driver attempted to extinguish the fire using an on-board fire extinguisher.

The fire was subsequently extinguished by Fire and Rescue NSW. As a result of the fire, parts of the axle box were heat affected and sustained significant damage to the speed sensor and rubber suspension components. There were no reported injuries.

What the ATSB found

The investigation determined that the fire was the result of a collapsed axle bearing on wheel 8 on the trailing bogie on car 2811, the end of the train. The axle bearing failed when the axle end cap bolts loosened and one fractured which caused the collapse of the bearing and frictional heat to be generated. The resulting fire was fuelled by grease, oil and rubber suspension components in the immediate vicinity of the axle box.

It is likely that during the last overhaul of bogie NJA31, the locking plate tabs retaining the axle end cap bolts were not fitted correctly against the sides of the bolts. The axle bearing installation process was not sufficient to ensure the tabs on the locking plate were installed correctly during a refurbishment three months before the incident.

A wayside monitoring system at Burradoo on the Down Main line detected an elevated temperature on one bearing, but the temperature recorded was below the threshold for an alarm to be sent to network control.

What has been done as a result

Following the occurrence Sydney Trains, which is the maintenance provider for NSW Trains, initiated an inspection of similar axle boxes in the fleet and undertook an audit of the contracted maintainer’s practices.

Sydney Trains have advised the following actions have taken place to prevent a recurrence:

• Improvements have been made to the contracted maintainer’s quality assurance processes to ensure that bolts and locking tabs are correctly installed.
• An improved process was implemented to review and retain the contracted maintainer’s certificate of completion checklists.

Safety message

Bearing failures continue to occur within the Australian rail network. This occurrence emphasises the significance of having adequate bearing installation processes and ensuring that axle bearings are correctly maintained and monitored throughout their operational life.

The occurrence

On Tuesday 13 October 2020, TrainLink passenger service SN68, operated by NSW Trains,^[1] departed Moss Vale at 1757.^[2] The two-car Endeavour train was crewed by a driver in the front cab and a guard in the rear cab. There were approximately 20 passengers on board the train as it departed Moss Vale (Figure 1). The train was to make 11 stops before being scheduled to arrive at Campbelltown at approximately 1900.

The train stopped at Burradoo and Bowral before departing Mittagong at approximately 1809. The train crew said they had experienced no problems with the train before Yerrinbool.

At 1820, as the train was slowing to stop at Yerrinbool Station, the guard, from inside the cab at the rear of the train, heard a loud noise and noticed smoke outside the window. The guard used the train’s bell system to ask the driver to stop. The driver brought the train to a stand at Yerrinbool Station.

Figure 1: Incident location and path of SN68

Source: Geoscience Australia, annotated by OTSI

Once the train stopped at Yerrinbool Station, the guard used the trains’ public address system to ask the passengers to move to the front of the train. The guard made a second announcement shortly afterwards, requesting passengers disembark onto the platform. The driver walked along the platform to the rear of the train and observed a flame and dark smoke coming from the last wheelset of the train, wheel 8 on axle 4 under the bogie of car 2811.

The driver spoke to an Australian Rail Track Corporation (ARTC) network controller at Junee requesting permission to go down onto the track to attempt to extinguish the fire. The network controller applied signal blocking to prevent rail traffic in both directions and then gave permission for the driver to access the track. Another passenger service, SN61, was stopped by the signaller at a signal before the platform at Yerrinbool. This provided protection on the adjacent line so the driver could go onto the track. The driver went onto the track and used the on-board fire extinguisher to attempt to put out the fire. The fire continued to smoulder/burn as the heat source remained.

Fire and Rescue NSW arrived on site at approximately 1828 and ensured the fire was extinguished before departing at 1850. Train passengers were transferred to buses which replaced train services between Campbelltown and Moss Vale in both directions. There were no reported injuries as a result of this incident.

The maintenance shift manager at Eveleigh Maintenance Centre organised for the Rail Emergency Recovery Unit to arrange pony bogies (Figure 2) to be fitted under all wheels of bogie NJA31 and the train was worked back to Eveleigh over the next two nights. Under the supervision of Office of Transport Safety Investigations (OTSI) investigators, Office of the National Rail Safety Regulator representatives and Sydney Trains engineering staff a partial disassembly of the axle end cap and removal of bolts from the affected bearing was undertaken. A further strip down inspection of the axle bearing assembly was conducted at bogie maintainer United Group Limited Unipart (UGLU) at Auburn, also under the supervision of OTSI investigators and Sydney Trains engineering staff.

Figure 2: Heat affected area and pony bogie fitted under NJA31

The inset image shows the axle cover removed. Two bolts were found to be missing from the end cap and one bolt was broken. All three bolts remained within the axle housing.

Source: OTSI

The damage was contained to this localised area around the trailing axle of the rear bogie. Parts of the axle box were heat affected and the speed sensor and rubber suspension components were significantly damaged.

__________

1. NSW Trains is an operating agency of Transport for New South Wales, it is responsible for the operations of TrainLink services.
2. Times shown in 24-hour time as Australian Eastern Daylight Time (AEDT).

Context

Environment

The Bureau of Meteorology (BOM) automatic weather station at Moss Vale, recorded the temperature as 24.4 °C at 1500 on 13 October 2020. Yerrinbool is approximately 30 km north-east of Moss Vale. Weather conditions were fine and clear.

Location

Yerrinbool Station is on the Main South line in the Southern Highlands of New South Wales (Figure 3). Yerrinbool is located at 116.310 km.^[3]

Figure 3: South-bound Endeavour two-carriage set at Yerrinbool Station

The figure shows south-bound (Down) Endeavour set at Yerrinbool Station. Image of car 2811 inset

Source: railgallery.wongm.com, annotated by OTSI

Train crew

The train was crewed by a driver, operating the train in the front driver’s compartment, and a guard located in the rear drivers’ compartment. The train crew were appropriately qualified and held the required route qualifications.

Train information

Train SN68

The passenger train involved in the incident, SN68, was an Endeavour railcar two-carriage set. This diesel-powered multiple unit train was operated by TrainLInk and built by ABB Transportation in Dandenong, Victoria. There were 14 Endeavour sets in service at the time of the incident and they first entered service in March 1994. Twenty-three Xplorer cars which have the same bogie types and axle bearings were also in service at the time of the incident.

The leading car of SN68 was LE2861, with TE2811 being the trailing car. The LE carriages feature a dedicated luggage space and can seat 95 passengers. The TE carriages feature a wheelchair accessible toilet and can seat 82 passengers.

The drivers’ cab, positioned at each end of the train, is a full width driving compartment with the driver's seat offset to the left-hand side. Passengers enter and exit through power activated doors operated and controlled by the driver or the guard. Dry chemical fire extinguishers are fitted in the drivers’ compartment.

Bogies

The bogies fitted to the Endeavour and Xplorer sets are NJA and PJA bogies. The bearing collapse occurred on an NJA bogie, the rear trailing bogie on car 2811. The NJA bogie is the trailer bogie (Figure 4), as opposed to the PJA powered bogie. Built for the State Rail Authority in 1994, the bogie involved in this incident was designated as NJA31. This bogie was installed on    car 2811 on 7 July 2020 and had travelled approximately 66,087 km since installation.

Figure 4: NJA31 bogie
 

Source: OTSI

Axle bearing installation

The maintenance and installation processes for critical components holding the axle bearing were examined as part of the investigation.

Each bogie has two wheelsets which have an axle bearing at each end of the axle (four bearings per bogie). The axle bearings were Timken SP130 type bearings. Securing the axle end cap were three different brands of bolts with the head markings showing: NLGS, JDF and HEC (Figures 5 and Figure 6). The axle end cap bolts were hexagonal head, metric 16 mm diameter (M16), 40 mm length (fully threaded), 2 mm pitch, and class 8.8. There are two types of end caps used, a standard or combined end cap suitable for mounting a phonic wheel. The phonic wheel is used as part of the train’s on-board system for recording speed and detecting wheel slide during braking, this end cap was the phonic wheel type.

Figure 5: Three types of axle end cap bolts removed from hub following incident

Source: OTSI

Figure 6: Side view of three axle end cap bolts, including broken NGLS bolt

Source: OTSI

The locking plate was a Timken brand K-422091 R.S 120-130. Stamped on the plate was the axle number (073275) and installation date (07 20 – July 2020) (Figure 7).

Figure 7: Locking plate

Source: OTSI

The requirements for installing the SP130 bearings onto the axles is documented in a Sydney Trains Standard Instruction.^[4] This instruction provided maintenance workers with the details for installing the end cap, torque requirements for bolts and installing the locking tabs. There was a wheelset certificate of completion used by the maintenance workers to show that bogie NJA31 was refurbished. This work was completed on 1 July 2020. There are check boxes on a form that the maintenance workers complete when each task is done. These were all checked as completed and the installation tolerances for the bearing were correct at the time of installation.

The axle bearing installation process commences with the bearing being pressed onto the axle journal before being retained on the journal by an end cap. The end cap is secured by three M16 bolts with a new locking plate positioned underneath the bolt heads. The bolts are screwed in threaded holes and using a calibrated torque wrench are finally torqued to 80 – 100 Nm.

The bolts are torqued in sequence until there is no further movement of the bolt resulting from the application of the specified torque. It may be necessary to further tighten the bolt to align the head with the locking plate tabs. The tabs on the locking plate are then bent up to engage with the sides of the bolt head to form a tight fit. After the process is complete a witness mark is applied to the bolt head and adjacent area to show the original position of the bolts (Figure 8). Movement can be visibly determined during any subsequent inspections.

Figure 8: Correct bolt and locking tab installation bolt

Inset image shows a close of the locking tabs correctly bent up and in contact with the head of the bolt as well as the witness mark (white paint pen).

Source: OTSI

Involved parties

The Australian Rail Track Corporation (ARTC) is the rail infrastructure manager that manages the Main South Line from Macarthur on the outskirts of Sydney to Melbourne, including the wayside monitoring device. 

NSW TrainLink provides rail services in NSW and also operates some interstate services to Victoria and Brisbane.

Sydney Trains is responsible for maintenance activities on the trains operated by Sydney Trains and NSW TrainLink.

United Group Limited Unipart (UGLU) are contracted maintenance providers to Sydney Trains and serviced the bogies of the Endeavour and Xplorer fleet. UGLU is a joint venture between United Group Limited and Unipart.

Track and infrastructure information

The section of track at Yerrinbool was standard gauge (1435 mm). It consisted of an Up Main line and a Down Main line. At the time of the incident SN68 was travelling towards Sydney on the Up Main line.

ARTC maintains operational control for this area from Network Control Centre South at Junee.

Wayside detectors

The ARTC, operates and maintains the wayside monitoring systems in the vicinity where this incident occurred. There are different types of wayside devices including but not limited to detectors for hot bearings, wheel impact loads, acoustic wheel monitoring, and dragging equipment (Figure 10).

At Burradoo, 138.000 km, on the Down Main line, an operational wayside device detected an elevated bearing temperature as SN68 as it passed, in the Down direction, on the way to Moss Vale. This occurred at 1703 when the elevated temperature was recorded on car 2811 (wheel 8 on axle 4), the location of the subsequent collapsed bearing. The temperature was recorded as 84°C, below the threshold to trigger an alarm. The temperature of the other bearings on the bogie were recorded as 73°C, 65°C and 69°C.

The ARTC has two threshold categories for hot bearing detector alarms.^[5]  When a threshold temperature is exceeded an alarm is sent to the network controller who must ensure the category of alarm condition is understood by the driver and is responded to according to the required action outlined below (Figure 9).

 Figure 9: Wayside Device Alarm Categories

Source: ARTC

The other wayside monitoring system between Campbelltown and Moss Vale was  located at Menangle on the Up Main at 67.25 km. It is likely that the hot bearing would have been detected here, 50 km past Yerrinbool.

Sydney Trains also checked previous passes by car 2811 over wayside monitoring systems and did not identify any other warm bearing temperature for this wheelset for the period 5 July 2020 to the incident date on 13 October 2020.

Figure 10: ARTC Network wayside detectors

Source: ARTC, annotated by OTSI

Related occurrence

On 1 December 2020, less than two months after the incident at Yerrinbool, a related incident occurred when a hot bearing on an Xplorer train was detected by a Sydney Trains wayside detector on the Up Main at Wyee, NSW. TrainLink passenger service, NP24, travelling from Armidale to Sydney was stopped at Wyee after the driver was notified of a hot bearing. After inspection, the train proceeded at a low speed (under 25 km/h) to Wyong where the passengers were disembarked. There was no injury or damage.

The Xplorer was subsequently examined at Eveleigh Maintenance Centre where it was found that two axle end cap bolts on car 2508 (wheel 8) had moved from their original position. It was also found that the locking plate tabs were incorrectly bent up. The last refurbishment of the wheelset was 22 months before the incident on 1 March 2019.

__________

3. The kilometre distance is measured from Platform 1, Central Station, Sydney, New South Wales.
4. Sydney Trains Standard Instruction, Installation of Metric SP type Package Unit Bearings, TRS1516.00, Vol 3, Section G, 8. Applying the end cap.
5. ARTC, Response & Management of Wayside Monitoring Device Alarms – Wayside Device Alarm Categories.

Safety analysis

Mechanism of bearing collapse

The investigation determined that the fire in the wheel area of SN68 at Yerrinbool was caused by a collapsed bearing on wheel 8 on the trailing bogie on car 2811. This led to frictional heat to be generated and a fire started. The fire was fuelled by grease, oil, and rubber suspension components in the immediate vicinity of the axle box. The fire did not spread to other parts of the train.

The likely precipitating events to the bearing collapse was the loosening of two of the three axle end cap bolts which placed higher loading on the remaining bolt which then started to fracture. During every cycle of the bearing there are micro movements within the system. The locking plate tabs, if positioned correctly against the face of the bolts, assist in retaining the bolts in position. The two bolts, inadequately restrained by the locking plate, continued to loosen and fell out and the remaining bolt then fractured completely (Figure 11). With the end cap unsecured the outer cone of the bearing was able to move on the axle. Wayside data indicated that once the bolt fractured it took approximately 15-20 minutes for the failure to be identified.

Figure 11: Axle end with protruding failed bolt

Insert image showing the inside collapsed axle box and failed bolt protruding.

Source: OTSI

An initial inspection of the axle bearing and components was conducted following the incident at Eveleigh Maintenance Centre. All three bolts and the locking plate were recovered and, although damaged, were able to be examined. There were three different brands of bolts used and the failed bolt was identified as a NLGS bolt. A further inspection at UGLU Auburn Maintenance Centre was conducted when the bogie was disassembled. Present at these inspections were representatives from OTSI, Sydney Trains and UGLU. Measurements were taken and recorded for critical items, such as bearing end float, end cap installation torque and axle diameters on the other three undamaged bearings. These measurements were all were consistent and within specification.

Torque values were also measured on the other three undamaged bearing axle end cap bolts. Four out of the nine torqued bolts remaining on the bogie exceeded the 80‐100 Nm torque range and two bolts were recorded at 180 Nm and 200 Nm. The differing torque amounts was attributed to bolts being tightened further to achieve the alignment with the locking tabs. This torque was the breaking torque, not the original application torque.

An independent metallurgical examination was also conducted on the bolts and the locking plate, as well as a sample of other similar bolts. The scope of this analysis included: examination and fractography, hardness testing on all bolts, microscopy analysis of the grain structure, tensile testing and compliance to applicable standards. A report was produced following this examination.^[6]

The metallurgical examination showed that the bolts had no material or surface defects and complied with the requirements of the Australian Standard.^[7] The use of differing bolt brands was initially identified as a concern but was later ruled out as an issue as all brands complied with the requirements of the standard. The metallurgical examination also showed the locking plate to be without issue. Other results from the metallurgical examination were:

- Damage was most severe on the first two bolts which loosened and fell out. These bolts were damaged after being tumbled around inside the case.

- The third bolt had the least damage as it had fractured after the first two bolt had fallen out.

- The third bolt had partially unscrewed about 4-5 mm before failure.

- The third bolt failure occurred progressively over a period of approximately one to two hours.

- The locking plates were made of low hardness steel which provided less resistance to loosening if the stresses in the system were sufficient to unscrew the bolts.

- The locking plate showed heavy damage and bent arms at the hole where the third bolt fractured.

The metallurgical report stated: ‘A potential factor in the failures was insufficient tensioning of the bolts on installation, however, annular impressions around the locking plate holes were mostly similar, which is a rough indication that torqueing of the bolts had been similar. This observation is very subjective, and the conclusion of similar torqueing may be erroneous.’ The investigation could not verify what torque level was applied to the axle end cap bolts that came loose.

Bearing installation process

An inspection of the processes undertaken at UGLU Auburn Maintenance Centre demonstrated that standard processes were in place, marked components were used, and calibrated torque wrenches available to be used by appropriately qualified personnel. Despite this, the physical evidence shows that it is likely that during the last refurbishment of the wheelset, on 1 July 2020, just over three months before the incident, the locking tabs were not sufficiently bent up against the face of the bolts.

There was completed documentation showing the processes had been checked off by a qualified maintenance person. The relevant checkboxes for all items were completed, this included:

- checking the bolt torque (new bolts used)

- tabs locked flat on the screw head face

- torque marking of screws.

However, at the time of the refurbishment there was no additional quality assurance check once this process was completed.

