Signals Passed at Danger by passenger train TD3050, at Upwey and Upper Ferntree Gully, Victoria, on 12 April 2015

The 1542 service (TD3050) from Belgrave to Melbourne departed Belgrave on time. The train was a six-car X’Trapolis Electric Multiple Unit.

The Belgrave line (Figure 1) is part of the Melbourne metropolitan network managed by Metro Trains Melbourne (MTM). Between Belgrave and Ferntree Gully trains operate on a single bi-directional track, excepting at Upper Ferntree Gully and Upwey, where the line splits to pass either side of island platforms. These stations therefore provide the crossing points for trains travelling in opposing directions.

Figure 1: MTM network map (part)

Source: Metro Trains Melbourne – annotated by Chief Investigator, Transport Safety (Vic)

Train TD3050 arrived at platform 1 at Upwey Railway station (Figure 2) to cross the Belgrave-bound service that had arrived at about the same time and was at platform 2. Just prior to the arrival of TD3050, the signal control panel at Upper Ferntree Gully failed. As a result the signaller based at Upper Ferntree Gully (UFG) no longer had control of signals and points at Upwey and could not determine the location of trains in the vicinity of Upwey.

Figure 2: Upwey track layout with key signals and points marked

Source: Chief Investigator, Transport Safety (Vic)

The signaller at Upper Ferntree Gully reported the panel failure to Metrol, the control centre for train operations on Melbourne's suburban rail network. In response to this call, Metrol contacted the driver of train TD3050 by radio to advise of the failed signal control panel and to ascertain the train’s location. The driver confirmed his location at Upwey Platform 1, and was informed by Metrol that he would need to contact the signaller at Upper Ferntree Gully to obtain authority to depart from Upwey.

The driver of 3050 then called the signaller at Upper Ferntree Gully by mobile phone to obtain instructions. Conversations between the signaller and the driver of TD3050 were not recorded. The signaller advised the driver of the panel failure and that he did not have track detection. The signaller also advised the driver that he (the driver) would need to operate the points in front of him (№ 41 points).

Unable to see the status of № 41 points from the Upwey platform, the driver boarded his train and ran forward towards the points. By this action, he passed the Home Departure signal at Upwey at Stop. This was the first Signal Passed at Danger (SPAD^[1]) event of this incident. Passing this Home signal at Stop, led to activation of the trip lever and a resulting enforced brake application which brought the train to a stand (see p5).

After the trip mechanism was reset by the driver, the train continued on slowly towards № 41 points. Approaching № 41 points the driver observed they were correctly set for his passage and continued on. As a result, he did not stop and lock the points in the hand position. The driver then continued on towards Upper Ferntree Gully.

Train 3050 next encountered Automatic signal^[2] № 38 that was displaying a Stop indication. Particular rules apply to Automatic signals (see p4) that permit them to be passed at Stop without authority from a signaller or train controller. After passing the signal at stop and resetting from the resulting enforced brake application, the train continued on towards Upper Ferntree Gully.

About six minutes into the train’s passage between Upwey and Upper Ferntree Gully, the signaller noticed (on CCTV) that train 3050 was no longer visible at the Upwey platform. The signaller called Metrol to advise of this, and was informed by the train controller that they would contact the driver of the other train at Upwey (TD3639) for confirmation. There were no further calls made to clarify the position of TD3050.

Train 3050 subsequently arrived at Home Arrival signal № 36 at Upper Ferntree Gully (Figure 3). Observing that the points appeared correctly set, the driver proceeded past this Home signal that was also at Stop, again experiencing a mandatory stop initiated by the mechanical trip system. This was the second SPAD event of this incident.

Figure 3: Upper Ferntree Gully track layout with key signals and points marked

Source: Chief Investigator, Transport Safety (Vic)

The train then recommenced its passage and passed through №s 35 and 25 points before arriving at Upper Ferntree Gully platform 1. The signaller became aware of the train as it arrived and instructed the driver not to move his train. The passage of train 3050 from Upwey to Upper Ferntree Gully had taken about 10 minutes. There was no damage to track infrastructure or the train and there were no injuries.

As a consequence of the signal panel failure, Metrol and the Station Master at Upper Ferntree Gully had agreed that Belgrave-bound trains would terminate at Upper Ferntree Gully. At the time that train TD3050 was arriving into Upper Ferntree Gully, a Belgrave-bound service was also approaching the adjacent platform.

