Collision between freight trains 7MP5 and 2K66, at Jumperkine, Western Australia, on 24 December 2019

Overview

On 23–24 December 2019, intermodal freight train 7MP5, operated by Pacific National, was travelling from West Kalgoorlie to Perth, Western Australia (Figure 1). At about 0200[2] on 24 December at Jumperkine, the train overran its limit of authority and passed signal 12L at stop. Train 7MP5 continued without authority for about 800 m further and collided with the rear of a loaded Watco grain train 2K66, which was stopped at Jumperkine. The locomotive cabin of 7MP5 was damaged and the driver of 7MP5 sustained fatal injuries.

After the collision, a third train, Pacific National train 3PM4, was permitted to enter Jumperkine on an adjacent track. Although this third train did not collide with the wreckage from the collision of 7MP5 and 2K66, there was a risk of a secondary collision.

Figure 1: Kalgoorlie to Perth Arc Infrastructure network geography

The image shows the location and place names of locations relevant to this accident.

Source: ARA Railways of Australia Map 2014, annotated by ATSB

Events prior to departure

Train 7MP5 departed Melbourne, Victoria, towards West Kalgoorlie on 21 December 2019 as a multi-rail traffic crewed (2-driver) operation. After arrival into West Kalgoorlie on 23 December, 7MP5 changed to a driver only operation (DOO).[3] This operating mode was intended for the rest of the train’s journey towards Perth, which included a driver change at West Merredin.

At about 0340 on 23 December 2019, the driver involved in this accident booked off duty and began rostered rest at the West Merredin drivers’ barracks. The driver’s next rostered shift was scheduled to commence at 2120 on the same day for a different train (7SP5). The driver was subsequently advised that their assigned service was changed to 7MP5 with the same rostered start time.

Train 7MP5 arrived at West Merredin at about 2057. The driver taking over the service commenced duty at 2120. At about 2200, the driver contacted Pacific National Integrated Planning Services (IPS)[4] to advise that they had been waiting for 40 minutes for 7MP5 and questioned why they had been booked on so early. The IPS operator confirmed that 7MP5 was waiting at West Merredin. The driver advised that they must have missed the arrival of the train and thanked the IPS operator before heading towards the train to undertake the driver change. Further details regarding conversations between the driver and IPS are provided in the Train driver section.

West Merredin to Jumperkine

Following the driver change, at about 2207, 7MP5 departed West Merredin for Perth. The track between West Merredin and Avon Yard was single line, with dual line extending after Avon Yard towards Perth.

Train 7MP5 undertook crossing movements[5] with an opposing train at Doodlakine, Bungulla, and Tammin prior to reaching Avon Yard (Figure 1). The last communication between the network control officer (NCO) and the driver of 7MP5 was to advise of the planned crossing movement at Tammin at about 2324, with 7MP5 completing the crossing movement and departing Tammin at about 2341. A crossing movement involved the driver of 7MP5 operating the train in response to restricted signal aspects.[6] The last time that 7MP5 was brought to a stop with restricted signals was at Tammin.

After Tammin, 7MP5 passed 33 consecutive signals displaying unrestricted clear (green) aspects on the up[7] main line prior to reaching Jumperkine. Throughout the journey, the driver controlled the train’s speed and acknowledged the vigilance system[8] alerts, as well as communicated for roll‑by inspections[9] with train services 7GP1, 2PM6, and 2PM9 that were passed on the dual line track after Avon Yard towards Jumperkine. The last roll-by communication was with 2PM9 at about 0147 on 24 December.

At about 0114, 2K66 (also travelling towards Perth) passed through Toodyay West (Figure 1), about 28 km ahead of 7MP5. Both trains continued their journey towards Perth. Train 3PM4, at about 0124, departed Perth towards Jumperkine in the opposite direction on the adjacent down main line.

At about 0134, as 7MP5 was approaching Moondyne and 2K66 was approaching Jumperkine (Figure 1), the NCO called the rail traffic crew of 2K66 on the open channel[10] train control radio system to advise that 2K66 would be brought to a stop on the main line at Jumperkine to allow for the passage of 3PM4 on the adjacent track.[11] The crew of 2K66 acknowledged and confirmed their understanding of this advice. The driver of train 3PM4 recalled overhearing this open-channel communication at about the time they were departing the Perth freight terminal.

The driver of 7MP5 commenced braking for a 20 km/h temporary speed restriction (TSR) at Moondyne at about 0137, reaching the target speed at about 0139. Train 7MP5 entered the start of the TSR at 0141 and commenced accelerating back towards the normal track speed (80 km/h) at about 0145, after the entire train had passed through the TSR.

Train 2K66 came to a stop at about 0148 on the approach to signal 4La displaying a stop (red) aspect at Jumperkine (Figure 2). At about this time, 7MP5 was about 14.5 km behind 2K66 and approaching Jumperkine. To protect 2K66 from 7MP5, signal U45 was displaying a caution (yellow)[12] aspect and signal 12L was displaying a stop (red, ‘at danger’) aspect. Train 2K66 was stopped with its last wagon about 800 m after (or west of) signal 12L.

Figure 2: Arc Infrastructure signal system layout at Jumperkine

This image shows the signal identifications and track configuration at Jumperkine relevant to the accident. Included are the location where 2K66 was stopped, the signal aspects displayed for 7MP5, and the location of 30 km/h TSR after signal 12L.

Source: Arc Infrastructure, annotated by ATSB

At about 0152:54, while the locomotive speed of 7MP5 was about 84 km/h (track speed limit 80 km/h), the driver placed the locomotive throttle to idle to reduce speed. At this time, the train was about 4 km away from signal U45. Train 7MP5 continued towards signal U45, without a need for the driver to undertake any control changes that would have reset the locomotive vigilance time count. The driver continued acknowledging the vigilance system alerts by pressing the vigilance acknowledgement pushbutton when necessary.

Signal passed at danger

At about 0156:10, 7MP5 passed signal U45 (displaying a caution aspect) and proceeded at about 75 km/h, below the track speed limit of 80 km/h, towards the next signal, 12L (displaying a stop aspect) (Figure 2).

Soon after passing signal U45, 7MP5 passed a temporary speed restriction (TSR) ahead sign,[13] warning of a 30 km/h speed restriction 2,500 m ahead. The driver continued acknowledging the vigilance system alerts, however they did not undertake any actions to prepare the train for the approaching TSR. At about 0159:05,[14] and 3 seconds before signal 12L was likely visible, the driver acknowledged a vigilance system alert (for the last time) using the vigilance acknowledgement pushbutton.

Train 7MP5 passed Jumperkine signal 12L (Figure 2) at about 0159:24, travelling at about 72 km/h (and unprepared for the 30 km/h TSR). As a result of passing the signal when it was displaying a stop aspect, a ‘signal passed at danger’ (SPAD) alarm was generated at about 0159:25 in the Arc Infrastructure network control centre.

Collision with train 2K66

At about 0159:27 (about 3 seconds after passing signal 12L at danger), 7MP5 passed the 30 km/h TSR start sign[15] travelling at about 72 km/h. At about 0159:30, after entering the TSR location, 7MP5 passed over a set of points (‘11 points’, Figure 2). As the locomotive of 7MP5 passed over the points, the locomotive’s forward-facing camera recorded a clunking sound consistent with the normal sound of locomotive wheels passing over the points. Shortly after this sound, the driver made a service brake[16] application (Figure 3).

Figure 3: Overview of Jumperkine accident site landmarks and braking information

The image shows the track curvature and geography of the Jumperkine accident site. This includes graphics showing about where 7MP5 service and emergency brake applications were made as well as the location of signal 12L and train 2K66.

Source: Google Earth and Pacific National, annotated by the ATSB

The train’s speed gradually reduced as it travelled around a sweeping left and then right curve before a straight section of track (Figure 3). The rear of 2K66 did not come into view in the night^‑time conditions until illuminated by the headlights of 7MP5 as the track straightened out (Figure 4). At this point (about 0200:00), the driver made an emergency brake[17] application (Figure 3). At this time, 7MP5 was travelling at about 59 km/h and was about 175 m from the rear of 2K66.

Figure 4: Forward-facing camera image from 7MP5

The image shows forward-facing vision from the lead locomotive of train 7MP5. The top image is about the time a line-of-sight opportunity existed to identify the rear of train 2K66. The bottom image is about the time that the headlights of train 7MP5 illuminated the rear of train 2K66 and shortly before the driver applied the emergency brake.

Source: Pacific National, annotated by the ATSB

At about 0200:07 (about 7 seconds after the emergency brake application and about 42 seconds after the SPAD alarm was generated in the network control centre), the Arc Infrastructure NCO commenced calling the driver of 7MP5 on the radio (stating ‘7MP5, control'). This initial call was about 5 seconds prior to the collision and the driver of 7MP5 never replied to this radio call or subsequent calls.[18]

At about 0200:12 (about 12 seconds after the emergency brake application), 7MP5 collided with the rear of 2K66 (Figure 5). Although the emergency brake application had decreased the train’s speed, the collision speed was about 41 km/h. The cabin of 7MP5’s lead locomotive (NR80) was damaged (Figure 5), and the driver sustained fatal injuries.

Damaged vehicles from 7MP5 and 2K66 came to rest away from the down main line track being used by 3PM4.

Figure 5: Accident site, lead locomotive of 7MP5 and last wagon of 2K66 post collision

The image shows damage to rolling stock from train 7MP5 and last wagon on train 2K66 post collision.

Source: Western Australia Police, annotated by the ATSB

Events post collision

At the time of the collision, the rail traffic crew of 2K66, unaware that 7MP5 had passed the signal directly behind them at stop, recalled that they felt a bump in their train. Although there was no direct alarm advising of a collision, the rail traffic crew did receive a train line (T/L) alarm.[19] In response to the T/L alarm, the crew observed that there had been no changes in the brake pipe pressures or flow rates of their train, and they began troubleshooting the alarm. One of the rail traffic crew went to inspect the trailing locomotive. Upon accessing the cab of the trailing locomotive, the crew member identified that a T/L alarm had also been generated without any other alarms that could assist their troubleshooting. The crew were confused by this information and discussed among themselves the possibility of a collision.

During this time the NCO, unaware of the collision, continued attempts to make contact with the driver of 7MP5. At about 0205:08, the NCO contacted the driver of 3PM4, which was approaching Jumperkine on the adjacent down track. The NCO, without advising that 7MP5 had passed a signal at stop, requested the driver of 3PM4 to get the attention of the driver of 7MP5 and request them to contact the NCO.

As 3PM4 entered Jumperkine, at about 0206:38, the rail traffic crew of 2K66 attempted to communicate to the driver of 3PM4 that something may have hit them from behind. However, this communication was not received or did not register with the driver of 3PM4.

At about 0207, as 3PM4 passed alongside 2K66, the driver of 3PM4 observed that 7MP5 had collided with the rear of 2K66. At about 0207:36, the driver of 3PM4 made an emergency call and reported the collision to the NCO.

Context

Network and infrastructure information

Track information

Arc Infrastructure was the rail infrastructure manager (RIM) for the rail infrastructure from West Kalgoorlie to Perth, including Jumperkine. The line is single bi-directional line between West Kalgoorlie and Avon Yard, where it changes to unidirectional double line towards Perth (including Jumperkine). The section of track between West Kalgoorlie and Perth forms part of the interstate main line.

The track through Jumperkine is mixed gauge comprising both standard gauge (1,435 mm) and narrow gauge (1,056 mm) using a common rail. Jumperkine contains a centre loop serviced by the up and down unidirectional double main line (Figure 6). The track consists of continuously welded rail secured to concrete sleepers by resilient fasteners and supported on ballast.

The up track between Avon Yard and Jumperkine (towards Perth) exhibits a mostly down gradient, varying between 1 in 3,875 and 1 in 210, with multiple left and right curves varying in radius between 400 m and 3,460 m.

The normal track speed approaching and through Jumperkine for a train configured like 7MP5 was 80 km/h. At the time of this accident, 2 additional temporary speed restrictions (TSRs) were in place on the approach to Jumperkine. These were both applied due to 2 separate track conditions that were being managed:

• A 20 km/h TSR was applied on 31 October 2019 to the track turnout at the western end of Moondyne (about 20 km prior to Jumperkine).
• A 30 km/h TSR was applied on 15 April 2019 to the track turnout at the eastern end of Jumperkine (Figure 6).

Figure 6: Jumperkine rail infrastructure layout

The image shows the track and signal infrastructure layout at Jumperkine, including the location of the TSR.

Source: Arc Infrastructure, annotated by the ATSB

Safeworking system

Safeworking systems are an integrated system of procedures and technology aimed at ensuring the safe operation and separation of rail traffic.

In May 2016, Brookfield Rail,[20] the predecessor to Arc Infrastructure, implemented the Network Safeworking Rules and Procedures as the safeworking system for its network. These network rules and procedures were aligned, with some variations, to the suite of Australian Network Rules and Procedures (ANRP). The ANRP was maintained and updated as required by the Rail Industry Safety Standards Board (RISSB) in collaboration with industry representatives.

The Arc Infrastructure Network Safeworking Rules and Procedures permitted 2 main safeworking methods:

• train order working (TOW) – where rail traffic crews are verbally advised of their proceed authorities and its limits by the network control officer (NCO).
• centralised traffic control system (CTC)[21] – where proceed authorities and their limits were communicated to rail traffic crews via line side signals, with some of these signals being controlled by the NCO from a centralised location.

The safeworking system in place between West Kalgoorlie and Jumperkine was CTC. The CTC system communicated proceed authorities, caution advice, and authority limits to rail traffic via coloured light signal aspects.

In the Arc Infrastructure CTC system context, local signal interlocking determined the exact signal to display based on the track occupancy status ahead for an intended train route. In addition, some of these signals required NCO input before they would display a proceed aspect. More specifically, the CTC system made use of 2 types of signals:

• controlled absolute signals – where the NCO, based in a central location, was required to request the signal clear to a proceed aspect before the local signal interlocking could arrange to display a proceed signal aspect. These signals were generally at yards and crossing loops where points and multiple routes existed.
• automatic absolute signals – where the NCO could not directly change the signal displayed, and whereby the signal would automatically clear to a proceed aspect as soon as the track occupancy status ahead was clear of other rail traffic. These signals were generally located in intermediate areas between crossing loops and prior to controlled absolute signals.

The Arc Infrastructure application of the CTC system was not equipped with any technical solutions or supervisory systems to prevent a train overrunning its authority, such as automatic train protection (ATP),[22] or to directly stop a train that had overrun its authority, such as automatic train stops.[23]

As discussed in the Signal passed at danger warning system section of this report, Arc Infrastructure’s network did include a signal passed at danger (SPAD) warning system, which provided an alarm to a network control officer (NCO) to alert them to a SPAD, and thereby the NCO could direct a rail traffic crew to stop a train.

At the time of the accident, the Arc Infrastructure risk register for managing SPAD or exceedance of limits of authority hazards identified the following controls:

• the accredited safety management systems[24] of rolling stock operators accessing its network
• SPAD incident investigations
• safety interface agreements with rolling stock operators accessing its network
• track access accreditation requirements for rail traffic crews operating on its network
• network safeworking rules and procedures
• track/signalling system design standards
• signal design principles (overlaps)[25]
• driver route knowledge (managed by rolling stock operators accessing its network)
• driver vigilance
• driver situational awareness (via open channel radio communications)
• NCO vigilance.

These controls placed a substantial reliance on a rolling stock operator’s safety management system, which includes train driver(s) observing signal aspects and controlling their train in compliance with the displayed signal aspect.

Signal information

Jumperkine signal arrangement

Rail traffic entering Jumperkine in the up direction was controlled by entry signal 12L (located at 41.738 km)[26] and its approach signal U45 (located at 45.935 km, or 4,197 m before signal 12L) (Figure 6). The TSR ahead sign was located about 1,430 m after signal U45 and the TSR start sign was located about 100 m after signal 12L.

Signal 12L was a controlled absolute colour light signal at the eastern up track entry into Jumperkine. The NCO operated this signal remotely from the Arc Infrastructure Metro Control Centre (see Safeworking system and Network control information sections for more information). Signal U45 was an automatic absolute colour light signal and was automatically controlled by the signal interlocking system in reaction to the status of signal 12L as well as the occupancy condition of the track section ahead.

Signals U45 and 12L were incandescent searchlight[27] style colour light signals, manufactured by McKenzie and Holland. This style of signal was capable of displaying green, yellow or red colour aspects. Generally, the term ‘proceed’ was associated with a signal displaying a clear (green) or caution (yellow) aspect, and the term ‘at stop’ or ‘at danger’ was used to refer to a signal displaying a stop (red) aspect (Figure 7). Caution (yellow) and stop (red) aspects were also collectively termed ‘restricted’ aspects, and clear (green) were collectively termed ‘unrestricted’ aspects.

Figure 7: Arc Infrastructure signal aspects

The image shows the colour light signal aspects and describes their intended communication to drivers.

Source: ATSB

A signal displaying a caution (yellow) aspect is advising the rail traffic crew that the next signal is displaying a stop or ‘at danger’ aspect. This notifies the rail traffic crew that their train must be brought to a stop prior to the next signal. Although the Arc Infrastructure Network Safeworking Rules and Procedures did not specify how close to a signal displaying an ‘at danger’ aspect a rail traffic crew must stop their train, Pacific National had specified a ‘hard and fast’ rule of 50 m within its SPAD Commandments document.

At the time of the accident, 2K66 occupied a track section directly ahead of Jumperkine signal 12L. As 7MP5 approached Jumperkine, the preceding signal U45 displayed a caution (yellow) aspect, and signal 12L displayed a red (stop) aspect. As such, the signalling system at Jumperkine operated as designed.

Signal sighting

The Arc Infrastructure signal sighting procedure specified the minimum time a signal shall be available for sighting by an approaching train was 8 seconds. For a train like 7MP5 travelling at 80 km/h, the track speed for this location, the signal must be visible on the approach from no less than 178 m.

The track approaching signal U45 at Jumperkine consists of a left curve which opens out into a straight section of track towards the signal. A review of the forward-facing camera footage from 7MP5 identified that signal U45, displaying a yellow caution aspect, came into view at about 400 m from behind foliage on the inside of the left curve (Figure 8). At track speed for freight train drivers (80 km/h), this provided about 18 seconds of signal sighting. The signal sighting for signal U45 was found to be compliant with Arc Infrastructure’s procedure for signal sighting.

Figure 8: Approach to signal U45

The image shows the track curvature towards signal U45 between Moondyne and Jumperkine, and an image of the first available sighting of signal U45 from 7MP5 (top left).

Source: Pacific National, and Google Earth, annotated by the ATSB

The speed of 7MP5 on the approach to signal U45 was about 76 km/h, providing about 19 seconds of sighting of the caution aspect prior to passing the signal. The ATSB did not identify any environmental factors that could have affected the driver’s ability to sight signal U45.

The track approaching signal 12L at Jumperkine consists of a left curve followed by a right curve. A review of the forward-facing camera footage from 7MP5 identified that signal 12L, displaying a red stop aspect, came into view at about 340 m from behind foliage on the inside of the right curve (Figure 9). At track speed for freight train drivers, this provided about 15 seconds of signal sighting. The signal sighting for signal 12L was found to be compliant with Arc Infrastructure’s procedure for signal sighting.

