Safeworking irregularity involving passenger trains 1898 and 18A0, near Thorneside, Queensland, on 7 March 2020

Overview

In the early morning of 7 March 2020, a maintenance work group was undertaking work between Thorneside Station and Birkdale Station on the Cleveland rail corridor in Brisbane, Queensland. Queensland Rail (QR) was the rail infrastructure manager of the rail corridor.

At about 0108 local time, a QR suburban passenger train, with passengers on board, almost collided with an excavator while it travelled along the rail tracks near Thorneside. While personnel were attempting to remove the excavator from the danger zone[1] of the rail corridor, a second near collision occurred involving another suburban passenger train.

Pre-work arrangements

The maintenance work group was tasked with replacing a defective section of railway track located between Thorneside and Birkdale stations. The following personnel were involved in the maintenance work:

• a QR depot supervisor
• a QR work group team leader (acting as the supervisor of the maintenance task under the guidance of the depot supervisor)
• 4 QR maintenance personnel, including the operator of a front-end loader and one worker performing the role of the recipient.[2]

In addition, the following contractors were involved in the track maintenance work:

• a welder
• a labourer   
• 2 protection officers[3] (POs), (lead PO and an assistant PO)
• an excavator operator.

The ‘planned closure’[4] was scheduled to start at 0218 on 7 March and involved the use of a track occupancy authority[5] (TOA) with in-field protection (sometimes known as a ‘protected TOA’).

At 2100 on 6 March 2020, the QR personnel, the labourer and the welder commenced their shift at the Cannon Hill depot in Brisbane. The supervisor and team leader discussed planning for the task and potential contingencies if there were delays. The team leader and members of the work group, who signed on at the depot, then prepared the work truck with the necessary tools for the worksite, while the supervisor planned the work schedule from their office.

At about 2130, the team leader gathered the work group members who were present for a network pre-start briefing[6] at the depot. The brief discussed the nature of the work task as well as the hazards and controls that would be applied. The work group was told that it was likely that preparation work at the worksite would occur prior to the planned closure using a TOA without in‑field protection (sometimes known as an ‘unprotected TOA’). The POs and the excavator operator were not involved in the pre-start briefing at the Cannon Hill depot.

After completing the network pre-start briefing, the team leader and members of the work group signed the relevant section of the Network Pre-Start Briefing form (MD-15-43), verifying they were present and that they understood the requirements of the briefing.

At about 2200, the work group members at the Cannon Hill depot travelled to the worksite at Thorneside, stopping briefly to purchase refreshments. At the same time, the POs arrived at the Cannon Hill depot to meet with the supervisor to discuss work arrangements, in particular the protection at the worksite. The supervisor communicated the potential for performing preparation work prior to the planned closure under the safeguard of a TOA without in-field protection,[7] which would require protection arrangements for the period of the preparation work in addition to those published in the train notice[8] for the planned track closure. Following the discussion between the supervisor and the POs, the team leader was provided with an overview of the proposed arrangements.

The lead PO contacted the network control officer (NCO) to discuss the proposed arrangements. The NCO checked their train diagram[9] and confirmed with the PO that there was availability to instate a TOA without in-field protection for the preparation work that allowed workers access to the track between trains for brief periods. As the NCO was nearing the end of their shift, they stated that they would inform the incoming NCO of the proposed work on track arrangement and the agreed protection for that work.

At about 2215, the team leader departed the Cannon Hill depot and travelled to the worksite at Thorneside. Shortly after, the POs and the supervisor also left the depot and travelled to the worksite in separate vehicles.

Preparation work

At about 2235, the team leader and members of the Cannon Hill work group arrived at the work group entrance gate to the rail corridor at Thorneside (located at the 23.645 km mark),[10] which was about 340 m east of the actual worksite (Figure 1). The team leader directed the recipient and the front-end loader operator to travel to Thorneside Station to collect the front-end loader that was required at the worksite.

At about 2245, the POs arrived at the work group entrance gate. The team leader and lead PO discussed the required protection arrangements for the preparation work, and the PO then briefed the work group members who were present about these arrangements.[11] The supervisor had not arrived at the worksite at this time. The PO explained that work in the danger zone would be for short periods, which would occur between train activity under the safeguard of a TOA without in‑field protection. The PO then contacted the NCO and the paperwork relevant to this TOA was completed. At about that time, the supervisor arrived at the entrance gate.

The TOA without in-field protection was issued to the lead PO at 2252 and it was suspended 10 minutes later at 2302. In that period, the PO, supervisor, and team leader entered the rail corridor through the entrance gate and walked to the worksite to evaluate the track defect and work requirements. While the TOA was suspended, they stood clear of the danger zone and 2 suburban passenger trains passed the site.

The TOA was reinstated at 2322 and suspended at 2333. In that period, at the request of the team leader, 4 members of the work group walked from the entrance gate to the worksite to perform preparation work, while the team leader returned to the entrance gate to measure a length of rail that had been placed in the rail corridor days earlier. The length of rail was to be cut to size in preparation for the replacement of the track defect at the worksite. The lead PO and supervisor remained at the worksite.

At 2325, the excavator operator, who was required for the planned closure (but not the preparation work) contacted the supervisor to obtain information about the location of the worksite. The supervisor directed the excavator operator to travel to the work group entrance gate and wait for instructions.

The excavator operator arrived at the entrance gate at about 2335, where they were met by the team leader and members of the work group. The excavator operator requested a worksite briefing but was told to wait until further notice as the excavator was not required until the planned closure and after the preparation work was finished. After completing several tasks, the team leader discussed the work arrangements with the excavator operator and requested the operator sign the network pre-start briefing form, which was signed. The excavator operator was not provided a formal network pre-start briefing and was not provided with any briefing about worksite protection arrangements by the lead PO. The PO was not informed or aware that an excavator had arrived at the worksite.

The team leader advised the excavator operator not to unload the excavator from the truck as passage through the work group entrance gate was not suitable for the excavator (as cement troughing was blocking its path). Consequently, the team leader directed the excavator operator to travel to another entrance gate further east, located at the 24.117 km mark (Figure 1), and wait for further instructions. In addition, the team leader advised the excavator operator to complete all documentation pertaining to the excavator accessing the rail corridor in readiness for the planned closure. The excavator operator then travelled to the next entrance gate, unloaded the excavator from the truck, and prepared the relevant paperwork.

Figure 1: Places of interest relevant to the worksite and the entrance gates

The image shows Thorneside Station, the worksite, entrance gates for the work group and the excavator and near collision location.

Source: Google earth, annotated by the ATSB

The TOA was reinstated at 0022 (on 7 March) and suspended at 0033. In that period, members of the work group walked from the worksite back to the work group entrance gate as preparation work at the worksite had been completed. The only remaining work activity prior to the planned closure was to load the bucket of the front-end loader with tools and equipment in readiness for transportation from the entrance gate to the worksite. At this time, the front-end loader was in the rail corridor near the entrance gate, but on the opposite side of the rail tracks to that of the entrance gate, work truck and work group.

While the TOA was suspended, the recipient, who had assisted in preparing the worksite, travelled by car to meet with the excavator operator at the other (excavator) entrance gate. The recipient and the excavator operator completed the necessary documentation in relation to the height limiter[12] on the excavator. The recipient advised the excavator operator that they required additional information on the state of the planned closure before they could grant access to the rail corridor. The recipient then travelled back to the work group entrance gate.

At 0051, as the recipient arrived back at the work group entrance gate, the TOA was reinstated. The team leader communicated an instruction to the work group ‘it’s on’, by which they meant the TOA had been reinstated and tools and equipment could be transferred from the work truck into the front-end loader.

On-tracking of the excavator

The recipient heard the team leader’s instruction and witnessed the work group loading the front‑end loader and assisted with the loading. Soon after, the operator of the front-end loader gave the recipient the height limiter key, which was a requirement before machinery could perform work on track under live overhead equipment. In interview, the recipient stated that the combination of these events gave them the impression that the planned closure was now in force.

In the belief that the planned closure was now active, the recipient contacted the electric control officer[13] (ECO), in accordance with procedures, to inform them about the location of the worksite and the number of machines (excavator and front-end loader) at the worksite.

Without seeking or receiving confirmation from the relevant personnel (team leader, supervisor, or PO) on the state of work and protection arrangements, the recipient travelled back to meet with the excavator operator at the (excavator) entrance gate. The recipient informed the excavator operator that the planned closure was active and that they could on-track the excavator, and the recipient unlocked the access gate.

Meanwhile, at the work group entrance gate, the team leader instructed all the workers there to stand down. At 0102, the lead PO, who was unaware that the recipient had directed the excavator operator to on-track the excavator, suspended the TOA and advised the NCO that preparation work was complete and there would be no further work until the planned closure at 0218. On receipt of the suspend code,[14] the NCO suspended the block,[15] and then set the signal path for a suburban passenger train (1898) to travel from Thorneside to Cleveland (eastward).

Shortly after the TOA for the preparation work was suspended, the excavator was driven into the rail corridor and, with the aid of its boom arm and bucket, the operator pulled the upper frame of the excavator onto the track and placed its guide wheels on the running tracks. The recipient advised the excavator operator to proceed towards Thorneside where they would be met. The recipient then returned to the work group entrance gate by car.

Track fault

At 0106:55, while train 1898 was stationary at Thorneside Station, the signalling system detected a track section between Thorneside and Birkdale was occupied. This detection momentarily generated a ‘failed track’ message on the monitor of the NCO’s workstation. At 0107:01 the track recovered, and at 0107:19[16] the passenger train departed the station.

As the indication of the failed track was in the vicinity of the work group, it prompted the NCO to contact the lead PO and question the whereabouts of the work group and machinery in relation to the running line. The NCO asked the PO if anyone in the work group had ‘gone on or near the track’, to which the PO replied ‘no’. The NCO further stated, ‘I’ve had a track fail and recover, which is most unusual, within the extremities of your TOA … which seems a bit odd’.

The lead PO ended the conversation by reassuring the NCO that everyone in the work group was off the track. At this time, the PO was unaware of the excavator’s movements and that it had on‑tracked as directed by the recipient.

First near collision

As train 1898 passed the work group entrance gate, it accelerated to above 90 km/h along the 100 km/h section of track (Figure 2). The recipient, who only minutes earlier directed the excavator operator to on-track the excavator, had just arrived back at the work group entrance gate as the train passed. On seeing the train, the recipient sounded the car horn in an attempt to warn the excavator operator of the approaching train, and they then proceeded in the car back towards the excavator.