__________

1. An industry term referring to the act of a train passing a signal that is displaying a Stop indication without authorisation.
2. An ‘Automatic’ signal is controlled by the movement of trains alone and is not directly controlled by a signaller/controller.

The train driver

The driver was qualified for the operation of this train on this route and was medically fit for duty. He was based at the Carrum depot and had qualified to drive suburban trains in February 2007. His most recent performance audit had been undertaken in January 2015. This incident was the driver’s first SPAD infringement.

Following the incident, testing of the driver returned a zero blood alcohol result and nil presence of drugs.

Track infrastructure

Upwey to Upper Ferntree Gully

From departure at Upwey railway station to arrival at the platform at Upper Ferntree Gully was about 2.4 km on a predominantly 1:30 downgrade. Between the mainline points at the two stations (№s 41 and 35 points) the line was single-track for a distance of approximately 2.05 km. Automatic signal № 38 is located midway between the stations.

Upwey

Upwey is an unattended crossing station, about 40 km from Flinders Street Station. Home Departure Signal № 42 is at the Melbourne end of Platform 1 (Figure 4).

Figure 4: Upwey railway station looking towards Upper Ferntree Gully and signal № 42

Source: Chief Investigator, Transport Safety (Vic)

About 160 metres from the Melbourne end of the Upwey island platform, № 41 points connects the two platform tracks to the single line extending towards Upper Ferntree Gully.

№ 41 points are controlled by a Dual Control Point Machine. They can be operated in ‘Motor’ (remote operation) or ‘Hand’ (manual operation) modes. This enables remote operation of the points by a signaller or hand operation in the case of system failure. In the case of system failure, all points are set to the Hand mode prior to being traversed to ensure the points cannot inadvertently operate while a train is passing across them. In addition, when set to ‘Hand’ mode, the Home signals protecting the points are held at Stop.

The Dual Control Point Machine has two levers – the Selector lever and the Hand Throw lever. The Selector lever is the shorter of the two. The normal position for the Selector lever is in the ‘Motor’ position (Figure 5 right-hand photo). To place the machine into ‘Hand’ mode the lever is rotated clockwise by 180 degrees (Figure 5 left-hand photo). With the Selector lever in this position, the Hand Throw lever can then be used to manually move the points to their required position. Figure 5 does not depict the actual point machine at the № 41 points at Upwey.

Figure 5: Dual Control Point Machine. The Selector lever is shown in the ‘Motor’ position (right-hand photo) and ‘Hand’ position (left-hand photo)

Source: Metro Trains Melbourne

Automatic signal № 38

An intermediate Automatic signal was provided between Upwey and Upper Ferntree Gully. Automatic signal № 38 provided advance warning and indication of the status of the Home arrival signal № 36 at Upper Ferntree Gully.

An Automatic signal is not directly controlled by a signaller or train controller but by the passage of trains detected by track circuits. As part of a permissive signalling system, an Automatic signal at Stop is allowed to be passed by a train under conditions specified by a Rule.

At the time of the incident, a trial existed^[3] to reinforce the process for passing Automatic signals at Stop. This trial involved train drivers who encountered an Automatic signal at Stop making use of a voice mail facility to receive an automated message conveying explicit instructions and to then provide certain identifying information. The driver of TD3050 did not follow this process.

Upper Ferntree Gully

Upper Ferntree Gully is an attended crossing station about 36 km from Flinders Street. Home Arrival Signal № 36 (Figure 6) is located about 220 metres prior to the platform.

Figure 6: Home arrival signal № 36 at Upper Ferntree Gully

Source: Metro Trains Melbourne

Trackage at Upper Ferntree Gully is more complex with several sidings either side of the mainline tracks (Figure 3). For mainline traffic, trains arriving at Upper Ferntree Gully from Upwey are typically directed to platform 1 by way of №s 35 and 25 points.

Train stops at signals

On the metropolitan network, Home and Automatic signals are fitted with Train Stops (Figure 7). This was the case at signal №s 42 (Upwey Departure), 38 (Automatic) and 36 (Upper Ferntree Gully Arrival).