The subsequent Sydney Trains investigation report into this incident at Wyee on 1 December 2020 showed strong similarities with the incident at Yerrinbool. The detection of the locking plate tabs not being bent up supports the same findings for Yerrinbool.

__________

6. MetallTech, Metallurgical investigation Endeavour bolt failure – axle box bolt, Report M2020/09-1, 23 November 2020.
7. Australian Standard AS 4291.1 / ISO 898.1 Mechanical properties of fasteners made of carbon steel and alloy steel.

Findings

From the evidence available, the following findings are made with respect to the collapsed bearing on passenger train SN68 at Yerrinbool, New South Wales on 13 October 2020.

Contributing factors

• The fire that occurred on SN68 was the result of excessive heat generated from a collapsed bearing on the trailing bogie of locomotive TE2811.
• The bearing collapse was the result of two axle end cap bolts becoming loose and the remaining bolt fracturing due to the increased load. Once the three bolts were no longer holding the end cap in position the bearing rapidly collapsed.
• It is likely that during the last NJA31 bogie overhaul the tabs on the locking plate were not installed correctly. This enabled the two axle end cap bolts to loosen.
• The axle bearing installation process was not sufficient to ensure the tabs on the locking plate were installed correctly. (Safety Issue)

Other (key) finding

• The brake and bearing temperature alarm detected an elevated temperature on an axle bearing at Burradoo as SN68 passed over it approximately 60 minutes before the fire was noticed at Yerrinbool. The temperature recorded was below the threshold for an alarm to be sent to network control.

Safety issues and actions

Axle bearing installation

Safety issue number: RO-2020-017-SI-01

Safety issue description: The axle bearing installation process was not sufficient to ensure the tabs on the locking plate were installed correctly (Safety Issue).

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Australian Rail Track Corporation
• NSW Trains
• Sydney Trains
• United Group Limited Unipart.

References

Australian Standard AS 4291.1 / ISO 898.1 Mechanical properties of fasteners made of carbon steel and alloy steel.

MetallTech (2020), Endeavour Bolt Failure – Axlebox Bolt – Metallurgical Investigation, 23 November 2020

Rail Industry Safety and Standards Board (2021), Glossary of Terms.

Sydney Trains (2020), Systemic Safety Investigation Report Collapsed bearing on car 2811 at Yerrinbool on 13 October 2020.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Australian Rail Track Corporation
• NSW Trains
• Office of the National Rail Safety Regulator
• Sydney Trains
• Transport for NSW

Submissions were received from:

Office of the National Rail Safety Regulator

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Section 21 (2) of the Transport Safety Investigation Act 2003 (TSI Act) empowers the Australian Transport Safety Bureau (ATSB) to discontinue an investigation into a transport safety matter at any time. Section 21 (3) of the TSI Act requires the ATSB to publish a statement setting out the reasons for discontinuing an investigation.

The ATSB commenced an investigation into a train runaway operated by Genesee & Wyoming Australia (GWA), which occurred on 31 July 2019. The train was operating within the Liberty Primary Steel complex at Whyalla, South Australia.

Within the steelworks, GWA operated trains using a single driver. The driver controlled the locomotive through a combination of cab controls and remote control equipment depending on the task (transiting, loading, unloading).

At about 0815 (Central Standard Time) on 31 July 2019, a driver was connecting a pair of locomotives to an empty rake of wagons using the remote control equipment. The driver was in the process of transferring control from the remote control to the locomotive cab. At about 0824, while in the locomotive cab, the driver noticed that the train was beginning to move backwards, towards the steelworks. At that time, the removable locomotive control handles were not in their normal location, so the driver was unable to operate the train’s airbrakes. The driver attempted to stop the train by applying the mechanical handbrake outside the locomotive cab, but this had no effect. With the train accelerating, the driver chose to jump off while the train was moving at low speed, and alert train control.

For about 11 minutes, the empty train rolled through the steelworks yard, reaching a maximum speed of 51 km/h over track with a permitted speed of 15 km/h. The train passed over eight level crossings and crossed a railway track used to move rail wagons carrying molten iron. As the track levelled out, the train slowed by itself and stopped on the steelworks balloon loop. The train travelled about 6 km without a driver in control.

Initial information from GWA suggests that while transferring control from the remote equipment to the locomotive cab, a pneumatic connection was closed before the brake pipe had been exhausted. This condition, combined with an undetected fault on one locomotive, resulted in all brakes releasing and the subsequent train runaway.

The Government of South Australia funds the ATSB, through a charging agreement, to undertake safety investigations for incidents that occur on intra-state rail networks in South Australia. At the time of this incident, the funding agreement had expired, although the Government of South Australia is committed to working with the ATSB to draft the terms for a future agreement. While the ATSB initiated a safety investigation under the TSI Act, the Government of South Australia informed the ATSB that they considered additional investigatory effort would not provide any increased understanding of the root cause of the incident, and had decided not to fund any ongoing activities. Consequently, the ATSB has discontinued this investigation.

_____________

The information contained in this update is released in accordance with section 25 of the Transport Safety Investigation Act 2003 and is derived from the initial investigation of the occurrence.

Safety summary

What happened

A six-car Metro Trains Melbourne (MTM) passenger train travelling from Flinders Street Station to Lilydale Station uncoupled shortly after leaving Croydon Station. The train consisted of two 3-car units and uncoupled at the mid-coupling. The train was travelling at about 78 km/h when the 3-car units uncoupled. The trailing car unit came to a stop under automatic emergency braking. Once the train driver noticed that the trailing car unit had uncoupled, he applied emergency braking and brought the lead unit to a stop about 300 m from the trailing car unit. There were no injuries in the incident.

What the ATSB found

It was found that two technical faults had combined to cause the uncoupling. Inspection and testing conducted by MTM revealed that a wiring error was made during a modification to the train’s low-note whistle on the lead car of the train. Further, there was a deterioration of insulation resistance in the uncouple solenoid connector of the lead car of the trailing car unit. The low insulation resistance of the uncouple solenoid combined with the incorrect wiring of the low-note whistle resulted in an error circuit forming to energise and actuate the uncouple solenoid. This resulted in the unintended uncoupling.

What's been done as a result

The X’Trapolis fleet was inspected by MTM. Eleven of the motor cars were found to have the low-note whistles wired incorrectly and these were rectified. The low-note whistle wiring document has been updated to provide further clarity and to prevent future wiring errors with respect to this modification. In addition, maintainers involved in low-note whistle modification work have been briefed and re-trained on the modification method statements. Further, completed modification work will require self-checks and supervisor checks.

MTM advised that it has implemented a program of mandatory insulation resistance testing of the uncoupling solenoid connectors. The information from the testing will be provided to the original equipment manufacturer in order to assist with determining the root cause for the failure and take appropriate remedial action.

MTM further advised that it is reviewing the scope for improving negative to ground testing during depot based scheduled maintenance and exploring a design for a system for monitoring common negative to ground potential.

Safety message

This incident highlights the importance of ensuring that a verification program is incorporated into quality assurance systems to mitigate the risk of errors during installation or modification of electrical systems.

The occurrence

On the afternoon of 9 November 2018, two empty 3-car X’Trapolis units^[1] were coupled at the Camberwell sidings in preparation for operating the 1607 Metro Trains Melbourne (MTM)^[2] passenger service from Flinders Street Station to Lilydale Railway Station (Figure 1). Car 959M was designated the lead car of the train and operated as a non-revenue service from Camberwell sidings to Flinders Street Station.

Analysis of the VICERS^[3] data logger indicated that at 1552, just prior to departure from Camberwell, the driver sounded the low-note whistle and there was a momentary loss of electrical signals between the leading and trailing 3-car units. At 15:52:15, the train departed from Camberwell sidings for Flinders Street Station.

On arrival at Flinders Street Station at about 1606, a driver exchange occurred. The new driver conducted the prescribed safety checks, entered the train describer number (TD 3817) and departed Flinders Street Station at about 1608. The train stopped at Southern Cross Station and Flagstaff Station before arriving at Melbourne Central Station at about 1615.

Figure 1: Melbourne train network showing train TD 3817 route on Lilydale Line

Source: Metro Trains Melbourne with annotations by Chief Investigator, Transport Safety (Vic)

The driver reported that at Melbourne Central Station, the message ‘Decoupling/Re-coupling’ appeared on the Driver’s Display Unit (DDU). He reported this to the Train Services Officer (TSO) at Metropolitan Train Control (METROL) who advised him that it could be the coupler pins not aligning in the centre coupler (coupler between the two 3-car sets). The driver reported that after a few seconds, a new message ‘PIDS^[4] Inoperative’ appeared and then after a short period the normal screen was restored. He then re-entered the Train Describer number into the DDU.

Analysis of the data from the VICERS indicated an electrical disconnection lasting about 7 seconds at Melbourne Central Station. At about 1616, the electrical signal was re-connected, the emergency brake safety loop re-established and the train departed Melbourne Central Station.

The train stopped at several stations before arriving at Croydon Station at about 1656. Although the DDU did not indicate any further irregularities, the VICERS data download traces between Melbourne Central Station and Croydon Station indicated three further electrical disconnections. These electrical disconnections did not disrupt the operation of the train.

The train departed Croydon Station at about 1657, with about 150 passengers on board. After leaving Croydon Station and on the approach to Coolstore Road level crossing (about 200 m from the station) the driver sounded the low-note whistle. The train then entered a left-hand curve, about 800 m from Croydon Station. About half way through the curve, the driver looked back through the rear-view mirror and noticed that the train consist had only three cars and the trailing unit had uncoupled (Figure 2). He immediately applied emergency braking and brought the three-car set to a stop.

Figure 2: Coupled cars 960M and 882M of X’Trapolis train that uncoupled

Source: Metro Trains Melbourne annotated by Chief Investigator, Transport Safety

The VICERS data download indicated that about 30 seconds after departing Croydon Station, an emergency brake application was made on cars 882M and 881M, and the trailing 3-car set came to a stop at about 1658. The download further indicated a momentary brake application on cars 959M and 960M (the motor cars of the leading 3-car set), but this brake application was not sustained and the car set continued moving. The VICERS download indicated an emergency brake application at about 1658 and shortly after, the leading car set 959M came to a stop about 371 m from the lead car 882M of the trailing car set. The train was travelling at about 78 km/h when the 3-car sets uncoupled. The trailing car set travelled under emergency braking for about 196 m before coming to a stop.

Events after uncoupling of 3-car units

After the leading car set came to a stop, the train driver made a priority radio call to advise METROL of the uncoupling of the trailing car set. METROL despatched an empty train (under extreme caution^[5]) from Lilydale Station towards Croydon Station to locate the 3-car set that had detached from the lead car set. Victoria Police, the Melbourne Fire Brigade (MFB) and the Ambulance Services arrived soon after and detrained about 150 passengers from the two detached 3-car sets.

__________

1. Units 959M-1680T-960M and 882M-1641T-881M.
2. MTM is the franchise contract manager for the Melbourne metropolitan rail network. MTM is also responsible for asset maintenance on the network.
3. Vigilance Control and Event Recording System. Refer to section on VICERS Data Logger system.
4. Passenger Information Display System.
5. MTM instruction to the train driver of the empty train to exercise extreme caution in case TD 3817 had derailed and was fouling the adjacent track.

Context

Location

The parting of the two 3-car units of train TD 3817 occurred about 500 m from Croydon Station. Croydon Station is on the Lilydale rail line and is located about 32 rail km from Flinders Street Station, Melbourne (Figures 1 and 3).

Figure 3: Location of Croydon on Lilydale train line

Source: Copyright Melway Publishing 2018, with annotations by the Chief Investigator, Transport Safety (Vic)

The environment and track

At the time of the incident, the weather was fine with light winds and the temperature was about 190 C.

The rail track from Croydon Station to the location of the train parting was concrete sleepered. From Croydon Station there were a number of left and right hand curves between 31.2 km and 32 km marks. The track slopes down at a slight gradient from 31.2 km to about 31.5 km and then is flat until about the 32 km mark.

Train driver

The train driver was employed by MTM for over 9 years and was qualified to drive Electrical Multiple Units (EMU). His driving performance was audited regularly by MTM driver supervisors and was last audited in July 2018. No non-conformances were recorded during these audits. Medical certification for the driver was valid and current at the time of the incident. No alcohol or drugs were detected during post-incident tests conducted on the driver.

The train

The X’Trapolis EMU is operated as a 3-car or 6-car set. The car body modules were designed and constructed in France and assembled at Alstom Australia, in Ballarat, Victoria. Each 3-car set is coupled in motor-trailer-motor configuration. They are coupled by auto-couplers between motor cars and semi-permanent couplers between the motor and the trailer cars, with rubber bellows inter-car canopy walkways.

TD 3817 was a 6-car set and consisted of 959M-1680T-960M-882M-1641T-881M passenger cars.^[6] A Scharfenberg automatic coupler connected the two 3-car units of TD 3817 between 960M and 882M. A 6-car train set has the total effective capacity for 752 passengers and this train was carrying 150 passengers at the time of the uncoupling.

The motor units are 24.46 m in length and the trailer units are 22.76 m in length. Each 3-car set is 71.68 m in length and a 6-car set is 143.36 m in length. The average mass of a 6-car set is about 244 t. Each car has six doorways, located at the front, middle and rear of the cars and the nominal floor height of the car is 1185 mm above top of the rail. The EMU is capable of a maximum speed of 130 km/h.

Master Controller and Operations

In order to prepare the train for operation, the driving cab must be made electrically operational by inserting and switching on the Master Key making it the cab-in-service. The driver then enters the Train Describer number into the radio control unit. The Master controller handle is moved back and forth between four positions—motor, coast, brake and emergency brake. The Reverser is a three-positon switch that can be moved to forward, neutral and reverse positions. In order to get forward traction, the Reverser must be moved to the forward position and the master controller moved from the brake to coast to the motor position. The position of the Master controller between the coast and motor positions dictates the tractive effort. The console and controls are accessible from the driving position (Figure 4).

Figure 4: Master Controller Panel

Source: Chief Investigator, Transport Safety (Vic)

Vigilance, Control and Event Recording System (VICERS)

The X'Trapolis fleet is fitted with a Vigilance Control Event Recorder System (VICERS). The vigilance component monitors task-linked activities and in the absence of any such activities provides intervention by applying the train’s brakes. It also incorporates an event recorder system, which monitors a number of on board systems including the operation of a number of driver control functions. The system records a comprehensive range of operational parameters including control equipment status, train speed, traction and braking and location.

Coupling and Uncoupling of Scharfenberg Coupler

Each end of the 3-car units were equipped with an automatic Scharfenberg coupler that enabled mechanical, pneumatic and electrical coupling of two 3-car units (Figures 5 and 6).

Figure 5: Mechanical, pneumatic and electrical components of Scharfenberg coupler

Source: Chief Investigator, Transport Safety (Vic)

Figure 6: Scharfenberg coupler between cars shown uncoupling

Source: Chief Investigator, Transport Safety (Vic)

The Scharfenberg coupler has a coupler lock that consists of a rotating hooked plate, a coupling link and tension springs (Figure 7). During coupling, the coupling link of one coupler engages the hooked plate of the mating coupling and locks in the indentations on the hooked plates. The cone and funnel shape design of the coupler front plates establishes a rigid and slack-free connection. During the coupling, the electric heads and the air pipe connections engage to ensure connectivity between the two car units. The coupler has a flexible buffer assembly that allows movement of the cars when negotiating vertical and horizontal curves.

Figure 7: Illustration of uncoupled Scharfenberg coupler

Source: Voith Group, annotated by Chief Investigator, Transport Safety (Vic)

The units can be coupled or uncoupled remotely from the driver’s cab or manually from trackside. The automatic coupling process involves moving one 3-car unit against a stationary 3-car unit.

X’Trapolis electrical and pneumatic systems for uncoupling

The Melbourne metropolitan electrified rail network operates on 1,500 V direct current (DC), supplied to the train via a roof-mounted pantograph that is in contact with the overhead wire. Two power inverters (static) convert the 1500 V DC to 400 V, 3-phase or 230 V single-phase alternating current (AC) to supply the various loads on the train. The 400 V AC supply is rectified and transformed to provide 120 V DC through a battery charger system.

The 120 V DC power supply is distributed to three lines; the permanent LV line, prepared LV Line and the prepared and cab operative line, each corresponding to an operational state of the train.

The prepared LV line supplies the uncoupling system (Figure 8). An intended uncoupling operation requires the train to be stationary and local cab active. The uncouple pushbutton (Figure 4 and 8) is pressed to energise and actuate the uncouple solenoid valve (VS). The energised uncouple solenoid valve directs supply air to the uncouple cylinders (Z3) on both couplers

Figure 8: Wiring diagram for uncoupling system

Source: Alstom Drawing AX00000263675, simplified and annotated by Chief Investigator, Transport Safety (Vic)

The uncouple cylinder (Z3) actuating piston rotates the hooked plates of the coupler against the force of the tension springs (Figure 7 and 9). The coupling links slip out of the indentations on the hooked plates and the couplers can then be separated. The uncouple cylinder actuating piston also rotates the cam (C1) that actuates the 5/2 way pneumatic valve (V4). Actuation of the 5/2 way pneumatic valve allows air to be directed to the pneumatic cylinders (Z4) that retract the electrical heads (E).

For the uncouple pushbutton to activate the uncouple solenoid valve, the cab has to be in-service (cab active) and the train speed has to be below 3 km/h (Figure 8). Pressing the uncouple pushbutton from the active cab energises the uncouple command relay which deactivates the coupling detection contactor relays. These in turn disconnect the traction and braking signals across the coupler electrical heads prior to uncoupling.

