Signalling irregularity involving train DP41, Eagle Junction, Queensland, on 23 September 2018

Preparation for planned track work

Track work had been planned^[1] between Eagle Junction (clear of the main and suburban lines) and Doomben, Queensland for Sunday 23 September 2018. This work included the replacement of the 705C (HW2000) points machine and timber bearers at Eagle Junction. At about 0627 Eastern Standard Time,^[2] a protection officer (PO) contacted a Brisbane suburban network control officer (NCO) in the Mayne Control Centre^[3] to arrange a track occupancy authority (TOA) for the work.^[4] The work group consisted of a civil team, and a signalling team including a team leader and three signal electricians (E1, E2, E3).

At about 0633, the PO clipped and locked the 704 and 705A/B (Figure 1) points at Eagle Junction in the normal position.^[5] For the 705A/B points, this meant that trains from the city were being directed towards the Airport Line and were prevented from entering the worksite at the 705C points on the Doomben Line. In addition, the 705C points were electrically isolated^[6] from the signalling system to prevent the work affecting train operations over the 705A/B points on the suburban line. About an hour later, after the work group had completed a pre-work safety brief, the planned work commenced on 705C.

Figure 1: Overview of Eagle Junction showing the location of the points

Note: The suburban line to the airport is represented in orange, the suburban line from the airport is yellow and the Doomben Line is red.

Source: Google Earth, annotated by the ATSB

Replacement of the points machine

The work continued as planned with the removal of the old points machine and re-timbering underneath. The new pre-wired machine was installed then checked, mechanically and electrically, and found to be functioning correctly. A signal electrician (E1) then liaised with the PO to conduct further testing with the involvement of the NCO.

Testing of the points machine

The PO contacted the NCO to arrange access to the Eagle Junction area for the testing to occur. The PO unlocked and unclipped the 704 and 705A/B points, then confirmed the correct operation of 704 points with the NCO. The PO advised the NCO that the signal electricians would liaise directly with him to conduct the testing on the 705 points set.^[7] Following this, a signal electrician removed the electrical isolation on the 705C points.

First test

At 1446, a signal electrician (E1) contacted the NCO to commence testing of the 705 point indications. The first test involved breaking detection^[8] at the 705C point machine to validate the function of the vital interlocking system input. The test passed successfully with a loss of normal detection indicated to the NCO on the Universal Train Control (UTC) system interface (refer to section titled Signalling infrastructure).

Second test

The second test required the NCO to enter a command via the UTC system interface for the 705A/B and C points to motor to the reverse position, directing trains to the Doomben Line. The signal electrician located at the 705C points observed the point machine move into the reverse position. However, the NCO stated there was no corresponding detection indicated on the UTC display. That is, the display continued to show the 705 points were not detected.

The NCO asked if the 705A/B points were part of the work. The signal electrician confirmed with the NCO that 705A/B were not part of the scope of work, and requested more time for testing. The NCO stated the next train required the 705 points set to normal (directing trains from the city towards the Airport Line) and that further testing could continue after the train had passed. The NCO received approval from the signal electrician to command the 705 points set back to normal. The NCO confirmed the UTC displayed detection of the points in the normal position. The signal electrician then informed the NCO that 705C had not moved and were still orientated in the reverse position, out of correspondence with the UTC system indication.

The signal electrician interrupted the detection electrical circuit at the 705C point machine and it motored to the normal position, previously selected by the NCO. The UTC indicated a loss of detection as the 705C points drove from reverse to normal, and then the UTC again displayed detection of the points in the normal position.

The NCO asked the signal electrician if it was okay to use the suburban airport lines (Figure 1). The signal electrician confirmed it was now okay, but further testing would be required. Suburban passenger trains DP37 and DG40, to and from the airport, travelled through Eagle Junction without incident.

Additional testing and fault-finding

After the passage of trains DP37 and DG40, the signal electrician (E1) contacted the NCO to continue testing the 705C points. With each test the same issue existed, where the 705 points set were in reverse, but the UTC system indicated that they were set in the normal position.

The testing and fault-finding continued between three trains until about 1530 when the signalling team split up. The team leader and signal electrician (E2) proceeded to the Eagle Junction signal equipment room (SER) located 100 m west of the platform, and the signal electrician (E1) and assistant moved to the location boxes on the eastern end of the platform, near the 705A/B points. Another signal electrician (E3) remained at the 705C points location.

At about 1536, the team leader at the SER contacted the NCO. The team leader confirmed with the NCO the indicated position of the 705 points set on the UTC display and verified this against the display on the maintenance terminal in the SER. The other signal electrician (E1) located at the location boxes checked the position of the points and relayed information back to the team leader. After verifying the physical position of the 705A/B points with the signal electrician (E1), and confirming with the NCO that the 705 points set were in the normal position, the team leader realised that 705A/B were also out of correspondence with the indication displayed on the maintenance terminal. At this point, the NCO requested that the points be released from testing to allow routing of trains DP41 and DG44, to and from the airport respectively. The team leader handed control back to the NCO, who set the routes through Eagle Junction for DP41 and DG44.

