Near hit with workers on track using Absolute Signal Blocking, Westmead, New South Wales, on 15 October 2019

Overview

At 2245^[1] on Tuesday 15 October 2019, a PO called the Westmead panel signaller at Granville signal box to arrange work on track protection for a Sydney Trains civil work group. The work group were intending to perform welded track stability analysis (WTSA) measurements on the Down Main line between Parramatta and Westmead stations.

The specific location of the worksite was identified by the PO between absolute signal^[2] GE463 and permissive^[3] signal M16.1. The location of the workers and the protecting signals used for the protection are depicted on the diagram below, which is based on a map prepared by the PO on their Worksite Protection Plan (Figure 1).

Figure 1: Driver’s Route Knowledge Diagram for Westmead

Source: Sydney Trains annotated by OTSI

The method of work on track protection proposed by the PO was Absolute Signal Blocking (ASB). The PO and the signaller agreed that absolute signals GE455 and GE 463 would be used to protect the worksite, in addition to 728 points being secured in the normal position.

During the conversation between the PO and signaller about the safeworking arrangements, there was discussion about the need to divert rail traffic around the work area. This diversion would require the use of the protecting signals for the alternative route to be able to run rail traffic via 727 points from the Do^[4] This was a manoeuvre that was permitted under the Network Rules and Procedures for ASB at the time.

At 2253, the signaller authorised ASB with blocking facilities on signals GE455 and GE463 and 728 points were locked and blocked in the normal position. The workers then made their way to the designated work location at Westmead and commenced work on track under the ASB.

At 2302, the signaller observed run 133U depart Parramatta station and removed the blocking facilities for signals GE455 and GE463 and set the route for the train via 727 points. This movement effectively routed the train into the worksite protected by the ASB.

The driver of run 133U saw the workers on track on the Down Main at approximately 24.700 km and sounded the train whistle. At the same time, other workers outside the rail corridor observed the approach of 133U and shouted a warning of “Train on”. The workers on track quickly vacated the Down Main line to the down cess area. The driver made an emergency brake application and the train stopped just past the location where the workers had been.

The image at Figure 2 is taken from the CCTV on the front of train 133U and shows the three workers in the Danger Zone as the train approaches 727 points on the Down Main line. It is estimated they were approximately 20-30 m from the front of 133U when this image was recorded.

Figure 2. CCTV image from train 133U

Source: Sydney Trains annotated by OTSI

Post incident

The train driver called the signaller at 2305 to report the incident. The signaller called the PO and the ASB was ended at 2307. The signaller then reported the incident to the Train Service Delivery Manager (TSDM) at the Rail Operations Centre.

A Sydney Trains Incident Rail Commander (IRC) was despatched to the site to investigate the incident. The signaller at Granville signal box was relieved of safeworking duties and stood down pending the investigation. The Protection Officer was also stood down from safeworking duties pending the investigation.

Drug and alcohol testing was conducted on the PO and the signaller with negative results for both.

__________

1. Australian Eastern Daylight Saving time.
2. An absolute signal is a fixed signal that must not be passed at stop without the authority of the signaller.
3. A permissive signal is a fixed signal that is normally controlled by the passage of rail traffic and its normal indication is a Proceed Authority. A signal that can be passed at stop without the authority of a signaller or Special Proceed Authority (SPA) if it is considered safe to do.
4. Down lines typically carry train movements away from Sydney, Up lines towards Sydney.

Network Rules and Procedures

Sydney Trains administer a suite of safeworking network rules and procedures to safely manage work on track. Absolute Signal Blocking (ASB) is one of several methods to protect work on track in the Sydney Trains network. The rule has been in place since July 2012. The rule was previously known as Controlled Signal Blocking, which was introduced in 2001.

Location

Westmead station is located approximately 25 km west of Sydney Central station on the main western line. Four railway lines run through Westmead, the Up West Main, the Up West Suburban, the Down West Suburban and the Down West Main.

Figure 3: Map of Westmead and surrounds

Source: Geoscience Australia

The work on track

The work being performed by the infrastructure workers was WTSA. This involved the workers taking measurements to detect and correct locations that are vulnerable to misalignment of rails. The location of the work was between signal GE463 at 24.635 km and signal M16.1 at 25.932 km.

The work involved two Sydney Trains Infrastructure workers and a PO from Swetha International Pty Ltd, a labour hire company that provides safeworking services to Sydney Trains.

