Parting of Metro Trains Melbourne passenger train TD 3817, at Croydon, Victoria, on 9 November 2018

On the afternoon of 9 November 2018, two empty 3-car X’Trapolis units^[1] were coupled at the Camberwell sidings in preparation for operating the 1607 Metro Trains Melbourne (MTM)^[2] passenger service from Flinders Street Station to Lilydale Railway Station (Figure 1). Car 959M was designated the lead car of the train and operated as a non-revenue service from Camberwell sidings to Flinders Street Station.

Analysis of the VICERS^[3] data logger indicated that at 1552, just prior to departure from Camberwell, the driver sounded the low-note whistle and there was a momentary loss of electrical signals between the leading and trailing 3-car units. At 15:52:15, the train departed from Camberwell sidings for Flinders Street Station.

On arrival at Flinders Street Station at about 1606, a driver exchange occurred. The new driver conducted the prescribed safety checks, entered the train describer number (TD 3817) and departed Flinders Street Station at about 1608. The train stopped at Southern Cross Station and Flagstaff Station before arriving at Melbourne Central Station at about 1615.

Figure 1: Melbourne train network showing train TD 3817 route on Lilydale Line

Source: Metro Trains Melbourne with annotations by Chief Investigator, Transport Safety (Vic)

The driver reported that at Melbourne Central Station, the message ‘Decoupling/Re-coupling’ appeared on the Driver’s Display Unit (DDU). He reported this to the Train Services Officer (TSO) at Metropolitan Train Control (METROL) who advised him that it could be the coupler pins not aligning in the centre coupler (coupler between the two 3-car sets). The driver reported that after a few seconds, a new message ‘PIDS^[4] Inoperative’ appeared and then after a short period the normal screen was restored. He then re-entered the Train Describer number into the DDU.

Analysis of the data from the VICERS indicated an electrical disconnection lasting about 7 seconds at Melbourne Central Station. At about 1616, the electrical signal was re-connected, the emergency brake safety loop re-established and the train departed Melbourne Central Station.

The train stopped at several stations before arriving at Croydon Station at about 1656. Although the DDU did not indicate any further irregularities, the VICERS data download traces between Melbourne Central Station and Croydon Station indicated three further electrical disconnections. These electrical disconnections did not disrupt the operation of the train.

The train departed Croydon Station at about 1657, with about 150 passengers on board. After leaving Croydon Station and on the approach to Coolstore Road level crossing (about 200 m from the station) the driver sounded the low-note whistle. The train then entered a left-hand curve, about 800 m from Croydon Station. About half way through the curve, the driver looked back through the rear-view mirror and noticed that the train consist had only three cars and the trailing unit had uncoupled (Figure 2). He immediately applied emergency braking and brought the three-car set to a stop.

Figure 2: Coupled cars 960M and 882M of X’Trapolis train that uncoupled

Source: Metro Trains Melbourne annotated by Chief Investigator, Transport Safety

The VICERS data download indicated that about 30 seconds after departing Croydon Station, an emergency brake application was made on cars 882M and 881M, and the trailing 3-car set came to a stop at about 1658. The download further indicated a momentary brake application on cars 959M and 960M (the motor cars of the leading 3-car set), but this brake application was not sustained and the car set continued moving. The VICERS download indicated an emergency brake application at about 1658 and shortly after, the leading car set 959M came to a stop about 371 m from the lead car 882M of the trailing car set. The train was travelling at about 78 km/h when the 3-car sets uncoupled. The trailing car set travelled under emergency braking for about 196 m before coming to a stop.

Events after uncoupling of 3-car units

After the leading car set came to a stop, the train driver made a priority radio call to advise METROL of the uncoupling of the trailing car set. METROL despatched an empty train (under extreme caution^[5]) from Lilydale Station towards Croydon Station to locate the 3-car set that had detached from the lead car set. Victoria Police, the Melbourne Fire Brigade (MFB) and the Ambulance Services arrived soon after and detrained about 150 passengers from the two detached 3-car sets.

__________

1. Units 959M-1680T-960M and 882M-1641T-881M.
2. MTM is the franchise contract manager for the Melbourne metropolitan rail network. MTM is also responsible for asset maintenance on the network.
3. Vigilance Control and Event Recording System. Refer to section on VICERS Data Logger system.
4. Passenger Information Display System.
5. MTM instruction to the train driver of the empty train to exercise extreme caution in case TD 3817 had derailed and was fouling the adjacent track.