Train DP41 approaching

At 1543:18, train DP41 approached Eagle Junction station from the city, heading towards the airport. At that time, the train’s forward facing video camera showed signal EJ45P (before the station) changing from a single yellow (proceed with caution) to green (proceed at authorised speed) (Figure 2).

Figure 2: Train DP41 approaching Eagle Junction station with signal EJ45P

Note: Signal EJ45P changing indication from yellow to green as DP41 approaches.

Source: Queensland Rail, annotated by the ATSB

Train DP41 arrived at the Eagle Junction platform for its scheduled stop, at which time the next signal ahead of the station, EJ45, was displaying a double-yellow indication to proceed with caution. At that instance, the driver saw workers at the end of the platform (including signal electrician E1 and the PO) and noticed that the orientation of the 705A/B points were in reverse directed towards Doomben, which conflicted with his route to the airport and the indication displayed by signal EJ45 (Figure 3).

Figure 3: Train DP41 at the platform with signal EJ45 and the 705 points incorrectly set

Note: Signal EJ45 indicating double-yellow. Route indicator not illuminated indicating points are set towards the Airport Line. Signal electrician E1 with the protection officer visible on the right. The gaps between the rails show that the points are in the reverse position.

Source: Queensland Rail, annotated by the ATSB

At around the same time, the signal electrician (E1) at the end of the platform noticed the irregularity between EJ45 and the 705 points set. The signal electrician visually indicated to the driver of train DP41 not to proceed. The driver contacted the NCO via radio to report the issue. The NCO directed the driver not to proceed until further instruction. The signal electrician also called for the detection to be broken at the 705C points. Train DP41 remained at the platform.

Train DG44 approaching

About 100 seconds after, train DG44 from the airport rounded the curve and approached Eagle Junction, across the conflicting route (Figure 4). The driver of DG44 overheard the conversation on the radio between the driver of DP41 and the NCO, and cautiously approached Eagle Junction platform for a scheduled stop.

As train DG44 was arriving at the platform, the signal electrician (E3) at the 705C points interrupted the detection electrical circuit, causing the 705 points set to motor to the normal position, as set by the NCO on the UTC system prior to the arrival of DP41 and DG44. As the points moved, signal EJ45 displayed a stop indication until the points were in the normal position and detected. Signal EJ45 then displayed a double yellow proceed indication, the correct indication for the configuration of the 705 points.

Figure 4: Train DG44 crossing the conflicting route

Note: Approaching train DG44 crossing the conflicting route.

Source: Queensland Rail, annotated by the ATSB

Train DP41 departing

As a result of the 705 points being reset, a ’restored in face of DP41’^[9] alarm activated on the UTC system in the control centre. The NCO immediately called the signal electricians to ascertain the reason for the alarm. The team leader confirmed that no further work would be performed on the 705 points. Several minutes later, after confirming the correct orientation of the points with the team leader, the NCO permitted train DP41 to depart. Train DP41 departed without further incident.

__________

1. Advertised in train notice 18-09841. The work was not scheduled to occur during normal Scheduled Corridor Access System (SCAS) closures and formed part of an existing shutdown.
2. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
3. The Mayne Control Centre, using the Universal Train Control (UTC) system, manages all train movements, both passenger and freight, over almost the entire greater Brisbane metropolitan area.
4. A TOA is used to occupy a defined portion of track for a specified period.
5. The position in which the signal and other devices are assumed to normally lie, according to rule, convention or otherwise, for example, the points set for main track.
6. The electrical isolation of 705C points in the normal position, a coded block.
7. The 705 points consist of components A (switches), B (swing nose crossing), and C (switches).
8. The proof of the position of the points (normal or reverse) to the interlocking equipment.
9. The signal had been restored to stop in front of the train.

Eagle Junction station

Eagle Junction station is located about 7.5 km north of Brisbane Central station. The station services the Airport, Doomben, Shorncliffe, and Sunshine Coast Lines with regular passenger train services. Point set 705A/B and C were located on the down side of the Eagle Junction station and formed the junction between the Airport and Doomben Lines.

Signalling infrastructure

The wayside^[10] signalling infrastructure at Eagle Junction was remotely operated by a network control officer (NCO) located in the Mayne Control Centre at Bowen Hills. The NCO used the Queensland Rail universal train control (UTC) system to set the routes required, and place blocks on sections of the track for maintenance and other purposes, enabling the safe passage of trains throughout the NCO’s assigned control area. The UTC showed a green line to represent the route set, a red line for an occupation/lock, and a yellow line when the section of track was not detected/error. Figure 5 shows a representation of what the UTC displayed when train DP41 was at the Eagle Junction platform.