Figure 9: Pneumatic schematic for uncoupling of Scharfenberg coupler

Source: Scharfenbergkupplung GmbH & Co. (annotated by Chief Investigator, Transport Safety (Vic)

__________

6. The letter M denotes a motor unit and the letter T denotes a trailer unit.

Safety analysis

Testing and fault finding conducted by MTM

Metro Trains Melbourne (MTM) conducted multiple dynamic tests of the train in an attempt to replicate the fault, without success. The Scharfenberg coupler and associated mechanical and pneumatic components were inspected and no fault was identified. The Scharfenberg coupler can be manually uncoupled by actuating the automatic coupler manual release handle. Examination of the manual release mechanism did not indicate that it had been used. It was concluded that the most likely initiator for an uncoupling event was via the activation of the uncouple solenoid (22Y3).

Insulation resistance testing of uncouple solenoid

Uncouple solenoid connectors of the coupled motor cars (959M and 882M) were tested for insulation resistance (IR)^[7] to ground (vehicle body/frame). The IR value for the uncoupling solenoid connector of car 882M was found to be 20 kΩ, when the typical IR is required to be over 100 MΩ. However, the low IR would not result in unintentional energising of the uncoupling solenoid valve without a power source to the solenoid.

Figure 10: Electro-pneumatic panel box showing uncouple solenoid valve

Source: Chief Investigator, Transport Safety (Vic)

Further, testing indicated that both the uncoupling solenoid and the uncouple relay picked-up and actuated at a minimum voltage of about 50 V, which was not unusual.

Insulation resistance testing carried out on all the uncoupling solenoid connectors of the X’Trapolis fleet revealed that 15 uncoupling solenoid connectors measured low insulation resistance. In addition, 19 trip re-set connectors^[8] and 15 trip raise connectors^[9] also indicated low insulation resistance.

Low-note whistle wiring error

MTM conducted test runs of the 3-car set with car 959M as the lead cab-active car. Normally, zero voltage should exist between a power supply common negative and ground (earth/vehicle body). However, during the tests on car 959M, an oscilloscope measured an intermittent 120 V between the common 120 V negative and ground. Examination of the VICERS download trace indicated that the voltage spike coincided with the use of the low-note whistle (Figure 4). Further, static testing confirmed that activation of the low-note whistle resulted in the application of 120 V supply between common negative to ground.

Examination of the low-note whistle wiring indicated that a relay on car 959M was installed incorrectly and a cable was connected to a wrong terminal. This error resulted in the low-note whistle’s 120 V supply being connected to the negative (24 V) of the Speed Interface Unit (SIU), which is an interface between the car’s speed detector and the VICERS unit (Figure 11).

MTM’s investigation of the wiring error revealed that although the electrical circuit diagrams were accurate, the technician carrying out the modification had made a cable connection error. Inspection of the X’Trapolis fleet indicated that 11 low-note whistles were wired incorrectly by the same technician. A function test would not reveal the wiring error, as pushing the low-note whistle button would complete the circuit to actuate the low-note whistle. In this instance, an assurance program involving a secondary and independent check of the wiring modification may have been the only means of detecting this error.

Figure 11: Electrical schematic showing incorrect wiring of low-note whistle

Source: Chief Investigator, Transport Safety (Vic)

Speed Interface Unit (SIU) design

The SIU converts the speed signal (0-20 mA) to a pulse train output to the VICERS unit. It provides isolation between the train circuits and VICERS unit. The negative of the SIU was connected to ground providing an electrical ground for the 24V system and the circuit path to actuate the uncoupling solenoid valve.

The safety loop circuit and uncoupling

The safety loop is a control circuit passing through each carriage within the trainset and is closed during operation under normal conditions. When the safety loop is opened due to an abnormal operating condition, the emergency brake solenoid valve is de-energised causing a maximum brake application.

In this instance, the uncoupling function was activated through an electrical circuit that was created by a wiring error in car 959M and the low IR of the uncouple solenoid of car 882M. This error resulted in the cab active relay, push button and the 3 km/h relay interlock devices being bypassed and allowing the unintended activation of the uncoupling circuit. The safety loop circuit on the lead car unit maintained the closed safety loop, hence emergency braking was not applied and it continued its journey until the driver realised that the trailing car unit had uncoupled, and brought the lead 3-car unit to a stop. As there were no active cabs in the trailing 3-car unit, the safety loop was opened, de-energising the emergency brake solenoid valves, resulting in the application of the emergency brakes on the trailing car unit bringing it to a stop.

__________

7. Megger tested at 250 V to ground.
8. The trip re-set solenoid located in the electro-pneumatic panel box enables the driver re-set the trip cock device (TCD) when the trip arm of the TCD is tripped by a train stop or track debris.
9. The trip-raise solenoid electro-pneumatic panel box enables the driver to raise trip arm of trip cock device from the cab. The trip arm of the TCD is required to stay raised on non-active motor cars.

Findings

The following findings are made with respect to the parting of a passenger train TD 3817 at Croydon, Victoria on 9 November 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• A wiring error was made during a modification to the trains low-note whistle on car 959M.
• The wiring error was not detected by Metro Train Melbourne’s verification program. [Safety Issue]
• There was a deterioration of insulation resistance in the uncouple solenoid connector of car 882M.
• The connection between the negative and ground via the Speed Interface Unit provided a path that created the circuit to actuate the uncoupling solenoid valve.

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the rail industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Wiring error was not detected

Safety issue number: RO-2018-019-SI-01

Safety issue description: The wiring error was not detected by Metro Train Melbourne’s verification program.

Additional safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

MTM advised that it has implemented a program of mandatory insulation resistance testing of the uncoupling solenoid connectors. The information from the testing will be provided to the original equipment manufacturer in order to assist with determining the root cause for the failure and take appropriate remedial action.

MTM further advised that it is reviewing the scope for improving negative to ground testing during depot based scheduled maintenance and exploring a design for a system for monitoring common negative to ground potential.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Metro Trains Melbourne Pty Ltd.
• SNC-Lavallin Rail & Transit Pty Ltd.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

Submissions were received from Metro Trains Melbourne Pty Ltd and the Office of the National Rail Safety Regulator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 12 December 2017, a fractured bogie was identified on Pacific National train TM78A during a roll-by inspection at the Kooragang Coal Terminal, New South Wales. The fracture was on bogie NDCA 1199 of wagon NHBH 42954J. This wagon operated loaded between Tahmoor Colliery and Kooragang prior to identifying the fractured bogie.

What the ATSB found

The ATSB found that a fatigue crack went undetected during preventative maintenance activities prior to the structural failure of the bogie frame. It is probable that the fracture was visible at the time of unloading at Newcastle Coal Infrastructure Group on 11 December, which went undetected. The fractured bogie was identified during a roll-by inspection on 12 December, likely preventing a derailment.

What's been done as a result

Pacific National made changes to the maintenance standards used during scheduled maintenance, to increase the area of the bogie frame subjected to non-destructive testing. These changes are aimed at identifying and addressing fatigue cracking prior to the escalation of the defect.

Safety message

Asset managers should ensure that inspection techniques effectively monitor and report on asset condition. Risk controls should also be continuously assessed to control risk to an acceptable level through the life cycle of the asset.

The occurrence

What happened

On the morning of 12 December 2017, train TM78A operated by Pacific National (PN) was unloading coal at the Kooragang Coal Terminal (KCT).^[1] At the time, a maintenance worker was conducting a roll-by inspection^[2] after the train moved through the unloading bay. The worker visually identified a crack on the lead bogie of wagon NHBH 42954J, this was the 35th wagon in the direction of travel. The train was stopped and the wagon was removed to allow for inspection.

The train operated between KCT to Clarence on the 10 December, before returning to Newcastle Infrastructure Coal Group (NCIG). On 11 December the train operated empty from NCIG to Tahmoor before returning loaded to KCT (Figure 1). During these journeys, the trackside condition based monitoring equipment recorded elevated bearing temperatures on axle 4 of wagon NHBH 42954J, as well as an increased angle of attack (AoA).^[3] These recordings did not generate an alert at the time of passing the various detection sites and the train continued to operate until the fractured bogie was visually identified by the maintenance worker.

Figure 1: Incident location

Source: Geoscience Australia, annotated by OTSI

Safety analysis

A PN maintenance worker was located inside the unloading bay at NCIG on 11 December, this worker’s primary function was to observe the wagon doors close. It was not clear if this worker was deemed to additionally be conducting a roll-by inspection. The worker was positioned on the opposite side (to the bogie fracture) of wagon NHBH 42954J and did not report any defects. The bogie was probably visibly fractured at the time based on the increased AoA.

The roll-by inspection completed on 12 December was completed by a single worker, with the worker positioned on the same side as the fractured bogie and the defect was identified. The axle showed signs of rotating forward and up relative to the frame as the fracture opened under the weight of the wagon (Figure 2). As the fracture opened the effective axle spacing changed, lengthening the wheelbase on the side of the cracked frame. PN maintenance standards permit roll-by inspections being completed by a single worker. The defect was detected during a roll-by inspection, however could have been missed if the worker was positioned on the opposite side.

Figure 2: Fractured bogie frame NDCA 1199

Source: Pacific National, annotated by OTSI

The train underwent unit train maintenance (UTM) and a full train examination (FX) on 8 December 2017 at the PN Lithgow maintenance depot. During this inspection, there were no defects reported in relation to bogie NDCA 1199. Prior to identifying the fractured bogie, the train was compliant with the PN technical maintenance plan.

Bogie NDCA 1199 underwent schedule maintenance in July 2015. The bogie frame was subjected to non-destructive testing (NDT) consisting of magnetic particle inspection (MPI) and tested in accordance with PN procedure WMM 11-08_06 One Piece Bogie Inspection. There were no defects detected at the time of testing and the location of the fracture was at the extremity of the area subjected to NDT. Evidence of remnant MPI marker paint was present on the outboard plate, but there was no apparent marker paint on the inboard plate at the region of the fracture.

Fatigue cracking has historically been identified in the NDCA bogies at the welded junction joining the vertical plate and bottom plate section due to the design and manufacturing process used to build this class of bogie at the time. The NDCA bogie is comprised of welded steel plates to form a single piece box section bogie frame.

Prior to this occurrence, a derailment occurred in 2011 at Leigh Creek, South Australia. This derailment was reportedly the result of a fractured NDCA bogie. The bogie fracture increased the wheelbase on the side of the fractures, likely placing additional loading on the axle bearing as the axle tracked abnormally, this led to the bearing overheating and failing.

Post-occurrence inspection of the bogie NDCA1199 showed a fatigue crack most likely initiated at the toe of the weld on the inboard corner of the bogie side frame before progressing across the lower plate and inboard vertical plate (Figure 3). The inboard fracture face was smooth and displayed beach marks (slow progression), while the outboard face was jagged in appearance indicative of rapid progression.

Figure 3: NDCA 1199 fracture analysis

The image shows the bogie fracture from the underside of the bogie to show the three fracture faces. Source: OTSI

The trackside condition based monitoring equipment recorded increased bearing temperatures from 10 December after departing Clarence, as well as an increased AoA on 11 December. Analysis of this recorded data following the event, indicates that the change was likely the result of the bogie frame fracture progressing. As the fracture progressed, the wheelbase (spacing between the axles) increased between axle 3 and 4, affecting the AoA and placing additional loading on the bearing.

At the time of passing through the various trackside condition based monitoring sites, the recorded bearing temperatures did not trigger an automatic alarm to notify the rail infrastructure manager (RIM) or PN. The track side detection equipment utilises algorithms to determine critical levels^[4] that trigger automatic alarms to advise the RIM or operator. In relation to bearing temperature, only warm or hot bearing alarms will trigger an automatic alarm that requires immediate attention. Low bearing temperature alerts and AoA are recorded by the system but do not generate automatic alarms.

The wagon loading for the previous journeys was reviewed and indicated, that between 10 December and 12 December, the wagon operated within the allowable 100 t gross limit. The operation of the train and wagon loading does not appear to have contributed to this occurrence.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• A fatigue crack likely originated at the toe of a weld on the inboard lower plate of the bogie frame that was not identified during the preventative maintenance activities, prior to the structural failure of the frame. The fatigue cracking most likely progressed across the full face of the lower plate and inboard side plate before rapidly progressing across the outboard side plate.
• The NDCA bogie design has a history of fatigue cracking which increases the risk of derailment if the cracking is not identified. Pacific National had processes in places to identify fatigue cracking but this crack was likely not detected due to the location of the defect.
• Trackside condition based monitoring equipment recorded elevated bearing temperature and increased angle of attack in the days prior to the fractured bogie being identified. This was likely a result of the bogie fracture progressing. The recorded temperature did not trigger an automatic alert to advise the rail infrastructure manager or operator.

Safety action

The ATSB has been advised of the following safety action in response to this occurrence.

Pacific National

As a result of this occurrence, Pacific National has advised the ATSB that they have taken the following safety actions:

Bogie Survey

Pacific National undertook a visual inspection of all NDCA bogie frames for evidence of cracking as directed by Office of the National Rail Safety Regulator (ONRSR).

Revised Maintenance Standard

Pacific National revised maintenance standard WMM 11-08_06 One Piece Bogie Inspection to increase the area subjected to NDT testing during schedule overhauls. The entire side frame is now tested on the inboard and outboard plates as well as the underside of the bogie frame through the horn cheek area.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. Kooragang Coal Terminal is operated by Port Waratah Coal Services (PWCS).
2. Roll-by inspections are a visual inspection of moving rail traffic to identify equipment, loading security or other defects or failure.
3. Angle of attack (AoA) refers to the alignment of the train axle and wheels relative to the rail.
4. Bearing and Brake Temperature Alarm Model, T HR RS 133003 ST, Version 1.0. Issue date 12 January 2017. Asset Standards Authority, Transport NSW.

Safety summary

What happened

On 22 April 2017, Qube Logistics (Qube) grain train 8960, travelling from Bogan Gate to Inner Harbour, Port Kembla, New South Wales, ranaway as it descended the Illawarra Mountain between Dombarton and Unanderra. After passing Dombarton, the driver realised he had lost control of the train. At 1248, the driver contacted the ARTC network controller who, in conjunction with Sydney Trains’ train controller, cleared a pathway for 8960. The maximum allowable speed for the Dombarton to Unanderra section was 30 km/h; however, the train reached a maximum speed of 107 km/h. At 1255, the train stopped, assisted by a shallower gradient near Unanderra station. There were no injuries or damage because of the incident.

What the ATSB found

The ATSB’s investigation found that as train 8960 was operated down the Illawarra Mountain, the train management actions by the driver did not conform to train handling procedures. After passing Summit Tank, the driver made ten brake applications and in doing so did not allow the train’s pneumatic brake system to fully recharge. This resulted in a loss of necessary braking capability to be able to control the train’s speed on the steep continuous descent. The incident was further compounded when the driver’s actions caused the locomotive’s dynamic braking system to be rendered inoperative, further reducing control of the train.

The braking system was operating within specification and were loaded below the maximum allowable payload. However, the train was loaded by approximately 10% more than that recorded on the train’s consist record. It is probable that the additional mass placed an extra load on the braking system and affected the handling characteristics of the train.

After the incident, the train controller in Sydney directed the driver of train 8690 to move the train from the rail network to Inner Harbour Terminal without any formal inspection following the runaway event. The Pacific National yard train controller in Inner Harbour did not alert ground personnel of the emergency event or of a runaway train being directed into their terminal.

What's been done as a result

Immediately following the incident, Qube withdrew the QBX locomotives and CGSY wagons from this route pending testing and inspections. They have since been cleared to return to operate on this route. Qube also changed the requirements for competency assessment on the Moss Vale to Unanderra section, from a single initial assessment to every six months. If a train driver has not been rostered over the corridor within six months he or she must be reassessed on this route. Qube also implemented other more stringent requirements for the training of drivers and weekly auditing of train operations between Moss Vale and Inner Harbour.

A review between the various rail infrastructure managers was conducted regarding the plans and procedures enacted in emergency events, and the decision-making process to move trains from the rail network to Inner Harbour.

Safety message

In order to minimise the risk of runaway events, freight operators should ensure that train drivers receive regular training and competency assessment for steep continuous gradient routes. The standards that apply to these routes should ensure that the locomotive and wagon braking ratios are suitable for the terrain the train will encounter on its route. Contingency plans and procedures to accommodate runaway trains in this area should be continually reviewed and tested by rail infrastructure managers.

The occurrence

Events leading up to the occurrence

On 22 April 2017, a Qube Logistics (Qube)^[1] train crew, comprising a driver and second person, signed on at Goulburn, New South Wales, depot at 0800^[2]. The crew were rostered to operate a loaded grain train, 8960, to Inner Harbour at Port Kembla where it was to be unloaded at the Quattro facility. The train had been loaded with wheat the previous day at Bogan Gate and was operated to Goulburn where it arrived at 2130 and was stabled overnight. The next day, a qualified train examiner inspected the train and no defects were reported.

Before departure, the train crew performed an inspection of the train. The driver instructed the second person to apply the brakes while the driver walked to the rear of the train to ensure that the brakes applied and there was brake pipe continuity on the train. He then radioed to the second person to release the brakes. The driver walked back to visually ensure that the brakes released and that all brake pipe and main reservoir pipe hoses were connected, and isolating cocks were in the open position.