The speed of 7MP5 on the approach to signal 12L was about 72 km/h, providing about 17 seconds of sighting of the stop aspect prior to passing the signal. If 7MP5 had approached signal 12L compliant with the 30 km/h TSR, about 41 seconds of sighting would have been provided. The ATSB did not identify any environmental factors that could have affected the ability to sight signal 12L.

Figure 9: Approach to signal 12L

The image shows the track curvature towards controlled absolute signal 12L at Jumperkine, and an image of the first available sighting of signal 12L from 7MP5 (bottom right).

Source: Pacific National, and Google Earth, annotated by the ATSB

Signal 12L SPAD history

The ATSB requested the SPAD records for Jumperkine signal 12L from Arc Infrastructure. A review of these records identified 5 SPAD events during 2010–2012, with none prior to or after this time. The records for the 5 SPAD events noted that the majority were outside of the drivers’ control and related to the signal restoring as the train approached, with only one being likely related to driver anticipation. There were no records of any driver completely missed[28] SPADs.

The signal interlocking data[29] was analysed for the month preceding the accident. This sample of about 336 rail traffic movements through Jumperkine identified that about 98% of trains approached signal 12L at Jumperkine displaying a proceed aspect.

Communications systems

Arc Infrastructure utilised an ultra-high frequency (UHF) radio system for communications on its network between Kalgoorlie and Perth. The UHF radio system incorporated channels that were assigned to different network control areas as well as channels available for local communications.

The local communications channels were generally not monitored by NCOs. These channels were intended for local communications that did not require the NCO, such as between different rail traffic crews during roll-by inspections as well as between rail traffic crews and track maintenance workers.

The network control channels were monitored by the NCO assigned to that geographic portion of the rail network. These channels were designed to be open channel (‘party-line’)[30] communication systems so rail traffic crews and track maintenance workers could hear communications not directed to them and maintain awareness of activities close to their area of operation. Further information about NCO communications is provided in Communication protocols.

Environmental conditions

Information obtained from the Bureau of Meteorology (BoM) established that the weather near Jumperkine was clear in the period leading up to the accident, and there was no recorded rainfall.

Sunrise was at 0508 with astronomical twilight[31] commencing at 0328 and civil twilight[32] commencing at 0440. Moonrise in the waning crescent phase[33] was at about 0324, providing no reflected or natural light at Jumperkine at the time of the accident. The location of the accident, within the Walyunga National Park, meant there was no artificial lighting in the vicinity. As such, all information indicated it was dark at the time of the accident (Figure 10).

Figure 10: Train 7MP5 view of Jumperkine signal 12L

The image shows available lighting and environmental collisions at first sighting opportunity of Jumperkine signal 12L.

Source: Pacific National, annotated by the ATSB

Train information

Train 7MP5

General information

Train 7MP5 was a standard gauge Pacific National intermodal[34] freight service between Melbourne, Victoria and Perth, Western Australia. The train was 1,070 m in length, consisting of 2 NR class locomotives with 25 single and multi-platform wagons, and had a total weight of 1,958 t. A driver only operation (DOO) was in use for 7MP5 between West Kalgoorlie and Perth (Figure 1).

Train 7MP5 locomotives

The 2 locomotives hauling 7MP5, NR80 and NR59, entered service in 1997. The NR class locomotives were a standard gauge Cv40-9i model diesel electric locomotive manufactured by A. Goninan & Co Limited.

The in-cab communication equipment (ICE) radio fitted to the locomotives transmitted and received all selected frequencies within the locomotive cab. The driver’s last communication with an NCO via radio on the open-channel frequency occurred at about 2324, and no problems were noted with this communication. The driver’s last known communication with another rail traffic crew via radio on a local frequency (during a roll-by inspection) occurred at about 0147. The driver was required to maintain a listening watch of the open-channel frequency while operating the train. The volume setting of the radio in the cab at the time of the collision could not be determined.

The NR class locomotives were fitted with an event recorder and a forward-facing camera. The microphone for the forward-facing camera was installed with the braking system pneumatic control rack. Information from the event recorder and forward-facing camera from the train’s locomotives have been included in the report where relevant.

The locomotives of 7MP5 were not fitted with in-cab voice or video recording devices, nor was it required.

Refer to the Locomotive vigilance system information section for information on the vigilance system fitted to the lead locomotive of 7MP5.

Train 7MP5 braking system response

In regard to the braking system responses required for rolling stock operators accessing the Arc Infrastructure network, Arc Infrastructure general operating instructions specified that:

The average gradient within the Jumperkine crossing loop (40 km to 41.7 km) was calculated to be about 1 in 340, a much flatter section of track than the 1 in 150 gradient specified by Arc Infrastructure.

Pacific National’s trains such as 7MP5 that travelled from Melbourne to Perth had to comply with the requirements of other rail infrastructure managers, including that of the Australian Rail Traffic Corporation (ARTC). In order to meet these requirements, a train such as 7MP5 on a relatively level gradient needed to meet the braking system response requirements outlined in Figure 11.

Figure 11: ARTC minimum full service braking requirement for train type MLF-115[35]  

The image shows the minimum requirements for train brake performance on the ARTC rail network as specified for operations of trains closest to the mass and length of 7MP5.

Source: Graphed by ATSB from data contained within Draft Code of Practice for the DIRN – Volume 5: Rollingstock, Appendix A

Both Arc Infrastructure’s requirements and ARTC’s requirements contemplated a full service brake application rather than an emergency braking application. Event recorder data on 7MP5’s emergency braking system response prior to the collision was limited to a relatively small sample period (that is, recorded speed for about 11 seconds sampled once a second). Analysis of this data indicated that the train’s braking performance was better than that specified by both the Arc Infrastructure and ARTC requirements. However, there was insufficient data to reliably predict the full braking performance of the train had the collision not occurred.

Event recorder data showed that a service brake application was made when the train was approximately 720 m from the point of collision (at about 0159:30). In addition, an emergency brake application occurred about 167 m prior to the collision (at about 0200:00), when the train was travelling at about 58 km/h. If the train had been travelling at 30 km/h in compliance with the temporary speed restriction (TSR) when the emergency brake was applied, it was likely that the train would have avoided the collision or the speed of impact would have been significantly reduced.

The ATSB considered the effect on the consequence of this accident had the emergency brake been initiated earlier at key events. Noting the limitation of assumptions made,[36] it was estimated that the train’s emergency braking distance when travelling at about 72 km/h (the speed prior to the service brake application) was about 516 m. More specifically:

• The distance from the first available sighting of signal 12L to the rear of 2K66 was about 1,200 m. The signal first became visible at about 0159:08 and the train was travelling at about 72 km/h. Had the emergency brake been applied immediately after this point, the train would very likely have stopped prior to colliding with the rear of 2K66.
• The distance from signal 12L to the rear of 2K66 was about 800 m. The train passed the signal at 0159:24 and the train speed was at about 72 km/h. Had the emergency brake been applied immediately after this point, the train would likely have stopped prior to colliding with the rear of 2K66.
• The distance between the 11 points and the rear of 2K66 was about 715 m. The train passed over the points at 0159:30 at a speed of about 72 km/h. Had the emergency brake been initiated immediately after this point, the train would likely have stopped before colliding with the rear of 2K66 or the speed of impact would have been significantly reduced.

Lead locomotive NR80 and trailing locomotive NR59 braking systems were inspected and tested post-accident. There were no anomalies identified from these inspections and tests that were found to have contributed to this accident.

For more explanation of train braking systems, refer to Appendix A – Train Braking Systems

Train 2K66

General information

Train 2K66 was a narrow gauge Watco bulk grain service between Koorda and Perth, Western Australia (Figure 1). The train’s length was 793 m and weight was 3,900 t. The train consisted of lead locomotive CBH10, trailing locomotive CBH04, and 52 CBHN class grain wagons. It was operated by a 2-person rail traffic crew.

Train 2K66 locomotives

The locomotives hauling 2K66, CBH10 and CBH04 entered service in 2012. These CBH class locomotives were a narrow gauge MP27CN model diesel electric locomotive manufactured by MotivePower Inc.

The CBH class locomotive was fitted with an event recorder and a forward-facing camera. The microphone for the forward-facing camera was installed within the driver’s cabin.

CBH class locomotives were fitted with a Q-Tron QES-III control system. The QES-III control system, among other tasks, monitored the locomotive’s operating parameters to ensure all systems were operating normally. In the event that the QES-III control system identified a potential abnormality or problem, it would, depending on the severity, generate either a message or alarm. These messages or alarms were then displayed to the driver on the computer display unit (CDU), located within the driver’s console. The locomotive’s CDU also displayed other operational parameters, such as locomotive speed, fuel levels, braking system pressures and flow rates, traction currents, and other operational measurements.

Train line fault alarm

One alarm included on the CDU was a train line (T/L) Alarm. This alarm is generated when a locomotive in the consist had at least one alarm active on its CDU.

At the time of the collision, a T/L alarm was generated on the CDU of lead locomotive CBH10, indicating to the rail traffic crew that the trailing locomotive had an alarm. The same alarm in trailing locomotive CBH04 was also found by the rail traffic crew to be active. However, the T/L alarm in the trailing locomotive was not accompanied by any other alarms to assist the rail traffic crew with diagnosis. This unexpected alarm response, coupled with being unaware of the overrun of authority limits by 7MP5, likely confounded the 2K66 rail traffic crew’s assessment as to what had happened.

Locomotive flow meter

One of the operational parameters the locomotive CDU displayed was the brake pipe flow rate. The brake pipe flow rate was a measurement of the air flow from the locomotive main air reservoir into the brake pipe. This measurement provided an indication of when and at what rate the train’s brake pipe was charged or attempting to be charged by the locomotive.

The brake pipe air flow measurement can provide warning that the brake pipe pressure has been affected, indicative of a leak or broken / ruptured brake pipe in the train, potentially related to a train separation, derailment, or collision.

Train 2K66 braking system response

At the time of the collision, 2K66 had a brake pipe pressure of about 331 kPa, when stopped at Jumperkine. This was consistent with the train’s automatic brake being fully applied. During and after the collision, the rail traffic crew did not detect a change in brake pipe pressure or brake pipe air flows, and none were identified in the locomotives’ event recorder data.

The ATSB determined that the brake pipe within the last wagon of 2K66 was likely crushed and sealed by the impact of 7MP5. Although there may have been some initial loss of brake pipe air pressure at the rear or the train, it was not significant enough to be recorded at the locomotives.

Train 2K66 visibility

The Arc Infrastructure Network Safeworking Rules and Procedures – Rail Traffic Lights and Markers, Rule Number 4005, described the lighting and marker requirements for the front and rear of trains operating within its network. Consistent with Rail Industry Safety Standards Board (RISSB) standards AS7531 Rolling Stock Standard – Lighting and Visibility, and AS7503.6 Rolling Stock Standard – Train Identification and Integrity, the Arc Infrastructure document required the rear of rail traffic to be identified by an end-of-train marker.

In normal main line train operations, the main purpose of the end-of-train marker was to enable a rail traffic crew to confirm that a train is complete. That is, a rail traffic crew undertaking examination of their train, or a roll-by examination of a passing train, could confirm that the last wagon/rail vehicle was fitted with an end-of-train marker, enabling a conclusion that the train being examined was complete. Due to the significant differences in braking performance between rail traffic and road traffic, the end-of-train marker should not be considered as a tail-light in the road traffic sense.

The Arc Infrastructure rule number 4005 required the end-of-train marker to be one or more clearly visible, steady or flashing red lights. In line with these requirements, the rear of 2K66 was fitted with an end-of-train marker that consisted of a white disk with 2 independently flashing red LED[37] marker lights. However, at the time of the collision, neither of the flashing red LED marker lights on 2K66 were operational (illuminated) as required for night operations.

The ATSB considered the effect that the non-operational end-of-train marker of 2K66 had on the accident. It is possible that, had the end-of-train marker been operational, the driver of 7MP5 may have identified a stopped train ahead earlier. However, due to the accident happening at night, coupled with the track curvature approaching the stopped train and multiple adjacent tracks (that the stopped train could have been perceived to be on), it is possible that the optical effects may not have enabled the driver to immediately identify the stopped train as being in their path. That is, after passing through the curve, and as the track straightened out, the driver may not have been able to identify that the stopped train was in their path until their headlights illuminated its rear wagon. This was about the same time that the emergency brake was recorded as being applied in this accident.

Train 3PM4

General information

Train 3PM4 was a standard gauge Pacific National intermodal freight service between Perth and Melbourne. The train was 691 m in length, consisting of 2 NR class locomotives with 36 single and multi-platform wagons, and had a total weight of 1,078 t. A DOO was in use for 3PM4 between Perth and West Kalgoorlie.

Site and wreckage information 

Location

The accident occurred on the Arc Infrastructure network at Jumperkine, approximately 40 track kilometres east from Perth (Figure 1).

The damage to rail infrastructure was reported as minor, with environmental damage limited to grain spill and some diesel from 7MP5. The rolling stock damage was more significant and is described in the following sections.

Train 7MP5 damage and injuries

The resulting forces of the collision involving the lead locomotive (NR80) of 7MP5 and the rear of 2K66 did not compromise the survivable space available to the driver. However, the cabin of the locomotive was damaged, with a large amount of grain from the ruptured rear wagon of 2K66 entering the cabin (Figure 12).

Figure 12: Grain ingress to lead locomotive NR80 of 7MP5

The image shows accident site wreckage of train 7MP5 and train 2K66, including ingress of grain to the lead locomotive (NR80) of 7MP5.

Source: ATSB

The driver was found on the floor of the locomotive near the observer’s seat position on the non‑driving side of the cabin. The post-mortem examination concluded that the fatal injury to the driver was asphyxiation as a result of the locomotive cabin being filled with grain.

Analysis of the wreckage identified that the lead locomotive (NR80) brake handle was in the emergency position.

The rapid deceleration of the front of the train, coupled with the momentum of the trailing portion of the train, caused the trailing locomotive (NR59), empty crew van RZAY00283C, and loaded intermodal freight wagons RQGY34999Y and RRYY00037R to be derailed and substantially damaged. Likely due to the curvature of the track at the point of collision, the crew van and freight wagon debris came to rest on the southern side of the track, clear of the main line that 3PM4 was pathed towards (Figure 13).

Train 2K66 damage

The last grain wagon CBHN1221 of 2K66 was ruptured and substantially damaged. This last wagon was lifted from the trailing end during the collision with 7MP5. The collision also caused some minor damage to the trailing end of the penultimate grain wagon CBHN1172, when the 2 wagons came into contact above their couplers.

Train 3PM4 damage

The debris from the collision did not obstruct the path of 3PM4 on the down main line. As such, this train was not damaged (Figure 13).

Figure 13: Jumperkine accident site (overhead view)

The image shows the site and wreckage layout at Jumperkine.

Source: Western Australia Police, annotated by the ATSB

Network control information

Traffic control system

Jumperkine was in Arc Infrastructure’s eastern network control area, which encompassed Avon Yard to Canning Vale (Figure 1). The network control officer (NCO) responsible for this area was located at the Arc Infrastructure Metro Control Centre located at Midland (in Perth) and operated the CTC system using the proprietary Phoenix computer-based traffic control system (TCS). The TCS presented the track layout in a plan view on a series of contiguous display monitors (Figure 14), with numerous real time indications displayed for the information of the NCO. These indications included the location of trains, train identification information, points, signals, and some types of alarms.

Additionally, the TCS provided the NCO with several assistive features. One is the option of applying the fleeting feature to controlled absolute signals. When fleeting was applied to a controlled absolute signal (such as signal 12 L), the TCS automatically, as soon as the route ahead of the signal was available, issued the request to the interlocking to clear the fleeted signal. This essentially changed a controlled absolute signal into an automatic absolute signal, until the fleeting feature was removed. At the time of the accident, the TCS fleeting feature had been applied to signal 12L at Jumperkine.

The NCO, by operating the TCS system, was able to safely route rail traffic over a wide area of railway, aided by the signal interlocking safeguards built into the system. These signal interlocking safeguards were designed to keep safe separation between trains.  

Signal passed at danger warning system

The TCS system was equipped to provide a reactive warning after a train passed a signal displaying a stop aspect (that is, a signal passed at danger or SPAD). This warning, known as a SPAD alarm, consisted of an audible alert accompanied with a visual dialog box that appeared on the NCO’s TCS screen (Figure 14). The dialog box typically included information about the train’s identification number, and the location and number of the signal.

The SPAD visual dialog box was not diagnostic about the type of SPAD or extent of exceedance. The visual dialogue box remained until the SPAD reason (from a set list) and an optional comment was recorded by the NCO and then the dialogue box was acknowledged. If a SPAD alarm was not attended to, the visual dialogue box would remain displayed and the auditory alert would remain on. 

The ability of this reactive warning to contribute to the prevention of a more serious consequence (such as a collision) was reliant on how much time the NCO and train driver had before the train that had overrun its limit of authority reached a point of conflict.

Figure 14: TCS SPAD warning

The image shows a portion of the track layout including Jumperkine, and an inset image of the SPAD warning dialog box like that provided by the Phoenix TCS system.

Source: Arc Infrastructure, annotated by the ATSB

A SPAD alarm could be triggered for legitimate reasons, ranging from a rail traffic crew starting their trains and moving against a signal, to completely missing the signal while travelling at track speed, as was the case for the 24 December 2019 accident at Jumperkine. However, false SPAD alarms could also be triggered for normal operational reasons, such as for rail traffic that had been verbally authorised past a signal at stop and track/signal maintenance works, or due to signal system faults or telemetry system faults. Consequently, following the receipt of a SPAD alarm, an NCO in response would typically need to determine whether it was a legitimate SPAD alarm or a falsely triggered SPAD alarm. This assessment would likely involve the NCO undertaking various checks to eliminate the falsely triggered alarm sources, such as confirming that the SPAD alarm was not:

• due to the NCO themselves verbally authorising the train to pass a signal at stop
• a signal system fault, such as a track fault or loss of communications with the field equipment
• related to a signal system power supply outage
• triggered by maintenance works
• due to an unknown/not obvious reason (not associated with a legitimate train movement).

After an NCO has confirmed that a falsely triggered SPAD was unlikely, they would typically treat the SPAD as a legitimate SPAD. This requires the NCO to action their responsibilities within the Arc Infrastructure Network Safeworking Rules and Procedures – Overrun of Limit of Authority, Rule Number 6001, to deal with the matter.

The TCS did not provide a specific alarm or warning related to a collision.

Rules for responding to a signal passed at danger

The Arc Infrastructure Network Safeworking Rules and Procedures – Overrun of Limit of Authority, Rule Number 6001, defined the operational process for managing rail traffic that had overrun its limits of authority. An overrun of a limit of authority was defined as occurring when rail traffic, without authority:

• passed a signal at STOP (SPAD)
• passed a sign that shows limit of authority
• overran the limit of an occupancy authority
• entered a block without the correct authority.

Arc Infrastructure’s rule 6001 was sourced from the Australian Network Rules and Procedures (ANRP) rule 6001. Both versions assigned responsibilities or required actions to the rail traffic crews and NCOs in relation an overrun of a limit of authority. Although the ANRP and Arc Infrastructure versions of rule 6001 made the responsibilities of the rail traffic crew and NCO mandatory, the Arc Infrastructure version did not require the immediate actioning of NCO responsibilities. The comparison of these responsibilities (with the key difference underlined) is described in Table 1.