Figure 7: Automatic train stop (left) and trip lever on suburban trains (right)

Source: Chief Investigator, Transport Safety (Victoria)

The purpose of this device is to bring a train to a stand when the train passes a signal that is at Stop. When a signal is at Stop, the trip arm of the unit located beside the track is raised. This strikes the trip valve lever that is fitted on suburban trains causing an emergency brake application and the train to come to a stand. Before a train can proceed after being ‘tripped’, its trip mechanism has to be reset by the driver.

In this incident, the train brake was ‘tripped’ when passing signals №s 42, 38 and 36. This stopped the train in each case, and the driver manually reset the trip, enabling the train to recommence its journey.

Traffic control on the metropolitan network

Metrol

Metrol is the central control centre for the Melbourne suburban rail network. The centre’s train control function covers the whole suburban area, while its control of points and signalling covers a limited area within central Melbourne and one (recently modernised) outer suburban area.

Outside the centrally-controlled areas, train movements are controlled by signallers located either in dedicated signal-boxes or operating signal control panels at suburban railway stations. These signallers are under the direction of the Metrol controllers. Upper Ferntree Gully was such a location.

Local area signalling from Upper Ferntree Gully Station

Safeworking system

The safeworking system used at this location was Automatic Track & Control (ATC). In this system, authority for a train to enter a section of track is provided by signals located at each end of the section. In single-line operations, the signals at each end of a track section are arranged such that once a train is in the section, an opposing train cannot be signalled to enter.

Signal control panel

Upper Ferntree Gully, was staffed by a signaller for the control of the single-line section between Ferntree Gully and the line’s terminus at Belgrave. The station was equipped with a signal control panel (Figure 8) that provided information of signal and points status and train position.

MTM maintenance attended to the loss of panel functionality. The inspection identified that the panel fault was the result of a processing failure within the Railmaster compact telemetry unit. This is an interface component between the signal control panel and field equipment. The Railmaster unit had failed and required a hardware reboot. The equipment that had caused the signal control panel outage was reset after about an hour. However, a secondary and separate fault with a set of points resulted in a delay in re-establishing the signalling system.

Figure 8: Signal control panel, Upper Ferntree Gully

Source: VicSig – Chris Jordan

The Signaller at Upper Ferntree Gully

The signaller (who was also the Station Master) was medically fit^[4] and appropriately qualified for his duty, and had been last audited at Upper Ferntree Gully (with no non-conformances) a month prior to the incident.

The station is usually staffed by two. However, on this day the rostered signaller had been sent home due to fatigue. As a result, the Station Master was also performing the role of the signaller. His duties included operating the signal control panel and dealing with passenger ticketing and enquiries. Around the time that the signal control panel failed, public inquiries were low and did not interfere with his response to the panel failure.

This was the signaller’s fifth consecutive 8-hour dayshift, following a five-day break off duty. There was no indication that fatigue affected the performance of the signaller.

Procedural safeworking and Caution Orders

Procedural safeworking on the MTM network, is instituted when there is a loss of signalling system and interlocking control. It permits the ongoing operation of the network, albeit at a reduced capacity.

The safeworking of trains was governed by the Book of Rules and Operating Procedures (1994). On the metropolitan network, implementation of these Rules was supported by procedures developed by the network manager, MTM.

Procedural safeworking requires coordination between the signaller (or train controller) and the train driver in order for signals to be safely passed and for points to be safely traversed. Home signals control arrival and departure movements at stations, and protect points and other interlocking.

The instrument of authorisation to pass Home signals displaying a Stop indication is called a Caution Order. This is an instrument used by a train controller or signaller to give a train driver authority to pass a signal at Stop in accordance with prescribed measures. The issuing of a Caution Order is a formally documented process, although its application can take various forms.

Procedures for departing Upwey

Upwey is an unattended station. Under circumstances of signalling system failure^[5] at unattended stations, an ATC System Caution Order is the instrument used to permit a train to pass a Home Departure signal at Stop.

The process for issuing an ATC System Caution Order included:

• On the direction of the train controller or signaller, the driver placing protected points in the ‘Hand’ mode and ensuring they were correctly set and secured for the train’s movement
• The driver then contacting the signaller and confirming the points had been correctly secured
• Once satisfied that points were secured and cognisant of other traffic, the signaller dictating the Caution Order to the driver, who would record the details of the order on a prescribed form
• On completion of the prescribed form, the train would have authority to proceed past the signal at Stop.