At 0910, train 8960 departed Goulburn with the second person operating the train under the supervision of the driver. As the train departed Goulburn yard, a roll by inspection was performed to ensure that there were no visible or audible defects. The train then travelled on the Up Main line to Moss Vale where it branched off towards Unanderra and Inner Harbour. The train passed through Moss Vale at 1045. The second person continued to drive the train, under the supervision of the driver, from Goulburn to Robertson. At Robertson, the driver took over the controls from the second person in order to operate the train down the Illawarra Mountain (Figure 1).

Figure 1: Gradient diagram Moss Vale to Robertson

Source:  Qube Logistics, annotated by ATSB

Between Goulburn and Mt Murray, the driver made a number of running brake applications using the train’s air brake system to gauge the train’s braking capability. There were no issues found with the train’s braking capability. This is known as a running brake test and it is a standard driving practice that train crews conduct this test.

The train passed Mt Murray and then, at 1216 it was brought to a stand just past Summit Tank, as required by a Qube work instruction.^[3] Here, the driver conducted a performance test of the brakes. The driver was satisfied with the braking performance and resumed the journey.

The track gradient between Summit Tank and Unanderra is one of the steepest in the New South Wales rail network and runs for approximately 18 km with a ruling gradient of 1 in 30. There is only one short intermediate shallow grade of 1 in 120 as the track passes through the Number 2 Tunnel (Figure 2). This means that once a train passes Summit Tank there are no rest points along the section where the train’s brake system can be fully recharged.

On departing Summit Tank, at 1216, event recorders indicated that the train increased speed to 28 km/h before the driver made a brake application, which reduced the train’s speed to 15 km/h. With dynamic brake engaged, the driver then made a further nine brake applications, and on each occasion, did not allow the air brake system to fully recharge prior to the next brake application.

Figure 2: Gradient diagram Mt Murray to Unanderra

Source: Qube Logistics, annotated by ATSB

The occurrence

The driver said the first indication that he had a problem was past signal WG 1058 (100.500 km), at Dombarton. The time was 1242. He said that the signal was at full clear with the train travelling at 20 km/h.

At 1242:07, the driver made a release of the train’s air brake for approximately 30 seconds. He then reapplied the air brakes with a 50 kPa reduction in the brake pipe pressure. The dynamic brake was delivering 229 kN of braking force. The independent brake handle was in the release position and there was 0 kPa in the locomotive brake cylinders.

At 1242:28, the train’s speed had increased to 30 km/h. At this point, the train brake air that had been venting to atmosphere was stopped by the movement of the automatic brake handle by the driver to the release position. The driver reduced the brake pipe pressure to 420 kPa. However, despite this, the train’s speed continued to increase. The driver continued to reduce the brake pipe pressure in order to slow the train. The driver again reduced the brake pipe pressure to 344 kPa and the train’s speed reached 46 km/h. The dynamic brake was still delivering 229 kN of force.

As the train approached a 20 km/h curve, at 1246:41, the driver applied the locomotive’s independent brake, which activated the dynamic brake power knockout switch. This eliminates the dynamic braking effort and is a feature that is designed to prevent skidded wheels from excessive braking effort. The train was travelling at 44 km/h at the time.

At 1246:52, the driver moved the automatic brake handle to the full emergency position. When the automatic brake handle is placed into the emergency position, the brake pipe pressure is reduced to zero. The brake pipe pressure took 25 seconds to reduce to 0 kPa, the locomotive independent brake cylinder pressure increased to 482 kPa. The maximum amount of available braking effort was applied however, the train’s speed increasing to 46 km/h.

The action of applying the automatic brake controller to the full emergency position by the driver did not increase the braking effort as the train brake was already fully applied. It also meant that the dynamic braking system was deactivated. At this stage there was nothing further the train crew could do to reduce the speed of the train.

At 1248:37, the driver alerted ARTC train control at Network Control Centre South (NCCS) via the train radio that the train was running away.

NCCS: ‘8960 received. Over.’

Driver: ‘Yeah mate, we are in emergency braking running away down the hill. Over.’

NCCS: ‘You are running away there? Over.’

Driver: ‘That is correct.’

The ARTC network controller^[4] at NCCS remained in constant communication with the driver throughout the runaway. This communication was effective in gaining information about the train’s speed, location, and informing the driver about the route settings.

The ARTC network controller at 1249 notified Sydney Trains South Coast Control (STSCC) that Qube service 8960 was running away and that the train was in the ARTC controlled Dombarton to Unanderra section, but heading towards Sydney Trains’ network. The train controller from STSCC also communicated with the driver and NCCS throughout the runaway.

At 1250, STSCC confirmed to NCCS and the driver that 8960 had the ‘full road’—meaning that the route had been cleared for the train and that there was no rail traffic in its path. Around the same time, Sydney Trains Wollongong Complex contacted Pacific National’s Inner Harbour train control to confirm that the route was clear of rail traffic. Number 1 Departure Road was confirmed as the final destination, in the event that the train ran that far.

At 1252:11, the train reached a maximum speed of 107 km/h as it rounded a curve approaching Unanderra station. The track speed at this location was 100 km/h. The train passed through Unanderra railway station where it was captured on CCTV camera (Figure 3). At 1252:21, the train started to reduce speed once it had reached the rising gradient at Unanderra north junction. The ARTC network controller expressed his concern to STSCC train controller that the driver had been unable to get the train under control. Just as he was saying this, the driver announced that the speed had reduced to 95 km/h.

Figure 3: Runaway train passing Unanderra station

Source: Sydney Trains

Post occurrence

As the train was coming to a stand the ARTC network controller asked the driver about his condition, the driver responded that apart from a few nerves he was good. He said, “I am just coming to a stand there now, I don’t know what my engine brakes are like but there is a lot of smoke behind me on the train, over.” The train controller from STSCC, who was also connected into the conversation along with the area controller from the Sydney Trains Wollongong complex, informed the driver that Wollongong complex would take control of their route once the train had come to a stand.

At 1255:03, train 8960 came to a stand at 85.225 km, on the Up Inner Harbour South Fork line. The train had come to a stand on the Sydney Trains network. It was approximately 13 minutes from the time the runaway event commenced and during that time the train had travelled 14 km.

At 1259, under instructions from the area controller at Sydney Trains Wollongong Complex, the train driver moved 8960 from the main line into Inner Harbour. However, despite the runaway, no formal inspection was made on the train before it was moved.

At 1306, the area controller then requested that the train crew ensure that the end of train marker (EOTM) was still present. The driver then moved the train at reduced speed forward while the second person conducted a roll by inspection of the train. After inspecting the train and confirming that the EOTM was intact at its rear, the second person called the driver on the radio to confirm that everything was in order. The driver then stopped the train and walked back to meet the second person approximately halfway along the train. They discussed what problems they had identified and noted that one wagon had an extended brake piston travel and that several brake shoes were worn below limits. Under direction from the Pacific National Inner Harbour train controller, the driver moved 8960 into the Number 3 Arrival Road in Inner Harbour and waited for the train to be examined (Figure 4).

Figure 4: Inner Harbour track diagram

Source: Asset Standard Authority NSW, annotated by ATSB

At 1436, Sydney Trains inspected the track from the ARTC interface boundary at 91.080 km to Unanderra. No defects were found and the track was certified for use.

As well, ARTC organised a track inspection, from Mt Murray (118.800 km) to its boundary at 91.080 km. This was to observe if there was any:

• damage to the track or track infrastructure
• mechanical components that may have fallen from any train
• contamination (such as curve wear grease) on the rail head
• grease pots over greasing
• grain spills on or around the track.

At 1615, ARTC reported internally that there was no evidence of damage to the track or infrastructure. The track was certified for use.

At 1632, the train crew were drug and alcohol tested. They returned negative test results.

Six days later, on 28 April 2017, the train departed the Number 3 Arrival Road and discharged its load of wheat at the Quattro facility in Inner Harbour, Port Kembla and the mass of each wagon was measured.

__________

1. Qube Logistics is part of Qube Holdings Pty Ltd.
2. The 24-hour clock is used in this report. Local time was Australian Eastern Standard Time (AEST).
3. Qube Logistics Work Instruction. Moss Vale to Inner Harbour Train Management. WI-540. Version 3.0 Issued 14 September 2016.
4. Train controllers on the ARTC network are called ‘network controllers’ and on the Sydney Trains network ‘area controllers’. In the Sydney Trains Rail Management Centre, the title ‘train controller’ is used and on the Pacific National controlled yards the title ‘train controller’ is also used.

Context

Incident location

The runaway incident occurred between Dombarton and Unanderra on the Moss Vale – Unanderra line. Unanderra is in the Illawarra district, 88 rail km south of Sydney’s Central station (Figure 5).

Figure 5: Location of incident

This map shows the incident location and the path of 8960 (shown in red).

Source: Geoscience Australia, annotated by ATSB

Train information

The train, designated as 8960, was a loaded wheat service operating from Bogan Gate to Port Kembla. It consisted of two QBX-type locomotives (Figure 6), QBX003 and QBX002 and 40 loaded CGSY wagons.

Qube Logistics (Qube) owned the diesel-electric locomotives and the wagons were leased from CFCL Australia (CFCLA). The train was 664 m long and had a gross trailing load of approximately 3360 tonnes (as recorded on the train consist).

The wagons were a CGSY grain hopper-type wagon (Figure 7). The wagons were designed and built in China in 2015.

Figure 6: QBX locomotive

This figure shows the side elevation of a QBX locomotive.

Source: Qube Logistics

Figure 7: CGSY wagon
 

This figure shows CGSY wagon CGSY451F.

Source: ATSB

Braking system

The automatic brake, the independent brake and the dynamic brake are sub-systems of the train’s braking system.

Automatic brake

This brake is the normal service brake on the train and applies the brakes in balance when brake pipe pressure is reduced. When the train’s brake pipe is charged to 500 kPa, the train brakes are released. Maximum braking effort is achieved when the brake pipe pressure is reduced to 350 kPa. There is no increase in braking effort between 340 kPa and 0 kPa.

The brakes on the train do not apply simultaneously. The brake on the leading wagon will apply first and the other wagons sequentially. It may take 30 seconds for all the wagons brakes to fully apply. When the train’s air brakes are applied and released it may take 40 seconds for the air pressure to be fully restored to 500 kPa or to a level where the brakes can be effectively reapplied.

The train automatic brake controller has five positions:

1. Release – provides 500 kPa of air pressure in the brake pipe and releases the automatic brake and independent brake on the locomotive (if the independent brake controller is in release as well).
2. Minimum (or lap) – reduces the brake pipe pressure from 500 kPa to 430 kPa, this also initiates a minimum application of the train brakes and the locomotives brakes.
3. Service zone – allows the brake pipe pressure to be progressively reduced from 430 kPa to 350 kPa.
4. Full service – reduces the brake pipe pressure to 350 kPa and fully applies the locomotive brakes and train brakes.
5. Emergency – reduces the brake pipe pressure faster than other brake applications so that the train brakes and the locomotive independent brakes are quickly applied. This turns off the dynamic braking system.

Independent brake

This brake applies air brakes to the locomotive and works independently of the train brake system. The locomotive’s brakes are applied when the locomotive independent brake controller is operated separately from the train brake system. This turns off the dynamic braking system.

Dynamic brake

Dynamic braking is a function on locomotives designed to reduce wear and heat in the friction type braking equipment on the train. Being a supplementary system, it provides an additional means of train-speed control but is not a substitute for the train air brakes. Dynamic braking operates through the electrical traction motors that drive the locomotive wheels by reversing the function, from a motor using electrical current, to a generator producing electrical current. When using dynamic braking, the current generated by the traction motors dissipates out through an electrical resistor bank on the locomotive’s roof as heat. Increasing or decreasing the amount of electrical resistance varies the retardation or braking effect on the rotating locomotive wheels and thereby train.

Control of the braking system

The QBX-type locomotive is fitted with a Wabtec braking system. ‘The Wabtec system is an electro-pneumatic interface between the operation of the driver’s automatic and independent brake controller stands and the brake computer. This interface provides the various braking functions on the locomotive and the train as is required.’^[5]

The position of the brake controller is to the driver’s left when seated (Figure 8). The movement of either brake controller transmits electronic signals to the brake computer, which in turn, responds to give the required brake application. The train control display shows pressure representations in numeric values on the driver’s screen.

The train control display shows the following air brake settings:

• brake pipe pressure
• equalising reservoir pressure
• main reservoir pressure
• brake cylinder pressure
• brake pipe flow meter
• end of train brake pipe setting (where fitted).

Figure 8: QBX locomotive driver’s control area

This figure shows the various controls and display areas for the driver’s position on a QBX-type locomotive.

Source: ATSB

Train crew

The train was crewed by a driver and a second person based at Qube’s Goulburn Depot. The driver was qualified for the rollingstock and the Goulburn to Port Kembla route. The driver had 17 years’ experience as a freight train driver and had previously worked in the rail industry as a shunter.

The second person was in training and qualified to drive a train under the supervision of the driver. Both the driver and second person held current competencies and medical certification.

Track information

The line on the Illawarra Mountain between Moss Vale and Unanderra is mostly a single track with crossing loops at Mt Murray. The section between Summit Tank and Unanderra, where the train ranaway, has a posted track speed of 30 km/h. At Dombarton, the line reverts to a double line. The track between Summit Tank and Unanderra has a ruling gradient of 1 in 30.

The posted track speed varies from 115 km/h from Goulburn to Moss Vale to 30 km/h from Summit Tank to Unanderra.

This standard gauge railway line was built in 1932. It provides a direct route linking Wollongong and Port Kembla to the Main South line. It carries mostly freight services (intermodal, coal and grain) and occasionally heritage passenger services.

No evidence exists to support that track conditions contributed to the incident.

Train control information

As 8960 progressed from Goulburn to its ultimate destination to the grain terminal at Port Kembla Inner Harbour, it came under three separate train control entities: ARTC, Sydney Trains and Pacific National.

Train movements on the Main South line from Goulburn to Moss Vale, and then between Moss Vale and Unanderra (at 91.080 km) are controlled from the ARTC Network Control Centre South at Junee under network rule ANSY 500 Rail Vehicle Detection System.

For trains travelling in the ‘Up’^[6] direction, once a train passes the network interface boundary at 91.080 km the train enters the Sydney Trains network. Sydney Trains direct train movements in their network from the Rail Management Centre in Sydney. These movements are controlled in conjunction with Wollongong Signalling Complex.

The Quattro grain unloading facility is located in the Port Kembla Inner Harbour terminal. Once trains are routed into the terminal controlled by Pacific National Inner Harbour Train Control. Movements in and out of this terminal are controlled in conjunction with the Wollongong Signalling Complex.

Environmental conditions

Weather conditions at the time of the incident were dry and fine. The Bureau of Meteorology recorded a maximum temperature of 23.3°C, at Bellambi, approximately 15 km from Unanderra.

It was determined that environmental conditions did not contribute to the incident.

Related occurrences

On 7 February 2011, a loaded El Zorro Transport grain service travelling to Port Kembla ranaway down the Illawarra Mountain. The driver was unable to control the speed of the train towards the end of the descent. The 2988 tonne train was 691 metres in length.

After passing Summit Tank, the driver made a number of progressively larger brake applications on the descent into Unanderra. As the train approached the bottom of the Illawarra Mountain, braking effort was at its maximum. The train then proceeded uncontrolled through Unanderra Station and signal WG 1014 at Stop, before coming to a stand on the slight uphill gradient 527 metres beyond the signal.

When the crew realised they were in difficulty, the driver told the co-driver to contact the signaller to have signal WG 1014 cleared for them. The co-driver stated that he tried to do so on nine occasions using a mobile telephone but was unsuccessful. The signaller at Wollongong explained that he was busy on other calls at the time.

The Office of Transport Safety Investigations (OTSI) conducted an investigation^[7] into this incident and found that the grain service became uncontrolled during its descent of the Illawarra Mountain because the train was not managed in accordance with current train management procedures.

The investigation also found that the company had no documented policies or procedures for the control of trains descending the Illawarra Mountain. Instead, drivers were instructed to use the rail infrastructure managers’ Train Operating Condition (TOC) manuals. It also found, despite being issued with TOC waivers that classified the wagons as single pipe wagons^[8], the company operated the grain train services under differing dual pipe conditions from the time of introduction of the wagons into service. This anomaly was not identified by the rail infrastructure managers.

__________

5. Qube Logistics – QBX Class Locomotive Briefing Package, March 2016.
6. Up lines typically carry train movements towards Sydney, Down lines away from Sydney.
7. OTSI Investigation Report 04505 (2011) Uncontrolled movement of El Zorro grain service 3996 Unanderra 7 February 2011. OTSI investigation reports can be accessed online at otsi.nsw.gov.au.
8. A single pipe train is a train that only has one airline pipe running through the consist for braking and recharging air reservoirs. The disadvantage of a single pipe train is that it takes much longer to recharge the air brake system.

Safety analysis

The investigation determined that the runaway event between Dombarton and Unanderra was the result of the train management actions made by the driver of train 8960. Despite concerns raised by train crew and another driver about the effectiveness of the train’s braking system, it was found to be within the specified standards.

It also analysed train management, braking performance, train loading, and risk management by the train operator and rail infrastructure managers.

Train management

Train management is a critical aspect of driving a train, especially loaded trains on a route that includes a long steep descent. Besides an understanding of the train performance itself, drivers need to have route knowledge over each rail section they travel over. Some aspects of route knowledge include gradients, train behaviour, location of signals, location of speed boards, brake release points and any changes to train operating conditions.