Table 1: Rule 6001, NCO and Rail traffic crew responsibilities

Role	Arc Rule 6001 responsibilities	ANRP Rule 6001 responsibilities
Rail traffic crew	Rail traffic crews that have overrun a limit of authority must immediately: stop their rail traffic, and broadcast an emergency radio call where the rail traffic crew believes there is an immediate danger, and take action to prevent a collision with other rail traffic, and report overrun to NCO.	Rail traffic crews that have overrun a limit of authority must immediately: stop their rail traffic, and broadcast an emergency radio call, and take action to prevent a collision with other rail traffic, and report overrun to NCO.
Network control officer	The NCO must: arrange to stop rail traffic that has overrun its limit of authority and has not stopped, and arrange to stop other rail traffic movements that are at risk, and notify protection officers at affected worksites, and notify affected rail traffic crew to await further instructions, and determine the method of working to be used to clear rail traffic, and report overrun to network rail operations manager, and report overrun to rolling stock operator’s representative, and report overrun to other affected NCOs.	The NCO must immediately: arrange to stop rail traffic that has overrun its limit of authority and has not stopped, and arrange to stop and prevent other movements that are at risk, and notify protection officers at affected worksites, and notify affected rail traffic crew to await further instructions, and determine the method of working to be used to clear rail traffic, and report overrun to rail infrastructure manager’s representative, and report overrun to rolling stock operator’s representative; and if a controlled absolute signal has been passed, tell other affected NCO’s.

Common to both the Arc Infrastructure and the source ANRP rule 6001, there was no requirement for the NCO to broadcast an emergency call, either to rail traffic that had overrun its limit of authority or to ‘at risk’ trains when another nearby train had overrun its limit of authority. This responsibility was only assigned to the rail traffic crew.

The Arc Infrastructure risk register had also not specifically identified or considered the immediacy of NCO responses to a SPAD alarm as a potential risk mitigation for a collision. In addition, Arc Infrastructure had also not specified its performance criteria for NCO responses to SPAD alarms or had any system in place to monitor this performance.

The ATSB explored the NCO response times to SPAD alarms for completely missed SPADs, with the response time defined as the time between the SPAD alarm and a radio communication to the rail traffic crew regarding the SPAD (Figure 15). The response time taken by the NCO for the 24 December 2019 SPAD event at Jumperkine was about 42 seconds. Due to the limited availability of historical recordings[38] to confirm the SPAD alarm response times, only a small sample size (3 samples, including the Jumperkine accident) for Arc Infrastructure was obtained. The other 2 events had similar NCO response times to the Jumperkine accident. In all 3 of these events involving Arc Infrastructure, the NCO’s initial call to the train that had overrun its limit of authority was not an emergency call.

To provide comparison and increase the sample size, the review was extended to include another freight-based rail infrastructure manager’s network that used similar technology to trigger SPAD alarms. Almost all (16) of these 18 events involved response times of more than 30 seconds. The overall median response time for the 18 events on both networks (including the Jumperkine event) was 91 seconds. The timeliness with which NCOs had assessed the situation and determined collision risk potential prior to communicating with rail traffic crews in most of the events could not be determined.

Figure 15: NCO response comparison for completely missed SPAD

The image shows a comparison of NCO responses to completely missed SPADs for both Arc Infrastructure and a similar operation managed by another rail infrastructure manager.

Source: ATSB

The ATSB has investigated several occurrences involving SPAD events in recent years on different rail networks where the NCO provided an emergency call to the rail traffic crew of the train that overran its limit of authority and/or other rail traffic at risk. Examples include RO‑2013‑003 and RO-2021-007 involving freight trains and several RO-2017-010, RO-2017-012, RO-2017-015, RO-2018-001, RO-2018-002, RO-2019-009 and RO-2020-019 involving suburban passenger trains. NCO response times were provided in 4 of these reports (including for the 2 freight trains), ranging from 6 to 17 seconds with a median time of 9 seconds.

Network control officer responsibilities

Network control officers (NCOs) were responsible for the productivity, safety, and record keeping of rail operations within their assigned geographic area of the Arc Infrastructure network. These responsibilities were broken down into broad tasks, as shown in Table 2.Table 2.

Table 2: Network control officer (NCO) tasks

NCO Responsibility	NCO Tasks
Productivity	Plan, set priorities for, and manage the rail traffic and network availability to efficiently meet business and customer requirements. This includes: issuance of movement authorities to rail traffic crews verbally via train order working safeworking systems, or via control of the CTC safeworking system applying prioritisation decision making in line with guidelines ensuring train consist information is correct, taking action to correct or report any incorrect train consist information monitor rail traffic and seek advice from rail traffic crews in regards to any time lost on scheduled run times monitor maintenance activities and seek advice from protection officers in regard to any delays related to scheduled hand back of work site possessions maintaining and frequently updating anticipated rail traffic paths in relation to the progress of rail traffic currently operating, or anticipated to enter the network initiating frequent advice of anticipated rail traffic arrival times to neighbouring control areas, rail infrastructure managers, and customers.
Safety	Ensure safe passage of rail traffic, and protection requested by rail safety workers is applied. This includes: application of protection for track side rail safety workers, via train order working safeworking processes or with the application of blocks using the CTC safeworking system reporting and responding to all actual and suspected safety breaches reporting and responding to any failures, or emergencies reporting and responding to any incidents / accidents assisting with any testing of infrastructure equipment or facilities receiving maintenance attention reporting and responding to rail traffic crews reporting fatigue to enable them to be brought to a stop reporting signal failures/irregularities by verbally advising rail traffic crews and maintenance representatives communicating with customers regarding any safety breaches, incidents, accidents or emergencies involving their rail traffic and rail traffic crews applying processes to ensure completion of safety critical tasks prior to commencing a new task reporting and communicating to rail traffic crews conditions affecting the network (e.g. temporary speed restrictions, level crossing equipment faults or deactivations) obtain permission from neighbouring rail infrastructure managers and/or network control officers before authorising rail traffic to proceed to an area controlled by another NCO taking action to slow down or reduce workload if the NCO believes fatigue or workloads are compromising their ability to make safe decisions.
Record Keeping	Maintain records and details of all protection applied, and details of rail traffic moving over the assigned network area. This includes recording: the progress of each rail traffic movement track closures, track out-of-service and conditions affecting the network works for maintenance of track, communications, signalling and other infrastructure as necessary for the network rail traffic crew names train consist information, including any changes consistent and detailed recording of information for the purpose of hand over to NCOs on subsequent shifts signal failures/irregularities requiring repair rail traffic delays to scheduled running, and/or delays in track possession hand back safety breaches, incidents / accidents, and emergencies.

An NCO will typically prioritise these tasks to ensure that safety-critical tasks are conducted completely and correctly. At times, NCOs may employ tactics like not starting a new task until all safety-critical steps of the current task are complete. For example, an NCO may complete application of controlled signal blocking,[39] and annotating the train control diagrams,[40] before issuing authorities to rail traffic or workers on track. As such, an NCO’s response to new tasks or train control system alarms is largely dependent on what other tasks are underway, and the level of operational activity the NCO is exposed to at that time.

Communication protocols

The protocols for communication between Arc Infrastructure NCOs and rail traffic crews were described in the Arc Infrastructure Network Safeworking Rules and Procedures – Network Communications, Rule Number 2007. These protocols included the following requirements for open-channel communication:

• communication must identify the receiver, such as by identifying the train number
• the sender must not assume a message has been understood unless the receiver confirms it has been understood.

NCOs at times provided supplementary advice to rail traffic that they were approaching a location where they would be required to stop. However, this supplementary advice was provided as a courtesy as there was no mandatory requirement for its provision. As such, the overall system was reliant on rail traffic crews observing the displayed signal aspects and operating their trains accordingly.

At 0134 on 24 December, the NCO made an open-channel communication to provide supplemental advice to the rail traffic crew of 2K66. This communication identified 2K66 as the recipient of the advice, and the crew acknowledged that they understood they would be stopping at Jumperkine. The driver of 7MP5 did not acknowledge having overheard this communication, and nor was there any requirement for them to do so.

Emergency communication protocols

The Arc Infrastructure emergency communication protocols were also described within Arc Infrastructure Network Safeworking Rules and Procedures – Network Communications, Rule Number 2007. These protocols required that emergency communications:

• had to start with ‘Emergency, Emergency, Emergency, this is…(reporter’s identification)’
• when answered, the reporter had to provide details of the emergency and advice on whether emergency services are required
• if not answered, the reporter had to repeat the emergency communication until answered
• had to be given priority
• had to be answered immediately by the intended recipient
• if on an open-channel radio, other channel users had to stop transmission immediately if there was an emergency message being communicated.

In respect to an overrun of limits of authority or SPAD, the Arc Infrastructure Network Safeworking Rules and Procedures – Overrun of Limit of Authority, Rule Number 6001 specified a requirement for an emergency communication (see Rules for responding to a signal passed at danger). The execution of this responsibility was assigned to the rail traffic crew; it did not also state a requirement for the NCO to initiate an emergency communication upon the receipt of a SPAD alarm. The NCO’s responsibilities following receipt of a SPAD alarm were limited to making contact with the rail traffic crew, and directing the rail traffic that had overrun its limit of authority to stop if they had not already stopped.

Network Control Officer information

The NCO responsible for the eastern control area at the time of the accident commenced their employment as an NCO with Arc Infrastructure’s predecessor (Brookfield Rail) in 2010. Personnel records showed that the NCO was awarded a certificate of competency for the eastern train control console in June 2010, and completed a certificate IV in rail network control (TLI42211) in February 2015.

Arc Infrastructure procedures required regular on-the-job observations[41] to assess compliance with the general responsibilities of a network controller procedure. On the job observations of the NCO involved in this accident, conducted in 2017, 2018 and 2019, did not identify any non‑compliances with the general responsibilities or functions of an NCO.

The NCO’s most recent rail safety worker health assessment (category 1) was on 29 January 2019, which found the NCO was fit for duty based on the standards described in the National Standards for Health Assessment of Rail Safety Workers. At interview, the NCO reported being in good health.

The Office of the National Rail Safety Regulator (ONRSR) organised for a post-accident drug and alcohol test of the NCO, which produced negative results (that is, no drugs or alcohol detected).

The NCO worked a rotating shift pattern, which included alternating sequences of 12-hour night shifts (1800-0600) and day shifts (0600-1800), followed by 3–5 days off. NCOs worked only day shifts in one sequence, and only night shifts in the alternating sequences. The NCO recalled that shift patterns varied between 3 and 5 shifts in length.

On the evening of the accident, the NCO was on their second consecutive night shift, having started at 1800. At the time of the accident, the NCO had been at work for about 8 hours.

ARC infrastructure advised that, at the time of the accident, NCOs were permitted to take rest breaks when required and that NCOs managed their own breaks to ensure the risk of fatigue was mitigated. ARC did not have records of the timing of rest breaks taken by NCOs.

When interviewed by the ATSB, the NCO stated that they were well rested prior to signing on for duty at 1800 on 24 December 2019 and they could not recall feeling tired on the evening of the accident. They recalled that it was a normal night shift, and that they were not particularly busy.

Network control officer actions

At the time that 7MP5 passed Jumperkine signal 12L at stop, the NCO was operating the CTC system for about 6 main line trains within their area of responsibility. The NCO recalled it being a normal work night without any signal faults or failures to manage, and that they did not feel busy or overwhelmed.

The Arc Infrastructure train control system (TCS) events log indicated that the NCO set a route for an unrelated shunt movement at about 0158:58, with an unrelated[42] ‘unknown train’ message generated at 0159:21. After this unrelated ‘unknown train’ message, at about 0159:25, the TCS events log recorded that a SPAD alarm was generated after 7MP5 passed Jumperkine signal 12L at stop.

There was no recorded data available to confirm the exact time that the SPAD alarm dialog box was displayed to the NCO, or in other words, that the TCS event log matched what was displayed to the NCO. The ATSB initiated a series of tests post-accident to determine the typical time taken from a SPAD event until the SPAD alarm dialog box displayed on the NCO’s TCS screen. These tests found the that the dialog box consistently displayed about 2 seconds after a SPAD was simulated at Jumperkine. As such, it is likely that at the time of this accident the SPAD alarm dialog box was displayed to the NCO in a similar timeframe.

The NCO recalled looking at the TCS screen when the SPAD alarm appeared. The NCO did not recall any tasks being undertaken that delayed their response and recalled trying to contact the driver of 7MP5 soon after observing the SPAD alarm. As previously noted, Arc Infrastructure had no explicit requirement for NCOs to take immediate action after a SPAD alarm.

Locomotive vigilance system information

Overview

Locomotive vigilance systems are safety devices that monitor the activity of train drivers and apply the train’s brakes (penalty brake application) if there is no activity detected in a specified period. The basic design of a vigilance system is a timed cycle of alerts consisting of an initial visual alert via a warning light, followed soon after by the addition of an audible alert. If neither alert is acknowledged by the driver via the vigilance acknowledgement pushbutton (Figure 16), the system initiates a penalty brake application, causing the train to stop. Thus, to continue movement and avoid the locomotive making a penalty brake application, the driver must press the vigilance acknowledgement pushbutton according to the vigilance system cycle alerts.

Modifications to the basic design include activity-based systems (also called task-linked systems) that also reset the vigilance system cycle whenever the driver interacts with the locomotive controls (such as braking and throttle changes). Other vigilance systems use a random-timing vigilance cycle, or a vigilance cycle where the interval between alerts decreases with faster train speeds.

Vigilance systems at Pacific National

The Pacific National Locomotive Vigilance Control Systems procedure stated that vigilance control systems were:

This procedure, dated April 2009, also stated that most Pacific National locomotives were fitted with random-timing vigilance systems, and that the intention was to ensure all locomotives were fitted with random-cycle systems.

Pacific National’s safety management system listed vigilance systems as one of multiple risk controls for managing a compromise to train driver performance by fatigue, drugs and alcohol, and/or medical conditions. In the case of driver only operations (DOO), the safety management system listed vigilance systems as providing additional mitigation for these hazards due to a shorter vigilance alerting cycle (compared to the cycle used for other train operations).

Vigilance control system on board NR class locomotives

The vigilance system fitted to NR class locomotives (such as that fitted to lead locomotive NR80 of 7MP5) was an activity-based, fixed-cycle system. Various activity parameters were monitored to reset the vigilance system timer.

The rail traffic crew interface to the vigilance system fitted to the NR class locomotive included the vigilance acknowledgement pushbutton, a visual alert (warning light), and an audible alert device. Additionally, the locomotive monitoring screen also provided a visual alert with advice on the vigilance cycle countdown to an alert (Figure 16).

Figure 16: NR class locomotive vigilance system

The image shows the key in-cab components of an NR class locomotive vigilance system.

Source: Pacific National, annotated by the ATSB

The NR class locomotive vigilance system had 3 unique fixed cycle times available for selection with ‘Cycle A’ applicable for DOO. The length of cycle A times and alerts is described in Table 3. Cycle A was the most sensitive vigilance cycle programmed into the vigilance system, with other cycles (used for multi-rail traffic crewed operations) allowing for up to 90 seconds of inactivity before generating an alert (compared to 40 seconds for cycle A).

Table 3: NR Class Locomotive DOO cycle (cycle A) times

Vigilance Cycle A	Time
Cycle time (prior to visual alert)	40 seconds
Visual alert ONLY (warning light)	10 seconds
Visual and audible alert (warning light and audible alert)	10 seconds

Event recording analysis confirmed that lead locomotive NR80 of train 7MP5 was set to DOO cycle A. Post-accident testing and inspections of locomotive NR80 concluded that the vigilance system passed all functional tests.

The vigilance cycle time could be reset whenever a driver control input to the locomotive throttle, brakes and other controls was made. Driver control inputs made during the cycle time before a vigilance system visual alert was raised would reset the cycle time to 0 seconds, and therefore pre-emptively reset the visual alert before it displayed.

The ATSB noted that the NR class locomotive maintenance and operational manuals did not include any explanation of whether the vigilance acknowledgement pushbutton also provided an ability for a driver to pre-empt the vigilance system visual alerts (that is, reset the cycle time to 0 seconds before a visual alert appeared). To understand this, post-accident testing of another NR class locomotive was undertaken. This testing confirmed that the vigilance system visual alert could be pre-empted by pressing the vigilance acknowledgement pushbutton prior to the start of the visual alert. This reset the cycle time to 0 seconds and prevented a vigilance system visual alert from being generated. Additional testing confirmed that there were no observable limits to how many times the visual alert could be pre-emptively reset by using the vigilance acknowledgement pushbutton.

Train 7MP5 driver vigilance inputs

The driver’s vigilance acknowledgement pushbutton inputs for the lead locomotive of 7MP5 were recorded by the locomotive event recorder. The ATSB analysis of the driver vigilance acknowledgement pushbutton inputs for 7MP5 with the fixed vigilance alert cycle times showed that:

• The data did not indicate that the driver was frequently pre-empting the visual alerts.[43] 
• At the start of the journey, the driver typically responded to the vigilance system alarm when it was in the visual alert only phase of the alerting cycle (that is, in the first 10 seconds of the alerting cycle).
• In the 35 minutes prior to 7MP5 passing signal 12L at danger, the response times to the vigilance alarms became longer. During this time, most of the driver’s responses to the vigilance alarm occurred only after the audible alert activated.
• For about 6 minutes prior to 7MP5 passing signal 12L at danger, the only recorded driver action was the operation of the vigilance acknowledgement pushbutton (Figure 17), with the last use of the pushbutton recorded at 0159:05. At about 0159:33, about 9 seconds after passing signal 12L, the driver made a service brake application, resetting the vigilance cycle timer.

Figure 17: Recorded data showing the driver of 7MP5’s vigilance acknowledgement pushbutton response time to vigilance demands

The image shows the vigilance acknowledgement pushbutton response times for the full shift of the driver of 7MP5. The grey portion of the graph indicates the vigilance system cycle time (up to 40 seconds), the yellow portion indicates the visual alert response time (up to 10 seconds), and the red portion indicates the visual and audible alert response time (up to 10 seconds). Note that the vigilance system cycle time resets undertaken by activity-based manipulation of locomotive controls, such as throttle, brakes, and horn, are not reflected in this graph.

Source: ATSB

Driver responses during a previous SPAD event

In August 2019, a Pacific National train with NR class locomotives and with DOO was involved in a SPAD event at Beckwith, Western Australia. A Pacific National internal safety investigation identified that the driver[44] was probably in ‘a state of sleep’ during the event and was not alert to their surroundings. The investigation found the driver continued to acknowledge alerts from the activity-based, fixed-cycle vigilance system. The investigation report noted that, in the minutes prior to the SPAD, the driver only responded to the vigilance system after the audible alerts activated, rather than responding to the visual only alerts. The investigation recommended a number of corrective actions, such as:

• adopt a variable (random) vigilance cycle for all locomotives
• consider changing the vigilance acknowledgement system to require a combination of actions to acknowledge vigilance alerts
• consider introduction of drowsiness detection technology[45] in main line locomotives, similar to equipment which was already operating in Pacific National light vehicles.

Pacific National had considered and undertaken some work to progress these recommendations. However, the recommendations that PN assessed as reasonable and practicable had not yet reached implementation at the time of the 24 December 2019 accident at Jumperkine.