Procedures for arrival at Upper Ferntree Gully

At an attended station such as Upper Ferntree Gully, the applicable instrument to use for a train to pass a Home signal at Stop is the Signaller’s Caution Order. This is a paper document that is passed from signaller to train driver. Before issuing such an authority, the responsibility for ensuring that any points are safe to traverse rests with the signaller.

Therefore at Upper Ferntree Gully station, in the case that the signaller was to issue a Caution Order, №s 35 and 25 points would be secured by the signaller, before a train was given the written authority to pass signal № 36 and proceed to Platform 1.

Voice communications

Drivers operating trains on the Belgrave line could communicate with the Upper Ferntree Gully signaller on the Digital Train Radio System (DTRS), which was recorded.

However, in this instance the driver contacted the signaller using his MTM-issued mobile phone – a mode of communication that is not recorded unless received on phones that are recorded, such as at Metrol.

The non-recording of safeworking communications leaves a significant gap in the capacity to review or resolve communications in the case of investigation or procedural auditing.

__________

3. Trial procedure running from 5 April 2015 to 21 June 2015, per Weekly Operational Notice № 13/2015.
4. Category 2 Medical Assessment in accordance with the National Standard for Health Assessment of Rail Safety Workers.
5. Under failure conditions of the centralised control of points and signals, those points and signals normally subject to that control are also considered to have failed.

Signal control panel

The signal control panel at Upper Ferntree Gully lost functionality as a result of a processing failure within the Railmaster compact telemetry unit.

Due to this failure, the signaller lost control over and information on the signals and points at Upwey. As a result, safeworking reverted to a back-up procedural system. This required the use of Caution Orders as the authority for trains to pass Home signals at Stop. This substitute process introduced a greater procedural burden on operational staff and an increased exposure to human error.

Departure from Upwey

The procedures for passing Home signals following signalling system failure are well established formal processes. At Upwey, the correct authority to proceed past the Home Departure signal that was at Stop was a dictated ATC System Caution Order. The train proceeded without this process being followed and therefore without authority. In addition, the train then proceeded over points № 41 without them first being secured by hand and the signaller being advised.

Having instructed the driver to check the 41 points at Upwey, the signaller’s expectation would have been that the driver would proceed on foot to the points, confirm their setting, and secure them in Hand mode. The driver would then return to his train to contact the signaller to advise accordingly and to have the ATC System Caution Order dictated by the signaller and recorded by the driver.

There are a number of factors that may have influenced the driver’s behaviour that led to these errors (unauthorised passing of signals at Stop). These include:

• A lack of understanding of the applicable safeworking procedures
• Distraction
• A misunderstanding of instructions from the train controller or signaller
• Expectation of a clear track ahead
• Infrequent operation on this line
• Fatigue.

Lack of understanding of safeworking procedures

Safeworking rules, including the application of Caution Orders, are a fundamental knowledge-based competency for drivers of trains. The driver’s record shows the completion of required training in safeworking procedures and also subsequent supervisory auditing. Due to the infrequency of use, the driver’s experience with using alternate safeworking in practice may have been limited.

The driver had no record of any SPAD incident during his 8-year career, and therefore no history of this type of error. There was no evidence to suggest a fundamental misunderstanding of rules and procedures. Rather, the response of the driver following the incident and realisation of his error suggests a possible lapse of awareness.

Distraction

The train driver was anxious about having to operate the set of points (№ 41) that he had been requested by the signaller to secure. The driver also reported having felt a sense of relief at seeing that the points were set for his movement. This was probably because it was some time since he had covered Dual Control Point Machines in his initial (2007) and refresher (2010) training The driver also suggested that he had never hand-operated such a machine in the field. Nonetheless, the required procedure was straightforward and assistance was available from the train controller or signaller if required.

Despite the ease of the task, it is apparent that the driver was apprehensive about operating the points. It is possible that this apprehension led to the driver forgetting the requirements to first check the points and then obtain a Caution Order before departing the train from Upwey.

Misunderstanding of communications with train controller or signaller

The driver’s communication with the Metrol train controller was straightforward and there is no indication that the controller’s instructions were misunderstood by the driver. The driver called the signaller at Upper Ferntree Gully as instructed.