Drivers are trained and assessed in the operation of each locomotive type. This training consists of classroom instruction, in-field instruction and operation of the light engine working. The driver was assessed as competent in the operation of QBX locomotives on 3 September 2016.

The driver of 8960 had driven this route 31 times previously since the start of the year. The driver had also operated a further 20 different grain train configurations on this same route. The second person had also previously accompanied this driver and other drivers on this route. He said that he had done the trip between 15 to 20 times since 1 January 2017.

Neither crew member had previously experienced a runaway train incident. During interview, the driver said ‘you have to give that mountain a lot of respect’. Both crew members stated they understood the risks and were not complacent about the task of operating a loaded train down the Illawarra Mountain.

Qube restricted the speed of its freight services down the Illawarra Mountain to a maximum of 30 km/h. It stated in a work instruction^[9] that ‘the 65 km/h and 45 km/h speed boards between Mount Murray and Dombarton must be disregarded. The Sydney Trains speed board approaching Unanderra must also be disregarded. Train speed must not exceed 30 km/h’. Specific instructions and driving techniques were also detailed in this work instruction. This instruction states that ‘if the brake pipe pressure reduction needs to exceed 100 kPa in order to control the speed then you must:

• stop the train and apply the locomotives’ independent brakes
• apply sufficient handbrakes if required, before recharging the train brake
• fully recharge the train’s air brake system before releasing the independent brake.

In this case, the driver did not get the chance to follow this instruction as he only became aware there was a problem after the train had started running away. By this time, the train was travelling at 46 km/h and its speed was increasing. The window of opportunity to take action by completely stopping the train and applying the handbrakes on the wagons had passed.

The critical sequence of train management actions occurred after Summit Tank. The driver made ten air brake applications, which did not allow a full recharge of the train’s air brake system. This resulted in a loss of necessary braking capability to control the train’s speed on the steep descent.

When the driver applied the independent brake, at 12:46:41, it also deactivated the dynamic brake via a power knockout switch. When, ten seconds later, the driver applied the automatic brake controller to the full emergency this did not increase the braking effort as, by this time, the train air braking system was already fully applied. At this stage there was nothing further the train crew could do to reduce the speed of the train.

The driver understood that when he applied the independent brake the locomotive’s dynamic braking system would become inoperative. He stated that ‘it is the golden rule that you never put it into emergency on this mountain.’ When questioned at interview why he did so, he said that he panicked.

A few weeks after the incident, on 9 June 2017, an operational test was performed of the braking capabilities of a similar train between Moss Vale and Inner Harbour. This test was done with a similarly configured train—40 loaded CGSY wagons hauled by two QBX locomotives. However, this train was 3179 t, compared to 3680 t on the runaway train. There was no information provided in the test report regarding the condition of the brake slack adjustors and other braking components on the test train on 9 June 2017.

This test assessed the effectiveness of the current work instruction for the operation of freight services on this route. A representative of The Instruction Company, a training organisation responsible for the production of the Qube work instructions, was present and supervised the actions of the train crew. The train was operated according to the Qube work instruction. The train completed the journey without issue over the test route.

Brake performance

The locomotives, wagons and wagon brake system components were examined and tested a number of times both before and following the incident. While a number of minor faults were identified, overall, the train braking system complied with standards. Some of these checks and examinations are discussed below.

The train had undergone a number of inspections on its braking system before the incident.

• A qualified train examiner inspected the train at Bogan Gate the day before the incident.
• The train crew at Bogan Gate inspected the train after it was loaded and operated the train to Goobang Junction.
• Another train crew operated this train between Goobang Junction and Goulburn without problem.
• A qualified train examiner inspected the train at the Goulburn depot on the morning of departure without problem.
• The driver tested the brake pipe continuity in the Goulburn depot.
• The train crew conducted a roll by inspection as the train departed Goulburn.
• The train crew conducted a running brake test between Goulburn and Mt Murray.
• The train crew conducted a performance test of the train’s air brakes just past Summit Tank.

No issues or concerns were raised about the braking performance of 8960 on the day of the incident or the day before the incident when it was operated from Bogan Gate to Goulburn. The train examiners certificates, issued at Bogan Gate and Goulburn, indicated that the examined wagons were within specification.

Following the incident, the train was inspected a number of times. The summary of these tests are described below.

• The second person conducted a visual inspection immediately after the incident. A wagon with an extended brake piston travel, and worn brake shoes were noted (these were within the allowable metrics). The end of train marker was also confirmed as being in place.
• The Office of Transport Safety Investigations (OTSI) inspected the train approximately four hours after the incident. The brakes were still hot. No problems were identified with the exception of two wagons, which had worn brake blocks and excessive piston travel. There was no evidence of overheated brakes or wear.
• On the day after the incident, 23 April 2017, an independent brake engineer tested the brake retention time, brake pipe leakage rate and brake pipe continuity. All were within specification.^[10]
• As well as testing the train’s brakes, the brake cylinder piston travel lengths were measured on all 40 CGSY wagons. It found that seven piston lengths exceeded the Asset Standard Authority (ASA) criteria relating to piston travel. Qube stated in their report that as the train had been manually regulated the piston travel was not considered a contributing issue.
• On 1 May 2017, a single car air test (SCAT) was carried out on three randomly chosen wagons: CGSY 4502, CGSY 4507 and CGSY 4510. This test was conducted by an independent contractor. The tests found that the slack adjusters were ineffective. This can cause irregular braking forces if the piston lengths increase outside tolerances and they fail to take up or let out the slack. The issue with the slack adjusters was known to the operator and ‘due to their design have never been effective.’^[11] The slack adjusters have since been re-engineered but at the time they were manually inspected and regulated prior to every train journey between Goulburn and Unanderra.
• On 4 May 2017, the train was inspected by an independent railway bogie and braking engineer. The inspection found that apart from the known problem with the slack adjusters there were no other braking issues that may have affected the performance of the train. It found that the slack adjuster operation would not have contributed to the incident as adequate mitigation strategies had been put in place by CFCL Australia (CFCLA) and Qube.^[12]
• On 18 May 2017, an independent contractor measured the actual mass of a CGSY wagon. The total tare mass of a wagon (CGSY 4502V) was found to be 23.096 t. At this time, the Net Brake Ratio was calculated.^[13] The ASA standard stated that for composite brake blocks a fully loaded wagon should have a net brake ratio of 13 per cent minimum. The net brake ratio calculated for this wagon complied with ASA standards.^[14]
• On 23 May 2017, a brake control valve from CGSY 4502 was tested by an independent contractor to determine its operational suitability. The test found that the valve was able to make repeatable minimum and normal brake applications and hold applied pressure for 15 minutes. It was considered satisfactory for normal use.^[15]
• On 9 June 2017, a simulated braking performance test was conducted at Goulburn Workshops. This test was conducted by an independent brake engineer, an independent driver trainer, and an independent wagon maintenance expert. Other staff from Qube and CFCLA assisted. The test involved two QBX locomotives (QBX 4 and QBX 5) with 42 loaded CGSY wagons. Pressure gauges were fitted to the brake cylinder and auxiliary reservoir on three test wagons. A test gauge was also fitted to the brake pipe of the 42nd wagon. The purpose of the test was to simulate the brake applications and release made before the runaway to assess the train braking performance. The result was that the train braking system performed satisfactorily. It also showed that the brake applications made by the driver on the day of the incident may have been ‘less than optimal to ensure full recharge of the brake system’.

The investigation noted that there were anecdotal reports from drivers that train 8960 did not handle consistently. The braking performance of the train was criticised by the train crew during the interview. The driver said ‘normally it is not a very good braking train. Most of the other trains you take down the hill when you use balanced braking they go down nice and sweet. This one, it doesn’t do anything the same on each particular day it is always different. It is a lot different actually.’

The second person was also critical of the braking performance of the train. He said ‘I have been down there (Illawarra Mountain), with that train, same wagons, a different driver, I’ve had to wind ten handbrakes on it, we’ve pulled it up, it hadn’t stopped, we wound five (handbrakes) on and it didn’t make much difference. So when we did pull up eventually the second time, I went and put another five on.’

Another driver from Qube came forward and was interviewed. This experienced driver said that this train did not brake consistently. ‘One time I can’t fault it; next time I’m flat out stopping it.’

Despite the criticism of the train braking performance by the train crew and another driver, the testing found that the train’s braking system was operating and adjusted to within the specified standards current at the time of the incident.

Since the runaway incident, the ASA has modified the braking ratios for bulk type commodity wagons across the rail network. This change was not made as a result of this incident but, rather, due to the introduction of new coal hopper wagons, and testing that identified brake performance deficiencies.

At the time of the incident, the net brake ratio was specified as a minimum of 13 per cent for high friction composite brakes on freight vehicles. From 1 January 2018 this specification was raised to 16 per cent for bulk commodities. The minimum level of 13per cent is still permitted, provided the brake performance can be confirmed by a stopping distance test.

The standard states: ‘From 1 January 2018 for all new bulk commodity type wagons, such as grain hopper, coal hopper, ore hopper, and wagons that are commonly marshalled in unit train consist at their fully loaded condition (for example, container wagons used to haul grain), the higher figure of 16% net brake ratio should be used as the minimum. Figures of less than 16%, down to 13% net brake ratio as a minimum, may be accepted; however, the wagons will require a dynamic brake test in the loaded condition in a comparable consist to confirm that the train consisting of these wagons is able to stop within the brake performance curves applicable for the operating corridor. Generally these will be the GW16, GW30, and GW40 brake performance curves; refer to T HR RS 00830 ST.’ ^[16]

The ATSB has been informed, that since the incident Qube has not experienced any significant braking incidents with grain trains operating from Moss Vale to Port Kembla. This provides some evidence that the changes made since April 2017 have, to a large extent been positive. The changes have included both procedural changes to the operation of the train, as well as a design change refinement to the braking system on the CGSY wagons. It has been noted by the ATSB that whilst the component level checks have been made and procedure specific train loading and setup as per the April 2017 incident has not been recreated exactly, commercial logistics have precluded this to date.

Train loading

There were discrepancies between the recorded train load and the actual mass of the train. The train consist recorded gross tonnage for the 40 wagons as 3360 t (84 t per wagon). It appeared that the mass for each wagon was originally recorded as 92 t with a gross tonnage of 3680 t however this had been hand written over. The changes to the consist should have been signed or initialled by the train crew, but this was not done.

The mass recorded on the train consist was 10 per cent lighter than the actual mass of the load. While the total mass was within the allowable limits of the track infrastructure, the heavier load impacted on the braking performance of the train. The train crew, that took over at Goulburn, said that they noticed the consist had been altered, they also noticed the extra load as the train was coming out of Goulburn. This indicated that the train crew was aware of the extra load and its potential to affect train performance.

The tare (unloaded) mass of each wagon was designated as 22.2 t with a loading capacity of 68.8 t. The actual tare mass of a wagon (CGSY 4502V) was measured after the incident. It was 23.1 t, 900 kg over the tare mass of 22.2 t stencilled on the side of the wagon and that designated by the manufacturer. Typically, the greater the payload (up to the allowable limit) loaded into the wagon the better the economic return on the trip.

When the train was discharged at the Quattro facility at Inner Harbour, the wheat load was weighed at the facilities as 2784 t in total. The heaviest wagon contained 73.91 t and the lightest 45.49 t. The average was 69.6 t per wagon (see Figure 9). This meant that the wagon mass was 3708 t, an average of 92.7 t per wagon. When the extra wagon mass and the extra grain mass was added together there was an extra 349 t or 10 per cent more than what the consist recorded.

As specified in the Qube work instruction, a calculation that should be performed by train crew before departing is the Tonnes per Operative Brake (TOB).^[17] This will determine the braking effort required to control the train on the downward sections of the route. It is calculated by adding the mass of the locomotives to the total mass of the wagons, then dividing this by the number of wagons. In the case of 8960, it was the addition of locomotive 1 (134 t) with locomotive 2 (134 t) and the mass of consist (3360 t). This gives 8960 a TOB of 90.7. The work instruction states: ‘grain trains with a TOB that exceeds 80 generally require higher brake cylinder pressures to bring the train to a stop or to control the train speed. Train drivers need to be mindful of this requirement when operating down steep grades’.^[18]

The train crew were aware of the extra load of the train, the driver said ‘we ran the train at 80 km/h that day, you can tell as soon as you get out of Goulburn, an extra 300 t is a heavy weight. It felt heavy pulling along the flat.’ The extra mass placed an additional load on the braking system and affected the handling characteristics of the train.

Figure 9: Wagon mass

This figure shows the recorded and actual loading of the 40 wagons in the train consist. Source: Qube Logistics and Quattro grain facility. Calculations by ATSB

Risk management

The track section where the runaway occurred had a ruling gradient of 1 in 30. Unlike the Blue Mountains, west of Sydney, there are no relief sections of shallow gradients to allow for the recharging of the air brake system.

Until the mid-1990s, a dead-end siding was available near Dombarton to divert an uncontrolled train in the event of a runaway. This siding was a part of the former Dombarton crossing loop. Though not originally placed as a risk mitigation measure, it could act as such if required. The siding was subsequently removed on the basis that the brakes on modern rollingstock were more effective.

Other issues

The train was moved on soon after coming to a stand despite not being formally inspected for any faults by a suitably qualified person. This was after a request from Sydney Trains Wollongong Signalling Complex to move the train from the Sydney Trains network to Arrival Road 3 in Inner Harbour. The request was made to keep the passenger line open.

The driver said that he should probably have refused to move the train but ‘wanted to do the right thing’. It was probable the driver was still affected by the incident. While the train was operated safely at a low speed into Inner Harbour, after such a runaway event it would have been prudent to ensure the train was safe to be moved and have an alternative crew to operate the train.

In addition, the Pacific National Train Controller at Inner Harbour did not inform any ground personnel, in particular the Pacific National Illawarra shift leader, of the emergency event of a runaway train being directed into the terminal. The original joint decision by Sydney Trains and Pacific National was to route the train into the Number 1 Departure Road. This road is adjacent to fuel storage and office buildings and other options were not discussed or considered. The option of routing the train into Number 1 Departure Road was not used as the train came to a stand outside the terminal.

Remedial actions

Qube have undertaken a number of changes since the incident. These include the following changes:

• The QBX locomotives and CGSY wagons were initially suspended from service on the Goulburn to Inner Harbour route. After testing the QBX locomotives and the CGSY wagons were returned to service on the Goulburn to Inner Harbour route.
• QUBE train drivers are now competency assessed on the Moss Vale to Unanderra section of track every 6 months. If a train driver has not been rostered over the corridor within 6 months he or she must be reassessed on the corridor.
• All driver trainers are now competency assessed by an external Registered Training Organisation (RTO) on the Moss Vale to Unanderra section of track.
• Trainee train drivers are now briefed to the same level as a train driver before being rostered on the Moss Vale to Unanderra section of track.
• A training audit for assessing train handling strategies on the corridor has been conducted. This has resulted in the instruction being amended.
• The recommencement of diesel and air brake refresher training for train crew was undertaken.
• An RTO was engaged to develop an improved training package. The first train crew to be trained were the train crew on the Goulburn to Unanderra line.
• An RTO was engaged to review QUBE Work Instruction WI-540 Train Management Moss Vale to Inner Harbour.
• A QUBE investigation officer, since the incident, has conducted weekly audits of trains operating between Moss Vale and Inner Harbour.
• Regular scheduled datalogger downloads have commenced for trains between Moss Vale and Unanderra.

As a result of this incident, Pacific National have undertaken a number of changes since the planned movement of 8960 into its facilities. These include the following changes:

• Review with Sydney Trains the plans and procedures enacted in emergency events, and the decision making process to move Qube Trains from Sydney Trains network to Inner Harbour.

• Review training for Train Controllers to ensure the protocols for an emergency event are followed, and risks are managed, for example: depot evacuation, and escalation process is followed.

  __________

  •  
    9. Qube Logistics Work Instruction. Moss Vale to Inner Harbour Train Management. WI-540. Version 3.0 Issued 14 September 2016.
    10. AR Ball Rolling Stock Maintenance Pty Ltd. CGSY Braking System Incident Moss Vale to Unanderra line. 22 April 2017.
    11. QUBE Logistics. Initial Investigation Report FM-512. Version 1. Issued 1 June 2017.
    12. SNC-Lavalin Rail & Transit Pty Ltd. Report of Bruce Sismey.10 May 2017 amended on 1 November 2017.
    13. The net brake ratio is the ratio of the sum of the measured actual brake block forces in kilograms divided by the total vehicle mass, in kilograms.
    14. Asset Standards Authority NSW. T HR RS 00400 ST RSU 400 Series – Minimum Operating Standards for Rolling Stock – Freight Vehicle Specific Interface Requirements. Version 2.0. Issued 24 August 2017.
    15. Wayne Clift Consulting Pty Ltd. Test report for control valve from CGSY 4502. Issued 25 May 2017.
    16. Asset Standards Authority NSW. T HR RS 00400 ST RSU 400 Series – Minimum Operating Standards for Rolling Stock – Freight Vehicle Specific Interface Requirements. Version 2.0. Issued 24 August 2017.
    17. Qube Logistics Work Instruction. Moss Vale to Inner Harbour Train Management. WI-540. Version 3.0 Issued 14 September 2016.
    18. Ibid.