Figure 5: UTC playback of the Eagle Junction area at 1545:05

Note: This figure is representative of Figure 4.

Source: Queensland Rail, annotated by the ATSB

The UTC is a non-vital^[11] computer-based system that interfaces with the vital signal interlocking equipment in the field to control the point machines and signals. The signal interlocking equipment sets the aspect displayed on the signal for the selected route, subject to the correct conditions being met. The interlocking receives information from the wayside equipment and transmits information of the status of the various track circuits, point machine position and signals back to the UTC system for display to the NCO (Figure 6).

Figure 6: Interface between the UTC system, vital signal interlocking equipment and the field infrastructure

Source: ATSB

Signal indications

The Queensland Rail signalling system at Eagle Junction used four-aspect signalling to display proceed authorities to drivers. Table 1 illustrates the four possible aspect combinations and their meaning.

Table 1: Four aspect signalling system indications

Table 2: Route indications

The renewal of the 705C points formed part of the 2017 program of work for the south-east Queensland point machine upgrade to increase reliability, and remove asbestos. The replacement of the 705C points did not occur in 2017 and carried over to the 2018 work program.

In July 2018, track possession planning commenced for the renewal of the 705C points. The original possession planning called for overnight works, between the last and first train services through Eagle Junction. However, to better accommodate staffing availability and fatigue management, the plan was amended for the work to be undertaken during the day, in negotiation with the NCO between train services. This plan coincided with an availability in the signal team’s work plan.

The signal team who carried out the removal and installation of the 705C points machine were all employed by Queensland Rail and were appropriately qualified. The planned work performed on this day was described by the signal team as routine and had been previously performed at other locations without issue.

705 points set

History

Prior to 2001, Eagle Junction had the 705A and B points, which consisted of switch-blade components with a fixed crossing. With the commissioning of the Airport Line in 2001, the points were re-configured and upgraded to 705A/B and C points, and included a movable swing-nose crossing.

705C points machine master circuit diagram

The Queensland Rail master circuit diagram (#3225) for the 705C points machine was first issued in 1999. In-line with their procedures, any changes made affecting the points was to be reflected on the circuit diagram and approved by an engineer. At the time of the incident, version four of the circuit diagram was current, dated June 2014. Variations made since initial issue were annotated on the diagram, none of which mentioned changes specifically relating to the 705C points machine. However, Queensland Rail noted that their documents only had to be retained for a period of 10 years, which meant that the reasoning behind any changes made beyond this could not be traced.

The master circuit diagram was used by the team leader to pre-wire the new 705C points machine prior to the day of installation. Figure 7 shows the way in which the new point machine was wired (in red).

Figure 7: 705C points machine master circuit diagram

Source: Queensland Rail, annotated by the ATSB

On the day of the incident, the work group removed the old machine and installed the new pre‑wired machine. During this process, there was no requirement to verify the wiring configuration of the old machine with the current master circuit diagram prior to its removal.

On-site fault finding

The work group continued fault-finding in an attempt to identify the reason for the irregularity between the signalling system and the points. Firstly, the wiring of the new 705C points machine was checked and verified with the master circuit diagram (#3225). The fault-finding was then expanded to include the circuit diagram for the 705A/B points machine and full master circuit diagrams at the SER. After reviewing these diagrams, the signal electricians determined that there was an error with the master circuit diagram for the 705C points machine.

The signal interlocking system relies on polarity signals from in-field equipment to determine the binary condition of equipment. For example, a positive voltage would register in the signal interlocking system as a normal points position, and a negative voltage indicated a reverse points position. This information is then utilised by the system to logically determine if a proposed movement is allowed or not. However, Queensland Rail reported that the master circuit diagram for the 705C points machine was drawn in a way in which the ‘configuration essentially sets the system to understand the points are in normal whether the points are in normal or reverse’. They also concluded that, although the diagram was incorrect, the removed points machine had been correctly configured and had worked as expected without fault.

Figure 8 (left) represents what the in-field wiring (in red) would have looked like before the 705C point machine was removed. This circuit also represents the change that was later approved following the incident. For comparison, the incorrect wiring configuration from the master circuit diagram is show on the right.

Figure 8: Comparison of the in-field equipment wiring (left) with the 705C points machine circuit diagram (right)

Source: Queensland Rail, annotated by the ATSB

After identifying the error with the diagram, all further work was suspended. The NCO arranged for 705A/B points to be clipped and locked, and electrically blocked, until an independent signalling engineer could approve the necessary changes to the master circuit diagram, which occurred later that night.