The train involved

133U was a Waratah 8-car A set, A44. The train was crewed by a driver in the leading power car, and a guard in the rear car. The train was operating on a route from Central to Penrith, departing at 2225 and scheduled to arrive at Penrith at 2347.

No abnormal operation of the train was reported during the journey, and it is therefore not considered a factor in the incident.

Operating environment in Granville signal box

Granville signal box is a two-panel signal box, consisting of the Granville and Westmead signal panels. Each panel is operated by a signaller. A relief signaller is always there to provide coverage when the rostered signaller is on a rostered meal break or comfort break.

The roster for the signallers gives specific acronyms to each signaller on shift. These acronyms will be used within this report.

The rostered signaller for the Granville panel is known as GG, the signaller for the Westmead panel is known as GW, and the relief signaller is known as GT. This stands for Granville Table. The Table signaller is the colloquial name for the relief signaller. The table refers to the spare desk or workstation in the signal box where the GT signaller performs various support functions while not providing relief on the signalling panels.

The system of safeworking for Granville signal box is unidirectional rail vehicle detection. The system is described in the Sydney Trains Network Rule NSY 500 Rail Vehicle Detection.

The signaller

The GT signaller operating the Westmead panel at the time of the incident had 15 years’ experience as a signaller in the Sydney Trains/RailCorp network. The GT signaller had no reported history of involvement in safeworking incidents. The GT signaller had all the necessary certifications in place to fulfil the functions of the role, except they had not attended a mandatory safety course. This course was called ‘Apply safety critical communications in the rail industry’. The GT signaller attended this course two weeks after the Westmead incident.

Fatigue management for signallers

Sydney Trains rostering and fatigue management principles were embedded in the operating practices of the organisation. Managing Shift Work and Rostering was an operating procedure used to manage rostering practices to help reduce the cumulative effects of fatigue on rail safety workers, including signallers.^[5]

The protection officer

The PO, employed by Swetha International, was an experienced PO with a 12-year history of safeworking qualifications. The PO had only one safeworking incident recorded in their work history at that time, a relatively minor event of protection being left on the track after a possession. There was no evidence from the rostering and work patterns that the PO was fatigued. Consequently, fatigue of the PO is not considered a factor in this incident.

__________

5. Sydney Trains, Managing Shift Work and Rostering procedure, SMS-08-OP-3128 V1.2.

Absolute Signal Blocking (ASB)

ASB works on the principle of rail signals being set to stop with blocking facilities applied to exclude rail traffic from the work area. Within the rule there are several options to provide protection, including:

• Having two controlled absolute signals set to stop with blocking facilities applied or
• Having one controlled absolute signal set to stop with blocking facilities applied and
  • Removing an ESML/EOL key, or
  • Securing points to prevent access, or
  • There being an easily reached safe place available and providing a lookout.

It is important to note that the rules provide two layers of protection. This provides a buffer area so that if a train that inadvertently passes the first blocked signal, it does not immediately enter a worksite location. For example:

Figure 4: ASB – Two consecutive controlled absolute blocked signals

Figure 5: ASB – One controlled absolute blocked signal and points secured

Figure 6: ASB – One controlled absolute blocked signal and Lookout

The ASB rule has the facility to allow the protection to be temporarily suspended in order to run rail traffic through the work area, provided certain assurances are gained. When rail traffic has left the work area, the ASB may be re-established. This facility was not used in relation to the work involved in this incident.

Within the ASB rule, there was also the facility to be able to clear signals being used for ASB protection to run rail traffic on an alternative route. This facility required the PO and the signaller to agree about the movements and make sure the worksite is clear of the alternative route. Other than these brief instructions, there was no other guidance in the rule, procedure, or other material to help make decisions when this facility in the rule was used. Sydney Trains withdrew this facility from the Network Rules on 16 October 2019, the day after the Westmead incident. This was achieved by issuing a temporary amendment document known as a Safe Notice Telegram 2019-1047.

The telegram stated:

‘ABSOLUTE SIGNAL BLOCKING (ASB) UPDATED REQUIREMENTS

Effective from 1800 hours, Wednesday 16 October 2019

In exception to NWT 308: Absolute Signal Blocking, when blocking facilities have been applied to exclude rail traffic from a portion of line, blocking facilities MUST not be removed to allow signals to be cleared for an alternate route. Blocking facilities MUST remain applied while the ASB is in force. These requirements will also apply when blocking facilities are applied to signals that are used to exclude rail traffic from a portion of line in accordance with NTR 432: Protecting activities associated with in service rail traffic.’