Findings

From the evidence available, the following findings are made with respect to the runaway incident involving train 8960, between Dombarton and Unanderra, New South Wales on 22 April 2017. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The train was loaded by approximately 10 per cent more than that recorded on the train’s consist, it is probable that the additional mass placed an extra load on the braking system and affected the handling characteristics of the train.
• Train 8960 was not operated down Illawarra Mountain in accordance with the operator’s work instructions. After passing Summit Tank the driver made ten brake applications and the brake system was never permitted to fully recharge again before the brakes were reapplied. This resulted in a loss of control of a train on a steep descent. The incident was further compounded when the driver’s actions caused the locomotive’s dynamic braking effort to be deactivated, further reducing control of the train.

Other factors that increased risk

• The Sydney Trains’ train controller directed the driver of train 8690 to move the train from the Sydney Trains network to Inner Harbour without any formal inspection of the train following the runaway event.
• The Pacific National Train Controller did not inform Inner Harbour ground personnel of the emergency event of a runaway train being directed into the terminal.

Other findings

• The train crew of 8960 was experienced and fully qualified. The crew had travelled this route down the Illawarra Mountain on numerous occasions.
• The train braking system was operating within the required specifications.

Safety issues and actions

Loading of train

Safety issue number: RO-2017-001-SI-01

The train was loaded by approximately 10 per cent more than that recorded on the consist, it is probable that the additional mass placed an extra load on the braking system and affected the handling characteristics of the train.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Australian Rail Track Corporation
• CFCL Australia
• Pacific National
• Office of National Rail Safety Regulation
• Qube Logistics
• Sydney Trains
• Transport for NSW

References

AR Ball Rolling Stock Maintenance Pty Ltd. CGSY Braking System Incident Moss Vale to Unanderra line. 22 April 2017.

Asset Standards Authority NSW. T HR RS 00400 ST RSU 400 Series – Minimum Operating Standards for Rolling Stock – Freight Vehicle Specific Interface Requirements. Version 2.0. Issued 24 August 2017.

Australian Wheat Board (AWB) Wagon loading instructions. Issued by El Zorro No. 002 31 October 2010.

CFCL Australia. CGSY Wagon data sheet. Issue No. 1.

Downer Rail. Engineering Report CER02691CSGY Wagon Specifications. Issued 14 June 2017.

Lacterus Verus Pty Ltd. Report into the braking system performance of QBX 003 locomotive on 22 April 2017. 23 May 2017.

Office of National Rail Safety Regulator. Guideline for the top event classification of notifiable occurrences – OC-G1. 2008.

OTSI Investigation Report 04505 (2011) Uncontrolled movement of El Zorro grain service 3996 Unanderra 7 February 2011.

Pacific National Incident Report – Dombarton to Unanderra, to Inner Harbour. 31 August 2017.

QUBE Logistics. Initial Investigation Report FM-512. Version 1. 1 June 2017.

Qube Logistics. Work Instruction WI-540 Moss Vale to Inner Harbour Train Management. Version 3.0. 14 September 2016.

SNC-Lavalin Rail & Transit Pty Ltd. Principal author Bruce Sismey. 10 May 2017 amended on 1 Nov 2017.

Sydney Trains. Incident Information System Management - Incident Report 43. 24 April 2017.

The Instruction Company. QLRS Train Braking Procedures Moss Vale to Inner Harbour – Participants Workbook. Version 1.0. 10 June 2017.

The Instruction Company. Report on 9 June 2017 test run Goulburn to Inner Harbour. 15 June 2017.

Wayne Clift Consulting Pty Ltd. Test report for train braking simulation on 9 June 2017. 26 May 2017.

Wayne Clift Consulting Pty Ltd. Test report for auxiliary reservoir fill times on CGSY 4502. 26 May 2017.

Wayne Clift Consulting Pty Ltd. Test report for control valve from CGSY 4502. Issued 25 May 2017.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Australian Rail Track Corporation, CFCL Australia, Pacific National, the Office of National Rail Safety Regulation, Qube Logistics, Sydney Trains, and Transport for NSW.

Submissions were received from the Office of National Rail Safety Regulator and CFCL Australia.

The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 6 April 2016, Pacific National (PN) grain train 5422N parted at Parkville on the Main North Line. A fractured yoke on the trailing end of the fifth wagon allowed the yoke pin to fall out and the coupler shank to disengage from the wagon. The coupler shank fell into the four foot of the track and damaged the underbelly discharge doors on 10 wagons as the train progressed over the coupler. Approximately 10 tonnes of barley was released from the wagons as a result. The trailing wheelset on the thirteenth wagon was derailed, then ran in a derailed state for approximately 45 metres causing damage to several track sleepers before the train came to a stop. Regular services were able to continue under caution past the incident site via the adjacent crossing loop. Wagon recovery and track repairs was completed without any further incident.

What the ATSB found

A draftgear component (the yoke), that was not compliant with a PN maintenance standard, was not identified during a maintenance inspection and re-entered service undetected. The yoke was an earlier design and susceptible to fatigue failure. PN had identified the issue and completed a programme to replace this yoke design across their grain wagon fleet however, the yoke on this wagon had been overlooked.

What's been done as a result

PN issued an additional Rolling Stock Notice to their maintenance teams to advise of the incident and to mandate that all yokes in the grain wagon fleet were checked to ensure no yoke of this design remained in service.

Safety message

Maintenance systems must ensure that when a non-compliant component is identified as needing replacement, all such units are located and replaced.

Figure 1: 5422N at Parkville

Source: ATSB

The occurrence

At 0230 on 6 April 2016 PN grain train 5422N parted at Parkville (approximately 322.350 km^[1]) on the Main North Line, Hunter Valley, NSW. The train parted due to a fractured yoke (in the draw gear assembly) on the trailing end of the fifth wagon (NGKF 35898X). The crew of 5422N comprised of a driver and second person.

The fractured yoke allowed the yoke pin to fall out and the coupler shank to disengage from the wagon. The coupler shank fell into the four foot of the track and damaged the underbelly discharge doors on 10 wagons as the train progressed over the coupler. Approximately 10 tonne of barley was released from the wagons as a result.

The trailing wheelset on the thirteenth wagon was derailed when the fallen coupler struck the wagon’s fourth axle. The wheelset ran in a derailed state for approximately 45 metres before both parts of the train came to a stop. A number of track sleepers were damaged during the incident.

The driver notified the Network Control Officer Upper Hunter 2 (NCO) that 5422N was stopped approximately 80 m from signal 06-12M. The driver told the NCO, he had experienced a sudden loss of air from the train which led him to believe the train had parted.

The second person conducted a walking inspection of the train and radioed the driver that the train had parted behind the sixth wagon and he could not see the remainder of the train.

The driver advised the NCO that an adjacent train in the Parkville crossing loop was not to move as he could not confirm the location of his detached train. The NCO told the driver of 5422N that he would warn the other train of the incident. The NCO also advised the driver that based on his indicator board, the two portions of the train were between the two yard signals and the line was clear for the other train to come out of the crossing loop.

With that knowledge, the NCO cleared the signal for the other train to depart from Parkville crossing loop. The second person continued his inspection and found the detached portion of 5422N and the flashing tail light marker^[2] on the final wagon, confirming the train was clear of the yard signals.

The driver asked the NCO for confirmation of track protection for 5422N. The NCO confirmed that protection of the train was being provided by the yard signals being blocked^[3].

The second person secured the detached portion of 5422N by applying the handbrakes on all wagons. The driver secured the locomotives and the front wagons of the train.

At approximately 0400 the NCO informed the driver that a Condition Affecting the Network (CAN) had been issued.

The driver and second person were post incident drug and alcohol tested and ceased duties for the rest of their shift in accordance with PN procedures. Both crew members returned a negative result from the post incident testing.

Site clean up started at approximately 1500. PN arranged for the damaged wagons and the spilled barley to be cleared from the site. PN then shunted the two portions of 5422N and re-railed the derailed wagon.

At 0210 on 7 April 2016 Australian Rail Track Corporation (ARTC) track maintainers were able to commence emergency track repairs and were completed by 0600. In accordance with ARTC procedures, a temporary speed restriction of 40 km/h was placed on the main line through Parkville to allow operations to continue.

__________

1. Distances are measured from platform 1 at Sydney’s Central station.
2. A flashing tail light marker is placed on the end of all PN trains to indicate the end of a train consist.
3. The term “blocked” signal indicates the signal has been protected from the signal being changed.

Context

Incident location

Parkville is located between Scone to the south and Murrurundi to the northwest (see Figure 2). Train 5422N was travelling from Werris Creek to Carrington Grain Terminal near Newcastle on the Main North Line. The incident occurred adjacent to the township of Parkville in the Upper Hunter region of NSW.

Figure 2: Incident location map

Source: Geoscience Australia, annotated by ATSB

Rail infrastructure information

There are two tracks at Parkville, namely a main line and a crossing loop. A single, bidirectional line connects Parkville and Murulla to the north. The track from Murulla to Parkville is predominantly on a falling grade or downhill (see figure 3). Murulla sits between Murrurundi and Parkville at approximately 339.4 km.

Figure 3: Curve and Gradient diagram of track between Murulla and Parkville

Source: ARTC, annotated by ATSB

Safeworking system

The safeworking system in place was Centralised Traffic Control (CTC). In this system, lineside signals and associated track circuits allow the NCO, from the control centre at Broadmeadow, see the location of any given train operating along the Main North Line.

Train information

5422N was a loaded grain train consisting of 40 wagons and hauled by three locomotives. It was approximately 636 m long with a mass of 3040 tonne excluding the locomotives. It was typical of many grain trains working throughout NSW.

The yoke and draw gear assembly

The yoke is an integral component of a wagon’s draw gear assembly. While a number of different designs are in service, they are all designed to retard the train’s longitudinal draft and buffering^[4] forces. The major components of a draw gear assembly are typically: coupler shank, buffer package, yoke and yoke pin (see Figure 4).

The yoke houses the buffer and is connected to the coupler by a pin or key (in this case a pin). The yoke is a part of the draw gear and transmits draft and buffering forces between wagons. Under compression, the force is transferred between the back-strap of the yoke and the wagon. In operation, the back-strap is subjected to repetitive loads. To mitigate against this effect, later yoke designs (post-1980) have internal rounded smooth radius fillets at high stress locations which are better able to withstand the cyclic stresses that are imposed on these areas. The later yokes are manufactured from a higher tensile steel.

The yoke in this incident was a pre-1980 design made from a lower tensile steel and without rounded smooth radius fillets in the high stress locations.

Figure 4: Draw gear assembly - fixed view (above) and exploded view (below)

Source: ATSB

Maintenance systems

PN has maintenance systems in place to manage it’s total wagon fleet of approximately 15,000^[5] wagons, across several locations in Australia.

PN was aware that the early design yokes (in grain wagons manufactured before 1980) needed to be removed from their fleet and replaced with later design yokes made from higher tensile steel and with internal rounded smooth radius fillets.

As such, specific instructions in PN’s Wagon Maintenance Manual (WMM) had been developed to provide instruction to PN’s wagon maintainers to identify and change out the early-design yokes as the wagons came in for preventative maintenance.

Site observations

ATSB observed the train had parted five wagons behind the locomotive (see Figure 1). The draw gear assembly was missing from the rear of the fifth wagon, NGKF 35898X (see Figure 5). The coupler shank was found under the rear axle of the rear bogie of the sixteenth wagon, NGKF 35864R (see Figure 6).

Figure 5: Location for draw gear assembly

Source: ATSB

Figure 6: Coupler shank in four foot

Source: ATSB

The bottom discharge doors on 10 wagons had been damaged. Approximately 10 tonne of barley had spilled from the wagons (see Figure 7).

Figure 7: Wagon doors and spilled grain

Source: ATSB

The coupler shank struck the axle of the trailing wheelset on the thirteenth wagon, NGPF 36032J. This resulted in the wheelset derailing near the crossing loop (see Figure 8). The wheelset travelled in a derailed state for approximately 45 m, damaging a number of concrete sleepers, before coming to a stop. (see Figure 9).

Figure 8: Derailed wheelset

Source: ATSB

Figure 9A: Damaged concrete sleepers

Source: ATSB

Figure 9B: Other damaged concrete sleepers

Source: ATSB

__________

4. Draft and buffering forces refer to the tensile and compressive forces between wagons.
5. This figure includes grain, coal and container wagons. Approximate figure provided by Pacific National.

Safety analysis

The ATSB found that a draftgear component (an older design yoke), that was not compliant with a Pacific National (PN) maintenance standard, and not identified during a periodical wagon maintenance inspection and the yoke re-entered service undetected.

PN had a system in place to remove this early design yoke from their grain wagon fleet and replace it with a later design yoke better suited to the application. However, this yoke had been overlooked by the wagon maintainers and consequently continued in service up until its failure on 6 April 2016.

The yoke fitted on the rear of the fifth wagon, NGKF 35898X, was of an early design and was known to be susceptible to fatigue failure. The undetected older style yoke eventually failed in-service and led to the train parting and the subsequent derailment (see Figure 10).

While the train data logger information indicated that some brake applications on 5422N did not comply with PN procedures, ATSB concluded train handling did not contribute to the incident. After the yoke pin fell out of the assembly, the downhill operation most likely kept the two portions of the train together until the train negotiated a slight uphill gradient at Parkville. Here the train experienced a longitudinal tensile load that allowed the two portions of the train to separate.

The track leading to the incident site was inspected by a track specialist on behalf of PN. It was concluded there were no track defects or anomalies that could have contributed to the incident.

Figure 10: Event sequence

Source: ATSB

Yoke failure

The yoke from wagon NGKF 35898X had a manufacture date stamp ‘10/71’. NGKF wagons were manufactured in 1976. The yoke was approximately five years older than the wagon itself. It was therefore, likely that this yoke was the original yoke fitted to this wagon.

The yoke design had recently been identified by PN as having a finite life due to a propensity to fatigue failure. The tensile strength of the parent metal and the lack of internal rounded relief fillets in high stress areas of the yoke contributed to this issue.

The yoke had fractured at the rear section where the top and bottom longitudinal straps connected with the backing face (see Figure 11).

Figure 11: Fractured yoke

Source: Bureau Veritas, annotated by ATSB

PN commissioned Bureau Veritas (BV) to conduct a metallurgical examination to identify the nature of yoke’s failure mechanism. The examination identified that the yoke had failed due to fatigue cracking which had initiated at multiple points on the inner face of the top yoke strap (see Figure 12). Fatigue cracking had progressed through approximately 85 per cent of the material’s cross-section before the ductile failure of the remaining material. The bottom yoke strap subsequently failed with approximately 10 per cent of the material’s cross-section subject to fatigue cracking before the ductile fracture, failing after the top arm failed.

The BV report stated that:

‘it was suspected that the fracture may be due to a material with low toughness properties^[6] being in service for a long time, which was exposed to cyclic stress.’

The BV metallurgical examination focussed on the material properties and while it did not review the design of the component, the report did note that “stresses are concentrated at the critical regions (e.g. radius relief groove, curves, thickness change)”.

Figure 12: Fracture faces of yoke

Source: Bureau Veritas including annotation

Fatigue cracking in yokes

Other research has been conducted into fatigue cracking and stresses in yokes in heavy haul services^[7]. Cookson et al 2013, identified a propensity for fatigue cracking in yokes due to the vertical oriented bending of the draft system. This vertical oriented bending in yokes was considered most likely due to misalignment in the draft system. As such, identifying misalignment in the draft system was considered important as it could affect the overall service life of the yoke.

It was noted that PN’s Wagon Maintenance Manual (WMM) 07-02_09 (dated 7 May 2009) Couplers and Draft Gear Maintenance makes reference to checks for alignment when inspecting varous parts of the draft system, including; the knuckle, coupler shank, the yoke strap and drawgear carriers.

Wagon maintenance

The periodic maintenance program in place for PN’s grain wagons was developed to ensure reliable and safe operation of the wagons.

WMM 07-02_09 sets out the maintenance requirements for wagon couplers and draft gear. Section 1.9 deals with yokes and it includes the following:

• Yoke straps are to be inspected for cracking
• Where video/borescopes are available these shall be used to detect cracking in yoke straps.
• If cracking is found (in the internal radius locations) the yoke shall be scrapped

Further, Section 1.9.4 makes specific reference to earlier design yoke straps:

‘Wagons manufactured before 1980 used lower grade steel in the draft gear castings and do not have a relief fillet in the rear top and bottom inside corners as identified in the picture below (see Figure 13) (i.e. sharp radius). Replace these when found.’

Additionally, while wagons with a draft capacity of less than 1.3 MN were excluded from this last requirement, NGKF 35898X had a draft capacity of 1.8 MN.

These requirements specified in PN’s WMM suggests the yoke on wagon NGKF 35898X should have been identified and replaced at the last maintenance intervention.

Figure 13: Yoke inspection areas

Source: PN WMM 07-02

It is worth noting the task requirements on wagon maintainers when required to inspect a unit train consist^[8]. When a unit train consist is scheduled for maintenance, such as the B inspection^[9], the consist is scheduled into a maintenance centre for usually 24 hours before being scheduled onto its next service.

In this time the wagon maintainer would need to attend to a list of items and either, test, service or lubricate, replace, adjust, gauge, measure or inspect each of these items on each wagon (for grain unit train consists, 40 wagons). The list of items to attend to on the B inspection sheet is 92 items.