Figure 2: View from train 1898 showing the work group, front-end loader, and headlights of the excavator in the distance

The image is from the front-of-train camera in train 1898. The time is 0108:22, about 19 seconds prior to the near collision. In the distance, the headlights of the excavator can be seen as it travelled towards the worksite.

Source: Queensland Rail, annotated by the ATSB

The excavator operator first noticed the train’s headlights in the distance and assumed that they belonged to other machinery at the worksite. They had not heard the car horn.[17] At about the same time, the train driver observed the lights of the excavator, which they thought belonged to a car travelling on the road adjacent to the rail corridor.

As train 1898 traversed the sweeping left curve between the 2 entrance gates (Figure 1), both the train driver and the excavator operator realised that there was an imminent risk of collision. The train driver immediately applied the emergency brake, while the excavator operator swung the boom arm about 90° to the right of the excavator’s direction of travel, gouged the bucket into the ground and dragged the excavator from the rail tracks just prior to the train passing at about 61 km/h (Figure 3).

The excavator came to a stop clear of the running tracks. However, it was still in the (3 m) danger zone, less than 1 m from the nearest rail.

Figure 3: View from train 1898 showing the near collision

The images, from 1898’s front-of-train camera, are in sequential order and show the near collision between 1898 and the excavator. The rear of the excavator moved clear of the running line less than 1 second before the train’s arrival, with the train travelling at about 61 km/h.

Source: Queensland Rail, annotated by the ATSB

After stopping (about 75 m past the excavator), the driver of 1898 contacted the NCO and reported that they had almost collided with a ‘tractor or backhoe’ that was on the track.

The NCO then called the lead PO and described what the train driver had reported and made further inquiries as to whether a backhoe or loader was at the worksite. The PO advised the NCO that there was a front-end loader at the worksite, but it was well clear of the track when the train passed. The NCO then asked the PO if there was any other machinery at the worksite, to which the PO replied, ‘we only have one machine that’s it … and I’m standing right next to it’. Further discussion between the PO and NCO considered the possibility that another machine had on tracked near the worksite.

After finishing the call, the lead PO informed the depot supervisor of the situation. The supervisor stated that they had just received a call from the recipient explaining how they had directed the excavator operator to on-track as they thought that the planned closure was active and train activity had ceased.  

At 0116, the lead PO contacted the QR ‘emergency hotline contact’ (located at the network control centre) and reported the near collision. As the PO was not located at the incident site, they provided details to the hotline contact as received from the supervisor, who was in direct communication with the recipient at the incident site.

The emergency hotline contact asked the lead PO ‘… has he moved away from the track’, referring to the excavator. The PO then relayed this question to the supervisor. The supervisor, after consulting with the recipient, confirmed that the excavator was away from the track, and this information was relayed on to the hotline contact. The emergency hotline contact then told the PO to leave the excavator where it was as the incident was going to be investigated. That message was then relayed to the depot supervisor, who passed it on to the recipient. During these communications, it was not made clear to any party that although the excavator was no longer on the track, it was still within the danger zone.

At the network control centre, the NCO was informed (by the emergency hotline contact) that the excavator had been moved away from the running tracks. After checking the welfare of the train driver, the NCO authorised the train’s movement from the incident site.

The depot supervisor, who had been in contact with their off-site manager regarding the incident, advised the lead PO that work was cancelled and that they were required to travel to the Cannon Hill depot for drug and alcohol testing. The depot supervisor then had another conversation with the recipient, who confirmed that the excavator was off track but may still be in the danger zone. The depot supervisor then travelled to the incident site to assess the situation (Figure 1). The PO discussed the supervisor’s directive with another member of the work group and then decided to travel to the incident site rather than returning to the Cannon Hill depot, as it was their role to oversee the protection of workers within the rail corridor.

Second near collision

When the depot supervisor arrived at the incident site, they noticed the excavator was still in the danger zone although they believed it was not within the profile of a train. The supervisor, without gaining the necessary authority from the NCO (via the PO), instructed the excavator operator to move the excavator from the danger zone. The supervisor later reported that they assumed that after a near collision, the NCO would have stopped all trains, but they did not confirm that this had occurred.

At 0136:22, the next suburban passenger train en route to Cleveland (18A0) departed Thorneside Station.

As the excavator operator moved towards the excavator, in accordance with the supervisor’s instruction, they heard a member of the work group call out ‘train on’. The excavator operator stated that, after seeing the train, they jumped down the embankment and clung to the fence as they thought the train may collide with the excavator. The train passed by the incident site at about 60 km/h.

At 0137, the driver of 18A0 contacted the NCO and reported ‘… the excavator was only just clear of the track, I thought I was going to clip it’. 

After 18A0 had cleared the area, and without requesting the necessary protection, the excavator operator was again directed to remove the excavator. On this occasion, members of the work group cut a gap in the fence and the excavator was removed from the rail corridor.

After receiving advice of the second near collision, the NCO contacted the lead PO regarding the location of the excavator and its proximity to the running track. The PO advised the NCO that the excavator had been removed from the rail corridor and the work group were returning to the Cannon Hill depot for drug and alcohol testing.[18]    

Context

General information of planned closure

Track defect

A track inspection in 2019 identified a track defect just east of Thorneside Station. Work to rectify the defect involved the replacement of a 5 m section of track, which involved cutting and welding. As dry weather restrictions were in place at the time, the work was deferred until the restrictions were lifted.

Train notice

On 28 February 2020, a train notice (TN20-02366) was issued that detailed the planned closure and work required to correct the track defect. The train notice included information such as:

• the date of the planned work – 7 March 2020
• the depot of the work group performing work – Cannon Hill
• the protection for the worksite – track occupancy authority (TOA) with in-field protection
• the extent of protection – main Cleveland line between signal L294 and signal TS9 Thorneside and No.2 road from signal TS11 to 656 points Thorneside (in effect from Thorneside Station east towards Birkdale Station)
• the name and contact details of the assigned protection officer (PO).

The train notice also specified the type of plant (machinery) that was permitted to work within the TOA, which consisted of a front-end loader and an excavator. In addition, it noted that rail traffic would be suspended on the main line from Birkdale to Thorneside for maintenance work between 0218 to 0440. No trains would normally be running on the line during this period.

The purpose of the train notice was to inform relevant rail personnel of the details associated with the planned work and the impact that it would have on operations and advise those who needed to plan for the proposed closure.

The train notice did not mention that preparation work would be conducted under the protection of a TOA without in-field protection, as this arrangement was initiated after the train notice was published and as a result of some staff reporting sick during the day of 6 March.

Planned closure protection

In the scheduling phase of the planned closure, a TOA with in-field protection[19] was the chosen ‘work on track authority’[20] to protect workers within the worksite. It was selected because repairing the track defect involved breaking and obstructing[21] the track. In addition, machinery and members of the work group were required to work within the danger zone. This option was determined as an efficient and safe means of protecting the work group when performing such work.

To implement the TOA with in-field protection, the PO needed to coordinate with the network control officer (NCO) so that the NCO applied blocking facilities to prevent unauthorised rail traffic entering the portion of track within the TOA limits. Additionally, the PO or their delegate was to organise in-field protection at the limits of the TOA or at a defined distance from the worksite after blocking facilities were in place.

Two POs had been allocated to the planned work, with a QR employee assigned the role of lead PO and a contractor the role of assistant PO (to organise the in-field protection).

The protection arrangements (TOA with in-field protection) for the planned closure on 7 March was appropriate for the type of work involved in removing and replacing the section of track at Thorneside.

Preparation work prior to planned closure

Reason for preparation work    

On 6 March, the day prior to the planned closure, the assigned lead PO and one of the 2 assigned welders reported sick. To fill the role of the lead PO, the contractor PO who had already been assigned the role of erecting in-field protection was elevated to the role of lead PO, and another contracted worker was engaged to erect the in-field protection for the planned closure. During the afternoon, both POs were advised to meet the QR depot supervisor at the Cannon Hill depot at 2200 to discuss protection arrangements for the worksite.  

A replacement welder, however, could not be found at short notice, which placed pressure on the work group completing the work within the available timeframe. To remedy this problem, there was a proposal to start preparation work earlier than the scheduled start time listed on the train notice. This involved gaining access to the rail corridor, under the safeguard of a TOA without in-field protection, to perform the preparation work prior to the planned closure. The proposal required approval from the NCO overseeing the area where the preparation work was planned.

Preparation work protection

The QR document MD-12-189 (Queensland Network Rules and Procedures or QNRP) stated the safety requirements for all persons required to access and perform activities on QR’s rail corridor. The QNRP allowed for work within the danger zone under the safeguard of a TOA without in-field protection provided there was no requirement to break or obstruct the track. The preparation work prior to the planned closure did not require the track to be broken or obstructed.

At the worksite, and prior to requesting the TOA without in-field protection, the lead PO completed a ‘corridor safety planner and assessment form,’ which determined the protection was adequate for the proposed work arrangements. The PO contacted the NCO, who issued the TOA without in‑field protection to perform the preparation work between train movements prior to the planned closure.

During the preparation work, the lead PO and the NCO were suspending and re-instating the TOA without in-field protection as required between train movements. When the TOA was active:

• The NCO was applying blocking facilities to prevent unauthorised rail traffic entry into the portion of track within the limits of the worksite.
• The lead PO’s role was to inform the work group that protection was in place and work could be performed within the danger zone. Immediately prior to suspending the TOA, the PO’s role was to ensure workers were clear of the danger zone and in a safe place.

Under the requirements for a TOA without in-field protection, a ‘lookout’[22] was required if the track speed approaching the worksite was 100 km/h and there was less than 560 m minimum sighting distance. The track speed approaching the worksite from the west was 100 km/h and the sighting distance was about 350 m. Therefore, a lookout was required as an additional safety measure at the worksite. The ATSB identified that there was no ‘lookout’ in place at the worksite while the preparation work was conducted. Although this omission did not comply with the procedure, it did not contribute to the first near collision.

Worksite and rail corridor information

The worksite was about 500 m east of Thorneside Station, on the Cleveland rail corridor branch line (Figure 1). The branch line, which commenced at Park Road Station, serviced the south‑eastern suburbs of Brisbane. Between Park Road and Manly stations there were 2 suburban unidirectional running lines with some bi-directional signalling to facilitate the passing of trains. The main line east of Manly (which included Thorneside and Birkdale stations) had a single bi-directional running line that continued through to Cleveland Station.

Steep slopes on either side of the rail corridor prevented direct access to the worksite. To reach the worksite it was necessary for the work group to enter the rail corridor through the entrance gate about 340 m further east.

The excavator could not access the rail corridor through the same entrance gate as the work group, as cement troughing blocked its entry. Therefore, it was necessary to transport the excavator to the entrance gate about 470 m further east of the entrance gate used by the work group (Figure 1).