In December 2020, Sydney Trains introduced rule and procedure changes for ASB that permanently prohibited the clearing of the signal immediately protecting the worksite for the purpose of running a train on an alternative route.

Protection methods under ASB and their principle of operation

Basic principles of protection

The basic principle of protection under ASB is that a signaller will set and maintain one or more signals at stop to prevent rail traffic from intruding into the work area. This is achieved through a mutual arrangement of understanding between the PO and the signaller about the location of the work, the signals needed to protect the work and the choice of which option is used from the choices available within the rule.

The critical element of the protection measure is that someone remote from the work area is responsible for the function of setting and maintaining the signals at stop. This is what stops a train from entering the work area. For the most part, the workers on the track have no control over the status of the protecting signals – they rely upon the competence, capability and diligence of the signaller to ensure the protection is set and maintained for the duration of the work.

Clearing signals for an alternative route

When the ASB rule permits the same signals providing protection to be cleared in order to run rail traffic through an alternative route, it introduces a potentially conflicting objective that must be carefully managed to avoid the situation that occurred in this incident. The ASB rule, as it was on the 15 October 2019, provided almost no direction for those involved in managing the protection and how to deal with this potentially conflicting objective.

The extract from the rule NWT 308, as it was on 15 October 2019, said the following:

‘If protecting signals need to be cleared for an alternative route, the Protection Officer and the Signaller must agree about the movements and make sure that the worksite is located clear of the alternative route.’

The associated procedure NPR 703 Using Absolute Signal Blocking had no direction or guidance at all about how to manage this activity.

Detecting rail traffic approaching the worksite

Workers on track using ASB are also reliant on a signaller remote from the work area correctly identifying that there is no rail traffic closely approaching the worksite before the protection is approved and workers enter the danger zone.

A worker was fatally injured at Kogarah, NSW, in 2010 when a signaller did not detect the presence of a train between the protecting signals and the worksite in time to warn the workers. After the protection was implemented the workers went on track and the then train entered their worksite, striking and fatally injuring a worker.

The NSW Office of Transport Safety Investigations (OTSI) compiled a report about that fatal incident and the findings included how poor practices relating to signal box management contributed to the accident.

This is an example of the safety of the workers on track being a joint responsibility, including a worker who is remote from the worksite, who has a number of other responsibilities and distractions that can lead to errors, mistakes and omissions from this task.

Alternate methods of protection

Rail systems across the world have adopted technologies and practices that place the protection of the work on track in the hands of those doing the work, and who bear the risk of being struck by a train. This includes;

• devices to activate track circuits at the worksite to put protecting signals to stop
• switches on signals that allow a worker to set and maintain a signal to stop
• automatic train warning systems that detect approaching rail traffic and warn workers to move to a place of safety.

Sydney Trains have projects in place that either are under trial or in implementation phase that seek to introduce technologies that provide greater control for worksite protection.

This program is called the Enterprise Track Worker Safety (ETWS) Program. These projects and trials are currently in various stages of progress and development. Use of protection systems that look to eliminate the human error in areas like miscommunication, distraction or performance are to be encouraged.

A device that activates the track circuit of the protecting signal, or a switch that acts on the signal itself to place it at stop, would likely have prevented this incident, as the activation of this type of protection would be in the control of the Protection Officer with the work group. The Protection Officer was with the work team and would be very unlikely to clear a signal that would knowingly allow a train to enter their own work area.

Operating arrangements at Granville signal box

Rosters and meal breaks

Both panels in the Granville signal box are attended 24 hours a day, 7 days a week by a signaller for the purpose of routing trains through their area of control. A relief signaller is present on all shifts to provide coverage for the two signallers rostered on to the panels. The table signaller provides meal and comfort break relief and administrative support to the operating signallers in the form of processing various operational documents that are circulated daily in the Sydney Trains network.

Night shift at Granville signal box runs from 2135 each night to 0535 the following morning. The arrangements for staffing the panels are contained in a document called ‘Table person duties Granville Box’. The document is not published anywhere within the Sydney Trains electronic document management system. It is in hard copy only.