Limitations on vigilance systems

Previous safety investigations have noted that vigilance device reset can occur during a period of acute fatigue. The following excerpt from the National Transportation Safety Board report on an accident at Macdona, Texas, 28 June 2004[46] describes this phenomenon:

Research on the limitations of locomotive vigilance systems is described in Appendix B – Research on locomotive vigilance system limitations In summary, because train drivers often habituate to vigilance systems and respond to alerts without conscious thought, vigilance systems in their present form have limited capacity to be effective controls for ensuring drivers are alert and attentive to the rail environment.

Train driver information

Qualifications and experience

The driver of 7MP5 was an experienced train driver who had worked for other rail transport operators in New Zealand and Australia. The driver relocated to Australia in 2010 to take up a train driver role with another operator in Western Australia before starting with Pacific National in Western Australia in 2014.

The driver held route competency[47] for the section of track at Jumperkine. The driver’s roster recorded regular journeys, in both directions, over the section of track at Jumperkine in the 3 months prior to the accident. Accordingly, the driver would have been familiar with the temporary speed restrictions located at Moondyne and Jumperkine.

Medical information

The driver’s most recent rail safety worker health assessment (category 1) was on 22 May 2019, which found the driver was fit for duty based on the standards described in the National Standards for Health Assessment of Rail Safety Workers (NSHARSW). The driver’s partner described them as in good health and fitness. The driver did not drink alcohol or coffee, and the only hot beverages they consumed did not contain a high level of caffeine.

During the category 1 health assessment, the driver reported no difficulty maintaining alertness during normal activities.[48] The driver indicated they had not experienced choking or interrupted breathing while asleep. The driver advised the physician that they had previously been diagnosed with sleep apnoea, however this was resolved with surgery 15 years prior to the examination. Based on these responses, and because the driver did not meet criteria[49] relating to body mass index or neck circumference, the driver was not referred for a sleep study to assess the probability of sleep apnoea.

In their most recent health assessment, the driver identified that they had hearing aids. The hearing assessment conducted as part of the health assessment was undertaken without the use of hearing aids, and the driver was recorded as meeting the prescribed hearing level standards defined in NSHARSW. The NSHARSW required safety-critical workers who had hearing aids to also undergo an evaluation of their ability to hear speech in noise or quiet. There were no records provided of these additional tests being undertaken.

The driver of 7MP5 was not wearing hearing aids at the time of the accident. Since the driver had been able to hear and communicate earlier in their journey, the ATSB assessed that this was unlikely to have affected the driver’s ability to hear any transmitted radio calls.

Post-mortem examination undertaken on behalf of the West Australian Coroner did not detect any traces of alcohol or other drugs. The cause of death was established as asphyxia from the ingestion of grain.

Recent history

Observations about alertness and wellbeing

The driver’s partner recalled that the driver would normally sleep about 8 hours a day, usually between about 2100 to 0600, when the driver was not working or did not have other commitments. The driver was reported to sleep soundly in such situations and did not take long to fall asleep at night. The partner also told the ATSB that the driver was known to be able to nap during the day, and would often nap at about 1400 prior to the start of a night shift (sometimes achieving a couple of hours sleep).

The driver’s partner reported that, in the weeks leading up to the accident, the driver appeared very tired. The partner said the driver had frequently mentioned concerns about their roster and the impact it was having on their ability to sleep through between shifts at times, and that they were tired when they woke up. The driver’s partner was concerned about this tiredness and encouraged the driver to take sick leave on 21 December 2019. The partner recalled that this leave day was taken only because of the driver’s tiredness and the driver had not been unwell or injured. Pacific National documentation recorded the leave day as casual sick leave without a certificate, with no other information recorded. One of the driver’s friends also recalled the driver describing being exhausted from work in the period around the time of the accident. Other than the sick leave taken on 21 December, the driver had not taken any personal leave or annual leave during October to December 2019.

The driver was known to undertake many additional or overtime shifts (that is, shifts additional to or different to that assigned in their planned roster). The Pacific National investigation report into the Jumperkine accident involving 7MP5 reported that the driver had often requested overtime. The driver’s partner recalled that the driver regularly filled in for other drivers and was reluctant to refuse requests to take an additional duty when the operator was short of available drivers. One of the driver’s colleagues said the driver did a lot of additional shifts, and recalled the driver saying they felt guilty if they refused taking on additional shifts when asked.

The driver’s partner reported that the driver was often involved in volunteer activities when not conducting work duties.

Roster information

Pacific National provided copies of the driver’s weekly planned working rosters, as well as records of the actual hours the driver worked during October to December 2019. The planned shifts and actual hours of work for the driver in December 2019 is illustrated in Table 4, and a detailed description of the 10 days prior to the accident is shown in Table 5.

The ATSB reviewed the driver’s roster during October to December 2019 and compared their planned and actual shifts to rules described in Pacific National documentation (see Rostering practices at Pacific National). Observations about the drivers’ planned and actual (worked) rosters included:

• The driver worked shifts on 11 of the 24 rostered days off (RDOs) allocated to them in the roster.
• The driver’s actual roster did not include an average of 2 RDOs per week in either October, November or December.
• The driver worked a maximum 49.5 hours in a 7-day period, and there were several other instances when the driver worked more than 40 hours in a 7-day period.
• The driver’s roster included several ‘quick returns’ where less than 11 hours interval between shifts was provided.
• The additional shifts also increased the variability of shift timing. For example, when the driver worked 17 and 18 December, instead of taking the allocated RDOs, this created a shift pattern of a night shift, an afternoon shift, a morning shift and then an early morning start.

Otherwise, the driver’s rosters were generally consistent with the prescribed rules, and there were no violations of rules relating to maximum consecutive shifts, maximum shift length, minimum rest opportunity or maximum FAID scores (see Pacific National use of biomathematical models of fatigue).

Table 4: Working (planned) roster and actual hours worked by the driver of 7MP5 in December 2019

Date	1 Dec	2 Dec	3 Dec	4 Dec	5 Dec	6 Dec	7 Dec
Planned	RDO	0600-1400	0600-1400	0800-1536	1710-2330	2050-0310
Actual	RDO	0600-1400	0600-1400	0800-1536	1830-0050	2050-0358
Date	8 Dec	9 Dec	10 Dec	11 Dec	12 Dec	13 Dec	14 Dec
Planned	0330-1200	0900-1700	RDO	RDO	RDO	2200-0630	2000-0400
Actual	0330-1200	0600-1400	RDO	RDO	RDO	2200-0630	2000-0400
Date	15 Dec	16 Dec	17 Dec	18 Dec	19 Dec	20 Dec	21 Dec
Planned	2000-0400		RDO	RDO	0700-1200 2335-0635		1400-2230
Actual	2000-0354		1955-0232	1230-1747	0700-1159	0300-1028[1]	SICK
Date	22 Dec	23 Dec
Planned	2030-0340	2120-0430
Actual	2030-0337	2120-0337

Source: Information provided by Pacific National summarised and tabulated by ATSB

[1] This shift was the same service that was originally scheduled to commence 3 hours earlier (that is, 2335–0635 starting 19 December).

Table 5: Recent duty times for driver of 7MP5

Date	Work activity	Duty start	Duty end	Duty time	Time free (of duty)
13 Dec 2019	Shunting, Perth	2200	0630	8.5 hours	13.5 hours
14 Dec 2019	Shunting, Perth	2000	0400	8.0 hours	16.0 hours
15 Dec 2019	Shunting, Perth	2000	0354	7.9 hours	>24 hours
16 Dec 2019	Off duty (after finishing at 0354)
17 Dec 2019	Additional shift, DOO train from Perth to West Merredin	1955	0232	6.6 hours	10.0 hours
18 Dec 2019	Additional shift, drive car from West Merredin to Perth	1230	1747	5.3 hours	13.2 hours
19 Dec 2019	Additional shift, drive car from Perth to West Merredin	0700	1159	5.0 hours	15.0 hours
20 Dec 2019	Additional shift, DOO train from West Merredin to Perth	0300	1028	7.5 hours	>24 hours
21 Dec 2019	Off duty (sick leave)
22 Dec 2019	DOO train from Perth to West Merredin	2030	0337	7.1 hours	17.7 hours
23 Dec 2019	DOO train from West Merredin to Perth	2120

Source: Information provided by Pacific National summarised and tabulated by ATSB

Rest opportunity and probable sleep in the days prior to the accident

Having taken sick leave (reportedly due to tiredness) on 21 December, there was a 58-hour period off duty between the end of the driver’s shift on 20 December and the start of their shift at 2030 on 22 December. After finishing work at 0337 on the morning of 23 December, the driver had about 18 hours off duty before starting work that evening at 2120.

The ATSB collected information from the driver’s mobile phone and other sources to understand how the driver utilised these periods free of duty, in terms of when the driver was awake and when they had opportunity to sleep.[50] The mobile phone records showed times when the driver was almost certainly awake (such as sending messages, making and receiving phone calls, and visiting web pages). It was not possible to determine how the driver utilised the times they were not using their phone and thus to identify the exact duration of sleep.

Table 6: Timeline showing times worked, sleep opportunity, and phone use by the driver of 7MP5 in day prior to the accident

Note: Times worked by driver of 7MP5 are shown as ‘W’, times of probable rest opportunity are shown as ‘S’, and times identified as active phone use are shown as ‘A’.

A timeline (Table 6) was established for recorded instances of mobile phone activity, duty time, and sleep opportunity for this period. The ATSB determined that:

• The driver had an opportunity for about 8 hours sleep from 2130 on 21 December until 0530 on 22 December.
• The driver’s partner recalled that the driver undertook various volunteer activities during the morning and early afternoon of 22 December. They had lunch with the driver sometime after 1400 on 22 December, and after that they went for a walk together. The partner recalled that, later in the afternoon the driver retired to rest, although they did not recall the timing or duration of this rest.
• Mobile phone records did not detect any active phone use for 4 hours from about 1450 to 1840 that afternoon (which probably included the post-lunch walk). The driver normally left home for work about 1 hour prior to their sign on time.

In summary, it is likely that the driver obtained a normal amount of sleep on the night of 21 December. It is possible that the driver also obtained some additional sleep on the afternoon of 22 December before commencing duty in Perth at 2030 that evening, but the duration of any sleep period could not be reliably determined.

Following the end of their shift at 0337 on 23 December, the driver had 17.7 hours off duty at the barracks in Merredin before starting work at 2120 for a second consecutive night shift that evening. The driver’s partner recalled that the driver had indicated that Merredin was one of their preferred barracks’ locations. In addition:

• One Pacific National driver advised that the barracks in Merredin were well appointed, as they had good light and temperature control and the beds were comfortable.
• Another Pacific National driver advised that, at the same time that the driver of 7MP5 was at Merredin barracks, things were normal with nothing unusual in the barracks that would have made sleeping difficult.

The driver’s mobile phone records showed that they used their mobile phone many times during the off-duty period at Merredin. After the driver finished work on the morning of 23 December, the first recorded phone use was a text message sent by the driver at 0844. Assuming a minimum 45‑minute period to begin sleeping after finishing work at 0337, this indicates that the driver had a sleeping opportunity of about 4.3 hours. The actual sleep obtained may have been less, as it is unknown for how long the driver was awake before commencing sleep or before sending the text message.

After this time, mobile phone records showed the driver was awake at times including 0910, 1030, 1150, 1240, 1300, 1330, 1410, 1610, 1840 and 2000 (with relatively constant use from 2000 until they commenced duty at 2120).[51] Phone calls at 1300 and 2000 were probably work related, and the other phone use was probably non-work related. There was no record of the driver visiting internet pages, nor any outgoing phone call or text message from the driver’s mobile phone, after 2200 on 23 December.[52]

The ATSB considered the likelihood that the driver obtained some sleep during the afternoon of 23 December. Recorded information showed the driver’s mobile phone use ceased for about 2 hours during 2 separate periods (commencing at 1410 and 1610), and it is possible the driver obtained sleep during 1 or more of these periods or at other stages with smaller breaks between recorded phone use. There was no evidence available to determine the extent of any actual sleep obtained during these periods.

The ATSB notes that the types of mobile phone activity detected at 1610, 1840 and 2000 were self-initiated (accessing email, sending a text message and making a phone call), which indicates that the driver had been awake for a time before using the phone.[53] Additionally, if the driver attempted to nap after being awake at 1610, 1840 and 2000, this would have been at a time of day when most people have the lowest propensity to sleep (Bes and others 2009).

In summary, the sleep on the morning of 23 December was significantly shorter than was normal for the driver during non-work periods. The ATSB could not establish to the required level of certainty whether the driver napped on the afternoon of 23 December. Any naps that were achieved were probably of less restorative value than night-time sleep. If the driver did not achieve any rest during the napping opportunities, then at the time of the accident they would have been awake for over 17 hours, having slept no more than about 4 hours in the previous 24 hours.

Events prior to departure from Merredin on 23 December 2019

At about 2000, the driver involved in this accident called the Pacific National Integrated Planning Services (IPS). At this time, phone voice recordings at the IPS logged that the driver asked if their assigned train (7SP5) was on time (with their duty period scheduled to commenced at 2120). The IPS operator advised that they had an estimate of 2259, noting that the IPS operator with a more accurate update was busy on another call. The driver acknowledged this advice, laughing and remarking that ‘at least’ the train was arriving the same day. The driver requested a half-hour warning call from IPS before the start of their shift.

Shortly after, at about 2004, the IPS operator called the driver back and advised that 7SP5 was ‘really late’, and that 7MP5, retaining the same rostered start time of 2120, had been allocated to the driver instead. The driver, without providing any reason, advised that they were happy to wait for the originally scheduled train (7SP5). The IPS operator explained that there were no other drivers available, with the only thing changing for the driver being the train number, not their rostered start time. The IPS operator asked if this was ‘okay’, and the driver (without giving any reason) replied ’not really, but anyhow I’ll take it’.

Train 7MP5 had stopped at West Merredin platform at about 2057. In preparation for the driver change with the incoming driver, the driver commenced their rostered shift at 2120 and proceeded to the eastern end of the West Merredin platform (Figure 1). At about 2200, the driver called IPS, likely in a location that they could not see the train, reporting that they had been waiting for 40 minutes for 7MP5 and questioned why they had been booked on so early for it. The IPS operator confirmed that 7MP5 was waiting at West Merredin. At this time, the driver realised and advised the IPS operator that they must have missed the arrival of the train.

The ATSB considered a plausible explanation for the driver’s conduct when interacting with IPS was that they wanted additional rest time ahead of the journey to Perth. There was also a small remunerative benefit for additional time in barracks for the driver. Ultimately, the ATSB was unable to determine the reasons for the driver’s conduct when interacting with IPS. The driver did not report any reasons for their concerns to the IPS operator or provide clear advice that they were not fit to commence work at 2200.

Fatigue risk management

Pacific National fatigue risk management program

Pacific National managed its fatigue related risks using a fatigue risk management program, as required by the Rail Safety National Law (WA). The Pacific National Fatigue Risk Management Standard stated that the operator used a ‘risk-based approach’ for managing fatigue risk. The standard described the overall structure of Pacific National’s fatigue management as comprising:

• health assessments to ensure workers were fit for their assigned tasks
• rostering rules and scheduling practices that sought to reduce the potential for fatigue (which included the use of a biomathematical model of fatigue or BMMF when designing rosters and varying existing rosters)
• fatigue self-reporting practices such that workers would self-report if they felt fatigued
• recording and investigation of fatigue events, and continuous improvement of fatigue management systems.

The Pacific National Fatigue Risk Management Standard specified that each work area must develop a fatigue risk profile that identified relevant fatigue hazards and applicable controls. At the time of the accident, there was no fatigue risk profile applicable to the intermodal freight operations in Western Australia.

Rostering practices at Pacific National

The operator maintained a master roster that described the general structure of expected shifts for a work group. Working rosters were developed at least 9 days before the start of each working week, and described the actual shifts each driver was expected to work.

Train driver rosters were developed to ensure rosters complied with rules in the relevant enterprise agreement (EA), as well as rules designed to reduce fatigue risk. The EA applicable to drivers at the Perth depot was the Pacific National Intermodal Train Crew Enterprise Agreement 2017.

Rostering rules within the EA included:

• a limit of 9 hours for driver only shifts, with a 12-hour maximum for all shifts
• a minimum of 12 hours between shifts while resting at home, which could be reduced to 11 hours with consultation
• a minimum of 10 hours between shifts when away from home for driver only operations (DOO) (whereas for multi-rail traffic crewed operations the minimum rest between shifts at a rest location was 10 hours after shifts terminating between 0400 and 2200, and 8 hours after shifts terminating at other times)
• a maximum of 11 consecutive shifts, inclusive of sick days (after which train crew were required to take a rest day)
• non-peak[54] master rosters were to average 38 hours and peak master rosters were to average 40 hours per week.

The EA provided additional rostering requirements for DOO, stating that, where possible, driver only shifts should include:

• shift start times held constant over a run of consecutive shifts
• shift start times which move in a forward direction
• other work types to break up sequential driver only shifts.

Pacific National advised in correspondence to the ATSB that the following rules were also used when developing rosters:

• Master rosters were developed to achieve an average of 2 RDOs per week. Working rosters were developed to achieve an average of 2 RDOs per week, and labour planners would conduct a weekly count of RDOs.
• The roster would group like shifts together to enable consistent workflow rather than alternating from days to nights then to afternoons.
• Pacific National used the FAID BMMF during roster development. This is described in more detail in Pacific National use of Biomathematical Models of Fatigue.

Provision and use of rest breaks

The EA provided an entitlement for drivers to take a 30-minute paid meal/rest break between the third and fifth hour of a DOO journey. Pacific National training material further stated that:

There was no evidence that the driver of 7MP5 attempted to arrange a rest break with the Arc infrastructure NCO. The accident occurred in the fourth hour of the driver’s shift and, had the accident not occurred, the train could have arrived at Perth prior to or shortly after the fifth hour of the driver’s shift.

One Pacific National driver who conducted DOO told the ATSB that, although drivers were entitled to a rest break during a shift, they did not know of any drivers who did so. This driver said this was partly because shifts were often not long enough to take breaks, and also partly because of perceived pressure not to inconvenience network control. The driver identified that shift scheduling, and hence the start time of the oncoming driver at the next shift change, did not incorporate the timing of a rest break. The driver also stated that, if required, a driver could contact network control at any stage to arrange a rest break.

Pacific National advised the ATSB that it did not collect records of driver utilisation of the rest provisions for DOO, and nor had the operator undertaken any reviews or audits of the utilisation of these breaks.

Start times worked by Pacific National drivers

The ATSB observed that the shifts worked by the driver of 7MP5 often included irregular start times. Another Pacific National driver also noted that there was little consistency in shift start times, and that the roster was often backwards rotating. That driver said that they were not able to develop a ‘genuine sleep pattern’ working under the roster. They highlighted an example involving a day shift, followed by a series of days off, followed by a night shift. They reported that they found it very difficult to sleep in to prepare for the night shift.

The ATSB obtained the rosters worked by all 30 drivers working from the Perth freight terminal between October and December 2019. The rosters showed that other drivers also occasionally worked shift patterns with irregular start times. For example, drivers worked the following patterns of start times:

• 0600, 1000, 0455, 0515, 0140, 1820, rest day, 0050
• 1955, 0130, 0600, 0225,1050
• 0600, rest day, 1905, 1200, 0750, 0355, 1325.