Rail network safety

Responsibilities of track workers

The QNRP referred to track workers as ‘Competent rail safety workers whose primary duties are associated with work on or around infrastructure in the Rail Corridor.’ It stated:

The QNRP also stated:

The deport supervisor, team leader, and recipient confirmed that prior to accessing the rail corridor under a TOA, the PO would obtain access authority and then inform the work group leader, who would then instruct other workers that they could access the rail corridor.

When dealing with a track vehicle needing to access or travel within a TOA, the QNRP stated:  

Work group information

The QNRP defined a work group as:

Track workers must only perform work relevant to their competency qualifications. The work group assigned the task of repairing the track defect at Thorneside were appropriately qualified to perform relevant rail safety work applicable to their area of competence.

Supervisor information

The responsibility of a work group supervisor / team leader was to ensure there were sufficient qualified workers to complete the work within the time available. This included:

• ensuring workers were appropriately qualified and competent to perform work
• ensuring the necessary tools, equipment and machinery were available for workers to complete work tasks
• having contingency plans in place if the work could not be completed in the scheduled time
• ensuring that all work group members participated in the network pre-start briefing.

At a worksite, the supervisor / team leader was required to:

• actively oversee and communicate with work group members to ensure the work was progressing as planned
• communicate with the PO to ensure protection arrangements were adequate for the protection of the work group
• assist as required at the worksite and comply with the rules and procedures relevant to QNRP.

The supervisor of the work group involved in the near collision at Thorneside gained employment with QR in July 2012 and held positions in several roles, all within track maintenance operations. At the time of the incident, their role was acting supervisor at the Cannon Hill depot. Their role at the worksite was to oversee the work and supervise the team leader and others as required.

The supervisor attended training courses and successfully gained numerous rail safety qualifications applicable to rail safety work. Training and critical safety alerts relevant to this incident included:

• Communication protocols
• Communications (QNRP)  
• Safely access the rail corridor (QNRP)
• Protection officer 1 (QNRP)
• Protection officer 2 TOA (QNRP)
• Critical safety alert: Follow instructions respond to emergency     
• Critical safety alert: Entering the danger zone
• Critical safety alert: Communication safety critical information 
• Emergency response
• Safety critical communications
• Delivering a pre-start briefing (network)
• Rail safety awareness
• Toolbox talk: Safeworking incidents
• Plan and organise work  
• Operate under track protection
• Process workplace documentation
• Follow work health and safety  
• Perform lookout duties 
• Awareness safeworking rules.
• Safety comes first always workshop.

On the day of the near collisions, the supervisor was overseeing the team leader, who was acting as the supervisor in charge of the work group.

The supervisor had been working day shifts until 5 March and had over 30 hours free of duty prior to signing on for the overtime shift at 2100 on 6 March. They reported that they had a nap on the afternoon of 6 March before going to work, and they did not feel fatigued at the time of the incident.

Team leader information

The team leader worked as a track maintainer with a rail contract company for about 3 years prior to gaining employment with QR in September 2016. Through internal training, the team leader acquired rail safety qualifications appropriate to their employment in network maintenance operations. They had recently undertaken the role of acting team leader. Training relevant to this incident included:

• Safely access the rail corridor (QNRP)
• Communications (QNRP)
• Protection officer 2 TOA (QNRP)
• Protection officer 1 (QNRP)
• Network lockout workshop
• Toolbox talk: First worker at emergency site 
• Delivering a pre-start briefing (network)
• Toolbox talk: Post incident management guideline
• Rail safety awareness 
• Follow occupational health and safety
• Process workplace documentation  
• Lead a work team or group
• Perform lookout duties
• Safety comes first always workshop.

On the day of the incident, the team leader was acting as the supervisor under the guidance of the depot supervisor. The team leader delivered the network pre-start briefing at Cannon Hill depot and oversaw the work group and work activities associated with the replacement of the defective section of track.

The team leader had been working day shifts until 5 March and had over 30 hours free of duty prior to signing on for the overtime shift at 2100. They reported that they had a normal sleep on the night of 5 March and a nap on the afternoon of 6 March before going to work, and they did not feel fatigued at the time of the incident.

Protection officer information

The QNRP stated that the primary duty and responsibility of the PO was to manage the rail safety component of a worksite, and that the PO must be satisfied other work will not interfere with their primary duties. A worksite in the danger zone, or a worksite with potential to intrude into the danger zone, was required to have a PO for the duration of the work.

Specific planning duties of a PO included:

• investigating the location of the worksite
• having a detailed work plan
• completing a safety assessment to determine the work on track authority, means of protection[23] or safety measures[24] needed to protect workers
• meeting with the supervisor of the work group to discuss safety and protection arrangements
• providing worksite protection details for the worksite safety briefing
• participating in the network pre-start briefing
• contacting the NCO if necessary.

Specific duties at the worksite included:

• communicating with the NCO about the work
• ensuring the appropriate protection had been selected to protect the work group at the worksite
• identifying the safe place (for workers at the worksite)
• advising the supervisor / work group when it is safe to enter the rail corridor / danger zone
• immediately prior to suspending a TOA ensuring workers cease work and remain clear of the danger zone
• keeping records about the work on track method and protection arrangements.

The lead PO involved with the track work near Thorneside held the appropriate competencies to administer TOA protection. The PO had worked for contract providers while performing the role as a PO for more than 3 years. They had worked on the QR network many times but had not previously worked at Thorneside. On the day prior to the planned closure, the PO was advised by a QR representative that they would be the lead PO and to meet the depot supervisor at Cannon Hill depot at 2200 to discuss protection arrangements for the planned work at Thorneside.

The assistant PO was not involved in any work activity related to the preparation work. Their role was to place in-field protection after the preparation work was completed and prior to the commencement of the planned closure.

Excavator operator information

The role of the excavator operator during the planned closure was to move the replacement piece of rail from within the rail corridor to the worksite. At the worksite, they were required to remove the defective rail and fit the replacement rail into place so it could be welded. In addition, they were required to comply with rules and procedures applicable to working safely within the rail corridor.

The excavator operator was employed by an external provider as a sub-contractor providing services to QR as required. They were advised to meet a QR representative at Thorneside Station at 2230 on 6 November, who would direct them to the worksite.

The excavator operator was qualified to operate the excavator and held the relevant competencies to work within the rail corridor and danger zone. They had worked in the earthmoving industry for many years and owned an earthmoving business for 11 years. The excavator operator stated that they had worked excavators at QR worksites on multiple occasions but had not previously worked at Thorneside.

Recipient information

The role of ‘recipient’ was previously known as ‘authorised person’ until a recent name change. Although the title of the role had changed, the responsibilities remained the same.

In accordance with QR’s authorised person [recipient] facilitator guide (FG-STD-141-01), the authorised person [recipient], working in QR’s 25,000 volts electrified area, was a qualified and competent worker who:

On the day of the incident, the recipient’s role was to ensure the excavator and the front-end loader did not encroach into the electrical exclusion zone while working under the overhead line equipment at the worksite. This involved completing the relevant documentation with the machine operators and ensuring the height limiter on each machine was engaged prior to working under the overhead line equipment.

As required, the recipient was to interact with and discuss relevant information with the PO at the network pre-start briefing and at the worksite to ensure safety. The recipient could also perform other work tasks at the worksite, providing they were qualified to do so and that the work did not interfere with their primary duties and responsibilities. During the planned closure on 7 March, the recipient was also required to act as the mobile plant spotter,[25] which involved separating the excavator and front-end loader from workers at the worksite.

According to QR’s safe work method statement (SWMS) work activity MD-13-268 (Operation of height limited plant), the recipient was required to establish communication processes with machine operators and these processes had to be incorporated in the network pre-start briefing. The recipient was to observe and supervise the plant operations with full visibility and communication. To ensure this means of communication was operating as intended, they were required to confirm the radio channel and test the radios with each mobile plant operator.

On the day of the incident, the recipient (acting as the mobile plant spotter) was not in possession of a radio when they directed the excavator operator to on-track the excavator and therefore was not able to contact and alert the excavator operator of the approaching train. Channel 15 was recorded in documentation associated with the network pre-start briefing as the radio channel for machine operators to use. However, the recipient did not advise the excavator operator of which channel to use. The excavator operator had set their radio to channel 15 as this was the preferred channel when working on QR worksites (Excavator information).

The recipient had worked in rail maintenance operations as a QR employee for about 3 years. Prior to working for QR, they were employed by a railway construction contractor performing rail safety work. The recipient had gained numerous rail safety qualifications and attended operational training courses that enabled them to perform rail safety work. Training relevant to this incident included:

• Safely access the rail corridor (QNRP)  
• Communications (QNRP)
• Safety comes first always workshop
• Delivering a pre-start network briefing
• Rail safety awareness 
• Authorised person
• Working in the electrified territory
• Process workplace documentation  
• Operate under track protection
• Follow work health and safety
• Lead a work team or group    
• Perform lookout duties
• Protection officer 1 (QNRP)
• Safety comes first always workshop.

Two days prior to the incident, the recipient attended a training course that provided them with recipient qualifications. The recipient attended the course on 4 and 5 March (0800–1600), before having 31 hours free of duty and signing on for work at 2100 on 6 March. The maintenance work at Thorneside on 6–7 March was the first time they had acted in the role of recipient since gaining the qualification. They had previously performed the role of mobile plant spotter.

The recipient noted that normally they would seek confirmation from the team leader / supervisor before directing a vehicle to on-track but on this occasion, they did not do so because they thought they had understood the situation. The recipient also noted that normally all the workers accessed the rail corridor from the same location, whereas on this occasion the excavator being at a different location added some complexity. The recipient also noted that in their experience it was normal for all the workers (including the POs) to be at the same briefing whereas on this occasion the briefings were distributed.

Network pre-start briefing

The QR procedure Network Pre-Start Briefing (MD-12-87) defined a network pre-start briefing as:

The purpose of a network pre-work briefing was to provide an opportunity for the work group to gain an understanding of the work, roles, and responsibilities of individuals, and provide an environment where questions relating to the work and worksite protection could be asked and answered. The briefing, and its associated form (MD-15-43), provided the framework to ensure hazards were identified, risks were managed, and relevant personnel at the worksite had the appropriate delegation to authorise safeworking decisions.

The QNRP and QR guidelines required the nominated person[26] (in this case the team leader) to deliver the network pre-start briefing before starting work (with a briefing to be conducted for each work activity). MD-12-87 stated the nominated person was to ‘gather all workers and contractors involved in the work to be undertaken’ and explain the activities that were to be completed and how it would be undertaken. Where safeworking requirements existed (for work in the rail corridor), these were to be discussed by the PO.