The document is not signed, approved or authorised by any Sydney Trains line management and has no document control or numbering, however it did have currency with the signallers in relation to the operating arrangements.

The document indicates that each signaller has two one-hour meal breaks per eight hour shift on day and afternoon shift. This document does not address the meal break and coverage arrangements for night shift. The document only shows meal breaks and panel coverage for day and afternoon shifts.

Figure 7 – Table Person Duties Granville Box

Source: Sydney Trains

The signallers at Granville signal box therefore had no guidance, direction or other instruction about how and when meal breaks should be taken on night shift or how and when coverage for the signalling panel should be arranged. It was essentially a self-managed function.

On the night of the incident, the GW signaller started work on night shift at 2135 and immediately went on a two-hour meal break. The signaller GT was then required to work on the Westmead panel from the start of the shift to provide a two-hour meal break relief for signaller GW.

At interview, the Sydney Trains line manager advised that it was not normal practice for signallers to commence their shift and immediately have a two-hour meal break. The Sydney Trains line manager advised at interview that two-hour paid meal breaks are not the common practice for Sydney Trains signallers, however this is what occurred on the night of the incident.

Supervision and work arrangements in Granville signal box

At around 2200 hours the signaller GG, rostered to be working the Granville panel, decided they would leave the panel and sit at the desk at the back of the signal box normally reserved for the GT, or table person.

The signaller GG did some of the work normally done by the table signaller, including processing Special Train Notices. The signaller GG also marked some training papers that they attended to as part of their role as a signaller trainer. Signaller GG left the control room at around 2300 to go to the meal room to prepare some food, leaving signaller GT alone in the control room.

This meant the GT signaller was managing both signalling panels for over one hour prior to the ASB incident at Westmead, and for a period of around ten minutes was the only person in the control room out of a team of three. The GT signaller is recorded as answering operational calls for both panels until the incident happened at 2304.

The role and responsibilities of signallers are documented in Network Rule NGE 234 Responsibilities of Signallers.

These responsibilities include:

• Safe operation of signalling equipment
• Responding to signalling faults, failures and warning alarms
• Authorising and issuing procced authorities, work on track authorities and methods
• Obtaining authority from the Sydney Trains Rail Operations Centre (ROC) to operate unscheduled rail traffic like defective trains, trains being worked out of service, empty trains being relocated and light engine movements
• Dealing with train delays and incidents.

The signallers roles are full time rail safety workers and the signalling panels are attended 24 hours a day, including on night shift. There is still rail traffic at night, including late night passenger and freight trains, and there is normally maintenance activity conducted at night. This warrants the full time attendance of signallers on both signal panels with rostered relief.

No explanation was offered by Sydney Trains for the unapproved absence of signaller GG. At interview, the Sydney Trains line manager considered the act of a signaller leaving their post without normal relief a code of conduct issue. There was no indication this matter was addressed as such.

Sydney Trains have a procedure that generally manages signal box operations, ‘Signal box management procedure’.^[6] The procedure was originally issued in 2015.

The procedure covers generic issues including:

• Responsibilities of signallers
• Operation of signalling equipment
• Communication and supervision
• Administration and safety equipment.

The signal box management procedure does not have a recognised document number to indicate it is part of the Sydney Trains document management system. The procedure is shown as managed by the Compliance Standards Manager and approved by the Network Operations Manager.

The procedure does not mention how internal operational coverage is managed at individual signal boxes. It does not mention meal breaks or the role of relief signallers during their shift. Given the absence of any direction in this procedure, and the unauthorised nature of the Granville signal box document, Sydney Trains did not address this important aspect of network operations within their established management system.

Fatigue management for signallers

This Sydney Trains rostering and fatigue procedure included eight rostering principles to be observed in order to reduce or manage the cumulative effects of fatigue. These eight rostering principles, and a description of these principles, are reproduced below from the Sydney Trains procedure:

The planned, or master, roster and shifts actually worked for the period from 6 – 19 October 2019 for signaller GT is included in the table below.

Five of the eight rostering principles were not met in relation to the roster of signaller GT in the eight days leading up to the incident. The five principles, and the nature of the departure from these principles, are outlined below.

