Collision of passenger train TD 6591 with buffer stop, Newport siding, Victoria, on 25 February 2019

Safety summary

What happened

On 25 February 2019, Train TD 6591, a six-car Comeng passenger train, operated by Metro Trains Melbourne (MTM), travelled from Flinders Street Station to Newport Station, Victoria, where all passengers disembarked. The driver commanded the train to depart the station once receiving an indication that the train was empty, with the intention to stable^[1] it at Newport siding, 810 m from the station. CCTV footage showed the train transiting to the siding with the driver visible and appearing alert.

While approaching the stabling location, for about 25 seconds from 0930:35 Eastern Daylight-saving Time,^[2] there were no recorded inputs from the driver. At about 0931, the train collided with the end of line protection (buffer stop) and derailed. Recorded data showed a brake application about 1.5 seconds prior to impact, which was after the train had passed the required stopping point. The collision resulted in substantial damage to the front of the train and the buffer stop, and the driver was hospitalised with minor injuries (Figure 1).

Figure 1: Front of Comeng train TD 6591, showing collision with buffer stop and derailment

Source: ONRSR, annotated by the ATSB

The train driver reported losing consciousness for an unknown period of time. The last thing that the driver could remember was noticing the track points were set correctly on entering the siding, with the next memory being after the collision.

Train driver

The driver had been driving MTM trains and based out of Newport for over 3 years, was suitably qualified and held a Category 1 medical (assessed as fit for duty unconditional in accordance with the medical standards contained in the National Standard for Health Assessment of Rail Safety Workers). Following the collision, the driver was tested for drugs and alcohol and returned a negative result for both.

The driver was admitted to hospital due to injuries sustained and examined by medical professionals. The driver reported that after extensive testing the medical professionals categorised the incapacitation as a vasovagal syncope (a common faint), possibly due to dehydration and lack of nutrition. The driver reported having a coffee and a banana but no water on the morning of the accident. The maximum temperature on the day was recorded to be above 30 °C, and the driver reported that the drivers cab was warm prior to the loss of consciousness and that there was no way to control the temperature as it was pre-set through the train. The driver also reported that the sun felt hot coming through the window.

Train controls and pilot valve

The brake controller (Figure 2) commanded the train’s pneumatic brakes through driver inputs.

The train was also equipped with a pilot valve system which was designed as a fail-safe mechanism such that the brakes would apply if there was no pressure applied by the driver (such as from incapacitation). When the pilot valve was ‘opened’ the brake pipe pressure would release and the brakes would apply. In order to keep the pilot valve ‘closed’, pressure was required to be maintained by the driver through either a foot pedal or hand controller. The hand controller for the pilot valve (hand pilot valve) formed part of the master controller (Figure 2).

The driver was using the hand pilot valve at the time of the accident. The hand pilot valve required a minimum downward pressure of 0.6–1 kg be maintained on the master controller handle to keep the valve in a closed position, preventing the brakes from applying.

Post-accident testing of the train’s braking system and hand pilot valve found no faults that would have contributed to a failure to stop.

Figure 2: Comeng driver’s cab of 333M, showing location of the brake controller, and combined master controller with hand pilot valve

Source: MTM, annotated by ATSB

Logged data

Each driving cab of the train was fitted with a Vigilance Control Event Recorder System (VICERS) data logger that recorded the speed, acceleration and operational status of the driving controls. The data logger from the leading cab (333M) was reviewed as it was the active cab and also the first carriage to impact the buffer stop. The logged data showed the following:

• The train’s speed was maintained below 15 km/h during the stabling operation and the driver used several brake and throttle modulations to do so.
• Driver inputs stopped at 0930:35 and there were no further inputs for about 25 seconds, with a brake application at 0931:00
• The brake application about 1.5 seconds prior to impact (at 0931:00) was consistent with an emergency brake application commanded by movement of the brake controller.
• There was no recorded change of state of the pilot valve system until impact.

Additional safety systems

The train was equipped with two additional safety systems to assist in protecting against driver error and incapacitation: a trip-lever and a task-based vigilance system.