The nominated person was also required to compile and complete the appropriate network pre‑start briefing form. In addition, they were required to ensure that all identified workplace health and safety and rail safety hazards associated with the work and equipment had appropriate controls in place to manage and or eliminate risk. Each worker / contractor was to have the opportunity to identify any additional hazards or controls, and each worker and contractor was required to sign the briefing form.

The PO’s role at the network pre-start briefing was to inform all workers about the protection in place at the worksite and the limits of the protection. In addition, they were to answer any questions related to protection and worksite arrangements.

Although a planned network pre-start briefing occurred at the Cannon Hill depot on 6 March 2021, delivered by the team leader, the POs and the excavator operator were not invited to the briefing and therefore did not participate in the briefing.

In interview, the recipient stated that a second network pre-start briefing occurred at the worksite prior to entering the rail corridor at Thorneside. This however was not a network pre-start briefing, but rather a briefing to advise the work group that protection was in place for the preparation work and when they could enter the rail corridor and the danger zone. The team leader confirmed that a network pre-start brief did not take place at the worksite.

To assist the investigation, the ATSB interviewed a QR subject matter expert who designed and delivered training for track workers, including POs. In relation to the planned track maintenance work at Thorneside, it was their view that all members of the work group, including the lead PO, assistant PO, and excavator operator, should have attended the network pre-start briefing at the Cannon Hill depot.

Network pre-start briefing form

After a fatal accident in Brisbane in May 2017 (see Previous network occurrences), QR revised and developed a new network pre-start briefing form (MD-15-43) specifically for staff who delivered and participated in network pre-start briefings. The form contained 6 sections that had to be completed by the nominated person before work commenced at a worksite.

The purpose of the revised network pre-start briefing form was to establish a consistent process for the delivery of a network pre-start briefing and provide a workplace focus on the identification, treatment and communication of both task and site-specific risks. QR developed a facilitator’s guide for trainers, and specific training was provided to rail safety workers who had a responsibility to deliver network pre-start briefings.

The network pre-start briefing form for the work at Thorneside on 6–7 March 2020 was completed by the team leader. Content in the form relevant to this incident included:

• Section 1 – This section briefly required details for the work group, the person in charge (in this case the team leader), and the work task (requiring a clear description, SWMSs and permits used). The completed form listed 3 SMWSs but no description of the work task was provided.
• Section 2 ­­– This section listed several specific items and sought brief information regarding the process in place for each item.
  • In response to the question ‘Is the work occurring within the Rail Corridor?’, a box was ticked for the answer ‘Yes – Protection Officer to provide a brief on the track protection requirements’.
  • In response to the question ‘Is there potential for mobile plant or equipment (including vehicles) to contact people, infrastructure or other plant?’, a box was ticked for ‘Yes – detail the site plan for the separation of people and plant in your briefing…’.
• Section 3 ­– With regards to a site sketch, a train signal diagram for Thorneside with annotations was appended to the form. The diagram showed (in broad terms) the area of the worksite and the travel path that machinery would be using. The travel path did not explicitly indicate that different machinery would be using different access gates (as that had not been determined prior to or during the briefing). The type of machinery using the travel path was not noted.
• Section 4 – The form required a list of site-specific hazards and controls. The completed form included several hazards and controls, including:
  • With regard to the hazard ‘Trains’, it listed ‘Blocks, Lookout’ as the applicable controls. There was no record in the briefing form that there would be 2 phases of work (preparation work and the planned closure work), each with different protection arrangements.
  • With regard to the hazard ‘Machinery’, it listed ‘Separation, spotters’ as the applicable controls. There was no indication on the form of the types of machinery that would be used (and no mention that an excavator would be used).
• Section 5 – This section contained details of what needed to be done if something changed. It included instructions for a ‘Pause and Re-start’ in the event of workers being unprotected, there was a change to the condition / task or a new hazard / risk was identified. Details of any debrief could be included on the form (and in this case it was blank).  The instructions for a pause and re-start included:
• Immediately pause the work we are doing;
• Move to a safe place, and ensure any plant or equipment is moved clear of the Danger Zone and is protected;
• Document the new hazard / risk and list the controls (using Section 4); and
• Communicate the controls to everyone onsite by conducting a ‘Restart Briefing’.
• Section 6 – This section (titled ‘Commitment to work safely’) asked workers to sign the form as acknowledgement that they had ‘taken the opportunity to ask questions and thoroughly discuss this briefing, so you can implement the controls agreed to protect you and your co-workers’. With regard to the completed form:
  • The work group members who attended the briefing at the depot signed the form at the depot.
  • The 2 POs and the excavator operator did not attend the briefing at the depot, however their signatures were recorded on the form. The excavator operator signed the form at the worksite at the request of the team leader. Both POs signed the form after returning to the Cannon Hill depot after work at the worksite had been cancelled as a result of the near collisions.
  • The supervisor’s signature on the network pre-start briefing form was listed after the excavator operator and the lead PO. The supervisor (and another worker) confirmed they were at the briefing at the depot, but the supervisor did not sign the form at that stage.

Network communication 

QNRP rule 2007 (Network communications) and QNRP procedure 2008 (Spoken and written communication) provided information for rail safety workers relevant to safeworking communication, general communication protocols and communication equipment.

Rule 2007 referred to effective communication as the ability to successfully send, receive and understand information. It stated that communication in the network must be:

• clear, brief and unambiguous, and
• relevant to the task at hand, and
• agreed as to its meaning before being acted upon.

In general, the rule provided information on the principles, fundamentals, and protocols of network communication. It noted that emergency communications needed to commence with the phrase ‘emergency, emergency, emergency’. It also detailed specifics relevant to spoken and written communication in the context of electronic transmissions. However, it did not specify the requirement to use rail industry specific terminology when communicating safety-critical information, either electronically or face-to-face.  

QNRP procedure 2008 provided standard terms to be used in radio communications, including using the term ‘out’ when the transition was complete and the term ‘roger’ meaning the information had been received and understood. Like the rule however, there was no guidance to rail safety workers on the use of rail-specific terminology when communicating safety-critical information, either via electronic devices or face-to-face.

In the context of the work and near collisions at Thorneside, rail-specific terminology used in communication should have included terms such as:

• danger zone
• foul[27]
• obstruction[28]
• safe place[29]
• access[30]
• obstruction[31]
• issued
• suspended
• reinstated.

Conversely, the Rail Industry Safety and Standards Board’s (RISSB’s) Safety critical communications guideline (2018) stated in a section on fundamentals of communication:

The guideline noted such principles should be applied to all communications, safety critical or not. 

The RISSB guideline also stated:

Train and excavator information

Trains 1898 and 18A0 information

Both trains (1898 and 18A0) were scheduled suburban passenger services travelling between Shorncliffe and Cleveland via Central Station. Train 1898 consisted of suburban multiple units (SMUs) 227 and 229, and 18A0 consisted of an interurban multiple unit (IMU) 166 and SMU 285. Both trains were crewed by a driver and guard and had passengers on board.

Trains 1898 and 18A0 were fitted with event recorders and front-of-train cameras. Relevant information from these recordings has been included in other sections of this report.

Excavator information

The excavator involved in the near collisions was a Kubota CRV032 (Figure 4). It had an operating weight of 5 t and was fitted with small, retractable rail wheels enabling it to mount and operate on the running tracks.

The maximum speed of the excavator while on track was 4 km/h. It had an R3[32] detection rating, which meant the vehicle did not reliably operate track circuits; as a result, the vehicle was not detected by the signalling system and was not visible on the NCO’s workstation monitor. The boom arm was fitted with a height limiter allowing it to work under live overhead line equipment.

According to QR standard MD-14-575 (Road Rail Vehicles), the excavator was classified as a ‘road rail vehicle’ and was only allowed to operate within track closures. The QNRP categorised a road rail vehicle as a track vehicle. In accordance with the QNRP, permission had to be obtained from the PO before a track vehicle could enter a work on track authority (such as a TOA) or traverse a worksite within a work on track authority. On the day of the incident, the excavator was on-tracked at Thorneside without the permission of the PO.

Australian Standard (AS) 7502:2016 (Road Rail Vehicle) stated that a flashing beacon light shall be mounted on the top of the vehicle, or in a suitable location(s), so that the light is visible to a person standing 4 m in any direction from the vehicle on level ground. In addition, the flashing beacon light was required to be activated while the vehicle was operating on-track in rail mode. Although the excavator involved in the near collisions was fitted with a beacon capable of flashing, video footage showed that it was not active at the time of the near collisions.

In general, where people and mobile plant (machinery) share the same worksite, there should be radio communication between the plant operator and the mobile plant spotter / supervisor. The excavator was fitted with a UHF radio, which was set to channel 15 when it was placed on-track. The excavator operator said that channel 15 was QR’s preferred channel for maintenance work communication and they had been told to use this channel at other QR worksites.

In interview, the excavator operator stated that after the first near collision they transmitted a call over the radio but communication with the work group was unsuccessful. The team leader reported that they heard a radio call on channel 15 including the word ‘train’ but did not know who had made the call and the call did not make sense (as they were not aware that the excavator operator had on-tracked). They asked the person to repeat the message but heard no reply.

Figure 4: Excavator involved in the near collisions

Source: Queensland Rail 

Related occurrences

Introduction

This section provides information about a selection of rail occurrences that involve problems with the briefing of rail workers prior to them undertaking work on track. The list is not exhaustive. Each of the occurrences involved a range of different factors, and the descriptions below focus only on aspects that have some relevance to the incident at Thorneside on 7 March 2020.

Mindi, Queensland, 2007                                                 

On 7 December 2007, 2 QR workers were fatally injured as a result of being struck by a track machine when carrying out their duties at Mindi, Queensland. The Queensland Transport Rail Safety Investigation (QT2140) stated that worksite safety briefings [network pre-start briefings] were not performed prior to starting work. It also noted that work group members did not challenge the absence of a worksite safety briefing.

One of the recommended safety actions from the investigation noted:

A coronial inquest into the Mindi accident noted that the absence of a worksite safety brief [network pre-start briefing] was most likely a contributing factor to the death of the 2 workers.

Newbridge, New South Wales, 2010[33]

At about 1116 on 5 May 2010 a collision occurred between an XPT passenger train and a track‑mounted excavator near Newbridge, New South Wales. The operator of the track-mounted excavator was fatally injured.

The PO had conducted a pre-work brief involving the excavator operator and a hot-work labourer, during which a TOA was identified as the control in place for rail traffic. After obtaining a TOA from the NCO, the PO then advised the excavator operator and the hot-work labourer that the TOA had been obtained and that they could prepare for work while the PO put the site protection in place. A short time later both the hot-work labourer and excavator operator entered the danger zone before the worksite protection arrangements (detonators and flags) had been put in place.