According to the Managing Shift Work and Rostering procedure, when departures from these rostering principles occur, line managers must intervene and put in place measures to try and correct the situation. The line manager for signaller GT was unaware of the departure from these rostering principles, and therefore did not put measures in place as required by the procedure. The line manager for GT had not undertaken the mandatory training course ‘Fatigue Management for Managers’.

Sydney Trains acknowledged in their internal investigation report that the requirements for the procedure Managing Shift Work and Rostering were not being followed. Sydney Trains adopted a recommendation from their internal report as follows:

‘Review why the requirements of SMS-08-OP-3128 Managing Shift Work and Rostering, in relation to the diverting from Rostering Principles, are not being followed and determine appropriate corrective actions. In particular:

· the process for identifying and managing exceptions to the rostering principles with day to day operations (recording exceptions and capturing controls that are identified as a result);

· who has completed the required fatigue training to ensure understanding of the rostering principles;

· reporting exceptions to rostering principles; and

· the processes around the implementation of the Network operations – fatigue risk management checklist and its integration with the SMS.’

At interview, the signaller GT stated that they were well rested for the shift prior to the incident. Signaller GT recounted how they had an effective rest regime at home when working night shift and had obtained sufficient rest, had slept as usual from about 0830 to 1500, and felt fit and able to carry out their shift.

It is unknown whether the amount of sleep was sufficient to allow for recovery from the seven consecutive shifts. It is possible that the signaller GT was affected by the cumulative effects of fatigue given the deviations from five rostering principles leading up to the day of the incident. However the evidence is not definitive and it is not possible to ascribe fatigue as a contributing factor with any certainty.

Use of bio-mathematical fatigue scores

Sydney Trains employed fatigue modelling (using FAID^[7]) for roster design and to ensure that employees were provided with adequate rest opportunity between shifts. Bio-mathematical models attempt to predict the effects of different working patterns on subsequent job performance, with regard to the scientific relationships among work hours, sleep and performance.^[8] FAID ‘assigns a recovery value to time away from work based on the amount of sleep that is likely to be obtained in non-work periods, depending on their length and the time of day that they occur.’^[9]

That is to say, FAID does not predict fatigue per se but rather predicts a sleep opportunity, demonstrating only that the organisation has provided employees with an adequate opportunity to sleep, producing a work-related fatigue score.^[10]

The FAID score is a single number based on a zero to above 120 range. The number ranges and descriptors are given below:

• Standard: 0-40
• Moderate: 40-80
• High: 80-100
• Very High: 100-120
• Extreme: above 120

The Sydney Trains Operations Manager West/Illawarra was responsible for the planned shift work roster for signaller GT. According to the Operations Manager they would only conduct a risk assessment when the FAID score exceeds 100. The FAID score on the day of the incident was calculated by Sydney Trains as 93. There was no consultation with signaller GT about the planned shift work roster. Departure from the rostering principles, as occurred in this case, did not trigger any action by the line manager related to managing the potential fatigue of the signaller GT.

Sydney Trains have conducted a review of the use of the FAID score as it related to this case. They found that there was no documented rationale for the use of a FAID score exceeding 100 as a trigger for risk management actions.

FAID, along with other bio-mathematical models, is a useful tool to account for hours of sleep opportunity provided, thereby providing an indication of fatigue exposure across a group of employees. It cannot account for the hours of sleep actually achieved by individuals, nor for the quality of that sleep. These additional factors necessitate the use of multiple layers of controls to manage fatigue-related risk.

As a result of inconsistencies with the application of rostering principles Sydney Trains have recommended a review of their procedure for Managing Shift Work and Rostering. In particular:

• The process for identifying and managing exceptions to the rostering principles with day to day operations (recording exceptions and capturing controls that are identified as a result);
• Who has completed the required fatigue training to ensure understanding of the rostering principles;
• Reporting exceptions to rostering principles; and
• The processes around the implementation of the Network operations – fatigue risk management checklist and its integration with the SMS.

Safety Critical Communication

The communication between signaller GT and the Protection Officer

Signaller GT and the Protection Officer discussed the need to divert trains around the work area, however neither worker identified that the intended route through 727 would intrude on the worksite.

The lack of direction in the rules and procedures about how to manage this conflict contributed to the error. The error was likely compounded by an assumption from Signaller GT that the work was taking place further west at Westmead platform. This assumption was based on previous work on track activity, like track cleaning, which regularly took place through Westmead platform.