Location

The parting of the two 3-car units of train TD 3817 occurred about 500 m from Croydon Station. Croydon Station is on the Lilydale rail line and is located about 32 rail km from Flinders Street Station, Melbourne (Figures 1 and 3).

Figure 3: Location of Croydon on Lilydale train line

Source: Copyright Melway Publishing 2018, with annotations by the Chief Investigator, Transport Safety (Vic)

The environment and track

At the time of the incident, the weather was fine with light winds and the temperature was about 190 C.

The rail track from Croydon Station to the location of the train parting was concrete sleepered. From Croydon Station there were a number of left and right hand curves between 31.2 km and 32 km marks. The track slopes down at a slight gradient from 31.2 km to about 31.5 km and then is flat until about the 32 km mark.

Train driver

The train driver was employed by MTM for over 9 years and was qualified to drive Electrical Multiple Units (EMU). His driving performance was audited regularly by MTM driver supervisors and was last audited in July 2018. No non-conformances were recorded during these audits. Medical certification for the driver was valid and current at the time of the incident. No alcohol or drugs were detected during post-incident tests conducted on the driver.

The train

The X’Trapolis EMU is operated as a 3-car or 6-car set. The car body modules were designed and constructed in France and assembled at Alstom Australia, in Ballarat, Victoria. Each 3-car set is coupled in motor-trailer-motor configuration. They are coupled by auto-couplers between motor cars and semi-permanent couplers between the motor and the trailer cars, with rubber bellows inter-car canopy walkways.

TD 3817 was a 6-car set and consisted of 959M-1680T-960M-882M-1641T-881M passenger cars.^[6] A Scharfenberg automatic coupler connected the two 3-car units of TD 3817 between 960M and 882M. A 6-car train set has the total effective capacity for 752 passengers and this train was carrying 150 passengers at the time of the uncoupling.

The motor units are 24.46 m in length and the trailer units are 22.76 m in length. Each 3-car set is 71.68 m in length and a 6-car set is 143.36 m in length. The average mass of a 6-car set is about 244 t. Each car has six doorways, located at the front, middle and rear of the cars and the nominal floor height of the car is 1185 mm above top of the rail. The EMU is capable of a maximum speed of 130 km/h.

Master Controller and Operations

In order to prepare the train for operation, the driving cab must be made electrically operational by inserting and switching on the Master Key making it the cab-in-service. The driver then enters the Train Describer number into the radio control unit. The Master controller handle is moved back and forth between four positions—motor, coast, brake and emergency brake. The Reverser is a three-positon switch that can be moved to forward, neutral and reverse positions. In order to get forward traction, the Reverser must be moved to the forward position and the master controller moved from the brake to coast to the motor position. The position of the Master controller between the coast and motor positions dictates the tractive effort. The console and controls are accessible from the driving position (Figure 4).

Figure 4: Master Controller Panel

Source: Chief Investigator, Transport Safety (Vic)

Vigilance, Control and Event Recording System (VICERS)

The X'Trapolis fleet is fitted with a Vigilance Control Event Recorder System (VICERS). The vigilance component monitors task-linked activities and in the absence of any such activities provides intervention by applying the train’s brakes. It also incorporates an event recorder system, which monitors a number of on board systems including the operation of a number of driver control functions. The system records a comprehensive range of operational parameters including control equipment status, train speed, traction and braking and location.

Coupling and Uncoupling of Scharfenberg Coupler

Each end of the 3-car units were equipped with an automatic Scharfenberg coupler that enabled mechanical, pneumatic and electrical coupling of two 3-car units (Figures 5 and 6).

Figure 5: Mechanical, pneumatic and electrical components of Scharfenberg coupler

Source: Chief Investigator, Transport Safety (Vic)

Figure 6: Scharfenberg coupler between cars shown uncoupling

Source: Chief Investigator, Transport Safety (Vic)

The Scharfenberg coupler has a coupler lock that consists of a rotating hooked plate, a coupling link and tension springs (Figure 7). During coupling, the coupling link of one coupler engages the hooked plate of the mating coupling and locks in the indentations on the hooked plates. The cone and funnel shape design of the coupler front plates establishes a rigid and slack-free connection. During the coupling, the electric heads and the air pipe connections engage to ensure connectivity between the two car units. The coupler has a flexible buffer assembly that allows movement of the cars when negotiating vertical and horizontal curves.