The ATSB conducted a review of the available research literature dealing with irregular working rosters and their influence on fatigue, summarised in Appendix C – Research on irregular roster patterns and fatigue risk. In summary, there is insufficient research on irregular working patterns to determine if they cause an increased risk of fatigue compared to other shift patterns such as consistent night shifts.

Fatigue events and fatigue assessments

The Pacific National Fatigue Risk Management Standard required workers to always present to work in a fit and rested manner, and report to their manager any instances of feeling tired or fatigued before, during or after work. The standard also required that managers investigate and record all fatigue reports, and update fatigue risk controls as necessary.

A total of 15 fatigue events were self-reported by Pacific National employees in the 5-year period prior to the 24 December 2019 accident involving 7MP5. None of these reports were from Western Australia operations, and none related to the driver of 7MP5.

Pacific National also used a Safe Worker Assessment Tool (SWAT) to conduct a structured assessment of drivers who may be experiencing fatigue. Procedures required that a SWAT be completed whenever a worker:

• exceeded a FAID threshold [see Use of FAID threshold values]
• exceeded hours of work limits
• felt fatigued, or if supervisors or co-workers were concerned about the worker’s fatigue
• was driving a Pacific National light vehicle fitted with drowsiness detection technology system[55] and the system detected a distraction or drowsiness event.

The SWAT procedure used a traffic-light style assessment of fatigue risks and symptoms. Table 7 shows the categories used to assess fatigue risk in this tool.

Table 7: Safe worker assessment tool questions and categories

Question/Category	AMBER fatigue risk	RED fatigue risk
FAID score	80-99	>99
Perceived fatigue	Feeling okay, less than fresh, a little tired	Feeling tired or drowsy, difficult to concentrate, having trouble staying awake
Sleep in previous 24 hours	Slept but did not obtain their ideal amount of sleep	Did not sleep
Sleep quality (previous 24 hours)	Average	Poor
Signs and symptoms of fatigue	1 or 2 minor symptoms	Some symptoms. Can include microsleeps or a recorded drowsiness event detected by in‑vehicle monitoring technology

Source: ATSB, based on Pacific National procedural documents

The procedures specified that main line train drivers who returned any red fatigue risks could not drive a vehicle or operate a train alone.

Other than SWAT assessments when rostering limits were exceeded, there was no requirement for rostering personnel to ask about a driver’s alertness or sleep, or any requirement to check on a driver’s alertness during the course of train journeys.

There were no records of any SWAT reports associated with the driver of 7MP5. There were 47 SWAT reports provided by Pacific National applicable to operations between Kalgoorlie and Perth from December 2017 and 2019. All of these 47 SWAT reports were related to the assessment of potential distraction[56] or drowsiness[57] events identified by Pacific National’s light vehicle (car) drowsiness detection technology system.

Pacific National reported that it had not conducted any reviews of the effectiveness of its fatigue self-reporting system, such as surveys of train drivers about their willingness to self-disclose if they felt tired.

Fatigue training and education

Pacific National had established training for workers engaged in shiftwork to support their ability to identify and manage fatigue. Objectives of this training included instruction on the causes of fatigue, fatigue symptoms, the consequences of fatigue on safety, and the implementation of fatigue management strategies in line with Pacific National’s policy.

Information presented in the training included that:

• Employees were expected to prepare and recover from shifts, and to manage non-work related tasks to minimise fatigue.
• Adequate sleep quantity and quality was required for safe working, and that a sleep loss of 1 to 2 hours in a single night typically caused impaired performance and alertness. The training did not identify how much sleep was typically required.
• Workers had a responsibility to monitor fatigue at work, and to report fatigue events. The training included some guidance about self-reporting fatigue events, encouraging participants to self-report being tired to their supervisor. The training said that after a self-report a SWAT assessment would be conducted before any further work was undertaken, and that additional controls or restrictions may be applied to manage risk.

The driver of 7MP5 completed the fatigue training a few weeks before the accident, and achieved a score of 100%.

Pacific National use of biomathematical models of fatigue

Overview of models

A biomathematical model of fatigue (BMMF) uses mathematical algorithms to predict the effect of different patterns of work on measures such as subjective fatigue or sleep. Different BMMFs make different assumptions about sleep and fatigue and use different inputs and produce different outputs to provide a fatigue measure. Each available model has different limitations in its use. In particular, the models are based on group-averaged data, and it is widely agreed that the models are not well suited for predicting a specific individual’s level of fatigue. In addition, none of the models consider all of the factors that can influence fatigue. The models are designed to be one element of a system for evaluating and comparing work rosters (see Civil Aviation Safety Authority 2014, Dawson and others 2011, Gander and others 2011, Independent Transport Safety Regulator 2010).

Pacific National used the FAID[58] BMMF to conduct assessments of rosters. FAID uses hours of work (start time and end time) as its inputs, and produces a score based on an algorithm that considers the effects of the length of the duty periods, time of day of the duty periods and the amount of work over the previous 7 days (Roach and others 2004). The more recent the duty period, the more effect the duty period has on the resulting score. The higher the score then the higher the potential for fatigue.

The developers of FAID stated that the model ‘assigns a recovery value to time away from work based on the amount of sleep that is likely to be obtained in non-work periods, depending on their length and the time of day that they occur’ (Roach and others 2004). Dawson and colleagues (2011) noted that FAID does not predict fatigue per se but rather predicts a sleep opportunity, demonstrating only that the organisation has provided employees with an adequate opportunity to sleep, producing a work-related fatigue (FAID) score.

FAID user documentation stated that a 5-day work schedule of shifts from:

• 0900–1700 produced a FAID score of 41
• 0600–1600 produced a FAID score of 79
• 2300–0700 produced a FAID score of 97.

Describing the level of performance impairment associated with high FAID scores, FAID user documentation stated that:

In addition, FAID user documentation stated scores of 40–80 were broadly consistent with a safe system of work. However, the threshold for deciding the acceptability of a roster needed to be set by the operator based on a fatigue hazard assessment, taking into account the fatigue-related hazards specific to the role or task, and determining the acceptable level of fatigue tolerance for that role or task. Without this assessment, the FAID program defaulted to a fatigue tolerance level of 80.

Pacific National use of FAID

The Pacific National rostering system calculated the FAID scores for each shift, and provided an updated FAID score for new future shifts when shifts were added or varied. The FAID score allocated to each shift was the peak FAID score for the shift. The system included a highlighting function that indicated to rostering personnel when FAID scores exceeded programmed thresholds, or when other criteria were breached. Pacific National advised the ATSB the following FAID thresholds were applicable:

• DOO main line operations had a soft limit of 60 and a hard limit of 80.
• DOO terminal operations had a soft limit of 70 and a hard limit of 80.
• Multi-rail traffic crewed operations had a soft limit of 80 and a hard limit of 100.

There were no documented procedures that described how rostering personnel used and interpreted FAID scores. Pacific National advised the ATSB that if a planned shift exceeded a soft limit, then rostering personnel would also consider the impacts of late running and extended shifts, and rostering personnel would not schedule a shift that breached hard fatigue limits. Pacific National stated that, in practice, rostering personnel were unlikely to identify a fatigue-related problem with a planned shift unless a FAID threshold was exceeded.

The driver of 7MP5’s FAID scores for the 10 days prior to the 24 December accident included a highest peak FAID score of 68 on 20 December. The predicted peak FAID score for the night of the accident was 56 at about 0420.

Pacific National provided the ATSB with records from 1 October to 28 December 2019 of the actual hours worked by all the drivers at the Perth depot, and the associated FAID score for each shift. Table 8 shows the distribution of FAID scores for relevant shifts, according to the threshold values described by Pacific National.

The maximum FAID score was 95 for all shifts. The maximum DOO FAID score was 86. The ATSB did not establish the circumstances of this exceedance of the DOO FAID threshold, with possible reasons including shift extension due to unplanned or emergency events. The FAID exceedance was not related to the driver of 7MP5.

Table 8: Summary of FAID peak score distributions by number of shifts during October to December 2019

	Multi-rail crewed, main line (n=240)	DOO, main line (n=428)	Shunting [1] (n=293)
FAID > 80	16 (6.7%)	1 (0.2%)	7 (2.4%)
FAID > 70	40 (16.7%)	13 (3.0%)	35 (11.9%)
FAID > 60	89 (37.1%)	69 (16.1%)	79 (30.0%)

[1] Shunting is the movement of trains or rail vehicles within rail yards and terminals for the purpose of marshalling trains or altering their consist. Pacific National records did not indicate the crew composition of shunting shifts. ATSB investigator experience is that shunting operations are typically conducted with 1 driver in the train.

Development and review of FAID threshold values

In late 2013 the ATSB published an investigation into a multiple SPAD event at Hurlstone Park, New South Wales, on 30 January 2013, involving a Pacific National bulk service using 2-driver crew.[59] The investigation identified the following safety issue:

The report also stated:

In response to the safety issue, the rolling stock operator advised at that time:

The ATSB acknowledges that Pacific National undertook work to improve its fatigue management processes since 2013. However, with regard to the determination of FAID threshold scores, Pacific National advised the ATSB during the Jumperkine investigation that there were no records showing how the threshold values utilised for assessing its rail traffic crew rosters were set, and nor were there any records of reviews or studies validating the thresholds.

The use of FAID scores of 80 and 100 as thresholds for evaluating rosters is a common practice within the rail industry, and has previously been described in other ATSB investigations.[61] Regarding the widespread adoption of ‘standard’ thresholds when using BMMFs, Dawson and others (2017) noted:

The ATSB notes that FAID scores (and the scores from any BMMF) need to be interpreted with caution. The Independent Transport Safety Regulator of New South Wales (2010) stated that, due to various factors associated with the model, ‘a FAID score of less than 80 does not mean that a work schedule is acceptable or that a person is not impaired at a level that could affect safety’. In addition, the US Federal Railroad Administration (2010) concluded that in some situations FAID scores between 70 and 80 can be associated with ‘extreme fatigue’.

Other contextual information relevant to fatigue

Underload and monotony

Although the task of freight train driving is complex and often demanding, it sometimes also involves long periods in which the driver is not called upon to significantly interact with the train controls. In such circumstances, the driver’s task can be categorised as monotonous and involving very low level of task demands (also called ‘underload’).

Extended periods of low task-demands can have a negative effect on vigilance and attention, leading to an increased safety risk. Research shows a disproportionate amount of fatigue-related road accidents occur on highways or other ‘low demand’ environments (Williamson and others, 2011). Simulated road research has shown that monotonous road conditions such as straight roads or repetitive roadside scenery are associated with more frequent dangerous driving behaviours (Tiffault and Beregon 2003). As summarised by Larue and colleagues (2011):

Monotonous driving conditions have been found to increase fatigue risk, independent of the effect of sleep restrictions, and similar results have been shown for laboratory visual tracking tasks. Interventions that target monotony by increasing arousal have been shown to reduce the effects of fatigue (Williamson and others 2011).

When drivers are fatigued, they will have even greater difficulty maintaining attention and alertness in low demand situations, and will respond more slowly to hazards, with one researcher arguing that the vigilance decrement is the strongest effect of fatigue (Dinges 1995). A fatigued driver will have a lower baseline level of attention and vigilance performance, and will therefore be more vulnerable to the effects of monotony.

Summarising the effects of monotony and underload on train driving, the Transportation Safety Board of Canada[64] stated:

Workload associated with the operation of 7MP5

In the direction that 7MP5 approached Jumperkine, the track had a mostly down gradient, varying in slope between 1 in 3,875 and 1 in 210, with multiple left and right curves varying in radius between 400 m and 3,460 m. An experienced driver over this section of track explained that, depending on the length and weight of a train, these curves could have a slowing effect on some trains (that is, counteracting against the down gradient). This driver added that, if the signals were green, a driver operating on this section would not be busy, perhaps with the throttle in idle or, if needed, small durations of throttle or dynamic brake to manage the train’s speed when required. This driver said that they tended to ‘relax a bit’ through this section if they were encountering green signals.

Early in the 7MP5 driver’s shift, the driver encountered some restricted signals when undertaking crossing movements with opposing trains at Doodlakine, Bungulla and Tammin (Figure 1). After the last crossing movement at Tammin (at about 2341), 7MP5 travelled for over 2 hours and about 158 km past 33 consecutive unrestricted green signals until reaching the restricted yellow and red signals protecting 2K66 at Jumperkine (Figure 18).

Figure 18: Train 7MP5 signal aspects between West Merredin and Jumperkine

The image shows a graph of the signal aspects* likely encountered by 7MP5 between West Merredin and Jumperkine, versus time at track kilometrage. Note* Signal aspects between Merredin and Cunderdin are estimated based on TCS data and expected signal system behaviour. Signal aspects between Cunderdin and Jumperkine were confirmed from forward-facing camera footage from 7MP5.

Source: ATSB

Information from 7MP5’s locomotive event recorder (Figure 19) showed that, at about 0152:54, the driver moved the throttle to idle to manage the train’s speed with reference to the track limit speed of 80 km/h. After the throttle was moved to idle, the train speed was somewhat constant, although did slow slightly approaching Jumperkine. The recorded locomotive driver control changes after the throttle was moved to idle were limited to the operation of the vigilance acknowledgement pushbutton, with most of these actions occurring after an audible alert (see also Train 7MP5 driver vigilance inputs section).[65]

Figure 19: Train 7MP5 lead locomotive NR80 event recorder data from 0151 until 0201

The image shows a sample of the recorded event data from the lead locomotive (NR80) of 7MP5. The data shows that at 0152 the driver moved the throttle to idle, after this point until passing signal 12L at Jumperkine, the driver’s tasks were limited to acknowledging the vigilance system alerts.

Source: Pacific National data, graphed and annotated by the ATSB

In summary, the driver of 7MP5 encountered predominantly unrestricted green signals and, in the closing minutes of their journey, the driver’s task demands for control inputs lowered. This situation was consistent with advice from another driver experienced on this section of track.

Other train driver actions approaching Jumperkine

Train 7MP5 passed signal U45 approaching Jumperkine while that signal was displaying a caution (yellow) aspect. The caution aspect displayed by signal U45 should have informed the driver that the next signal, signal 12L (4,197 m past signal U45), was at stop, and that the train was required to be managed so that it could be stopped prior to this signal. Accordingly, the driver should have commenced slowing the train significantly in advance of signal 12L. However, the train remained at about the track limit speed (80 km/h) approaching and passing the signal.

Additionally, about 1,430 m after passing signal U45, 7MP5 passed a temporary speed restriction (TSR) ahead sign warning of a 30 km/h speed restriction ahead. This should have reminded the driver that there was a TSR ahead that the train needed to be prepared for. The location of the TSR (about 100 m past signal 12 L) was such that the driver needed to start slowing the train a significant distance before reaching signal 12L.

The driver had successfully slowed the train to comply with a 20 km/h TSR at Moondyne, returning the train to normal track speed (80 km/h) at about 0145. In comparison with the driver’s actions in relation to the TSR at Moondyne, the driver could have been expected to have commenced slowing their train at Jumperkine at about 1,800 m past signal U45. The driver did not make any attempt to stop or slow 7MP5 between signals U45 and 12L. The only recorded interactions between the driver and the locomotive controls during this time was the acknowledgement of vigilance system alerts via the driver’s vigilance acknowledgement pushbutton.

Effects of fatigue on train driver performance

Fatigue impairs the ability to perform simple and complex tasks. An extensive body of research has shown that fatigue negatively affects decision making, reaction time, memory, and information processing (see Lim and Dinges, 2010). A review by Williamson and colleagues (2011) summarised that, in transport and other operational contexts, sleep loss leads to impaired performance and accidents.

Research has noted that in railway operations, fatigue is associated with performance impairment such as slowed reaction time to safety alarms (Hildebrandt and others 1974) and reduced conformance with operating requirements, including heavy brake applications and maximum speed exceedances (Dorrian and others 2007). Fatigue has been identified as a contributing factor to numerous major rail accidents, and fatigue has been shown to significantly increase the likelihood of a human-factors rail accident (Raslear and others 2013, Rudin-Brown and others 2019).

Karrer and colleagues (2005) describe the phenomenon of ‘driving without awareness’, where a driver remains seated upright with eyes open but is not attentive to the road environment and not able to react to hazardous situations. This phenomenon, which has also been described as ‘highway hypnosis’ and ‘driving without attention mode’, has been attributed to conditions including underlying fatigue, the monotony of the driving task, and the automatization of driving due to highly practiced or highly predictable road conditions. 

Some researchers describe this phenomenon as a precursor event to falling asleep, and as a ‘drowsy interval between waking and sleeping’ (Briest and others 2006). Briest and others used video analysis techniques to identify instances of driving without awareness, and observed that this often preceded or accompanied subjects experiencing microsleep events, and that driving without awareness was associated with fatigue-related changes in blinking behaviour. An alternative explanation for driving without awareness is that the phenomenon reflects a state where the driving task becomes highly automated and attention is not allocated to the road environment. These explanations cite the common experience of reaching a familiar destination and having no recollection of the drive (Charlton and Starkey 2011).

Pacific National driver only operations and SPAD risk controls

Application of driver only operations

The traditional rail traffic crew composition for freight trains is 2 people, with a primary driver mainly responsible for operating locomotive controls and another person (commonly a driver but sometimes another qualified person) responsible for cross-calling[66] signals as well as other support duties.

Driver only operations (DOO) involve the use of only one train driver. The implication is that the tasks otherwise conducted by, or shared with, the second person must either be performed by the primary driver or not performed at all. Therefore, supporting and reminding tasks, such as cross‑calling signals, are no longer possible.

Pacific National has operated main line DOO services between Kalgoorlie and Perth since 2003, and it also operated DOO services in Queensland and South Australia. The ATSB requested details of the risk assessment and change management documentation conducted prior to the commencement of DOO services between Kalgoorlie and Perth. However Pacific National advised that, due to the time elapsed since commencing these operations, no records could be found.

Appendix D ­– Additional contextual information about Driver only operations provides additional information about research and statistics of the safety of DOO.

Driver only operations SPAD prevention controls

The Pacific National main line risk assessment described the risk controls used in the Pacific National safety management system. This included the risk controls applied to manage the hazards of collision or derailment due to an overrun of limits of authority (with a SPAD being one type of overrun of limit of authority). A sub-table in the risk assessment described the additional risk controls for the same hazards for DOO. Table 9 shows the ‘hazard/risk causes’ for collisions and derailment due to overrun of limits of authority identified by Pacific National, and their associated risk controls.

Table 9: Pacific National overrun of limits of authority (SPAD) risk controls

Hazard	Risk controls	Additional DOO controls
Driver performance compromised by fatigue, drug and alcohol, or medical condition	Vigilance system Health assessments Drug and alcohol testing FAID (threshold 100) Rostering rules Suitable barracks	Shorter vigilance cycle Lower FAID threshold (80) Greater minimum break times
Extended time driving train compromises performance because of the required high concentration	Rostering rules Driver rotation Shift limits when working with trainee drivers	Shorter maximum shift times. 30-minute break between third and fifth hour
Driver has insufficient knowledge to identify end of authority	Route certification Competency assessment Network signal system Network rules Automatic train protection (Queensland only)
Driver does not take appropriate action to comply with network rules and PN procedures	Competency assessment Incident investigation Performance management Data logger downloads and review
Driver is distracted by other activities	SPAD management procedures Defensive driving strategies Competency assessments Incident investigation Performance management

Source: ATSB, based on Pacific National risk management documents

As shown in the table, the Pacific National risk register for DOO identified additional hazards associated with the train driver having their performance compromised (including due to fatigue) and specified additional risk control measures, including a shorter vigilance system alert cycle, amended rostering rules, and a lower FAID threshold.