An examination of the pre-work briefs found that the identified hazards were mostly related to general issues (for example, slips trips and falls and hazards associated with work equipment such as the excavator or oxyacetylene cutting). The only mention regarding the hazard of potential rail traffic identified the TOA as the relevant risk control. There was no mention of unexpected approaches of other rail vehicles and the use of additional site protection.

The excavator operator and hot-work labourer were relatively inexperienced. The ATSB found that, although the PO had told the excavator operator and hot-work labourer that the PO had received the TOA, they did not explicitly communicate to the workers that they should not occupy the danger zone until all site protection measures were put in place.

Jaurdi, Western Australia, 2011[34]

On 28 March 2011, a freight train 7SP3 collided with a track mounted excavator between Jaurdi and Darrine, Western Australia. The train driver sustained a minor injury. There was significant damage to the lead locomotive and the excavator, and minor damage to the track as a result of the accident.

The ATSB found that 2 track mounted excavators had been placed back on the track without permission of the authorised employee responsible for the coordination of track side safeworking activities between Jaurdi and Darrine. Another finding was that, although separate pre-work briefings were conducted, there was no discussion about train running information and site protection between the supervisor of the excavators and the authorised employee (who was the supervisor of the track machines at another location).

Laverton, Victoria, 2015[35]

On 2 October 2015, a train departing Laverton Station approached a worksite where a supervisor was marking a track to identify dog spikes to be removed, with a lookout for their protection. The lookout observed the train, warned workers of its approach, and signalled to the driver that the track was clear. However, as the train took the crossover, the supervisor was foul of the track, and was struck by the train that was travelling at about 59 km/h. The supervisor suffered serious injuries.

The ATSB found that the pre-work briefing was not conducted. As a result, the supervisor and lookout (and others in the work group) did not receive the benefits of a safety briefing that would have informed them of the outcomes of the worksite hazard assessment, train running, and the designated position of safety.

Clyde, New South Wales, 2016[36]

On 18 June 2016, a signal maintenance team (SMT) worker was fatally injured by a train at Clyde, New South Wales, while working in the rail corridor. The ATSB investigation (conducted by the NSW Office of Transport Safety Investigations) identified a number of contributing factors and other factors that increased risk. Safety factors related to pre-start briefings included:

• The PO had briefed the civil team, however they did not brief the signal team, and the signal team did not seek a pre-work briefing before commencing work on-track.
• The signal team assumed their workplace was within the limits of the TOA and did not plan their own worksite protection…
• The Sydney Trains worksite briefing process did not compel a new work group to seek a worksite protection pre-work briefing when accessing an existing worksite. The safety message from the ATSB report noted:

The investigation report also included a finding relating to network communications between multiple parties not being ‘clear, brief and unambiguous.’

Petrie, Queensland, 2017[37]

In May 2017, a QR protection officer (PO) was fatally injured after being struck by a suburban passenger train at Petrie, Queensland.

Four POs were assigned to the maintenance task, including 3 POs at Petrie Station. The lead PO participated in the briefing of the maintenance workers, and the 3 POs then undertook a pre-start brief for the implementation of the protection (stop signs and railway track signals), which the other 2 POs then started implementing. It was one of these POs who was fatally injured.

The ATSB found that the POs were not familiar with the new rail infrastructure and uncommon site layout at Petrie Station. The POs were not advised of an early work shift start requirement, which resulted in them having insufficient time to prepare for the task, and they experienced pressure to complete the task within the scheduled time. In addition, QR had no process for ensuring the provision of adequate time for the POs to familiarise themselves with new or changed worksites.

The train notice diagram had been incorrectly marked with the open and closed rail lines by a different PO, and the POs’ pre-start briefing was limited to about 90 seconds. In addition to this, the recorded pre-start briefing forms contained errors and inconsistent sign-off entries; it is possible that the recording of the pre-start brief had been rushed.

Following the accident, QR undertook a number of safety actions. The QR investigation had found that the ‘pre-start briefing process on the night was not effective in ensuring the risks of individual live tracks and site-specific hazards and risks were understood and controlled by the Protection Officers’. A subsequent review of the task distribution for POs noted that the pre-start safety briefings often lacked planning and were delivered spontaneously, and it recommended a review of the effectiveness and improve the delivery of the pre-start safety briefings. The network pre‑start briefing procedure and form were subsequently revised with briefings provided to relevant workers.

Training and qualification records showed that the supervisor, team leader and recipient involved in the occurrence at Thorneside, had attended training in delivering the revised network pre-start briefing procedure and form, and the revised form was used during the pre-start briefing on 6 March 2020. QR also re-enforced the message of ‘the right to stop work and getting safety right before commencing’ as part of its ongoing network pre-start brief project.

In addition, QR organised the development of a consistent process for marking up train notice diagrams.

Margam, United Kingdom, 2019[38]                                        

On 3 July 2019, at Margam East Junction in South Wales, United Kingdom, 2 track workers were struck and fatally injured by a passenger train. A third track worker came close to being struck.

The group of 6 track workers were assigned a safe work pack (SWP) that included 3 tasks to be completed, and another task was added on the morning of the accident that was not included in the SWP. The SWP stated the work would be conducted between 1230 and 1530, with 2 types of protection included for this period (line blockages and lookout warning), although which tasks were to be protected by which method was not clearly articulated.

The workers commenced the tasks soon after 0800 using a lookout, but there were problems with its implementation when the workers spilt into 2 groups doing different tasks with only 1 designated lookout between them. The workers who were struck were performing a noisy task (maintaining a set of points) that should only have been undertaken with the line blocked. The controller of site safety (PO) and the lookout were with the other group when the accident occurred.

Overall, the system of work that was proposed was not adopted, and an alternative arrangement became progressively less safe as the work proceeded, which created conditions that made an accident much more likely. The SWP was developed without the involvement of any of the workers involved, and there was no challenge by the workers to the way the work was being conducted.

The investigation by the UK Rail Accident Investigation Branch (RAIB) found that local management/supervisors were not actively monitoring, and had not identified and managed, non‑compliant safety behaviors at the depot. The investigation also considered why Network Rail (the rail infrastructure manager) had not created the conditions that were needed to achieve a significant and sustained improvement in track worker safety. Relevant underlying factors were identified:

In terms of safety assurance, frontline management/supervisors were required to undertake planned ‘Level 1’ (first-line) assurance activities, which included worksite inspections to review the effectiveness of the planning process, competence of staff, and unsafe behaviours and activities/ conditions, including corrective actions as required. Regarding worksite inspections, the investigation identified that managers may have been relying on submitted paperwork rather than undertaking observations of work on site. In addition, there was a self-assurance process where front-line management was required to formally check compliance with procedures by responding to a series of subject-related questions. These questions were designed to monitor the managers’ own compliance and that of their staff.

The evidence obtained by RAIB suggested that the underlying weaknesses in the design of the level 1 assurance processes included:

The investigation also found multiple problems with the design and execution of this process and noted that it was frequently referred to by managers and staff as a ‘tick box’ exercise. Overall, for a variety of reasons, the audits were not effective in detecting a range of problems with planning paperwork, procedural non-compliance, and unsafe working practices, and did not trigger the higher-level management actions needed to address them.

In contrast, level 2 audits (conducted by persons independent from those with the responsibility to implement the risk controls) detected numerous examples of non-compliance in work practices. Over a 3-year period (June 2016–July 2019), 30 level 2 audits were undertaken. These identified 36 non-compliance reports (NCRs) and 8 repeat NCRs. Most NCRs contained multiple instances of non-compliance of various types and 10 NCRs included non-compliances that were considered by the auditor to be ‘systemic’ in nature. The RAIB noted that the NCRs confirmed evidence that the management self-assurance (level 1) process was an unreliable mechanism. The RAIB also noted these level 2 audits, although reasonably thorough, were heavily based on reviews of paperwork.

Other incidents

Track worker safety has been a significant concern for the rail industry for many years, and at the time of the Thorneside incident track work safeworking was listed by the Office of the National Rail Safety Regulator (ONRSR) as one of its safety priorities. For the calendar year 2020 it reported that there were 458 track work safeworking rule and procedure breaches.

During the investigation, QR was requested to provide records and brief descriptions of notifiable safety incidents relevant to work on track safety breaches between 1 March 2018 and 29 February 2020. QR provided details of 24 incidents that occurred on its south-east Queensland network. Limited details were provided for some incidents. However, the available information indicated at least 3 notifications had some similarities with the incident at Thorneside:

• One notification in which a PO advised that an excavator operator had on-tracked an excavator without permission.
• One incident in which a welding crew had accessed a rail corridor and commenced work. The welding crew had not contacted the PO to sign on to the multiple workgroup register. A subsequent internal investigation identified a number of ‘absent or failed defences’, including the ineffective use of the pre-start briefing.
• One incident involving a near collision between the tilt train[39] and a work group, where the PO suspended the TOA unaware that there was a work group working on-track.

Management oversight of network safety

Overview of risk management and assurance process

QR had documented standards and procedures for risk management and assurance. The standard MD-11-1338 (Risk management) stated:

In a section titled ‘Monitor and review, the standard stated:

The standard also stated:

QR standard MD-16-24 (Assurance) expanded on the monitor and review concepts. It stated that in order for risk management to be effective, QR should comply with a set of assurance principles, which included:

QR’s 3 lines of defence assurance model was summarised in a diagram, as shown in Figure 5.

Figure 5: QR’s 3 lines of defence assurance model

Source: Queensland Rail

In line with QR’s procedure MD-12-27 (Assurance), QR was to develop an integrated assurance plan (IAP) focussing on second-line and third-line assurance activities through an assurance mapping exercise to provide a holistic view of all assurance activities in relation to the corporate risk hierarchy. The assurance procedure also stated that the planning of second-line and third-line assurance activities would be based on matters such as:

QR’s corporate risk register regarded the safeguard of its workforce as one of its major priorities. One of the risks identified was:

As part of the investigation process, QR was asked to provide its integrated assurance plans[40] for financial years 2017–18, 2018–19, 2019–20 and 2020–21. In addition, the ATSB requested first‑line, second-line and third-line assurance activities over a predetermined period related to network pre-start briefings and related matters.

First-line assurance activities   

One type of first-line assurance activity QR used to assess pre-start briefings and protection arrangements and compliance was conducted by use of form MD-17-27 (Worksite protection compliance inspection). The form was focussed on evaluating a specific worker’s compliance relevant to work activities and included 10 items, each with a comments section to record non‑compliances and required actions. One of the items referred specifically to ‘Pre-start safety briefings including additional Site-Specific hazards’. Five of the items referred to different types of safeworking protection. The compliance inspections and the forms were completed by the worker’s supervisor or manager.