Figure 7: Illustration of uncoupled Scharfenberg coupler

Source: Voith Group, annotated by Chief Investigator, Transport Safety (Vic)

The units can be coupled or uncoupled remotely from the driver’s cab or manually from trackside. The automatic coupling process involves moving one 3-car unit against a stationary 3-car unit.

X’Trapolis electrical and pneumatic systems for uncoupling

The Melbourne metropolitan electrified rail network operates on 1,500 V direct current (DC), supplied to the train via a roof-mounted pantograph that is in contact with the overhead wire. Two power inverters (static) convert the 1500 V DC to 400 V, 3-phase or 230 V single-phase alternating current (AC) to supply the various loads on the train. The 400 V AC supply is rectified and transformed to provide 120 V DC through a battery charger system.

The 120 V DC power supply is distributed to three lines; the permanent LV line, prepared LV Line and the prepared and cab operative line, each corresponding to an operational state of the train.

The prepared LV line supplies the uncoupling system (Figure 8). An intended uncoupling operation requires the train to be stationary and local cab active. The uncouple pushbutton (Figure 4 and 8) is pressed to energise and actuate the uncouple solenoid valve (VS). The energised uncouple solenoid valve directs supply air to the uncouple cylinders (Z3) on both couplers

Figure 8: Wiring diagram for uncoupling system

Source: Alstom Drawing AX00000263675, simplified and annotated by Chief Investigator, Transport Safety (Vic)

The uncouple cylinder (Z3) actuating piston rotates the hooked plates of the coupler against the force of the tension springs (Figure 7 and 9). The coupling links slip out of the indentations on the hooked plates and the couplers can then be separated. The uncouple cylinder actuating piston also rotates the cam (C1) that actuates the 5/2 way pneumatic valve (V4). Actuation of the 5/2 way pneumatic valve allows air to be directed to the pneumatic cylinders (Z4) that retract the electrical heads (E).

For the uncouple pushbutton to activate the uncouple solenoid valve, the cab has to be in-service (cab active) and the train speed has to be below 3 km/h (Figure 8). Pressing the uncouple pushbutton from the active cab energises the uncouple command relay which deactivates the coupling detection contactor relays. These in turn disconnect the traction and braking signals across the coupler electrical heads prior to uncoupling.

Figure 9: Pneumatic schematic for uncoupling of Scharfenberg coupler

Source: Scharfenbergkupplung GmbH & Co. (annotated by Chief Investigator, Transport Safety (Vic)

__________

6. The letter M denotes a motor unit and the letter T denotes a trailer unit.

Testing and fault finding conducted by MTM

Metro Trains Melbourne (MTM) conducted multiple dynamic tests of the train in an attempt to replicate the fault, without success. The Scharfenberg coupler and associated mechanical and pneumatic components were inspected and no fault was identified. The Scharfenberg coupler can be manually uncoupled by actuating the automatic coupler manual release handle. Examination of the manual release mechanism did not indicate that it had been used. It was concluded that the most likely initiator for an uncoupling event was via the activation of the uncouple solenoid (22Y3).

Insulation resistance testing of uncouple solenoid

Uncouple solenoid connectors of the coupled motor cars (959M and 882M) were tested for insulation resistance (IR)^[7] to ground (vehicle body/frame). The IR value for the uncoupling solenoid connector of car 882M was found to be 20 kΩ, when the typical IR is required to be over 100 MΩ. However, the low IR would not result in unintentional energising of the uncoupling solenoid valve without a power source to the solenoid.

Figure 10: Electro-pneumatic panel box showing uncouple solenoid valve

Source: Chief Investigator, Transport Safety (Vic)

Further, testing indicated that both the uncoupling solenoid and the uncouple relay picked-up and actuated at a minimum voltage of about 50 V, which was not unusual.

Insulation resistance testing carried out on all the uncoupling solenoid connectors of the X’Trapolis fleet revealed that 15 uncoupling solenoid connectors measured low insulation resistance. In addition, 19 trip re-set connectors^[8] and 15 trip raise connectors^[9] also indicated low insulation resistance.