Pacific National procedures for managing the risk of SPAD were described in its SPAD Prevention Management Standard, which stated (among other requirements) that all rail traffic crew were responsible for:

The Pacific National SPAD Commandments procedure stated that one of the ‘hard and fast rules’ for reducing SPAD risk was ‘Call and Cross call ALL signals’.

Neither the Pacific National SPAD Commandments nor the SPAD Prevention Management procedures made specific mention of DOO. The Pacific National briefing package for DOO stated that, consistent with the procedural requirements for other operations, DOO drivers were required to call the aspect of all signals en route. The document further stated:

The DOO risk controls (in the main line risk assessment for overruns of limit of authority) did not explicitly consider the hazards associated with the reliance on the single driver for observing and complying with signals for main line DOO operations.

The investigation was not able to establish whether the driver of 7MP5 was verbally calling out signals on the day of the accident (or would normally call out signals while conducting DOO).

Safety performance of driver only operations

In November 2017, Pacific National produced a statistical report titled ‘Safety and Train Performance Review’ that examined the safety performance of Pacific National DOO and multi-rail traffic crewed train services between January 2015 and July 2017. The report compared the safety records of DOO against multi-rail traffic crewed operations on various types of occurrences, and concluded there was no evidence to suggest that DOO had more safety-related occurrences.

One of the types of occurrences examined was SPADs due to driver error. In correspondence to the ATSB, Pacific National identified that 4 SPAD events that had been identified as multi-rail traffic crew in its initial analysis were in fact DOO. Pacific National was unable to determine the crew configuration of 3 additional SPADs. As such, the analysis presented in the Pacific National review document underestimated the SPAD rate of DOO and overestimated the rate for multi-rail traffic crew services. When the data was corrected, it indicated that the SPAD rate for DOO was almost twice the rate for multi-rail-traffic crewed operations (Table 10).

Table 10: DOO and multi-rail traffic crew SPAD rate comparison[67]^,[68]

Type of operation	SPADs	Million km	SPAD per million km
DOO – Western Australia and South Australia	6	1.6	3.8
Multi-crew – Western Australia and South Australia	11	14.9	0.7
Multi-crew – Australia excluding Queensland	101	49.7	2.0

Source: ATSB, based on information provided by Pacific National

Additional statistical analysis conducted by the ATSB using the revised SPAD events showed that the SPAD rate for DOO in Western Australia and South Australia was significantly[69] greater than the rate for multi-rail traffic crew operations in those states. The difference in SPAD rates for DOO in Western Australia and South Australia compared to multi-rail traffic crewed operations in all mainland states except Queensland was not statistically significant, probably due to the small sample for DOO.

The rail infrastructure manager, Arc Infrastructure, in respect to DOO train services undertaken on its network, did have processes for when DOO drivers exited the cab of their locomotive / train. However, Arc Infrastructure did not identify any changed or additional risks to the safety of its network, or make any specific requirements of its customers, with respect to DOO train services operating on its network.

Related occurrences

Overview of running line collisions

The Office of the National Rail Safety Regulator (ONRSR) Rail Safety Report publication between 2015[70] and 2020 reported the following instances of running line collisions within Australia (Table 10). These running line collision statistics include track maintenance vehicle collisions and light rail vehicles/trams, as well as a series of collision contributors that were unrelated to the Jumperkine accident. To normalise this information with the events related to this accident, the ATSB reviewed the ONRSR rail safety report data and identified which of these running line collisions had a pre-cursor SPAD event, and which ones were directly related to heavy rail operations like that involved in this accident (Table 11). As evidenced in the table, there were no other such collisions during the period from July 2015 through to June 2020.

Table 11: ONRSR reported running line collisions between trains and rolling stock

Year	Running line collisions	Heavy rail collisions[1]	Collisions involving SPADs[2]
2015 – 2016	6	3	0
2016 – 2017	4	2	0
2017 – 2018	6	4	0
2018 – 2019	4	3	0
2019 – 2020	4	3	1[3]

Source: ONRSR Rail Safety Report, and the ATSB.

[1] ONRSR running line collisions excluding collisions involving light rail vehicles / trams, road rail vehicles, and track maintenance vehicles.
[2] Heavy rail collisions which included pre-cursor signals passed at danger events.
[3] Relates to the accident at Jumperkine.

ONRSR normalised its running line collision statistics with the kilometres travelled in Australia. This analysis reported that there had been a downward trend, with overall collision rates dropping from about 0.04 per million train kilometres in 2015 to less than 0.02 per million train kilometres in 2020.

The ATSB reviewed Australia wide ATSB investigation reports between 1997 and 2019 as well as Pacific National and Arc Infrastructure Western Australia based investigation reports between 2015 and 2019. This review sought to identify investigations into other completely missed SPADs, as well as main line near misses and collisions involving rolling stock. Due to the extent of this sample, the review filtered investigations that identified similar safety factors and themes to the Jumperkine accident. The occurrences are discussed under the following sections:

• collisions without a pre-cursor SPAD
• collisions with a pre-cursor SPAD
• SPADs on the Arc Infrastructure network
• other potentially related SPADs without a collision.

Collisions without a pre-cursor SPAD

The ATSB identified 2 investigations for this category, which relate to 2 train-to-train collisions occurring in South Australia and New South Wales. These investigations were undertaken by the ATSB.

Yass Junction, New South Wales on 9 December 2010[71]

At about 0153 on 9 December 2010, bulk grain train 3234N passed signal YJ20 at the western end of Yass Junction, New South Wales. The signal was displaying a 'Calling on/Low speed’ aspect.[72] Train 3234N proceeded at low speed, but subsequently collided with the rear end of another bulk grain train 8922N, which was stationary on the main line.

The ATSB found that the driver of 3234N, on receiving a ‘Calling on/Low speed’ signal aspect, proceeded at a speed greater than the required speed to enable the train to stop, ‘within half the distance of clear line that is visible ahead’, as prescribed by the operational rules. The driver was aware that the operational rules stipulated that the ‘block ahead may be occupied or obstructed’ but did not expect that 8922N was stationary on the track so close ahead. As the driver of 3234N approached 8922N, a combination of track curvature, embankments and the effective illumination of the train’s headlight initially obscured their view of the stopped train. When the driver finally saw the rear of 8922N, they immediately made an emergency brake application, but was unable to stop the train before it collided with 8922N.

The ATSB found that the speed of the train (being too fast for the prevailing conditions), was the primary factor in the Yass Junction collision. In addition, even though NCOs were not required to provide ‘close quarters’ information, the driver had expected to be told by the NCO if a train was stopped ahead (likely influenced by previous experiences where this information had been provided).

Mile End, South Australia, on 31 March 2015[73]

At about 0730 on 31 March 2015, intermodal freight train 2MP9 passed No. 1 signal at the southern end of the Mile End crossing loop (South Australia). The signal was displaying a 'Calling on/Low speed’ aspect. Train 2MP9 proceeded at low speed, but subsequently collided with the rear end of intermodal freight train 2MP1, which was stationary on the main line.

The ATSB found that the driver of 2MP9, on receiving a ‘Calling on/Low speed’ signal aspect, proceeded at a speed not greater than 25 km/h, but was unable to stop the train ‘within half the distance the line ahead was clear’, as prescribed by the operational rules. The driver was aware that the operational rules stipulated that the ‘block ahead may be occupied or obstructed’ but did not expect that 2MP1 was stationary on the track so close ahead. As the driver approached 2MP1, some stumpy vegetation and a low fence initially obscured their view of the empty flat wagons at the rear of the train. When the driver finally saw the rear of 2MP1, they immediately made an emergency brake application, but was unable to stop the train before it collided with 2MP1.

The ATSB report included the following 2 safety issues:

• The practice of pathing a following train onto a line occupied by a preceding train, when an alternate route was available and not obstructed, presented an elevated level of risk.
• The practice of pathing a following train onto the same line occupied by a preceding train, without pre-warning the driver regarding the train ahead, presented an elevated level of risk.

In response to the safety issues, the rail infrastructure manager (Australian Rail Track Corporation) advised it would issue a notice to control centres advising ‘that when operationally possible maximum use of available and suitable infrastructure should be made available while optimising train running’.

Collisions with a pre-cursor SPAD

The ATSB identified 2 investigations for this category, which relate to 2 train-to-train collisions occurring in South Australia and New South Wales. These investigations were undertaken by the ATSB.

Beresfield, New South Wales on 23 October 1997[74]

On 23 October 1997, at 0632, coal train DR396 collided with the rear of another coal train (MT304). The collision occurred in clear conditions, adjacent to the western end of Beresfield railway station. Both of the rail traffic crew of DR396 were seriously injured, and there were injuries to 2 other people at the station. The 3 locomotives and first 10 coal wagons of DR396 were derailed, as were the 3 rear wagons of MT304. Wreckage blocked both coal roads and adjacent main lines. Beresfield station and associated structures also suffered extensive damage. Considerable disruption to passenger and freight operations resulted from the accident.

Train DR396 was on a journey from Port Waratah to Drayton, and the rail traffic crew reported that they observed clear (green) signals throughout this journey. At the time of the collision signal C113.0 was showing a caution indication and signal C112.2 was showing stop. Recorded data from DR396 showed no significant change to the progress of the train as it passed signals C113.0 and C112.2. Emergency braking was applied by the driver about 370 m prior to impact, consistent with first sighting the rear wagon of MT304. The predicted stopping distance required by DR396 was 579 m. There were no defences in place with the capability to warn the crew of DR396 of signals missed, or to arrest the progress of the train on passing a stop signal.

The investigation found the circumstances of the accident were consistent with the crew of DR396 not complying with caution and stop signal aspects protecting the stationary MT304. Reduced driver alertness, associated with work related fatigue, was found to be a significant factor in the events leading to the collision. The report noted that it was unlikely that the driver was asleep, but it was probable that that they were experiencing some form of reduced alertness such that they were able to perform simple or familiar tasks (such as operating the vigilance control) but were incapable of responding quickly to more critical tasks and situations.

This investigation also found that the locomotive vigilance system was ineffective in detecting reduced levels of alertness. It also found that the safe progress of the train relied on a system intolerant of human error, depending entirely on the rail traffic crew observing and correctly responding to track signal indications.

Dry Creek, South Australia on 11 October 2011[75]

At approximately 0105 on 11 October 2011, empty ore train 1901S passed signal 13 displaying a stop aspect at Dry Creek Junction in South Australia. Train 1901S subsequently collided with loaded grain train 5132S, which was travelling in the opposite direction and traversing the turnout at Dry Creek Junction to enter the Dry Creek North Yard. The collision was at low speed and there was no injury to the train crew of either train. There was significant damage to the crew cab of the lead locomotive of 1901S and to the grain wagons of 5132S that were struck during the collision.

The ATSB determined that the SPAD of signal 13 was a result of the driver-in-training and co‑driver (supervising driver) of 1901S becoming distracted during the approach to the preceding signal, 135, which was displaying a caution aspect indicating that signal 13 ahead was at stop.

The investigation revealed that a combination of individual actions and systemic issues contributed to the collision. The driver’s limited route knowledge, combined with an expectation of a clear run through the area, probably influenced the driver not observing signal 135 at caution. The supervising driver was completing an administrative task that diverted their attention away from the primary task of supervising the actions of the driver-in-training.

While fatigue impairment was not considered a contributing factor in this occurrence, the process for assessing driver rosters for relay operations relied excessively on a score produced by a biomathematical model (FAID), and the operator had limited mechanisms in place to ensure drivers received an adequate quantity and quality of sleep during relay operations.

SPADs on the Arc Infrastructure network

Overview

Following the fatal accident at Jumperkine on 24 December 2019, Arc Infrastructure commissioned a review of its network SPAD data for 2010–2019. This review identified that there were 976 recorded SPADs during this period. Overall, 660 SPADs (68%) were attributable to rail infrastructure manager irregularities (including 535 where the signal restored as train approached), 260 (27%) attributable to rail traffic crew error, and 49 (5%) related to rolling stock movement (such as a rollback or shunting operations within rail operator yards). With reference to SPADs attributable to rail traffic crew error, recorded SPAD subtypes included:

• 11 driver completely missed (about 1.1 % of overall total of 976)[76]
• 220 driver misjudged (23% of overall total of 976)
• 29 (3%) limit of authority missed by train crew.[77] 

The SPADs attributable to rail traffic crew error were distributed over 5 rail transport operators.

The review noted that the driver misjudged category was frequently used but for most of those SPADs the distance exceeded was not recorded. In addition, there were 12 driver misjudged SPADs where the exceedance distance was 50 to 500 m.

One of the conclusions of the review was that data associated with SPAD events was not systematically collected and analysed, limiting the ability of the review team to develop an accurate understanding of the rail infrastructure manager’s SPAD risk profile. The review also noted that there were ‘a number of significant SPADs’ attributable to rail traffic crew error where the driver had no intention of stopping until advised by the network control officer (NCO). Such SPADs included a SPAD in December 2016 (exceedance by about 1,650 m, involving another operator) and a SPAD in March 2017 (exceedance by 3,000 m, involving Pacific National at Darrine, discussed below). The review also noted another ‘serious incident’ SPAD event at Moondyne resulted in a train stopping about 120 m from the rear of another train (discussed below).

Moondyne, Western Australia, on 16 September 2016

At about 0546 on 16 September 2016, freight train 3MP5 passed signal 12L displaying a stop aspect at Moondyne, Western Australia. The train was operated by Pacific National as a driver only operation (DOO). The SPAD event was not investigated by the ATSB. The following information was obtained from the Pacific National investigation report (and other sources where noted).

Train 3MP5 was following another freight train (5426) on the route from Merredin to Perth. Train 3MP5 was brought to a stop at signal U66 (showing a stop aspect) as 5426 was being brought to a stop ahead. After about 13 minutes, when the rear of 5426 vacated the overlap of signal 12L, signal U66 changed to caution and 3MP5 departed towards signal 12L.  

Approaching signal 12L, 3PM5 reached a maximum speed of about 58 km/h. About the time the driver sighted signal 12L displaying a stop aspect, the driver applied the emergency brake, and the train passed the signal at about 39 km/h. The train stopped about 160–180 m past the signal, which was about 100–120 m to the rear of 5426.

Given that the driver noticed the stop aspect and commenced braking prior to passing the signal, this event was a ‘driver misjudged’ SPAD rather than a completely missed SPAD.

The Pacific National report concluded that the ‘root cause’ of the event was the driver not complying with the operator’s SPAD Prevention Management Standard when operating the train in a safety-critical zone as it approached Moondyne. Other notable aspects in the report included:

• The driver was originally scheduled to commence their shift at West Merredin at 2315 but this was subsequently rescheduled to 0135. The driver had 15 hours off duty at Merredin but reported that they had difficulties sleeping at the accommodation at West Merredin. They also reported that they felt tired and misjudged the location of the signal. The operator’s report concluded that there was insufficient evidence to conclude that the SPAD was due to fatigue.
• There was fog in the Avon Valley prior to the SPAD, however there were no reports to the NCO regarding the fog. A review of the locomotive forward-facing camera footage showed signal 12L at Moondyne was visible from the cab of the locomotive at a distance of approximately 450 m.
• The driver reported that they were not aware that they were following 5426 until after the SPAD and they came to a stop behind the stationary train ahead.
• The rail infrastructure manager, Brookfield Rail, routinely queued trains one signal behind preceding trains. (The Brookfield Rail investigation report also noted that the rail infrastructure manager accepted that trains will occasionally have a SPAD but that there were built-in safety margins to mitigate the risk of collision as a result.)

Darrine, Western Australia, on 1 March 2017

At about 2206 on 1 March 2017, freight train 2SP7 passed signal 2L displaying a stop aspect at Darrine, Western Australia. The train was operated by Pacific National as a driver only operation (DOO). The SPAD event was not investigated by the ATSB. The following information was obtained from the Pacific National investigation report (and other sources where noted).

A speed restriction of 60 km/h was in place over signal 2L, and the train passed the signal at 48 km/h. At the time, the driver was conducting a roll-by inspection of another train (and therefore not looking for the signal aspect).

The driver was not aware they had passed signal 2L at stop until notified by the Arc Infrastructure NCO. The train was stopped about 2,800 m past the signal.

The investigation concluded that the ‘root cause’ was that the driver did not have the train under sufficient control when it entered the safety critical zone. The driver commenced their shift at 1910 and reported no issues with fatigue during the investigation.

Based on the available information received, the ATSB was not able to confirm the response time of the NCO to the SPAD alarm. The ATSB was able to confirm that the initial radio call to the driver was not an emergency call.

Beckwith, Western Australia on 14 August 2019

At about 0610 on 14 August 2019, freight train 3PM7 passed signal 2R displaying a stop aspect at Beckwith Loop, Western Australia. The train was operated by Pacific National as a driver only operation (DOO). The SPAD event was not investigated by the ATSB. The following information was obtained from the Pacific National investigation report (and other sources where noted).

The train passed the previous signal (D466) displaying a caution aspect at 95 km/h and then signal 2R at stop at 104 km/h. The driver was not aware they had passed signal 2R at stop until notified by the Arc Infrastructure NCO. Information from Arc Infrastructure indicated that the NCO contacted the driver 31 seconds after the SPAD (with no emergency call broadcast). The Pacific National report indicated that the NCO’s call prompted an emergency brake application. with train 3PM7 passing signal 2R by approximately 1,605 m. It was reported that train 3PM7 came to a stand about 895 m from the lead locomotive of stationary bulk ore train 3036.

The investigation concluded that the ‘root cause’ was that the driver of 3PM7 failed to adhere to defensive driving strategies to allow them to stop prior to passing signal 2R as a result of being unaware of their surroundings. The report also identified the following contributing factors:

• The driver was in a state of sleep leading up to and during the SPAD event. The driver had about 35 hours free of duty at home (Merredin) before commencing the shift. The driver’s shift was scheduled to commence at 0055 and they were contacted by IPS at 2320 with a revised start time of 0230. They subsequently fell back to sleep and woke up at 0230. The driver reported that they had not rested well due to various factors. Soon after the SPAD, the driver reported to IPS that they ‘must have dozed off’.  
• The driver was able to acknowledge the locomotive vigilance system while being in a state of sleep. The driver acknowledged the vigilance system at least 8 times via vigilance acknowledgement pushbutton operation and throttle manipulation when both audible and visual alarms were active (50 to 60 second period) between Koolyanobbing East and Beckwith in Western Australia.

A number of safety recommendations were identified by Pacific National in relation to this investigation, including the consideration of some engineering controls related to locomotive‑based fatigue detection and vigilance systems. At the time of the Jumperkine accident (4 months later), Pacific National was progressing the accepted recommendations and actions.

Other potentially related SPADs without collision

The ATSB identified 4 other investigations with potential relevance to the current investigation, although the list was not intended to be exhaustive. The investigations included 3 completely missed SPADs (where a significant overrun past the signal or a very near miss had occurred) and 1 driver misjudged SPAD. The ATSB investigated occurrences were in Queensland and New South Wales.