There was no explicit guidance associated with the form to explain what aspects of the pre-start briefing were being evaluated (for example, whether it was simply evaluating whether a briefing was conducted, or whether it was also evaluating the content the worker provided during the briefing or whether all members of the work group were at the briefing).[41]

During the 12 months from January to December 2019, south east Queensland (SEQ) network conducted 495 compliance inspections using form MD-17-27. Of these, 9 inspections (about 1.8%) identified non-compliance where action was required with a small number also including reminders or minor issues. The non-compliances included:

• incomplete or missing SW01 (corridor safety planner and assessment) form
• incomplete or missing safe work method statements
• inadequate worksite protection.

No instances of non-compliance in relation to the network pre-start briefing were identified. It was noted that a relatively high proportion of the non-compliance and feedback were identified by a relatively small proportion of those who conducted the inspections.           

Another type of first-line assurance activity QR utilised to assess compliance with network pre‑start briefings, worksite protection, and multiple other tasks on the rail corridor was form MD‑12-66 (Construction / Maintenance HSE Inspection Record). The form related to all types of maintenance activities and worksites (not just those on track) and included 199 questions within 24 sections. The form’s instructions stated:

In a section titled ‘Prestart Safety and Environment Briefing’, one of the questions asked if a ‘pre‑start safety and environment briefing was performed prior to accessing the site’ and another question asked, ‘During the Pre-start brief are the hazards and controls communicated to the workers and captured on the Pre-start brief’. None of the questions specifically asked whether all workers were at the pre-start brief or whether the PO specifically discussed worksite protection at the brief.

Another section was titled ‘Safe Working’ and included 35 items. These items primarily dealt with the technical implementation of different types of protection; none of the items referred to the conduct or content of the pre-start briefing.[42]

One of the questions regarding the pre-start briefing asked if radio channels / other communication was discussed. Another section on mobile plant included questions related to whether amber lights were fitted and operational, and whether the plant had a UHF radio and was it operational.

As part of the ATSB request, QR provided 118 (MD-12-66) forms that were conducted between 2019–2020. The ATSB examined the completed forms in accordance with the form’s instructions. The examination identified noteworthy similarities with each completed form, including:

• Of the form’s 199 elements for inspection, they were either marked as compliant (Y) or if the element was not able to be inspected it was marked as not applicable (NA). There were very few cases where non-compliance (N) was recorded on an inspection form.
• None of the forms recorded outstanding issues from previous inspections.
• There were no recorded non-compliance issues noted with the network pre-start safety briefing component of the form.
• There were no recorded issues relating to the separation of people and plant.
• There were no recorded issues related to safeworking or worksite protection.
• None of the inspections recorded any outstanding issues at the completion of the inspection.
• All the inspection forms examined included minimal (if any) commentary or contextual evidence to support the results/findings of the inspections.
• There were many cases of forms being completed by the same person with similar entries or phrasing in comments.

Second and third lines of assurance

During the financial years 2017–18, 2018–19 and 2019–20, QR’s integrated assurance plans recorded 3 scheduled second-line assurance activities that related to network pre-start briefings. One scheduled in Q3 of financial year 2017–18, another in Q4 of 2018–19 financial year and the other which took place in Q2 of the 2019–20 financial year.

On request, QR was able to provide a report for one of these 3 scheduled second-line assurance activities – a second-line assurance activity titled ‘Pre-Start Briefing Improvements Review’, which was conducted in September 2019. Its purpose was to determine whether changes made to the network pre-start briefing process (following the May 2017 Petrie accident (see Petrie, Queensland, 2017) had been effectively implemented across the network function and whether the changes met the intent of recommendations arising from QR’s investigation.

The assurance activity involved reviewing worksite activities at 21 locations throughout Queensland. Where the pre-start briefing had already been conducted and work had started, the auditor reviewed the completed briefing form and discussed with workers whether they were aware of the listed hazards and controls. For those worksites where the briefing had not commenced, the auditor discussed with the workers how the briefings were completed using the current version of the form. The audit report did not specifically note that any observations were conducted of briefings, and it also did not note whether all relevant workers (particularly POs) were present at the briefings.

The assurance activity noted that all work groups were using the required form, workers were aware of the risks and controls, and most work groups shared the task of conducting the briefings. Overall, the results of the second-line assurance activity recorded that the control effectiveness score was substantially effective. Some minor areas for improvement were noted. The auditor identified irregularities with documentation in relation to where the network pre-start briefing should be delivered (at the worksite or away from the worksite, such as at a depot) and recorded work groups receiving slightly different information in relation to completing the network pre-start briefing form.  

Although not directly related to network pre-start briefings, another second-line assurance activity was undertaken in the second half of 2018 titled ‘Protection Officers’. The objective of the activity was to determine how QR (POs) interpreted safeworking rules in the field, how effective safeworking changes were communicated, and the effectiveness of first-line assurance activities.

According to the auditor, the risk control effectiveness of the assurance activity was rated at substantially effective. The auditor noted that none of the 42 POs interviewed were aware of the requirement to assure the worksite location on the detailed work plan (worksite diagram) matched the actual work location by comparing the plan to a labelled permanent structure and to have this validated by a member of the work group. The ATSB notes that, given this was a common understanding, it appeared to be related to the dissemination of information to POs rather than a compliance problem. The audit report did not provide any information regarding the network pre‑start briefing process.

Evidence provided by QR indicated there were no internal recorded third-line assurance activities directly relevant to changes made to the network pre-start briefing process following the May 2017 Petrie accident.

However, there were a number of compliance inspections undertaken by ONRSR in relation to track worker safety during 2019–20. Although the inspections did not identify any non‑conformance requiring action by QR, there were observations during the inspections that required consideration by the rail operator. Examples of those observations included:

Safety analysis

Introduction

At about 0108 on 7 March 2020, a Queensland Rail (QR) suburban passenger train (1898) with passengers on board almost collided with an excavator while it travelled between Thorneside and Birkdale stations. The excavator operator was directed to on-track the excavator on the understanding that the section of track was closed and protected from rail traffic.

The near collision had the potential for serious consequences. In this case, it was very likely that the emergency actions of the train driver and the excavator operator prevented an imminent collision. Had this scenario resulted in a collision, it most certainly would have led to significant adverse consequences for the excavator operator and potentially the derailment of the train.

After the initial near collision, and while attempting to remove the excavator from the danger zone of the rail corridor, a second near collision occurred with another suburban passenger train. Although this occurrence was not as serious, it still had the potential for adverse consequences.

The safety analysis will consider the events and conditions which influenced the near collisions, particularly:

• limitations associated with the network pre-start briefing
• other limitations with communications at the worksite
• the effectiveness of assurance activities related to these matters.

Pre-start briefing processes

All documentation associated with QR network pre-start briefings gained during the investigation stated that all work group members, including protection officers (POs), contractors and others associated with work within the rail corridor, were required to attend a network pre-start briefing. This understanding of the requirements was supported by a subject matter expert who developed and delivered training for QR’s POs and track workers.

In most cases, and as described by QR’s guidelines, a nominated person will deliver the network pre-start briefing with assistance from the PO and others as required. For example, the recipient or the mobile plant spotter should also provide information when required. The pre-start briefing should provide an environment where all work group members can participate and ask questions relevant to the work, including protection arrangements and the roles and responsibilities of individuals. One key aim of the briefing was to ensure everyone working on the site had a correct, shared understanding of the worksite protection arrangements that would be used and the limits of that protection.

On 6 March, the lead PO was advised to meet the depot supervisor at the Cannon Hill depot at 2200 to discuss protection arrangements for the planned work at Thorneside. By the time the PO arrived at the depot, the team leader had completed the network pre-start briefing, and shortly after the work group departed the depot for the worksite. Neither the lead PO or the assistant PO attended the briefing or provided any input to the briefing regarding worksite protection arrangements for the planned closure or the preparation work (for which the protection arrangements had not yet been assessed, planned, and confirmed). Most of the workers present at the briefing signed the network pre-start briefing form, even though they had not received a briefing from the PO. The supervisor did not sign the briefing form until after the near collisions.

The excavator operator was also not invited to the network pre-start briefing at the Cannon Hill depot. Instead, the arrangement was for a QR representative to meet the excavator operator at Thorneside Station at 2230, prior to the commencement of work. On arrival at the worksite, the excavator operator correctly requested a worksite briefing. The team leader explained the work requirements pertaining to the excavator. However, they were not provided with a network pre‑start briefing or any briefing from the PO explaining the protection arrangements relevant to the worksite, even though they were requested to sign the network pre-start briefing form.

Other than the network pre-start briefing delivered at the Cannon Hill depot, neither the supervisor nor the team leader, who was working under the guidance of the supervisor, provided an opportunity for the PO to deliver information about the worksite protection requirements to the work group for the planned work activities.

It was suggested by the recipient at interview that the PO delivered their component of a network pre-start briefing immediately prior to the work group entering the rail corridor at Thorneside. This however was not a formal network pre-start briefing, but a mandatory requirement of the Queensland Network Rules and Procedures (QNRP) before work could commence in the rail corridor. At the time the PO delivered the brief to access the rail corridor, the excavator operator and the supervisor of the work group were not present as they had not yet arrived at the worksite. There was no discussion of the work activities and protection arrangements for the planned closure.

It is understandable that in some situations, where maintenance work extends over several days, not all workers will be able to attend the same network pre-start briefing. Under those conditions multiple network pre-start briefings should be delivered to ensure that all workers are provided with safety information relevant to their working environment. However, the maintenance work at Thorneside was scheduled over one shift. Therefore, all members of the work group, including the POs and the excavator operator, should have attended the same pre-start briefing to enable them to develop a shared understanding of the worksite protection arrangements that would be in place for both the preparation work and the planned closure.

In this case, given the excavator operator was not present at the network pre-start briefing, the team leader (and supervisor) needed to ensure that the operator was provided with a full network pre-start briefing when they arrived at the worksite (or at least prior to the team leader directing them to an alternate entrance gate away from the worksite). This should have included briefings and involvement from relevant personnel such as the PO and the recipient / mobile plant spotter.

As well as the actual briefing, there were limitations with the level of detail included in the network pre-start briefing form about the type of machinery that would be used. The protection arrangements listed were also general in nature, and not clearly specified for both the preparation work and the planned closure. Given that the POs did not see the form prior to the near collisions, and the excavator operator was not involved in the preparation work, limitations within the form did not contribute to the near collisions.