Queensland Rail indicated that, the configurations shown above (Figure 8) were both correct ways for wiring a points machine. However, only one of these was applicable to the set-up at Eagle Junction. Hence, the error in the master wiring diagram may not have been obvious to the signal electricians by visual inspection.

__________

10. Wayside: Parts of the Infrastructure not directly involved in train operations, but necessary for the safe and effective operation of the railway.
11. Non-vital: Signalling equipment and circuits are considered non-vital where failure to function correctly would not cause an unsafe outcome of the signalling system.

Introduction

During planned signal maintenance work, a wayside signalling system irregularity occurred where signal EJ45 at Eagle Junction, Queensland displayed an incorrect authority to an approaching train (DP41). The authority from signal EJ45 was invalid for the positioning of the 705 points ahead. Both the driver of train DP41 and a signal electrician noticed the irregularity and the train was prevented from proceeding by the network control officer (NCO). A short time later, another train approached and crossed over the conflicting route. The actions of the driver of DP41, NCO, and signal electrician identifying the irregularity and stopping the train mitigated the potential for a collision to occur.

This analysis will examine the signal irregularity, how the pre-wired 705C points machine affected the signalling system, and why the error in the master circuit diagram for the machine was not detected before installation.

Signal irregularity

Following replacement of the 705C points machine, the signal electricians tested the functionality of the system and detected a fault. The fault resulted in a mismatch between the position of the 705 points set, and the signal indication at the station and the Universal Train Control System. While attempting to locate the fault, trains continued to operate normally over the points without issue. This occurred due to the signal electrician breaking detection at 705C, following each test but before the next train, eliminating the mismatch. However, this did not occur before train DP41 approached the station as the signal electrician had moved away from 705C to fault-find.

Despite not understanding the nature of the fault at that time, for undetermined reasons, control of the 705 points was handed back to the NCO. However, it was possible that the team leader expected the mismatch to self-correct, consistent with previous experiences with trains over that section. As such, the NCO set DP41’s route for the Airport Line, although the points were directed to the Doomben Line.

Points machine pre-wired

Queensland Rail required the master circuit diagram to be updated and approved when changes were made to the signalling equipment. However, post-incident fault-finding established that the diagram did not reflect the existing wiring configuration of the removed 705C points machine.

While minor changes over the years were noted on the diagram, there was no reference to the wiring configuration having been altered. Therefore, as the removed machine had been functioning correctly until replacement, it was likely that, when the points were upgraded to accommodate the Airport Line, changes were made to the machine but the master circuit diagram was not updated to reflect these modifications. Since that time, maintenance had been routinely performed on the machine, however, it was likely that this did not involve comparing the in-field wiring with the master circuit diagram.

Consequently, the new 705C points machine was wired in accordance with the master circuit diagram, and a wiring error was inadvertently introduced. This resulted in the Universal Train Control and signal interlocking systems indicating the 705 points set were in the normal position, irrespective of whether they were physically in normal or reverse.

Procedures

When replacing the 705C points machine, the existing machine was removed and the new, pre‑wired machine installed. During this process, there was no requirement to cross-check the wiring configuration of the existing machine with the master circuit diagram prior to removal. Without this check, this placed sole reliance on the diagram being updated each time changes were made to the points machine. This removed an opportunity to detect any errors between the diagram and the in-field equipment.

From the evidence available, the following findings are made with respect to the signalling irregularity at Eagle Junction, Queensland, on 23 September 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• Even though an abnormal condition, which was not understood, was identified during testing of the signalling system, the train was authorised to proceed using the system. This resulted in train DP41 approaching a junction where there was a mismatch between the signal indication and the position of the points.
• The Queensland Rail master circuit diagram did not reflect the existing configuration of the removed 705C point machine. This resulted in the new pre-wired machine being installed with a wiring error, which led to the abnormal condition and signalling system irregularity.
• Queensland Rail did not have a procedure in place to cross-check a master circuit diagram with the existing configuration of the in-field equipment before using the diagram for safety critical work. This removed an opportunity to detect any error in master circuit diagrams. [Safety issue]

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the [aviation, marine, rail - as applicable] industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

No procedure to cross-check master circuit diagram

Safety issue number: RO-2018-020-SI-01

Safety issue description: Queensland Rail did not have a procedure in place to cross-check a master circuit diagram with the existing configuration of the in-field equipment before using the diagram for safety critical work. This removed an opportunity to detect any error in master circuit diagrams.

Sources of information

The sources of information during the investigation included the:

• Queensland Rail
• Drivers of DP41 and DG44
• Network control officer
• Signalling team.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Queensland Rail, the Office of the National Rail Safety Regulator, and directly involved individuals.

Submissions were received from Queensland Rail and the Office of the National Rail Safety Regulator. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.