Fisherman Islands, Queensland on 20 September 2004[78]

At about 0738 on 20 September 2004, 8868 was nearing the end of its journey from Rockhampton to the Brisbane port of Fisherman Islands when it passed signal FS66 showing a stop aspect. The passing of this signal at stop circumvented the initial phase of the level crossing protection and the train passed through the Pritchard Road level crossing before the boom gates were in the horizontal position. There were no injuries or damage as a result of this incident.

The driver noticed cars on the level crossing ahead and then noticed that signal 8868 was at stop when about 15 m from the signal and then applied emergency braking when at 48 km/h. The train stopped about 175 m past the signal (and 74 m beyond the level crossing). At that time, no SPAD alarm was provided to the relevant NCO for that signal. The area coordinator, who received a SPAD alarm, did not advise the driver or the NCO of the alarm.

The ATSB found that the driver of 8868 had a maximum of 4.5 hours sleep between shifts and was fatigued and probably experiencing microsleep episodes on the approach to signal FS66. The locomotive vigilance control system was ineffective in maintaining the driver’s vigilance. Additionally, it was found that there were no secondary protection measures to guard against such errors in a driver only operation.

Gloucester, New South Wales, on 11 March 2008[79]

At about 0750 on 11 March 2008, a Pacific National freight train 2WB3, travelling from Newcastle to Brisbane passed the Gloucester outer home signal at stop. The Australian Rail Traffic Corporation (ARTC) was the rail infrastructure manager.

At the time of the SPAD, the distant signal was at caution and the outer home signal was at stop. The rail traffic crew (driver and tutor driver) reported that visibility was reduced to 100–150 m in fog. When they sighted the distant signal at caution, they realised that they needed to slow down and the driver made a service brake application. The speed did not reduce quickly enough and the driver made an emergency brake application. At about that time, the rail traffic crew sighted the outer home signal about 100 m away. The train passed the signal at about 45 km/h and stopped about 140 m past the signal.

The NCO received a SPAD alarm (with visual and auditory alert) when 2WB3 passed the outer home signal at stop. About 22 seconds later, they received a phone call from a track worker about another matter and dealt with that matter. About 3 minutes after the SPAD alarm, the NCO received a call from the train crew advising of the SPAD. The NCO reported in interview that because 2WB3 was (only) occupying the track circuit beyond the outer home signal that they ‘knew’ it was stationary. The NCO also said that if the next track circuit beyond the home signal had showed as occupied then they would have initiated a call to the driver of train.

A contributing factor to the SPAD was insufficient sighting distance of the distant signal and outer home signal. One of the other findings in the ATSB report was the following safety issue:

Hurlstone Park, New South Wales, on 30 January 2013[80]

At about 0229 on 30 January 2013, a Pacific National freight train 9837, travelling from Nowra to Orange, passed signals SM109G and SM115G at stop between Dulwich Hill and Hurlstone Park in Sydney.

The ATSB found that the train crew did not take action in response to the aspects of 3 consecutive signals, resulting in the passing of 2 of those signals at stop without authority. It was found that the more senior co-driver had inadvertently fallen asleep on the approach to these signals. The trainee driver, in a reduced state of alertness, missed the first signal at caution, and the next signal at stop. It was found that likely due to an expectation that they would not have to stop at the incident location the more senior co-driver had probably relaxed and inadvertently fallen asleep on the approach to these signals. The network control officer broadcast an emergency message to the train crew after the first SPAD, with no response from the train crew. The trainee driver applied the brakes once the train passed the final signal at stop upon realising this signal applied to their train.

The investigation report stated that the available evidence indicated the driver was responding as required to the activation of the vigilance system, and that it was plausible that the trainee driver continued to respond to the vigilance system requirements in a reduced state of alertness, as had been implicated in other SPAD events.

A number of Pacific National’s policies and procedures were examined to determine if any area of the management or training of the train crew contributed to the incident. Fatigue management, and in particular over-reliance on the use of biomathematical model scores used to roster train crew, was one area where a need for improvement was identified (see also Development and review of FAID threshold values). The ATSB also concluded that Pacific National’s SPAD strategy focused on individual crew actions and the costs of SPADs, rather than developing integrated error-tolerant systems of work with regard for the broader systemic issues known to contribute to SPAD events.

Wagga Wagga, New South Wales, on 1 March 2019[81]

On the 1 March 2019, at 0504 local time, Pacific National (PN) grain train 5KC3 passed signal 04‑26 at stop at Wagga Wagga, New South Wales, while on a journey from Ararat, Victoria to Cootamundra, New South Wales. The train continued its journey north, passed another 2 signals at stop and through a set of points in Wagga Wagga yard. The train was stopped after the NCO contacted the train crew by radio and informed them of the SPAD events. Train 5KC3 was a multi‑rail traffic crewed operation.

Another train, 4BM9, had departed Bomen and was heading towards Wagga Wagga to cross 5KC3 about the same time that 5KC3 passed the signals at stop. After 5KC3 passed the up direction starting signal for the Wagga Wagga to Bomen section, it was heading into a potential collision with 4BM9. The 2 trains were around 2.5 km apart by the time they were both brought to a stand.

This investigation was conducted by the Office of Transport Safety Investigation on behalf of the ATSB and discontinued on 20 April 2021. However, at the time the discontinuation was published, the ATSB reported a number of factors:

• The rail traffic crew of 5KC3 commenced their shifts at about 2000 the previous evening and their recent shifts were not regarded as being outside the normal rostering parameters for the operator.
• The crew of 5KC3 did not react to the signal aspects within Wagga Wagga yard limits that were set at first to caution and then stop. The reason for the crew of 5KC3 not responding to the signal indications could not be conclusively determined.
• The data logger of the leading locomotive of 5KC3 indicated the driver was successfully responding to the demands of the locomotive vigilance control system.
• There was no evidence that either of the rail traffic crew of 5KC3 were affected by a medical or other health episode.
• Neither of the crew members could recall their journey beyond the southern entrance to Wagga Wagga yard limits until the notification of the SPAD events by the NCO.
• The reasons for the rail traffic crew not responding to the signals may have been determined if the driver’s cab was fitted with an inward-facing camera recording of the actions of the rail traffic crew.
• The contributing factors to this SPAD highlight the need for a positive train control system to provide additional control in the prevention of SPAD events and their subsequent consequences.

During the Jumperkine investigation, the ATSB sought additional information from ARTC, the rail infrastructure manager associated with the Wagga Wagga event. Based on this information, the response time of the NCO to the initial SPAD alarm was estimated to be 66 seconds, and the initial call to the rail traffic crew was not an emergency call. The rail infrastructure manager’s procedures on its New South Wales network for an NCO’s response to a train overrunning its limit of authority were similar to those of Arc Infrastructure (that is, there was no requirement to 'immediately’ stop the train that had overrun its authority and no requirement for the NCO to make an emergency radio call).[82]  

Information available to the investigation

The lead locomotive on 2K66 was fitted with an event recorder and a forward-facing camera. The microphone for the forward-facing camera was installed within the driver’s cabin. The ATSB investigation was greatly assisted by the availability of in-cab audio recording from the lead locomotive of 2K66. The in-cab audio recordings from the lead locomotive of 2K66 supported the written statements from the train crew, which in isolation, may have been considered controversial. This provided efficiencies in the evidence collection phase and removed the necessity for the train crew of 2K66 to be subjected to a formal ATSB interview.

Audio and video recording technology was not installed in the cab of the lead locomotive 7MP5. Although there was no requirement for such technology, had such technology been in place, its use may have enhanced the ability of the investigation to better understand the actions and state of the driver in the period leading up to the collision. Such technology would also have improved efficiencies in the analysis phases of this investigation.

In October 2021, ONRSR introduced a policy proposal that each passenger and freight train operating on the main line must be fitted with an in-cab audio and video recorder in the driver’s cab of the controlling locomotive. This proposal was endorsed by the Infrastructure Transport Ministers Meeting (ITMM)[83] in December 2021.

In December 2022, Ministers noted proposed legislation to require installation of audio and video cameras in driver cabs. Ministers also noted the desire to limit the circumstances under which ‘live-feed’ style recordings would be permitted to genuine emergencies only, and for the inclusion of reporting requirements. Ministers tasked ONRSR to work with unions, operators, and jurisdictions to settle any remaining changes to the proposed legislation. Agreement on the outstanding issues has not yet been reached.

The ATSB acknowledges the difficulties that rail transport operators, ONRSR, and rail safety worker representatives have had in working towards the implementation of this policy proposal. Given the significant benefits of in-cab recordings for rail safety investigations, the ATSB encourages ITM members, ONRSR, rail transport operators and representatives of rail safety workers to negotiate solutions and protections that will enable implementation of this policy proposal.

Safety analysis

Introduction

On 24 December 2019 at about 0159, Pacific National freight train 7MP5 passed absolute entry signal 12L into Jumperkine at stop (red aspect) and continued into a section of track that was occupied by train 2K66. Following this, at about 0200, 7MP5 collided with the rear of Watco grain train 2K66.

As 7MP5 passed signal U45 at caution (yellow aspect) and then approached signal 12L at stop, the train was operated within the limits of the track speed (80 km/h). The train was not slowed to enable a stop at signal 12L, and was not slowed for a 30 km/h temporary speed restriction (TSR) that was in place at points about 100 m past signal 12L.

Soon after passing signal 12L at stop, 7MP5 passed over a set of points that were the location of the TSR. Shortly after passing the points, which likely produced a noticeable noise and movement in the locomotive cabin, a service brake application was made. The extent of this service brake application was only likely to slow the train rather than bring it to a stop. Slowly decelerating, 7MP5 proceeded towards the stopped 2K66 ahead.

At about 0200:00, the rear of 2K66 was illuminated by 7MP5’s headlights. At about this time, while 7MP5 was travelling at 59 km/h, the driver of 7MP5 engaged the train’s emergency braking system. The braking system likely worked as designed and reduced the speed of 7MP5. However, about 12 seconds later, 7MP5 collided with the rear of 2K66 at about 41 km/h, and the collision impact was still sufficient to rupture the grain wagon at the rear of 2K66. Grain spilled from the grain wagon and filled the cabin of the lead locomotive of 7MP5. The driver of 7MP5 received fatal injuries.

In summary, in the minutes before the collision 7MP5 had passed signal U45 at caution and (4,197 m later) signal 12L at stop while travelling within the limits of normal track speed. The driver had also not slowed in preparation for the TSR section, which the driver was familiar with and was appropriately marked by a trackside advanced warning sign. The investigation found there were no technical faults with the trackside infrastructure or the train.

Consequently, this analysis considers reasons an experienced train driver passed a red signal and did not commence braking until it was too late to prevent the collision and the risk controls in place to manage the risk of such a collision. The analysis also considers the operation of the safeworking system that authorised 7MP5 up to the section of track occupied by a stationary train, as well as the Arc Infrastructure overrun of limits of authority processes.

Factors affecting train driver performance

Introduction

Train driving is a specialised task that involves conducting routine, frequently practiced tasks in a largely automatic manner (at a skill-based level) with occasional conscious checks on performance. In addition, it relies on well-developed safe-working and route knowledge, particularly the location of signals and the sequence in which they function. Instead of simply responding to each signal in isolation (as is largely the case with road vehicle drivers), train drivers are required to anticipate the state of future signals based on the signal aspects of the preceding signals and other relevant information.

The cognitive requirements of train driving include the successful retrieval of route information from long-term memory, as well as vigilant attention to the rail environment. The US Federal Railroad Administration (Multer and others 2019) identified that common cognitive problems associated with signal passed at danger (SPAD) events include:

• Perception and understanding of the railway environment are driven by expectations, resulting in potential for error if expectations are violated.
• Cognitive processes are vulnerable to distractions, both from external events and ‘internal’ mind wandering.
• Fatigue can increase susceptibility to distraction, and affect judgement and decision making.

In this case, the driver of 7MP5 made no attempt to slow the train after passing signal U45 and when approaching Jumperkine signal 12L. The train driver initially only made a service brake application to slow the train upon arrival at the TSR, which was associated with auditory and tactile cues as the locomotive ran over the associated set of points. As such, the evidence available to the investigation indicated that the driver did not notice the restricted signal aspects and detect a requirement to stop, or notice the TSR ahead sign and a requirement to slow the train. The driver likely only identified the overrun of their limit of authority when they noticed 2K66 on the track ahead, by which time it was too late to stop.

The ATSB considered several factors that may have affected the performance of the driver, including incapacitation, signal visibility, distraction, expectancy and fatigue.

Driver incapacitation

Information recorded by 7MP5’s event recorder showed that the driver continued to interact with the locomotive vigilance system during the approach to Jumperkine. In addition, the driver promptly initiated a service brake application in response to the cues of running over the points, and promptly initiated an emergency brake application at the time that the rear of 2K66 became visible. These actions indicated that the driver was not completely or significantly incapacitated by a medical event or other cause.

Signal and sign visibility

Although it was dark at the time, there was no evidence that conditions outside the cab of the locomotive affected the visibility of the signals or TSR warning signs. The available signal sighting and location of warning signs were aligned with the related Arc Infrastructure standards.

Distraction

One possible explanation for the missed signals during the approach to Jumperkine was that the driver’s attention was distracted by events outside the locomotive or with other tasks for an extended period of time. When train drivers are distracted, they are more likely to miss important information, and distraction has been associated with previous accidents and incidents involving missed red signals.

However, there was no evidence of any event or task that distracted the driver during the approach to Jumperkine. In particular, there was no evidence of any problems with the serviceability of the train and its systems, and the workload associated with the train driving task on the approach to Jumperkine was relatively low. In addition, there was no record that the driver was engaged in any communications via radio or on their phone in the period prior to passing signals U45 and 12L entering Jumperkine.

Onboard, in-cab recording technology was not installed in 7MP5, nor was there any requirement for such technology. Had such information been available it would have enhanced the ability of the investigation to understand the events inside the train cab during the period leading up to the collision.   

Expectancy

Expectations are based on past experience and other sources of information. They strongly influence where a person will search for information and what they will search for (Wickens and McCarley 2008), and they also influence the perception of information (Wickens and others 2013). In simple terms, people are more likely to see what they expect to see, and less likely to see what they do not expect to see.

Due to the performance characteristics of long and heavy trains, freight train drivers proactively manage train energy using the train brakes and throttle. Rather than reactively slowing and accelerating the vehicle based on the immediately observable environment, a train driver will frequently utilise route knowledge stored in long-term memory to anticipate the route ahead and thus the appropriate train handling technique. As such, train driving is a task in which the operator is frequently thinking about future events, and thus is particularly affected by expectations.

Train drivers form expectations for signal aspects based on long-term memory of that location. As described by Moray and others (2017):

This phenomenon, where a driver has a low expectancy for encountering a restricted aspect due to prior experience of mainly proceed aspects in previous journeys, has been implicated in previous SPAD incidents and accidents.[84]

The driver of 7MP5 was very familiar with the journey from West Merredin to Perth. ATSB analysis of the signal interlocking data sampled for the month preceding the accident showed that drivers rarely encountered a red aspect at Jumperkine signal 12L. It is likely that prior to commencing the journey to Perth, the driver had a low expectancy of stopping at Jumperkine.

Train drivers’ expectancies for signal aspects are also formed by information perceived during a train journey. This can be described in terms of a short-term mental model of the rail track the driver is utilising, with the signals encountered en route shaping the driver’s expectancy of other rail traffic and thus the probability of encountering restricted signals. Prior to reaching the restricted caution and stop signals at Jumperkine, 7MP5 travelled about 150 km and passed 33 signals sequentially with unrestricted green aspects. Drivers typically receive sequential green signals during journeys when no other rail traffic is ahead of them, and the driver may have formed a belief that this was the situation on the morning of the accident. Had the driver received a restricted signal sometime before approaching Jumperkine, even if it had subsequently cleared, this may have shifted the driver’s expectation such that they anticipated a higher likelihood of further restrictive signals. As it was, the sequence of unrestricted green signals probably contributed to the driver forming an expectation that upcoming signals, including U45 and 12L at Jumperkine, would also be green.

There was an open-channel communication between the NCO and the rail traffic crew of train 2K66 about 2K66 being bought to a stop at Jumperkine. This communication provided an opportunity for the driver of 7MP5 to identify that 2K66 would be stopped at Jumperkine, and thus form an expectancy of encountering restrictive signals when approaching that location. The ATSB could not determine why this advice was not effective for alerting the driver to a requirement to stop (see Driver awareness of 2K66 for further discussion), although notes that a radio call directly to the driver requiring a response would have provided more assurance that the driver understood the situation (see Pathing options and provision of traffic advice to drivers).

In summary, the driver of 7MP5 probably had a low expectancy of encountering a red signal at Jumperkine because of prior experiences at that location, and because of the consecutive green signals encountered during the journey. This low level of expectancy potentially increased the likelihood of the driver not detecting the yellow (caution) aspect in signal U45 and the red (stop) aspect in signal 12L.

Fatigue

Symptoms of fatigue

Although the ATSB could not directly observe the driver’s alertness during the journey, recorded information from the locomotive event recorder provided some indications. There were no recorded brake applications during the approach to signal 12L (which was red), or for the TSR shorty after 12L. This data indicates that the driver was not attending to the rail environment, or did not notice important changes or cues in the rail environment. Degradation of visual attention and the perception of important information is a known effect of fatigue.[85]

The locomotive data also showed that for about 7 minutes prior to the driver’s service brake application when they became aware of their arrival at the TSR, the only recorded driver actions were to acknowledge vigilance alarms. Towards the end of the journey, the driver began responding more slowly to the vigilance alarms, with most of these responses likely triggered by the audible alert. Slowing reaction times is also a well-established symptom of fatigue.

Overall, the evidence indicates the driver remained able to complete simple, routine tasks such as responding to vigilance alarms, but was potentially operating in such a degraded state that they were unable to identify and respond to the unexpected signals at U45 and 12L and the TSR warning signs. This pattern of behaviour is indicative of the driver being in a near-sleep state consistent with the phenomenon of ‘driving without awareness’.

Recent sleep

A common source of fatigue is restriction in the quantity and/or quality of recent sleep periods. Most people need at least 7–8 hours of sleep each day to achieve optimum levels of alertness and performance (Watson and others 2015). Research has shown that obtaining less than 5 hours sleep in the previous 24 hours, and less than 12 hours sleep in the previous 48 hours, is associated with significant performance decrements (Dawson and McCulloch 2005, Dawson and others 2021). Other research suggests a slightly stricter threshold, noting that 5–6 hours sleep in the previous 24 hours is problematic (Dawson and others 2021, Williamson and others 2011). A significant amount of research has also shown that a person’s performance starts to decline after 16–18 hours of extended wakefulness (Dawson and others 2021).

Witnesses told the ATSB that the driver reported being tired in the weeks prior to the accident, and the sick leave taken by the driver on 21 December was reported to be associated with tiredness. It is possible that the driver was experiencing chronic problems with fatigue, but based on the available information the ATSB was not able to confirm whether this was the case.

On the evening of 21 December, the driver had an opportunity for a normal amount of sleep (8 hours) before waking at about 0530 on 22 December. The driver may have also obtained some additional sleep (or nap) on the afternoon of 22 December, prior to commencing work at 2030 that evening. The extent to which the sleep prior to commencing duty on 22 December enabled the driver to overcome their reported tiredness could not be determined.