During the period of the conversation between the signaller GT and the PO to establish the ASB, signaller GT was regularly interrupted by phone calls related to the Granville signal panel, which the signaller GT was operating as well, because signaller GG had vacated their workstation.The signaller was performing multiple tasks in ensuring normal train running was occurring, monitoring multiple computer monitors, and ultimately attending to the request for worksite protection.

The communication requirements in NGE 204 require that interrupted communications must be restarted, however the signaller GT and the PO resumed their conversation after the interruption rather than restart it.

There was no advance notification to the signaller about the intended work, and its consequent impact on train running. An improvised train operations plan needed to be implemented. This added to the workload of the signaller and was likely a contributing factor to the error in assuming the workers were located clear of 727 points. The signaller GT misunderstanding of the position of the workers on track and the error in routing the train was likely the result of the cumulative effects of fatigue, magnified by the increased workload.

The lack of direction in the rules and procedures about how to properly identify the actual location of the workers within the area protected by the ASB, compounded by the signaller GT’s assumption about the location of the workers, led to the error of allowing the train 133U to pass protecting signal GE 463 and enter the worksite.

Planning of work in the Sydney Trains network

Sydney Trains Engineering and Maintenance Division employ several thousand people, including maintenance and upgrading staff, performing a multitude of tasks in and around the rail corridor. Sydney Trains also employ numerous contractors performing work on or around the track. Other organisations like Transport for NSW and Sydney Metro are also doing works in and around the rail network.

Many work activities are undertaken within a planned possession regime when occupation of the track is planned in advance and train operations are altered or replaced with buses. This work is advertised, and significant work goes into its delivery, including the altered train working arrangements.

In May 2020, Sydney Trains implemented the Access Pre-Advice system, (APS). This system is regarded as a planning and registration system, not a safety system. The purpose of the APS is to require work outside of a Local Possession Authority to be planned and logged into the system four days in advance, so that Network Operations have some visibility of the intended work and can plan for it.

In the period 20 May to 20 June 2020, there were 1063 applications for Absolute Signal Blocking in the Sydney Trains Network as recorded in the APS. Not all of these requests would result in train diversions, however, this figure illustrates the amount of unannounced work that Network Control Officers had to deal with in the Sydney Trains network prior to the introduction of the APS.

Sydney Trains also have a worksite protection planning system called the Corridor Safety Centre (CSC). This system requires the Protection Officer to contact the CSC and have their protection arrangements reviewed and validated before work commences.

In April 2021, Sydney Trains announced a trial of the integration of these two systems at Waterfall in NSW. This trial may introduce improvements to the process of planning and delivering worksite protection in the network.

At the time of the incident in October 2019, a significant proportion of the work on track that occurred in the Sydney Trains network was done with no prior knowledge of, or advice to, the Operations Division. In this incident, the first knowledge that the signaller had that the work was to occur was when the PO2 called Granville signal box to request the ASB.

There was no evidence available to indicate that the impact to train operations from the proposed work was considered by the Engineering and Maintenance Division. The effort was only put into determining the worksite protection required to permit the work to occur. Any resulting change to train operations is therefore a responsibility that is handed to the signaller to organise, with no advance notice.

Even a relatively small job like the WTSA inspections can cause train operations disruption, because of the need to exclude trains, and therefore, divert trains from their normal timetable. Diversions mean trains are not on their normal rostered path, stopping patterns are altered because different platforms need to be used for passenger working and the volume of services get compressed from two tracks to one.

Passenger information must be dispersed, station staff need to be informed and other adjoining signal boxes need to be advised of the altered train running arrangements. A decision to grant an ASB for a relatively simple task of taking track measurements can have a large effect on the network.

Because the WTSA inspections work was not known to the signaller, the signaller had to devise an improvised train operations plan, with little time to consider the implications of what was being planned. The signaller also had to attend to the other normal train running activities associated with the signal box on those tracks unaffected by the ASB.

The lack of an integrated planning regime for work outside the possession planning process could have increased the possibility of errors and omissions during the delivery of protection for work on track.

At the time of the incident, there was no requirement for this work to be notified to the Operations Division of Sydney Trains, so that some form of planning and preparation for the impact could have been made. At the time of this incident, Sydney Trains did not employ an integrated system to manage work on track in the rail network.