Low-note whistle wiring error

MTM conducted test runs of the 3-car set with car 959M as the lead cab-active car. Normally, zero voltage should exist between a power supply common negative and ground (earth/vehicle body). However, during the tests on car 959M, an oscilloscope measured an intermittent 120 V between the common 120 V negative and ground. Examination of the VICERS download trace indicated that the voltage spike coincided with the use of the low-note whistle (Figure 4). Further, static testing confirmed that activation of the low-note whistle resulted in the application of 120 V supply between common negative to ground.

Examination of the low-note whistle wiring indicated that a relay on car 959M was installed incorrectly and a cable was connected to a wrong terminal. This error resulted in the low-note whistle’s 120 V supply being connected to the negative (24 V) of the Speed Interface Unit (SIU), which is an interface between the car’s speed detector and the VICERS unit (Figure 11).

MTM’s investigation of the wiring error revealed that although the electrical circuit diagrams were accurate, the technician carrying out the modification had made a cable connection error. Inspection of the X’Trapolis fleet indicated that 11 low-note whistles were wired incorrectly by the same technician. A function test would not reveal the wiring error, as pushing the low-note whistle button would complete the circuit to actuate the low-note whistle. In this instance, an assurance program involving a secondary and independent check of the wiring modification may have been the only means of detecting this error.

Figure 11: Electrical schematic showing incorrect wiring of low-note whistle

Source: Chief Investigator, Transport Safety (Vic)

Speed Interface Unit (SIU) design

The SIU converts the speed signal (0-20 mA) to a pulse train output to the VICERS unit. It provides isolation between the train circuits and VICERS unit. The negative of the SIU was connected to ground providing an electrical ground for the 24V system and the circuit path to actuate the uncoupling solenoid valve.

The safety loop circuit and uncoupling

The safety loop is a control circuit passing through each carriage within the trainset and is closed during operation under normal conditions. When the safety loop is opened due to an abnormal operating condition, the emergency brake solenoid valve is de-energised causing a maximum brake application.

In this instance, the uncoupling function was activated through an electrical circuit that was created by a wiring error in car 959M and the low IR of the uncouple solenoid of car 882M. This error resulted in the cab active relay, push button and the 3 km/h relay interlock devices being bypassed and allowing the unintended activation of the uncoupling circuit. The safety loop circuit on the lead car unit maintained the closed safety loop, hence emergency braking was not applied and it continued its journey until the driver realised that the trailing car unit had uncoupled, and brought the lead 3-car unit to a stop. As there were no active cabs in the trailing 3-car unit, the safety loop was opened, de-energising the emergency brake solenoid valves, resulting in the application of the emergency brakes on the trailing car unit bringing it to a stop.

__________

7. Megger tested at 250 V to ground.
8. The trip re-set solenoid located in the electro-pneumatic panel box enables the driver re-set the trip cock device (TCD) when the trip arm of the TCD is tripped by a train stop or track debris.
9. The trip-raise solenoid electro-pneumatic panel box enables the driver to raise trip arm of trip cock device from the cab. The trip arm of the TCD is required to stay raised on non-active motor cars.

The following findings are made with respect to the parting of a passenger train TD 3817 at Croydon, Victoria on 9 November 2018. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• A wiring error was made during a modification to the trains low-note whistle on car 959M.
• The wiring error was not detected by Metro Train Melbourne’s verification program. [Safety Issue]
• There was a deterioration of insulation resistance in the uncouple solenoid connector of car 882M.
• The connection between the negative and ground via the Speed Interface Unit provided a path that created the circuit to actuate the uncoupling solenoid valve.

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the rail industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Wiring error was not detected

Safety issue number: RO-2018-019-SI-01

Safety issue description: The wiring error was not detected by Metro Train Melbourne’s verification program.

Additional safety actions

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

MTM advised that it has implemented a program of mandatory insulation resistance testing of the uncoupling solenoid connectors. The information from the testing will be provided to the original equipment manufacturer in order to assist with determining the root cause for the failure and take appropriate remedial action.

MTM further advised that it is reviewing the scope for improving negative to ground testing during depot based scheduled maintenance and exploring a design for a system for monitoring common negative to ground potential.

Sources of information

The sources of information during the investigation included:

• Metro Trains Melbourne Pty Ltd.
• SNC-Lavallin Rail & Transit Pty Ltd.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

Submissions were received from Metro Trains Melbourne Pty Ltd and the Office of the National Rail Safety Regulator. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.