In summary, there were a significant number of problems associated with the application of the network pre-start briefing process prior to work commencing at the Thorneside worksite. Of most importance, the POs and the excavator operator were not included in a network pre-start briefing, which denied them and the work group of essential safety information applicable to their roles and responsibilities. This limitation significantly increased risk and contributed to the initial near collision.

Other communication processes

Introduction

When working in a rail environment such as a worksite, communication for the purpose of developing a shared understanding is vitally important. The network pre-start briefing is an essential part of ensuring subsequent communications are based on a shared understanding and are effective.

In this case, there were a number of communication problems that occurred following the network pre-start briefing, many of which can be attributed in part to the absence of a thorough network pre-start briefing involving all of the personnel working at the site.

Protection officer awareness of the excavator

While at the worksite, the supervisor received a call from the excavator operator regarding the location of the worksite. The supervisor directed the operator to travel to the worksite and meet workers at the work group entrance gate. This information was passed on to others in the work group, including the recipient and the team leader, for future planning consideration. However, it was not communicated to the lead PO. The PO was not cognisant of the working arrangements involving the excavator and they were unaware an excavator had arrived at the site.

The need for that information became safety critical when the network control officer (NCO) contacted the PO regarding a track fault, which was very likely caused by the excavator when it was being on-tracked. When the NCO asked the PO if there was any equipment on-track, the PO had an incomplete mental model of the work group and advised the NCO that there was no equipment on-track.

Had the PO known that the excavator had arrived on site, it is likely they would have associated the track fault with the on-tracking of the excavator and communicated this information to the NCO. Given that the track fault occurred about 105 seconds prior to the first near collision, it is likely that such communications would have prevented the first near collision (or at least significantly reduced the risk associated with any such near collision).  

Direction to on-track the excavator

The recipient directed the excavator operator to on-track the excavator before the planned track closure. This action appeared to result from a combination of situational factors. Firstly, the recipient misinterpreted the team leader’s instruction of ‘it’s on’ as meaning the planned closure was active, whereas the team leader was referring to the reinstatement of the protection for the preparation work, and that the work tools could be loaded into the bucket of the front-end loader. The recipient’s misinterpretation was reinforced by the work group loading the front-end loader with tools for the planned closure and then receiving the height limiter key from the operator of the front-end loader.

Although the chain of events had the potential to be misinterpreted by the recipient, there should have still been some level of doubt that the planned closure was in force. The time of the team leader’s instruction (0051) was well prior to the scheduled start time of the planned closure (at 0218), and there had been no discussion of changing the start time of the planned closure (and scheduled trains were still operating). In addition, the PO had not authorised the on-tracking of the excavator and the team leader (or supervisor) had not explicitly informed the recipient to direct the excavator operator to on-track at that time.

For any questions relevant to protection arrangements, the communication pathway should be through the PO. If a member of the work group required clarification on information or instructions, then they should gain this clarification from the person in charge at the worksite. In a work group there should be clearly defined communication protocols, and these protocols should be highlighted at every network pre-start briefing.

The recipient had been formally trained in network communication and should have been aware that, before acting upon a communication regarding access to the rail corridor and danger zone that is not explicit, further clarification is necessary. However, in this case the recipient acted on an assumption rather than clarifying the instruction and gaining the necessary authority from the PO and the person responsible at the worksite before they directed the operator to on-track the excavator.

It is conceivable that the recipient undertook the action with the view that it would help facilitate the work and provide more confidence that subsequent tasks would be completed within the planned closure period. However, there was no indication that the recipient was intentionally deviating from procedures when they directed the excavator operator to on-track. Rather they appeared to simply misunderstand the situation.

The work group member acting as the recipient was new to the role, having only received their qualification 2 days before. Therefore, consideration to provide supervision over the actions and performance of the recipient (also acting as the mobile plant spotter) should have been a priority for the supervisor and the team leader. However, there appeared to be limited supervision or support provided.

In summary, without gaining the necessary authority, the recipient directed the operator of the excavator to on-track under the incorrect assumption the planned closure was active, and the worksite was protected by a TOA with in-field protection and train activity on the rail corridor had ceased. However, there was no protection in place and the rail corridor was open for normal train traffic.

Use of standardised railway terminology

It is important that standardised industry-specific terminology is used when communicating safety‑critical information. When using general terms, it is possible for individuals to misinterpret the intent of a communication. In a work environment such terms can lead to a situation where something important can be taken out of context, which may lead to serious consequences. In the case of this investigation, there were 2 instances where workers used generic language to communicate safety-critical information that was misinterpreted and lead to serious consequences.

Firstly, the team leader communicated the generic term ‘it’s on’ to the work group to signify the TOA without in-field protection (or an ‘unprotected TOA’) had been reinstated and tools and equipment could be transferred from the work truck into the front-end loader. This term was misunderstood by the recipient and interpreted as the planned closure was now in force, prompting the recipient to direct the excavator operator to on-track the excavator.

A contributor to the second near collision was the conversation between the lead PO and the emergency hotline contact (located at the network control centre) by not incorporating standardised industry-specific terminology during their conversation. While gaining information relevant to the first near collision, the emergency hotline contact asked the PO had the excavator been moved away from ‘the track’, rather than using the rail-specific term ‘danger zone’.

The lead PO then gained confirmation from the supervisor (and indirectly from the recipient at the incident site) who verified the excavator was away from the track. On gaining this information, the emergency hotline contact advised the PO to leave the excavator where it was for investigation purposes. The emergency hotline contact then informed the NCO that the excavator was away from the track. Based on this information, the NCO believed that the excavator was clear of the danger zone and therefore allowed rail traffic to proceed past the incident site without imposing restrictions. However, the excavator was still in the danger zone and close to the running line, which meant it was a risk to operations. Had the conversations between the PO, emergency hotline contact and other parties identified the excavator was in the danger zone, it is highly likely that this information would have been forwarded to the NCO and the second near collision would have been avoided.

Guidelines for the use of standardised railway terminology

The Rail Industry Safety and Standards Board’s (RISSB’s) Safety critical communications guideline (2018) stated that one way to mitigate the risk of misunderstanding in communication was to avoid the use of acronyms and words with alternative meanings. Instead, the guideline advised the use of industry-specific terminology that cannot be misinterpreted. Although QR’s QNRP provided relevant information on spoken communication and the use of standard terms, such as the phonetic alphabet, when communicating information, there was no formal guidance for rail safety workers to incorporate standardised rail-specific terminology when communicating safety-critical information. Including this guidance, and reinforcing its use during safety-critical communications, would reduce the risk of these types of miscommunications, particularly during an emergency response.

Direction to remove the excavator from the danger zone

Following the first near collision, the supervisor travelled to the incident site to assess the situation, after being advised that the excavator was off the track but may still be in the danger zone. After arriving at the site, they confirmed that it was still in the danger zone, and they instructed the excavator operator to move the excavator further away from the tracks.

In interview the supervisor advised that they had assumed that rail traffic would have been suspended following the first near collision, but they had not confirmed that this was the case with the NCO. It is understandable that a natural reaction to such a situation would be to immediately remove a potential collision hazard. However, by instructing the excavator operator to enter the danger zone and move the excavator without first gaining permission from the NCO and confirming that rail traffic had been suspended, the supervisor was placing the excavator operator and others nearby (and potentially those on the train) at unnecessary risk.

After the second near collision, again the supervisor exposed the excavator operator to danger by directing them to remove the excavator from the danger zone without gaining the necessary protection from the NCO.

Assurance activities

Additional task performance aspects

At present in most rail networks in Australia, work on track fundamentally relies on administrative controls (rules and procedures), with there being limited use of technology to reduce the risk of workers being struck by rail traffic. However, human performance is inherently fallible. Accordingly, working within the rail corridor requires significant planning, communication and worker adherence to rules and procedures in order to provide a safe work environment.

As already outlined in previous sections of this analysis, there were limitations associated with the network pre-start brief that increased safety risk. There were also limitations with a number of subsequent communications that increased risk, as discussed in the previous section. In addition, the investigation identified a number of other actions at the worksite that increased risk, many of which were explicitly or implicitly inconsistent with the rail operator’s rules and procedures. These actions included:

• The supervisor did not attend the briefing delivered by the lead PO at the worksite regarding the TOA without in-field protection prior to the preparation work and they then commenced work tasks in the rail corridor.
• The supervisor provided limited supervision of the team leader and the recipient at the worksite, who were both new to their roles.    
• There was no designated ‘lookout’ in place for the preparation work, which was conducted with a TOA without in-field protection with less than the required sighting distance.
• The recipient did not gain permission from the PO before directing the excavator to on-track the excavator.
• The recipient did not advise the excavator operator of the radio channel to use at the worksite (although this was listed on the network pre-start briefing form).
• The recipient did not have a radio and did not maintain full visibility and communication (radio contact) with the excavator operator.
• After the first near collision there was no ‘pause and re-start’ in accordance with the network pre-start briefing form.
• The supervisor directed the PO, who oversaw protection within the rail corridor, to return to the Cannon Hill depot while machinery and workers were still in the rail corridor without the required protection. 

Although the team leader (acting as the person in charge of work) and the recipient were acting in roles for which they were inexperienced, they and the supervisor of the work group were experienced in track work safety. All 3 rail safety workers had been formally trained to act as a PO, deliver a network pre-start briefing, conduct communications (as per the QNRP), conduct lookout duties and rail safety awareness. Their training and experience should have provided them with the necessary competence and skills to work safely in the environment of the rail corridor.

The investigation did not identify any environmental conditions that necessitated the undertaking of deviations from procedures. The absence of one worker due to sickness resulted in the work group undertaking preparatory work prior to the planned closure to manage this contingency. However, there appeared to be no indication that there would be insufficient time to undertake the preparatory work and the preparatory work was completed well before the planned closure period.

The arrival of workers at different times and the need to use multiple access gates for different machinery complicated the situation for the work group. However, this situation should have indicated a need for more thorough briefings and communications as these problems developed. Although the activities were occurring overnight, the available evidence did not indicate that any of the involved work group was experiencing adverse levels of fatigue.

Given the number and variety of individual actions that increased risk associated with the near collisions, and no obvious explanation for this overall pattern of actions, the investigation considered the assurance processes the operator had in place to detect work practices being inconsistent with rules and procedures.

Assurance activities related to network pre-start safety briefings

It is essential that information gained from first-line assurance activities genuinely reflects what is actually happening when frontline workers are performing tasks in the rail corridor. Accurate data capture is critical in first-line assurance, as second and third-line assurance are linked and leverage off the results. If the information is not accurate, then the integrity of the 3 lines of defence assurance model will be flawed, which will likely have a significant impact on future safety.