__________

6. Sydney Trains, Signal box management procedure, version 1.3 dated 12 September 2019.
7. Fatigue Audit InterDyne: A bio-mathematical model designed to predict aggregated fatigue risk over a roster. Fatigue risk is interpreted by way of a number related to fatigue risk, known as the Fatigue Index or FAID score.
8. Dawson, D., Noy, Y.I., Harma, M., Akerstedt, T. & Belenky, G. (2011). Modelling fatigue and the use of fatigue models in work settings. Accident Analysis and Prevention, 43, 549-564.
9. Roach, G.D., Fletcher, A. & Dawson, D. (2004). A model to predict work -related fatigue based on hours of work. Aviation, Space, and Environmental Medicine, 75(3), 61-69.
10. Dawson et al (2011).

From the evidence available, the following findings are made with respect to the near hit incident with workers on track at Westmead on 15 October 2019.

Contributing factors

• The PO and the signaller did not come to a clear understanding about the arrangements to use the protecting signal in order to run a train on the alternative route.
• The signaller experienced a period of high workload during the shift which likely contributed to the error where signal protection for the worksite was removed to allow a train to run through the worksite.
• The signaller's roster departed from rostering principles and the rostering arrangements did not provide sufficient assurance in managing the risks.
• Sydney Trains did not provide suitable management arrangements for supervision at Granville signal box to ensure there was adequate coverage on both signalling panels. (Safety issue)
• The ASB rule NWT 308 and procedure NPR 703 did not provide sufficient description for the task of using protecting signals for an alternative route. (Safety issue)
• There were inconsistences with Sydney Trains’ application of their fatigue management system, in particular the use of a bio-mathematical model to predict individual fatigue risk. (Safety issue)

Other factors that increased risk

• The FAID score of 100 used by Sydney Trains as a threshold for intervention has no documented rationale.
• A significant proportion of the work on track that occurred in the Sydney Trains network was done with no prior knowledge of, or advice to, the Operations Division.
• The Granville signaller was absent from the panel with no rostered relief.

__________

The ASB rule and procedure for using an alternative route

Issue number: RO-2019-018-SI-01

Issue number description: The ASB rule NWT 308 and procedure NPR 703 did not provide sufficient description for the task of using protecting signals for an alternative route. (Safety issue)

Signaller supervision

Safety issue number: RO-2019-018-SI-02

Safety issue description: Sydney Trains did not provide supervision at Granville signal box to ensure there was adequate coverage on both signalling panels. (Safety issue)

Inconsistencies with application of fatigue management system

Safety issue number:  RO-2019-018-SI-03

Safety issue description: There were inconsistences with Sydney Trains’ application of their fatigue management system, in particular the the use of a bio-mathematical model to predict individual fatigue risk. (Safety issue)

ASB                 Absolute Signal Blocking

CCTV               Closed Circuit Television

CSC                 Corridor Safety Centre

EOL                 Emergency Operation Lock

ESML               Emergency Switch Machine Lock

ETWS              Enterprise Track Worker Safety program

GG                   Granville signalbox, Granville panel signaller

GT                   Granville signalbox, Table signaller

GW                  Granville signalbox, Westmead panel signaller

IRC                  Incident Rail Commander

NGE 234          Network Rule General 234

NPR 703           Network Procedure 703

NWT 308          Network Rule Work on Track 308

PO                   Protection Officer

TSDM              Train Service Delivery Manager

WTSA              Welded Track Stability Analysis

__________

Sources of information

The sources of information during the investigation included the:

• Sydney Trains Systemic Safety Investigation Report
• Swetha International Pty Ltd Investigation report
• Voice recording data from Granville signal box

References

Dawson, D., Noy, Y.I., Harma, M., Akerstedt, T. & Belenky, G. (2011). Modelling fatigue and the use of fatigue models in work settings. Accident Analysis and Prevention, 43, 549-564.

Folkard S, Robertson KA, Spenser MB (2006). The development of a fatigue / risk index for shiftworkers. p.12.

Roach, G.D., Fletcher, A. & Dawson, D. (2004). A model to predict work -related fatigue based on hours of work. Aviation, Space, and Environmental Medicine, 75(3), 61-69.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Sydney Trains
• Transport for NSW
• The Office of the National Rail Safety Regulator
• Swetha International Pty Ltd

Submissions were received from Sydney Trains and The Office of the National Rail Safety Regulator. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

__________