Trip-lever

A trip-lever would initiate emergency braking if the train passed a signal requiring the train to stop. In this accident, the train was entering a siding and did not pass any signals requiring the train to stop. Therefore, there was no requirement for the trip-lever to activate the brakes.

Task-based vigilance system

The task-based vigilance system monitored driver control inputs and if there were no inputs for a certain amount of time, a warning would sound. If the driver did not respond to that warning, the brakes would apply. The timer would reset when certain tasks were performed, such as operation of the master controller or brake controller.

At the time of the accident, due to the train’s speed, the system was operating on a 45-second interval. The 25-second time period which elapsed without driver inputs was therefore too short to activate the system.

Fatigue

The driver’s rosters for the three months prior to the accident and reported 72-hour history were reviewed as part of a fatigue analysis, which included the use of biomathematical modelling. The roster was input into two biomathematical modelling software programs, FAST^[3] and FAID.^[4] Biomathematical modelling forecasts the effects of circadian rhythms and sleep on performance, but cannot determine fatigue (or predict errors caused by fatigue) due to individual and situational circumstances.

Both models’ outputs indicated that the predicted levels of fatigue on the day of the accident were not in a range known to have a significant impact on performance. This was likely due to the driver having a day off work two days prior, which would have impacted the biomathematical modelling outputs.^[5] However, in the week preceding the accident, before the day off, both biomathematical modelling outputs predicted that the driver was likely experiencing levels of fatigue shown to have an effect on performance.

Safety analysis

The driver may have been incapacitated in the period prior to the accident and therefore temporarily lost awareness of the driving task, leading to the train not stopping at the designated stopping point as the driver did not apply the brakes in sufficient time. While it is possible the driver was incapacitated in the period before the collision, due to limited and conflicting evidence the cause, duration and presence of incapacitation could not be determined. Although dehydration was raised as a possible reason for why the driver may have fainted, the available evidence could not confirm this. In addition, although the logged data showed no driver inputs for 25 seconds followed by a brake application, the duration of any incapacitation could not be confirmed as no driver inputs other than a final brake application to stop the train were required during that period as the train was maintaining the required speed. However, the recorded brake application occurred after the train had passed the required stopping point (and therefore was not effective in stopping the train).

The pilot valve was part of the overall train safety system, including the trip-lever and vigilance system. In this situation, the pilot valve was the only aspect of the safety system that could have activated and applied the brakes to protect against driver incapacitation. The hand pilot valve required minimal pressure to prevent the brakes from applying. It is very likely that adequate pressure was maintained on the pilot valve (master controller) during the period when no driver inputs were made, and therefore this part of the safety system was not triggered to activate the brakes and stop the train.

The driver’s rosters for the previous three months were reviewed through a fatigue analysis, including the use of biomathematical modelling software. This analysis indicated, due to the number of rostered days worked and the timing of shifts, the driver was likely experiencing a level of cumulative fatigue known to have an effect on performance in the week preceding the accident, before the day off. However, aspects such as the time of day, the driver’s 72-hour history including a day off work, and the driver reporting being very alert, suggests that fatigue was a not contributing factor in this accident.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The driver did not apply the brakes at the required time to stop the train, nor did the pilot valve brake activate, resulting in the train colliding with the buffer stop and derailing.
• Due to rostered work it is likely the driver experienced levels of fatigue known to have an effect on performance during the week prior to the accident, but not on the day of the accident.
• The ATSB could not confirm the presence or length of any driver incapacitation before the accident.

__________

1. To leave rail traffic unattended and secured, usually in a siding.
2. Eastern Daylight-saving Time (EDT) was Coordinated Universal Time (UTC) + 11 hours.
3. Fatigue Avoidance Scheduling Tool (FAST®). FAST predicts fatigue based on actual sleep and work schedules, and critical event scenarios using a model of human fatigue and circadian variation in cognitive performance and alertness.
4. Fatigue Audit Interdyne (FAID) Quantum. FAID predicts sleep opportunity, and as a proxy, estimates fatigue due to work-related causes.
5. For FAID, a recovery value is assigned depending on the length of non-work periods and the time of day that they occur.