As already outlined, the network pre-start safety briefing is an essential and safety-critical component of minimising safety risk while conducting work on track. Findings from investigations have shown that ineffective network pre-start briefings have either directly or indirectly contributed to the death of workers as a consequence of being struck by rail traffic, and this was also a key problem in the near collisions at Thorneside. Accordingly, the ATSB focussed its assessment on the application and results gained from assurance activities, relevant to pre-start briefings, to determine the effectiveness of the 3 lines of defence assurance model in identifying and managing risk.  

The ATSB reviewed first-line assurance inspection forms that were completed between 2019‍‍–‍2020, which included (among other things) the inspection of compliance with network pre‑start briefings, worksite protection and safe work activities. These consisted of 495 worksite protection compliance assessment forms and 118 maintenance inspection records. Almost every form examined by the ATSB identified near full compliance with all aspects of the required processes with very few safety-related matters identified. This data could be interpreted as providing assurance to the organisation that workplace activities were routinely being conducted effectively. However, the results of this investigation and at least some other incidents indicate that workplace activities were not always effective.

The extent to which the first-line assurance activities provided a reliable assessment of the network pre-start briefings appeared to be limited due to multiple factors:

• There was no explicit guidance associated with the worksite protection compliance assessment form that explained what aspects of the briefing were to be evaluated. More specifically, the extent which all relevant workers (including POs) were at the briefing and participated in the briefing was not explicitly requested or recorded.
• The maintenance inspection form covered a wide range of topics and was detailed, consisting of 199 items. However, although some of these items referred to the network pre-start briefing, none of the questions asked if all relevant workers (including the PO) were at the briefing and participated in the briefing. It is acknowledged that not every specific aspect can be covered in such assessments, and increasing the length of such assessments will not always lead to more useful, accurate data.
• The maintenance inspection forms were completed by a supervisor or team leader on their own work section (which is an inherent part of many first-line assurance activities). However, as noted in the UK Rail Accident Investigation Branch report into the Margam accident, such a process can be associated with a range of factors that may limit the objectivity, completeness, or accuracy of such assessments.

Accordingly, appropriate use of independent (or second-line / third-line) assessments is needed to provide confidence in the validity and reliability of first-line assessments. Evidence provided by QR showed that there had been limited second-line and no third-line assurance activities directed at network pre-start briefings, possibly due to the near faultless results of first-line assurance activities. One second-line assurance activity conducted after the May 2017 fatal accident at Petrie focussed on network pre-start briefings and involved interviewing workers associated with 21 tasks about a briefing or the briefing process. Given the identified criticality of effective pre-start briefings following the Petrie accident, this was a relatively small sample. The assessments also appeared to focus on the extent to which workers advised whether the briefings provided information about hazards and controls, which is obviously important. However, the extent to which all relevant personnel (including POs) attended briefings and actively participated in briefings was not documented.

The available evidence does not indicate that there was widespread non-compliance with network pre-start briefing procedures or related communication processes, and the ATSB has not concluded that widespread non-compliance was occurring. However, the assurance activities that were conducted did not provide sufficient assurance regarding the extent to which network pre‑start briefings were being conducted effectively. In other words, based on the nature of the assessments conducted, the extent to which the problems that occurred at Thorneside on 6‍–‍7 March 2020 had occurred at other locations or at other times could not be reliably evaluated.

In summary, QR’s 3 lines of defence assurance model is well equipped to manage safety. Nevertheless, if the process is not administered as intended and in line with risk management principles then track worker safety may be at risk. Network pre-start briefings are a critical control to manage the risk of collisions between rail traffic and workers. However, the design of the first‑line assurance activities and the limited conduct of second and third-line assurance activities provided only limited assurance that the worksite protection aspects of the briefings were being conducted effectively.

It is understood that assurance processes, regardless of how well or how often they are conducted, will not prevent all instances of procedures not being conducted as expected. In this case, given some of the situational factors involved, the extent to which improvements in the assurance processes would have prevented the near collisions at Thorneside was difficult to evaluate.

The ATSB notes that, following the Thorneside incident, QR has undertaken a significant program of work to improve track worker safety. Further details are provided in the Safety issues and actions section of the report.

Accident prevented

On recognising the imminent risk of collision, both the train driver and the excavator operator took immediate action which prevented the serious incident becoming an accident. The train driver applied the emergency brake on the train while the excavator operator used the excavator’s boom arm and bucket to drag it from the rail tracks as the train passed at about 61 km/h.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.  Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the near collision incidents involving an excavator and passenger trains 1898 and 18A0 near Thorneside, Queensland, on 7 March 2020.

Contributing factors

• The lead protection officer (PO), assistant PO and the excavator operator were not included in a network pre-start briefing, which denied them and the work group of essential safety information applicable to their roles and responsibilities.
• The lead protection officer (PO) was not informed of or aware that an excavator had arrived at the worksite. Consequently, when the network control officer (NCO) notified the PO of a track fault indication (associated with the on-tracking of the excavator) and asked if there was any equipment on-track, the PO had an incomplete mental model of the work group and advised the NCO that there was no equipment on-track.
• Without gaining the necessary authority, the recipient directed the operator of the excavator to on-track under the incorrect assumption the worksite was protected by a track occupancy authority (TOA) with in-field protection and train activity on the rail corridor had ceased. However, there was no protection in place and the rail corridor was open for normal train traffic.
• Following the first near collision, communications between the protection officer (PO), the emergency hotline contact and other parties about the location of the excavator did not clarify that, although the excavator was off the track, it was still in the danger zone.
• The Queensland Network Rules and Procedures did not provide sufficient guidance for rail safety workers to ensure they used standardised rail-specific terminology when communicating safety-critical information. [Safety issue]
• After the first near collision, the supervisor directed the excavator operator to remove the excavator from the danger zone without gaining the necessary authority from the network control officer or confirming that rail traffic had been stopped. This omission contributed to the second near collision between another suburban train and the excavator.

Other factors that increased risk

• Network pre-start briefings are a critical control in place to manage the risk of collisions between rail traffic and workers and machinery, and Queensland Rail had undertaken significant work to improve these processes. However, the design of the first-line assurance activities and the limited conduct of second-line and third-line assurance activities provided only limited assurance that the worksite protection aspects of the briefings were being conducted effectively. [Safety issue]

Other findings

• After detecting that the train and the excavator were on a collision course, the driver of train 1898 and the operator of the excavator both promptly undertook all available actions to reduce the collision risk.

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation. Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Use of standardised railway terminology

Safety issue number: RO-2020-003-SI-01

Safety issue description: The Queensland Network Rules and Procedures did not provide sufficient guidance for rail safety workers to ensure they used standardised rail-specific terminology when communicating safety-critical information.

Assurance activities related to network pre-start safety briefings

Safety issue number: RO-2020-003-SI-02

Safety issue description: Network pre-start briefings are a critical control in place to manage the risk of collisions between rail traffic and workers and machinery, and Queensland Rail had undertaken significant work to improve these processes. However, the design of the first-line assurance activities and the limited conduct of second-line and third-line assurance activities provided only limited assurance that the worksite protection aspects of the briefings were being conducted effectively.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Additional safety action by Queensland Rail

Critical safety alert

Soon after the incident, on 10 March 2020, Queensland Rail issued a critical safety alert (CSA) directed to protection officers (POs) and their supervisors and managers, and all infrastructure workers and their supervisors and managers. The alert provided a brief overview of the incident and stated the following actions to be taken:

Subsequent improvement activities

Following the incident, Queensland Rail (QR) offered an enforceable voluntary undertaking (EVU) to the Office of the National Rail Safety Regulator in September 2021, with clarifications made in October 2021. This EVU summarised the following additional actions undertaken by QR:

Subsequent proposed initiatives

Under the EVU, QR outlined 13 initiatives to improving planning processes for track access, the safeworking control framework, capability of safety-critical workers and effectiveness of safety assurance and performance. The EVU outlined safety initiative leads and accountabilities and a proposed schedule for implementation. The initiatives included the following:

• improve planning and communication between track workers and network control officers (NCOs) in south-east Queensland
• implement a track access system (a common interface between NCOs and POs)
• conduct further work to review the Queensland Network Rules and Procedures (QNRP) and deliver refresher workshops
• enhance network lookout processes (to reduce the likelihood of unintentional release of track protection while workers are still in the danger zone)
• cease using lookout working[43] within south-east Queensland
• review lookout working in regional areas
• improve trackside pre-start briefings
• introduce a non-technical skills program for POs
• introduce a non-technical skills program for trackside worker supervisors
• use external and internal incidents to review QR processes for any deficiencies
• develop an approved tool for conducting first-line assurance of POs (and compliance with procedures for working in the rail corridor) and an associated assurance plan
• develop an assurance tool for assessing communications between NCOs and POs and implement the assurance process.

QR advised the ATSB that, as of 1 November 2023, 12 of the 13 initiatives had been externally verified as closed and the final initiative was on track for completion by 31 December 2023.

Additional safety action by other parties

In January 2023, the Office of the National Rail Safety Regulator (ONRSR) and the Rail Industry Safety and Standards Board (RISSB) released the results of a global investigation into how world standard technology can protect track workers in the Australian rail industry. The introduction section of the Track Worker Safety Options Report stated:

The options in the table were grouped in the following types:

• vehicle installed devices that give warnings to train crew
• worksite installed devices the give warnings to track workers
• sensors and devices that give targeted alerts to both vehicle crew and track workers
• infrastructure systems, methods and devices that remove the need for workers on tracks to undertake work
• infrastructure systems and devices that automatically prevent vehicles from entering a worksite.

Glossary

CSA	Critical safety alert
ECO	Electric control officer
EVU	Enforceable voluntary undertaking
NCO	Network control officer
ONRSR	Office of the National Rail Safety Regulator
PO	Protection officer
QNRP	Queensland Network Rules and Procedures
QR	Queensland Rail
RAIB	Rail Accident Investigation Branch (United Kingdom)
RISSB	Rail Industry Safety and Standards Board
TOA	Track occupancy authority

Sources and submissions

Sources of information

The sources of information during the investigation included:

• relevant staff from Queensland Rail
• the lead protection officer
• the excavator operator
• event recorder evidence from trains 1898 and 18A0
• CCTV footage from the front-of-train camera of train 1898
• universal traffic control replay system
• Queensland Rail.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Queensland Rail
• the depot supervisor
• the work group team leader
• the recipient
• excavator operator
• the Officer of the National Rail Safety Regulator (ONRSR).

Submissions were received from Queensland Rail and ONRSR. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2023 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.