The communication between the driver and the signaller was not recorded and so its precise nature is not known. Combined with the driver’s sense of anxiety at operating the points, it is possible that the signaller’s instruction that the points be checked prior to receipt of authority was construed as permission to pass the Home Departure signal. However, this would have been contrary to procedure.

The driver was required to then report the state of the points to the signaller. The possibility of a momentary lapse of awareness does not fully explain why, having observed the points, he then continued without reporting their status.

Expectation

The driver of train № 3050 was aware that the opposing Belgrave-bound train was already at Upwey Platform 2. He had been informed by Metrol that there were signalling problems at Upwey and that once the opposing train had arrived he should contact the signaller at Upper Ferntree Gully to obtain ‘authority to move past [the Home Departure signal]’. He would therefore have expected that the single line to Upper Ferntree Gully was clear and that there was no impediment to obtaining authority to proceed through the section.

Infrequent operation on this line

Carrum-based drivers mostly operate over the Frankston, Craigieburn, Hurstbridge, and Sunbury lines. To maintain familiarity, they are rostered to operate over the Belgrave line twice in each 16-week cycle. Therefore, the driver was not a regular operator on this line. This driver had also not been audited on the Belgrave line in the last three years.

While less familiarity with a route can contribute to apprehension or errors, it is unlikely that this factor contributed to the errors in this instance.

Fatigue

The driver had commenced his shift at 1009 and at the time the incident occurred had been on duty for about 5 hours and 30 minutes. Based upon the driver’s rostered work schedule, time-of-day, time-on-task, and the nature of the errors observed, it is considered unlikely that the driver’s performance was fatigue-impaired at the time of the SPAD events.

Arrival at Upper Ferntree Gully

At Upper Ferntree Gully the correct authority to proceed past the Home Arrival signal that was at Stop was a Signaller’s Caution Order. The train entered the station without this authority.

In proceeding into the station, the driver also operated the train across two sets of points without them first having been secured against the possibility of movement while being traversed.

There are no additional factors or events that may have influenced the driver’s behaviour in this second SPAD event. Being already in the section and in the belief that there were no opposing trains, the driver probably believed it was safe to proceed to the platform at Upper Ferntree Gully.

Missed opportunity to contact unauthorised train

About six minutes after train TD3050 departed Upwey, the signaller at Upper Ferntree Gully noticed on CCTV vision that the platform was vacant. The signaller conveyed this observation to the Metrol train controller. However, there was no further action-by either the signaller or the train controller-to contact the train. MTM SPAD risk management procedures specify that following a SPAD, contact must be made with the driver of a train and the train stopped.

After its detected departure from Upwey, about four minutes passed before the train arrived at Upper Ferntree Gully. There was an opportunity to stop the train during this period.

From the evidence available, the following findings are made with respect to the double-SPAD incident at Upwey and Upper Ferntree Gully, Victoria, on 12 April 2015. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Contributing factors

The signal control panel at Upper Ferntree Gully failed, requiring the introduction of procedural safeworking that resulted in an increased exposure to human error

The train passed the Upwey Home Departure signal at Stop without authorisation

The train passed the Upper Ferntree Gully Home Arrival signal at Stop without authorisation.

Other factors that increased risk

• Although train TD3050 was identified as having made an unauthorised departure from Upwey, there was no follow-up action to contact the train.

Safety issues and actions

Safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Metro Trains Melbourne advised that as a result of this occurrence they:

• Have reviewed training provided to drivers in the operation of Dual Control Points Machines
• Will consider a system modification to capture all safeworking communications at Upper Ferntree Gully
• Will add the incorporation of SPAD alarms into asset management plans for future upgrading of signalling at this location.

Sources of information

The sources of information during the investigation included:

• Metro Trains Melbourne.

References

• MTM Weekly Operational Notice № 13/2015
• National Standard for Health Assessment of Rail Safety Workers
• The Book of Rules and Operating Procedures (1994) – PTC.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the driver of the train, the Station Master at Upper Ferntree Gully, Metro Trains Melbourne, the Office of the National Rail Safety Regulator and Public Transport Victoria.

Submissions were received from Metro Trains Melbourne, the Office of The National Rail Safety Regulator, and Public Transport Victoria. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.