Additionally, the location of the yoke in situ makes it challenging for the wagon maintainer to identify cracking in the yoke. As pictured in Figure 14, the wagon maintainer is required to inspect the highlighted areas. As Figure 15 shows, the access to view these areas while the yoke is in situ is difficult and potentially restricted by time constraints in the maintenance opportunity.

Figure 14: Yoke inspection areas

Source: PN WMM 07-02

Figure 15: Yoke in situ

Source: ATSB

Train handling

The yoke pin was found nearly 6 km before Parkville. There was a constant falling grade towards Parkville and the train driver was using dynamic braking to control train speed. Therefore, the wagons of the train generally remained in a compressed state ensuring the train did not part.

On account from the driver, there is a slight incline after Wingen just prior to the downhill into Parkville. At this point the driver allowed the train to roll freely through the section of track to maintain speed. This coincides with a releasing of the buffering or compressive forces in the draw gear. The yoke pin most likely fell from the train at this point which is where it was found during inspection post incident (see Figure 16).

The train was able to continue without a mechanical connection through to Parkville as compressive forces kept the train and brake air hoses together on the downhill into Parkville. However, as the train rolled into Parkville at approximately 60 km/hr, the driver reduced dynamic braking to account for the slight incline to the middle of the yard which is when the train parted, seperating the air hoses. This enabled the brakepipe to vent to atmosphere, triggering an emergency brake application which brought both parts of the train to a stop.

The train handling in the lead-up to the incident was not considered a contributing factor to the incident.

Figure 16: Yoke pin lying in the four foot

Source: ARTC including annotation

Previous incidents

PN reported that, over the five years preceding the incident, there were 14 incidents of trains parting due to defective yokes. These incidents occurred between 2011 and 2016. There were a further 13 wagons that had their yokes replaced during maintenance between 2011 and 2012. No older style yokes were detected after that date until this incident in 2016.

Pacific National investigation

PN conducted a safety investigation into the incident at Parkville. PN’s internal Investigation Report (Form PN-FOR-SAF) dated 10 May 2016 identified that the incident wagon (NGKF35898X)

‘underwent regular maintenance and inspection as per WMM 01-01b_05 Bulk Services Division Services Schedule of Inspections; however, the early model yoke strap on this wagon was not identified or replaced (as per WMM 07-02_09).’

Two of the preventative actions in the report were:

• To develop and issue a Rolling Stock Notice (RSN) to all wagon maintenance and engineering teams to reiterate required inspections on early model yokes on wagons and replacement of specified parts.
• Develop a safety alert detailing the contributing factors for derailment and distribute to NSW/Vic operations.

ATSB requested PN to demonstrate that the actions had been completed. PN notified the ATSB that the first two items had been closed out by issuing a single RSN (see Appendix A) to wagon maintainers.

__________

6. Toughness properties: The ability of a material to absorb energy and plastically deform without fracturing.
7. Fatigue Cracking and Stresses in Yokes in Heavy Haul Service 10th International Heavy Haul Association Conference, 2013; Cookson J.M., MacNish A., Baartz M. Institute of Railway Technology, Monash University, Melbourne Australia
8. A unit train consist is the entirety of the train, less the motive power. For grain unit train consists, there was typically 40 wagons. These wagons would remain together for operational and maintenance efficiencies.
9. The B inspection is a maintenance opportunity to apply PN’s maintenance standard WMM 01-05.

Findings

From the evidence available, the following findings are made with respect to the derailment of grain train 5422N at Parkville, NSW on 6 April 2016. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

• The yoke was an earlier design prone to failure through fatigue cracking.
• The presence of the earlier design of yoke on wagon NGKF 35898X was not detected during preventative maintenance activities.

Other factors that increased risk

Nil

Safety issues and actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety actions in order to reduce their safety risk. The ATSB has been advised of the following safety actions in response to this occurrence.

Preventative maintenance systems

Safety issue: RO-2016-004-SI-01

The presence of the earlier design of yoke on wagon NGKF 35898X was not detected during preventative maintenance activities.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• The Australian Rail Track Corporation Ltd.
• Office of the National Rail Safety Regulator
• Pacific National

Submissions

Nil

Appendices

Appendix A – Pacific National Rolling Stock Notice

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2018 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 23 September 2015, two Pacific National terminal operators and the train crew were completing a shunt of train 4MW2 at the Sydney Freight Terminal. After detaching the remaining wagons, the train crew moved the five locomotives toward the end of the stabling road, where a shunt driver was waiting trackside to take over. After stopping, the train crew exited the cab and alighted from the lead locomotive. The train crew had left the locomotive independent brake handle fully applied but did not operate the park brake prior to leaving the cab.

The shunt plan required two of the five locomotives to be uncoupled and stabled. In readiness to uncouple, one of the terminal operators entered between the locomotives and isolated the air taps, disconnected the train hoses and lifted the coupling pin to the two trailing locomotives. Neither the train crew nor shunt driver realised that the rear two locomotives had been uncoupled. Shortly after, the shunt driver boarded the lead locomotive and in conjunction with the other terminal operator moved the front three locomotives to another area of the terminal. The two trailing locomotives remained at the end of the road, unattended by a qualified worker.

Shortly before 1751, sufficient air had bled from the brake cylinders to allow locomotives NR24 and NR12 to begin to roll away. The locomotives continued to roll uncontrolled through the Sydney Freight Terminal before exiting into the Australian Rail Track Corporation network. The locomotives travelled a short distance on the Down South Fork before coming to rest at Chullora West Junction. There were no injuries or damage due to the run away.

What the ATSB found

The ATSB found that a combination of individual action and ambiguous radio communications resulted in a breakdown of controls to prevent an uncontrolled movement of rolling stock. The interface coordination arrangements at the eastern interface between Pacific National and the Australian Rail Track Corporation were ineffective in capturing an uncontrolled movement before exiting the Sydney Freight Terminal.

What's been done as a result

The Australian Rail Track Corporation have issued instructions for the restoration of points at the interface following each movement and commenced investigation into the feasibility of automatic resetting of the points at that location.

Pacific National undertook toolbox briefings and issued Business Safety Notices restricting terminal operators from uncoupling locomotives and reinforcing the importance of applying communications and shunting procedures.

Safety message

Rail transport operators and rail safety workers must ensure the correct and consistent application of communication protocols and procedures when undertaking safety critical work, such as detaching and securing unattended locomotives.

The occurrence

On 23 September 2015, Pacific National (PN) freight train 4MW2 departed Melbourne and travelled along the Interstate Main Line via Junee and Goulburn toward Sydney. Within the Sydney area, 4MW2 traversed sections of the Australian Rail Track Corporation (ARTC) Southern Sydney Freight Line and the Metropolitan Freight Network en route to, the PN Sydney Freight Terminal (SFT) at Chullora (Figure 1). Train 4MW2 consisted of five locomotives hauling 76 wagons.

Figure 1: Location of Pacific National Sydney Freight Terminal

Map of Sydney area showing various passenger and freight rail lines. Train 4MW2 travelled along the rail line from Goulburn through Cabramatta then toward the Pacific National Sydney Freight Terminal at Chullora. Source: Geoscience Australia, annotations by ATSB

At about 1657,^[1] as train 4MW2 approached Chullora, the co-driver contacted staff at the SFT by radio seeking instruction on the final destination road^[2] for the train within the terminal. A terminal operator waiting for the arrival of 4MW2 informed the train crew that it was to enter the EPA1^[3] road in preparation for shunting.

At about 1658, train 4MW2 arrived at the EPA1 road where the terminal operator further advised the train crew that there were no local relief train crew available, and that they would need to assist in the shunt of train 4MW2. The train crew, in conjunction with two terminal operators then commenced a series of shunt movements onto the various EPA roads. The terminal operators coordinated with each other to control the shunt and to uncouple and secure the required wagons in accordance with the shunt plan for that train.

After completing the shunt movements to the EPA roads, a terminal operator instructed the train crew to push the remainder of the train to the number 9 road. Number 9 road was located adjacent to the gantry crane roads in another section of the SFT.

The train crew, with the assistance of the terminal operators, moved the five locomotives and remaining wagons to the gantry crane area and toward the dead end of the number 9 road. The terminal operators again coordinated with each other to position the shunt movement along the road.

Around this time, a SFT shunt driver was working on number 6 road testing the air brake system of a rake of wagons in the gantry crane area. On completing the testing, the SFT shunt driver moved the shunt locomotive to the entrance of the number 6 road, secured it and took a short rest break.

At about 1734, a terminal operator (TO1) uncoupled and secured the remaining wagons from the locomotives. The same terminal operator also contacted the train crew to ask where they wanted to leave the back two locomotives (NR24 and NR12), as the shunt plan had also listed them to be detached, but did not specify the final road. The locomotive driver replied that they wanted to leave all five locomotives and get off. Shortly after, the other terminal operator (TO2) who was at the opposite end of the wagons situated at the dead end of number 9 road interrupted, suggesting that the locomotives be moved to the entrance of number 9 road where the SFT shunt driver could take over from the train crew and finish the shunt of the locomotives.

The train crew subsequently moved locomotives (NR91, NR82, AN8, NR24, and NR12) forward toward the entrance to the number 9 road. The driver applied the independent brake^[4] fully, stopping the locomotives adjacent to the SFT shunt driver. The SFT shunt driver on returning from the rest break overheard a conversation between the terminal operators and train crew that he was to take over the locomotives on number 9 road. The SFT shunt driver then waited trackside adjacent to number 9 road.

As the terminal operator (TO1) continued to secure the detached wagons, the other terminal operator (TO2) moved from the dead end of number 9 road to meet the five locomotives that were now stationary at the entrance of number 9 road. The terminal operator (TO2) knew that the back two locomotives were to be detached but did not know the final road for stabling. The SFT shift manager and terminal operator briefly discussed arrangements for the two locomotives and decided to leave them on number 9 road where a local train crew would attend to them when available, about 30 minutes later.

Once adjacent the locomotives, the terminal operator (TO2) went between locomotives AN8 and NR24, disconnected the air hoses to the main reservoir and brakes, and lifted the pin in the coupler. Immediately after completing this task, the terminal operator departed the area to take a meal break. There was no direct communication between the terminal operator and train crew or SFT shunt driver, so the drivers were unaware that the terminal operator had entered between the locomotives and undertaken this task.

About the same time, the train crew were in the process of alighting from the lead locomotive and meeting with the SFT shunt driver, who was standing on the ground adjacent to the locomotives. After discussing the operational state of the five locomotives, the train crew departed and the SFT shunt driver boarded the lead locomotive.

Shortly after, the terminal operator (TO1), who had completed securing the wagons that were detached earlier, joined the SFT shunt driver. The terminal operator and SFT shunt driver then moved locomotives NR91, NR82, and AN8 from number 9 road. Neither the shunt driver nor terminal operator was aware the locomotives had been uncoupled. Locomotives NR24 and NR12 remained on the number 9 road and unattended by a qualified worker.

About 8 minutes later, sufficient air had leaked from the brake cylinders to allow locomotives NR24 and NR12 to commence rolling away. The locomotives continued an uncontrolled movement through the SFT traversing a number of roads and trailable points^[5], reaching a maximum speed of about 21 km/h within the yard.

The locomotives continued toward the eastern interface point between the SFT and the ARTC network. While signal ED288 was set to stop, the points at the interface were set to direct rail traffic toward the ARTC Chullora West Junction.

At about 1751, locomotives NR24 and NR12 passed signal ED288 at stop. This generated a Signal Passed at Danger (SPAD) alarm at the ARTC Network Control Centre South (NCCS) in Junee. About a minute later, the locomotives passed a further signal (ED278), generating another SPAD alarm.

The NCCS NCO contacted the SFT shift manager to identify the train movement that triggered the SPAD alarms. The SFT shift manager confirmed that there was no shunting operation occurring in that area, but would investigate the source of the SPAD alarms. At about 1759, the SFT shift manager confirmed to the NCO that two locomotives (NR24 and NR12) had run away and exited the SFT. The locomotives came to rest with the front of the lead locomotive (NR24) located at about the 17.407 km point^[6] on the Down South Fork of the Chullora West Junction.

The SFT shift manager dispatched Pacific National staff from the SFT to take control and secure the locomotives. The locomotives remained at that location until ARTC and Pacific National staff had inspected the track sections traversed by the locomotives. There was no damage identified to either the locomotives or track.

At about 2035, locomotives NR24 and NR12 cleared from the ARTC main line to the interface area and back towards the SFT.

__________

1. The 24-hour clock is used in this report and is referenced from Eastern Standard Time (EST).
2. The term used to describe a designated rail track within the terminal area or shunting yard.
3. Term EPA relates to the Pacific National naming convention for an area of the Sydney Freight Terminal.
4. Brake that acts on the locomotive independently from the rest of a train
5. Points designed to permit a trailing movement through points closed against the intended move. The wheel set opens the points which spring back to the normal position after the wheel set is through.
6. Point on the MFN referenced from the kilometre change location at Marrickville Junction

Context

The location

The SFT was located at Chullora in Sydney, NSW at about the 19.828 km point on the ARTC Sydney Metropolitan Freight Network (Figure 2). Rail access from the Sydney Metropolitan Freight Network (MFN) to the western and eastern extremity of the SFT was available via turnouts located at Enfield West and the Chullora West Junction respectively. The ARTC Network Control Centre South (NCCS) at Junee controlled rail operations along the MFN and at the interface with the private sidings at Chullora.

Figure 2: ARTC Sydney Rail Freight Corridors

Figure illustrates the various main line track arrangements in the Sydney area and relative location of Chullora and the Chullora West Junction. Source: Australian Rail Track Corporation, annotations by ATSB

Train and train crew information

Train 4MW2 consisted of five locomotives (NR91 leading, NR82, AN8, NR24 and NR12) and 76 wagons. The train was 1501 m long and had a trailing mass of 3132 t. The trailing mass included the locomotives AN8 and NR24 because they were setup as ‘off line’. Train 4MW2 was crewed by a driver and co-driver.

In conjunction with the train crew, two terminal operators and an SFT shunt driver also undertook various activities in the shunting of 4MW2 within the terminal. Post incident, the train crew of 4MW2, two terminal operators and the SFT shunt driver underwent preliminary testing for the presence of alcohol or a drug^[7]. The result of this testing was negative.

The locomotive drivers and terminal operators held PN qualifications for shunting rolling stock and using communications systems. An examination of the health assessment records confirmed that their health assessments were current and that each satisfied the standards prescribed by the National Standard for Health Assessment of Rail Safety Workers.

Chullora – Private Sidings

The Chullora area contained four private sidings^[8] that interfaced with the ARTC MFN at five locations (Figure 3).

The PN Sydney Operations Yard was a private siding with an eastern and western interface to the ARTC network. Motorised point machines on the turnout at each interface may be set to direct an uncontrolled movement (runaway) toward a dead end track section. The NCO controlled the points and signals at the interface locations remotely from the NCCS.

The NCO also controlled rail movements at the interface with the other private sidings by providing a release from the NCCS. The release enabled a qualified employee to set the points by operating the associated local ground frame^[9].

A motorised catch point^[10] was located at the eastern boundary of the Chullora interface area to protect the ARTC network from an uncontrolled rolling stock movement (runaway) from the private sidings entering the Down south fork and Down Main line. The ARTC controlled the signals, catch-point, and all other motorised point machines at the Chullora West Junction remotely from the NCCS.

Figure 3: Track arrangement at Chullora West Junction

Figure illustrates the main line track arrangement at Chullora Junction including the interface connections to the Pacific National Sydney Operations Yard and other private sidings. Source: Australian Rail Track Corporation annotations by ATSB

ARTC/PN Interface coordination – Sydney Freight Terminal

An interface agreement^[11] stipulated the arrangements for the joint management of the operational risk at the ARTC/PN boundary. The interface agreement was in draft, dated 23 April 2015. The risk assessment of operational hazards in the draft agreement identified no site-specific risk factors that raised the generic ARTC corridor risk rating above low.

The PN risk assessment for the SFT^[12] access and egress through the interface boundary identified the hazard of unauthorised entry or exit of a train to/from the SFT. An unauthorised movement may take the form of a train operated by a driver or rolling stock (locomotive or wagon) that is uncontrolled. The risk assessment identified various controls requiring the driver to comply with signal indications and approval protocols that permitted access/egress through the interface. For an uncontrolled rolling stock movement approaching the interface, the risk control relied on diverting the rolling stock away from the interface area.

At the eastern end of the SFT, motorised points adjacent signal ED288 provided the control mechanism to divert rolling stock toward a dead end track section (shunt neck) and away from the ARTC network (Figure 4). The signalled route selected determined the orientation of the motorised points. At the time of the uncontrolled movement, the route was set to allow access between the ARTC network and the SFT.

Figure 4: PN Sydney Freight Terminal eastern interface point and dead end road

Interface point at the eastern end of the PN Sydney Freight Terminal. Signal ED288 and the motorised point machine were controlled by the ARTC from the Junee control centre. The points should be positioned as shown to route any uncontrolled movement toward the dead end and away from the roads of the other private sidings and main lines at Chullora West Junction. Source: Australian Transport Safety Bureau

Pacific National Sydney Freight Terminal

The SFT encompassed the EPA, Gantry, Shed, and Transfer rail marshalling areas (Figure 5). The PN Shift Manager controlled the incoming and outgoing rail movements in conjunction with the other routine internal shunting operations. The standby train crew or a terminal shunt driver in coordination with terminal operator ground staff undertook the rolling stock shunting operations for the marshalling of trains within the various areas of the SFT.

Within the SFT areas, the terminal operator ground staff manually operated (hand throw) points to route the rolling stock between the various roads of each area. The design of a number of these manually operated points enabled a trailing movement^[13] through the point assembly by the rolling stock.

The track grade from the entrance to of the Gantry road area toward Chullora West Junction started with a falling grade of about 0.70% before increasing to 1.166% through the Arrivals road area. The falling grade then reduced to around 0.060% through the Transfer road area before transitioning to a rising grade of around 0.26% through the interface area with the ARTC.

At the top of the grade in the Gantry area, four of the roads (#5, 6, 7 and 8) were equipped with a manually operated derail mechanism to prevent unauthorised access into or to capture an uncontrolled movement from the respective road. Road #9 was not equipped with a derail mechanism.

Figure 5: Pacific National Sydney Freight Terminal

View of the Pacific National Sydney Freight Terminal showing the relative location of the EPA and Gantry road areas. The uncontrolled movement of locomotives NR24 and NR12 commenced at the #9 road in the gantry area before travelling through the transfer road area and toward Chullora West Junction. Source: Google, annotated by ATSB

Pacific National shunting procedures

The Pacific National standard^[14] and procedure^[15] outlined the safe practices established for the movement of rolling stock. Both documents were applicable to operations undertaken on the main line, a terminal or a yard.

The standard identified PN’s obligation relating to the assessment of shunting risks and defined the responsibilities for the PN staff involved. In a terminal or yard, the terminal operator in charge of a shunt was responsible for providing instructions to the locomotive driver to facilitate the placement of rolling stock. The terminal operator was also responsible for detaching or coupling wagons.

Rolling stock - Wagons

The PN procedure detailed the specific processes and communication exchange protocols required when undertaking a shunt movement. A key component of the procedure was the implementation of a three-step protection process before a qualified worker (terminal operator or locomotive driver) entered between rolling stock to detach or couple wagons.

The intention of the three-step protection process was to ensure clear communications between the driver and qualified worker (in the case of 4MW2, the terminal operator) of the intention to enter in between rolling stock to undertake a task. The process was reliant on a sequential exchange of instruction and acknowledgement between the two parties to ensure the driver had undertaken actions to secure the rolling stock from moving.

To implement the thee-step protection, the driver was required to:

• fully apply the locomotive’s independent brake and if required the automatic brake^[16]
• position the throttle to idle
• move the reverser lever to the centre position

Once the driver confirmed these protections, the qualified worker could then enter between the rolling stock. On completing the required task, further communication between the terminal operator and the driver was to occur before removal of the protections and the locomotives operated.

Where a wagon or number of wagons were uncoupled and left unattended for any period, the qualified worker was also responsible for ensuring the application of the park brake. A PN generic procedure^[17] for securing trains with park brakes specified the minimum number of park brakes required to hold the rolling stock. The number of park brakes required varied depending on the location where stabled and local track grade.

Rolling stock - Locomotives

The safe practices contained in the standard and procedure were similarly applicable to the shunting of locomotives. Where a locomotive or locomotives were to be left unattended^[18], the locomotive driver (whether operating as a two-man crew or as Driver Only Operation) was responsible for the uncoupling of locomotives and ensuring that the park brake was correctly applied. A PN generic procedure^[19] for securing locomotives with park brakes specified the required actions to ensure the correct application of the park brake.

The park brake on the NR locomotives was a spring-operated device held off by the application of air pressure sourced from the main reservoir. When selected, by the operation of a pushbutton in the locomotive cab, the device released the air pressure and the spring applied the brake to the wheels. The park brake selection relayed electrically to other similarly equipped locomotives coupled in the train via the Multiple Unit interconnector cable.

Previous occurrences

Several incidents have occurred of the uncontrolled movement of rolling stock (run away) in New South Wales. None was directly comparable to the runaway incident at the SFT on 23 September 2015. That is, they did not involve runaway locomotives.

The previous incidents principally related to the securing of wagons that were uncoupled from locomotives or stabled. The incidents prompted the Independent Transport Safety Regulator (ITSR) to issue a Transport safety alert on 13 April 2011^[20] to address the effective securement with handbrakes and stop block functionality.

The Office of Transport Safety Investigations (OTSI) also investigated a runaway of rolling stock at Enfield Yard on 3 May 2011^[21]. A rake of 28 wagons loaded with aggregate (total mass in excess of 2500t) ran away from North Road No. 1 in Enfield Yard and through the yard before colliding with a rake of 15 empty fuel tanker and three flatbed wagons stabled in South Road No. 1. The investigation identified the immediate cause of the incident was that, during maintenance activities, the air brakes were released on a wagon and the rake ran away due to the rake’s remaining brakes being insufficient to hold it stationary on the prevailing grade.

Pacific National proposed a number of safety actions in response to the Transport safety alert and investigation into the runaway at the Enfield yard.

__________

7. Within the meaning of the Rail Safety National Law National Regulations 2012
8. Sidings owned and maintained by a person who does not own, control, or manage the running line with which the siding connects.
9. A small trackside-interlocking machine used for manual points operation at yards, sidings, crossovers, and loops.
10. Set of points designed to prevent unauthorised access to a section of track by prior intentional derailment of the vehicle
11. Interface Agreement IA1919, Version 8 - draft, Dated 23/04/2015
12. Safety Standard Form risk assessment SFT SHT-01, Revision 4
13. A wheelset movement through a set of points from the heel end to the toe end.
14. PN-STD-SAF Shunting Standard ,Version 1, 1 June 2015
15. PN-PRO-SAF Shunting Procedure, Version 1, 1 June 2015
16. Control that applies/releases all brakes of the train
17. GPR_6_10 Securing Trains with Park Brakes – R02, Dated 1 July 2015
18. No-one in the cab controlling the locomotive
19. GPR_6_12 Securing Locomotives with Park Brakes R02, Dated April 2009
20. Independent Transport Safety Regulator, Transport Safety Alert Number 36, 13 April 2011, Effective securement with handbrakes and stop block functionality
21. Office of Transport Safety Investigations, Rail Safety Investigation Report, Runaway of rolling stock Enfield Yard, 3 May 2011, Investigation reference 04514

Safety analysis

Planning and coordination of a shunt

In planning a shunt, the PN standard required the communication of the shunt plan to the shunting team (terminal operators) and locomotive driver to ensure:

• the identification of the shunter in control and responsible for coordinating shunting movements
• the identification of the roles of each shunter involved in the shunt
• the planning to complete the shunt in the safest number of moves
• the informing of locomotive driver and the shunt team about the planned shunt moves
• confirming the shunt sequence and rolling stock to be moved

On 23 September 2015, the communication of the shunt plan commenced when a terminal operator advised the inbound train crew via radio that they would be operating the locomotives to shunt from the EPA1 road onto the EPA3 and EPA4 roads, before heading to the number 9 road.

The terminal operators then commenced uncoupling wagons in accordance with the shunt plan. The terminal operators communicated between each other to transfer the role of shunter in control. The shunter in control communicated instructions to the train crew for the movement of the train. The train crew did not have a copy of the shunt plan to facilitate clear understanding of shunt sequence and the rolling stock that would be uncoupled.

After detaching the remaining wagons on the number 9 road, the last entry in the shunt plan indicated ‘to bed’ against locomotives NR12 and NR24. There was a series of communications:

• between the shunter in control at that time and the train crew
• between the two terminal operators, and
• between one of the terminal operators and the SFT shift manager.

Each conversation contained information related to the intended actions to address the shunt plan for locomotives NR12 and NR24. However, the communications did not ensure that there was a clear understanding among all parties of what was to occur.

Communication protocols

The PN voice radio protocols promoted effective spoken radio communications to be:

• clear and unambiguous
• relevant to the task at hand
• agreed as to its meaning before being acted upon

The communication protocols and shunting procedures required the locomotive driver and terminal shunter to reply to each communication to indicate that they have complied with the request or to acknowledge the previous communication. The protocols contain a warning that qualified workers must not assume that a receiver has understood a message before the receiver confirms that the message has been understood.

The sequencing of radio exchanges between the parties that occurred during the preparation for the final shunt of the locomotives resulted in essential information being misunderstood or lost. This was particularly pertinent to the application of the three-step protection process.

The application of these processes to ensure protections were in place before the terminal operator entered between rolling stock may have alerted the train crew of the intention to uncouple the locomotives.

Procedures for uncoupling locomotives

Following the request from a terminal operator, the driver moved the locomotives forward to the entrance of number 9 road and applied braking using the independent brake lever.

The independent brake valve was self-lapping, meaning the degree of braking effort was proportional to the positioning of the lever by the driver. The valve regulated the air pressure applied to the brake cylinders of the lead locomotive, and through the train pipe and interconnecting hoses to the brake cylinders of the four trailing locomotives to stop the train.

Once stationary, the driver left the independent brake handle in the full application position, which maintained the air pressure to the brake cylinders holding the locomotives with maximum braking effort. The train crew then gathered their gear and vacated the cab in preparation to leave the locomotive.

The train crew did not apply the locomotive park brake prior to vacating the cab. The implementation of the park brake requirements in the procedure for securing locomotives would almost certainly have prevented the runaway from occurring.

When on the ground, a short conversation occurred between the crew and the SFT shunt driver, which included a briefing on the set up of the locomotives in the train on arrival at the SFT. During this time, the terminal operator entered between locomotives AN8 and NR24 and uncoupled the locomotives. The terminal operator on completing this task assumed that the locomotive drivers were aware of the intention to undertake a task, and had made the rolling stock safe in accordance with the three-step process. The terminal operator did not subsequently contact the drivers to arrange the removal of protections to enable the operation of locomotives.

Terminal operators were only authorised by PN to undertake the task of uncoupling wagons. The task of uncoupling and securing locomotives was the responsibility of the locomotive crew or SFT shunt driver. It was apparent however that some terminal operators, who during their employment with other rail operators, had received training in undertaking this task and would on occasion assist a locomotive driver to uncouple locomotives.

Although PN undertook compliance and safety audit monitoring programs, these had not identified the practice of terminal operators assisting locomotive drivers existed, or that variances in the application of the radio communication protocols, such as the three-step process, were occurring at the SFT.

Interface risk assessment

The ARTC Engineering (Signalling) Standard^[22] includes the option of providing self-normalisation^[23] of catch points on sidings to protect the main line. Where self-normalisation is provided in the signalling arrangement, the catch point sets to normal (open position) when the signalling interlocking system indicates that the catch point has been continuously free to move for a period not less than 45 seconds. The self-normalisation principle could also apply for power-operated points on a turnout (as installed at each end of the SFT).

The design of the ARTC interlocking at Chullora did not include the functionality to self-normalise either the catch point or points at the interface between PN and ARTC.

The PN assessment of risk from an unauthorised movement exiting the SFT relied on the effectiveness of a series of engineering and administrative controls. The assessment identified the automatic operation of the points at either end of the SFT toward a dead end track section, when the associated signals were at red as an engineering control. The assessment assigned responsibility for this control to the ARTC.

As the interlocking design at Chullora did not include automatic operation of the points, PN’s reliance on automatic operation as an engineering risk control was therefore incorrect at this location.

The signalling at Chullora operated as an ‘Entrance – Exit’ system. To set a route the NCO operated controls to select the required entrance and exit signals along the desired route. The interlocking set the points (if free to move) to the required orientation before clearing the required signals along the route. If required, the system also enabled the NCO to operate the point machines individually to set the desired orientation.

The interface coordination required liaison between the SFT Shift Manager and NCO to progress movements through the interface area. Signalled routes were set to enable train services to enter or exit the SFT. If required, signalled routes could also be set to enable PN to shunt long trains from the SFT through the interface area and onto the main line. The point machines within the selected route would lie in the orientation set for the previous movement until the operation of another set of entrance and exit signals to request a new route.

The draft interface agreement identified the Chullora operational boundaries at ED 288 signal and the clearance point at the back of 361B turnout. The agreement identified the ARTC and PN as responsible for operations within their respective territory, and jointly responsible for the management of risk at the interface. The correct orientation of the ARTC controlled point machine 361B situated between the interface boundary of the PN Sydney freight terminal and PN dead end track section, was essential to ensure the preferred routing of an uncontrolled movement toward the dead end (that is, away from the main line).

The administrative process associated with the interface coordination between the PN Shift Manager and the NCO did not ensure that, on the completion of PN rail movements, the motorised point machine adjacent signal ED288 diverted any uncontrolled rolling stock movement toward a dead end track section and away from the ARTC network.

The Interface Agreement IA1919 was in draft since mid-2014. Neither ARTC nor PN had endorsed the interface coordination arrangements for the joint management of risk at the ARTC/PN boundary. The absence of a self-normalising turnout or a finalised agreement on responsibilities for the coordination at the interface, likely increased risk to the ARTC corridor.

On 23 September 2015, the points at the eastern interface toward Chullora West Junction remained set from a previous PN rail movement through the interface area. This allowed locomotives NR24 and NR12 to exit the PN controlled SFT and onto the ARTC network.

__________

22. ESD-05-01 Common Signal Design Principles S1 – Signalling Locking and Train Dynamics, Version 3.0 Dated 13 October 2015
23. Power operated points that are automatically returned by the interlocking to the normal position to provided protection after a movement via the points reverse.

Findings

From the evidence available, the following findings are made with respect to the uncontrolled movement (runaway) of locomotives NR24 and NR12 from the Pacific National Sydney Operations yard onto the ARTC main line at Chullora, NSW on 23 September 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• A terminal operator entered between locomotives AN8 and NR24 disconnecting the air hoses to the main reservoir and brakes, and lifted the pin in the coupler.
• The train crew did not apply the locomotive park brake prior to vacating the cab.
• Power operated point machines at Sydney Freight Terminal eastern interface were not set to direct rolling stock toward the dead end track section.
• The implementation of communication protocols and procedures for the planning and coordination of the shunt was ineffective in ensuring that the shunt plan was clear and unambiguous and that adequate protections against the unintended movement of rolling stock were in place.

Other factors that increased risk

• The engineering control listed in the Pacific National risk assessment SFT SHT-01 incorrectly identified the availability of an automatically operated point machine at the interfaces to the Australian Rail Track Corporation network to mitigate risk from an uncontrolled rolling stock movement.

Safety actions

Additional safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Additional safety action taken by Australian Rail Track Corporation

On 28 October 2015, the Australian Rail Track Corporation issued an instruction to all Network Control Officers at the Network Control Centre South (NCCS), Junee requiring:

• The restoration of the points at the eastern end interface of the Sydney Freight Terminal to the normal position (toward the dead end track section) following each rail movement. There was no exception to this requirement, even when following train movements were to occur.

The Australian Rail Track Corporation also advised the commencement of an investigation into the feasibility of modifications to the signalling control systems to restore the points at the interface automatically and the provision of a catch point alarm on the NCO’s control panel at Junee.

Additional safety action taken by Pacific National

Pacific National post incident actions included:

• Toolbox meetings involving all train crew and terminal operators at the Sydney Freight Terminal briefing on the incident and reinforcing the importance of correct communications and the need to follow procedures.
• Issue a Business Safety Notice, BSN 15-29 to outline the restrictions on terminal operators uncoupling locomotives, reiterate the application of the three-step protection, and the shunting procedures.
• The provision of a manually operated derail situated at the entrance to the Number 9 road in the Gantry road area.
• The review and update of the shunting procedures used at the Pacific National Sydney Freight Terminal. The revised procedure includes instruction prohibiting Terminal Operators from uncoupling locomotives from other locomotives.
• The locomotive crew undertook re-training in the relevant procedures for securing locomotives and in radio protocols.
• Pacific National monitors, on a random basis, the orientation of turnouts at the interface. Where found to be incorrectly set, the ARTC control centre at Junee is requested to set the points for the correct orientation.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Australian Rail Track Corporation
• Pacific National
• Pacific National Sydney Freight Terminal staff
• Office of the National Rail Safety Regulator
• Office of Transport Safety Investigations
• RISSB Glossary of Railway Terminology – Guideline Version 1, December 2010

References

Australian Rail Track Corporation ESD-05-01 Common Signal Design Principles S1 – Signalling Locking and Train Dynamics, Version 3.0 Dated 13 October 2015

Australian Rail Track Corporation, Interface Agreement IA1919, Version 8 - draft, dated 23/04/2015

Independent Transport Safety Regulator, Transport Safety Alert, TSA no. 36, Dated 13 April 2011, Effective securement with handbrakes and stop block functionality

Office of Transport Safety Investigations, Rail Safety Investigation Report, Runaway of Rolling Stock, Enfield Yard, 3 May 2011, Investigation reference 04514

Pacific National, Safety Standard Form risk assessment, SFT SHT-01, Revision 4

Pacific National, PN-STD-SAF Shunting Standard, Version 1, 1 June 2015

Pacific National, PN-PRO-SAF Shunting Procedure, Version 1, 1 June 2015

Pacific National, GPR_6_10 Securing Trains with Park Brakes – R02, Dated 1 July 2015

Pacific National, GPR_6_12 Securing Locomotives with Park Brakes R02, Dated April 2009

Rail Safety National Law National Regulations 2012

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the Australian Rail Track Corporation, Pacific National, the Office of the National Rail Safety Regulator and the relevant Sydney Freight Terminal staff involved in the shunt of 4MW2.

Submissions were received from the Australian Rail Track Corporation, Pacific National, the Office of the National Rail Safety Regulator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2016 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.