After finishing work at 0337 on 23 December, the driver had 17.7 hours off duty before starting work at 2120 on the night of the accident. Although this off-duty period provided a significant opportunity for the driver to sleep, most of it was outside of the normal sleep period (consistent with many shiftwork rosters). The driver was awake at 0844, providing a maximum sleep opportunity of about 4.3 hours until that time. The driver may also have obtained some additional sleep (or nap) during the afternoon of 23 December.

Any naps that were achieved on the afternoons of 22 and 23 December were probably of less restorative value than night-time sleep. If the driver did not achieve any sleep during the napping opportunities on 23 December, then at the time of the accident they would have been awake for over 17 hours.

There are significant differences between individuals in terms of how much sleep they obtain in general as well as in a particular situation. Research has shown that, on average, train drivers obtained significantly less total sleep during rest periods when the rest period began at about 0400 (about 6 hours) compared to when their rest periods begin in the afternoon or evening (Roach and others 2003). A biomathematical model of fatigue (BMMF) known as FAID Quantum (available since 2016) estimates the amount of sleep obtained during rest periods based on multiple research studies.[86] Given the driver’s roster, the model estimated that an average person would have obtained about 6.5 hours sleep during the rest period on 23 December (with 6.25 hours of this obtained from about 0437 onwards and the remainder in the evening).

Ultimately, based on the available information, it was not possible to determine exactly how much sleep the driver obtained in the 24 hours and 48 hours prior to the accident. The ATSB concluded that the driver probably obtained about 4 hours sleep on the morning of 23 December and potentially an additional 1–2 hours sleep during the afternoon of 23 December. In addition, in the 48-hour period up to the accident on 24 December (at 0200), the driver probably obtained 3.5 hours sleep (up to 0530 on 22 December) and potentially an additional 2 hours sleep during the afternoon of 22 December. Therefore, the driver had probably obtained about 5–6 hours sleep in the 24 hours prior to the accident, and about 10.5–11.5 hours sleep in the 48 hours prior to the accident. It is possible the driver obtained less sleep, and it is also possible but unlikely that the driver obtained more sleep.

Time of day

Human beings are typically most alert (and least fatigued) during the day, and least alert at night. This reflects the daily (circadian) cycle of sleep and wake. Work during the so-called ‘window of circadian low’ is widely understood as increasing the risk of fatigue-related errors. Similarly, rest opportunities at times outside the window of circadian low typically provide a poorer opportunity for restorative sleep.

The International Civil Aviation Organization (2015) defined the window of circadian low as:

The ICAO document further stated that peaks in sleepiness were ‘…different in people who are morning types (whose circadian rhythms and preferred sleep times are earlier than average) and evening types (whose circadian rhythms and preferred sleep times are later than average).’ Given that the driver was normally reported to awaken at about 0600, it is likely that a time of 0200 would have been associated with their normal window of circadian low.

The driver’s journey from Merredin to Perth was planned between 2207 and 0400, thus spanning the window of the circadian low. More specifically, the accident occurred at a time (0200) when the circadian component of fatigue exposure was relatively high.

Workload

Sustained periods of high workload can increase the likelihood of fatigue. Alternatively, as described in Other contextual information relevant to fatigue, sustained periods of low workload can exacerbate the effects of fatigue.

The geometry of the rail corridor for the section of rail track approaching Jumperkine probably provided a low level of task-related workload for train drivers when the signals were mainly green, such as on the night of the accident. Low workload and monotony on the night of the accident therefore increased the risk of the driver experiencing fatigue due to other factors.

Summary

Overall, there was insufficient evidence to conclude that incapacitation, signal and sign visibility and/or distraction affected the driver’s performance. Rather, the recorded data and the nature of the accident sequence were strongly indicative of the driver’s performance being impaired by fatigue. More specifically, the ATSB found that, due to a combination of insufficient sleep in the 48 hours prior to the accident and operating in the window of the circadian low, the driver of 7MP5 was likely experiencing a level of fatigue known to adversely affect performance. This fatigue almost certainly contributed to the driver not identifying and responding to signals U45 and 12L, and ultimately the overrun of authority and collision with 2K66 at Jumperkine at 0200 on 24 December.

Factors exacerbating the extent of fatigue on this occasion included the low workload or monotonous nature of the driving task in the minutes leading up to the SPAD and then collision. In addition, it is noted that the driver had not undertaken a rest break since commencing duty at 2120. The driver may also have not fully recovered from a period of being reportedly tired prior to commencing the shifts on 22 and 23 December.

As well as leading to a low workload situation, the extended period of 33 unrestricted green signals prior to reaching signals U45 and 12L, together with signal 12L’s normal setting being a proceed aspect, may have created a high level of expectancy that the signals would have been unrestricted. However, the extent to which this expectancy contributed to the driver’s reduced state of alertness, or the non-detection of the signal aspects, could not be reliably determined.

The ATSB notes that there was no requirement for the train to be fitted with in-cab voice or video recording devices. Had such technology been in use it would have enhanced the ability of the investigation to understand the actions and state of the driver, as well as better understand the quality of radio communications received by the driver in the locomotive cabin.

Effectiveness of the vigilance system

The driver of 7MP5 continued to respond to the vigilance system’s acknowledgement demands throughout the journey. Even though the driver’s response times slowed towards the end of the journey, consistent with the effects of fatigue, the vigilance system did not generate a penalty brake application. In this instance, the vigilance system was not effective at preventing the driver’s reduced level of alertness from leading to a collision. This outcome is consistent with the known limitations of vigilance systems and the development of other similar accidents.

The vigilance system fitted to NR class locomotives was an activity-based, fixed-cycle system. This system allowed the driver to pre-empt the visual alerts by resetting the cycle time using the vigilance acknowledgement pushbutton. There was also no limit to how many times the cycle time could be reset pre-emptively by the vigilance acknowledgement pushbutton. However, there was no evidence that the driver was regularly pre-empting the vigilance alerts prior to the collision on this occasion. Rather, as already discussed, towards the end of the journey the driver began responding more slowly to the vigilance alarm. The ATSB did not identify that either the fixed alerting cycle or ability to pre-empt the alert were contributory to the development of the accident.

The ATSB notes that the fundamental design of vigilance systems means that they detect some types of driver activity, and this is a limited approximation of alertness and attention. Regardless of whether vigilance systems use fixed-cycle or variable-cycle alerts, or if they are activity-based, the ability of drivers to respond to vigilance systems while not effectively attending to the driving task is a fundamental limitation of the technology.

Following a SPAD incident at Beckwith, Western Australia, in August 2019, the operator identified similar issues with the effectiveness of vigilance systems. The operator recommended changes including modifying the vigilance system technology to require alternate modes of response, such as a combination of actions that the driver must perform to reset the vigilance cycle. The ATSB is not aware of any research showing the effectiveness of such technology, but in principle it may reduce the likelihood of drivers responding to vigilance alerts in a highly automated way. The ATSB encourages operators, industry bodies and others to develop technological improvements to vigilance systems or other technologies to enhance the ability to identify when drivers are fatigued or otherwise inattentive.

In particular, the ATSB observed that, during the development of this accident, the train driver responded to the vigilance system alerts more slowly with the driver responding to mainly the audible vigilance alerts in the 35 minutes prior to the collision. The ATSB believes this pattern is indicative of fatigue and suggests that future improvements to vigilance system technology could include automatically identifying such patterns to prompt additional intervention.  

In summary, consistent with the known limitations of locomotive vigilance systems, the system on board train 7MP5 did not identify when the driver was experiencing a level of fatigue known to adversely affect performance and not be attentive to rail signals.

Fatigue risk management of rail traffic crew

Roster worked by the driver of 7MP5

As noted in Factors affecting train driver performance, the driver was probably experiencing a level of fatigue known to adversely affect performance during the journey from Merredin to Perth, and had reportedly been tired in the weeks before the accident. As such, the ATSB considered the risk controls used by Pacific National to reduce the likelihood of its drivers experiencing fatigue while operating trains.

It is noted that shiftwork is an inevitable part of commercial transport, and irregular working hours are a common feature of rail scheduling. Overall, night shifts will generally have a negative effect on a person’s amount of sleep, sleepiness and performance (Akerstedt and Wright 2009, Sallinen and Kecklund 2010). The primary reason is that people are generally adapted to a normal sleep‑wake cycle (with sleep at night), and a night shift forces people to work and sleep at the physiologically least suitable times of day.

Pacific National designed rosters for train drivers according to rules that were intended to ensure drivers had sufficient rest prior to commencing shifts. In general, the rostering rules provided significant rest opportunities to drivers and were consistent with industry practice for fatigue management.

Records showed that the driver of 7MP5 regularly worked on their rostered days off (RDOs), missing about half the planned RDOs in the 3 months prior to the accident. The effect of the additional shifts was an inevitable increase to the hours worked by the driver over the planned roster, and thus a potential reduction in the opportunity to obtain recuperative sleep. The additional shifts also increased the variability of shift timing, which was not consistent with the operator’s intention to provide stable shift patterns.

Overall, the roster worked by the driver was not ideal. However, although these factors had the potential to increase any fatigue experienced by the driver of 7MP5 in the weeks prior to the accident, the available evidence did not indicate that the driver’s roster was necessarily unsafe. The duty periods were generally a duration of 8 hours or less, and the roster typically provided an interval between shifts for the average person to obtain sufficient rest, although often not at the most suitable time of day (as is inherently the case with shiftwork). The driver had significant time off duty in the days prior to the accident, albeit with the use of a sick day on 21 December. They then had 17.7 hours free of duty prior to starting work on the night of the accident.

In summary, shiftwork will inherently increase the risk of fatigue, and the number and nature of the additional duties assigned to and undertaken by the driver increased the potential for fatigue. However, it could not be established that the pattern of shifts worked significantly contributed to the driver’s fatigue at the time of the accident beyond that associated with conducting tasks at 0200 in the morning.

The effects of shift patterns on sleep and fatigue are subject to individual variability, and it is possible that the driver of 7MP5 was more susceptible to these effects than the average person in the weeks leading up to the accident. The adequacy of shift patterns for reducing fatigue risk is also based on assumptions about how rest opportunities will be used, and it is possible that the driver may have engaged in activities while not working that contributed to fatigue in the weeks before the accident.

Fatigue reporting systems and proactive assurance of fitness for duty

The Pacific National fatigue risk management system placed an emphasis on drivers’ responsibility for ensuring they were alert when commencing driving duties. Drivers were expected to identify if they were unfit to perform duties, and self-report fatigue problems either at the start of their shift or during their shift.

Because the driver had recently been provided fatigue training and had worked in the rail industry for a number of years, it is likely they were broadly aware of the effects of fatigue on performance. However, the driver did not report that they were experiencing fatigue or had restricted sleep prior to commencing their shift on the evening of 23 December. Several factors may have contributed to this decision:

• The driver may not have known the extent that their performance was affected by fatigue. Research has shown that people will generally underestimate their level of fatigue (Battelle Memorial Institute 1998), including underestimating the impact of several days of sleep restriction (Banks and Dinges 2007). Some research has also shown that people overestimate the amount of sleep they obtain (Lauderdale and others 2008, Jackson and others 2018).
• Due to the variation in alertness associated with circadian factors, it is likely that the driver was more alert when they signed on for work at 2120 compared to later in their shift.
• Even if the driver had identified that they were experiencing a level of fatigue (or would likely experience a level of fatigue), they may have perceived implicit pressures that prevented self‑disclosure of that impairment. The driver had previously reported feeling as though they would be letting people down if they did not take additional shifts, and was probably aware that sourcing a replacement driver to run a train from West Merredin (in rural Western Australia) in the days before Christmas would be disruptive for the operator.
• The operator’s fatigue management training did not emphasise the amount of sleep typically required each day for an average person to maximise alertness and performance.

Once the journey commenced, the likelihood of the driver self-reporting that they were impaired due to fatigue potentially declined further. There would have been an additional operational burden associated with stopping the train to arrange a replacement driver, or even to some extent to request a rest break. There may also have been perceived difficulties associated with self‑disclosing fatigue after having commenced a journey.

Ultimately, the ATSB could not establish what the driver knew about their potential fatigue impairment prior to and during the journey to Perth. Nonetheless, the events preceding the accident highlight both the importance of train drivers enacting their shared responsibility to self‑disclose when they have had restricted sleep or otherwise at increased fatigue risk, and the importance of multi-layered fatigue risk management systems that do not extensively rely on self‑disclosure. The ATSB also notes that there were at least 2 previous SPAD events on the same network involving Pacific National trains conducting driver only operations (DOO) during 2016–2019 where drivers reported, after the event, difficulties with recent sleep and tiredness.

Although fatigue self-reporting was the primary mechanism for identifying real-time fatigue problems, there were very few instances of Pacific National drivers self-reporting fatigue in the years prior to the accident. Several explanations may account for this, including:

• drivers did not identify signs or symptoms of fatigue, and did not identify instances where they had insufficient sleep prior to commencing duty
• drivers identified fatigue-related impairment and removed themselves from duty using other mechanisms, such as taking sick leave.
• fatigued drivers were unwilling to self-report and instead presented for, or continued with, their duty.

Concerns about self-reporting fatigue are commonly perceived among train crew in the rail industry (for example, Fitness and Naweed 2017). The topic is not restricted to any particular operator, and has been discussed in other ATSB reports into rail and aviation occurrences.[88]

Although it was not possible to determine the exact reasons that Pacific National drivers seldomly self-reported problems with fatigue, the absence of fatigue reports was an indication that the systems that supported train drivers to identify and manage fatigue were not operating effectively. Given the importance of self-reporting within the fatigue management system, Pacific National could have taken steps to review the use of the self-reporting systems in order to identify perceived or actual barriers to drivers self-identifying fatigue problems. However, the operator had not undertaken any audits, driver surveys or other types of reviews for this purpose.

In addition, Pacific National had limited other processes in place to provide assurance that drivers had obtained adequate sleep during times off duty and were not operating trains while fatigued when working their rostered shifts. There was no routine questioning of drivers to proactively identify potential restricted sleep or fatigue-related problems unless a driver self-identified they were fatigued, another person raised concerns about a driver’s fatigue or alertness, or the driver’s roster exceeded FAID limits or other rostering rules. Passively assuming that personnel have conducted an accurate self-assessment of their fatigue or alertness level provides limited assurance that the risk associated with shiftwork rosters has been adequately managed.

Although proactively seeking assurance from drivers may not be considered necessary in all situations, it would be appropriate in situations where drivers had more potential to be at higher fatigue risk. Examples would include undertaking a significant number of additional shifts, conducting operations such as DOO on night shift, and potentially also if they have recently undertaken sick leave.

In summary, Pacific National's fatigue management procedures required train drivers to not work if they felt fatigued. This requirement primarily relied on drivers self-reporting if they felt fatigued, and there was no proactive assurance that drivers had obtained adequate sleep, including for higher fatigue risk situations. Self-reporting mechanisms were very seldom utilised and Pacific National had not conducted surveys or used other audit mechanisms or processes to identify any perceived or actual barriers to drivers self-identifying fatigue.

In the case of the Jumperkine accident, it was not possible to determine to what extent the driver was aware that they were experiencing the effects of fatigue, or were likely to experience such effects given their limited sleep. It was also not possible to reliably determine whether factors such as perceived pressure to complete the journey to Perth would have affected how the driver would have responded to proactive questioning about their recent sleep or alertness on the day of the accident. Consequently, there was insufficient evidence to determine whether limitations to the effectiveness of fatigue self-reporting systems, and the absence of proactive assurance of driver alertness, were contributory to the fatigue experienced by the driver of 7MP5. Nevertheless, improving these processes will reduce the risk of fatigue and the likelihood of future fatigue-related occurrences.

Use of FAID scores

The Pacific National fatigue risk management system included the use of the FAID biomathematical model of fatigue (BMMF) to evaluate planned shifts, to evaluate new and modified shifts, and to inform self-assessments of fatigue. The operator used threshold peak FAID scores of 80 for driver only operations (DOO) shifts, permitting scores of up to FAID 100 for other operations. When shifts were compliant with the relevant enterprise agreement (EA) rostering rules, rostering personnel relied on FAID scores to identify fatigue risks, and additional checks would not be made to determine roster fatigue risk when FAID scores were less than 80 for DOO. Train drivers sometimes worked shifts with predicted FAID scores above 80, although this was infrequent.

It is probable that the FAID thresholds used by Pacific National reflected a default to standard practice within the rail industry, which probably originate from guidance provided when FAID was first introduced. The ATSB reiterates analysis of Dawson and others (2017) which highlighted that these commonly used thresholds were initially developed as ‘guestimates’ and were not based on large-scale research. Consistent with the recommendations of the FAID developer, where operators apply FAID thresholds to evaluate rosters, this should be based on a documented assessment of the appropriateness of those thresholds for the planned operations. Operators should also undertake validation that, when employees work rosters designed according to set thresholds, they achieve adequate levels of rest.

Pacific National could not provide evidence of analysis of the appropriateness of its FAID thresholds or validation of the rest achieved by drivers based on using these thresholds. As such, the ATSB found that Pacific National’s rostering and fatigue management system had not conducted analysis to determine that train drivers working rosters according to its specified thresholds were sufficiently rested to conduct driving duties.

The ATSB notes that this problem was previously discussed in another ATSB investigation involving Pacific National (RO-2013-003). In addition, similar problems have also been identified with other transport operators in ATSB investigations (for example, RO-2019-018[89] and AO‑2009‑072).[90] Accordingly, together with assurance of the effectiveness of fatigue reporting, the application of appropriate thresholds when using a BMMF is another important lesson for all transport operators.

Use of technical solutions to manage SPAD risk

The defences-in-depth approach to safety seeks to ensure that major, catastrophic risks are controlled by multiple-overlapping forms of risk controls. Administrative controls, such as procedural rules, provide the weakest form of protection against the likelihood and consequence of individual actions by frontline personnel that increase risk. In contrast, technical solutions or engineering controls will generally provide more assurance that the risk associated with individual actions can be managed effectively.

The safeworking system for rail traffic between Merredin and Perth was primarily reliant on train drivers correctly observing and responding to rail signals to prevent an overrun of their limit of authority. Although reliance on signal compliance has been central to the rail safety system in Australia for many years, it is fundamentally limited in situations where the driver is not fully attentive to the rail corridor or misperceives a signal. Existing risk controls focus on ensuring train drivers remain alert and able to identify signals, however there will always be some instances when drivers mistakenly proceed through signals at stop. Human performance is inherently variable, and there are multiple reasons why a competent, well-trained driver may not correctly observe a signal – with fatigue being one of these reasons. The number of driver completely missed SPAD events on Australian railways each year is evidence of this inherent vulnerability to error.

In recent decades, rail safety investigations in the United States and Canada have made observations about the limitations of reliance on signal observance, and the importance of technical solutions or engineering controls to prevent SPADs or prevent collisions following SPADs. Since December 2020, and following many recommendations made by the National Transportation Safety Board (NTSB), all Class 1 railways in the United States have implemented fail-safe engineering controls, collectively known as positive train control.[91] These systems utilise a combination of train-borne and track-side technologies to prevent specific forms of accidents (such as train-to-train collisions, overspeed derailments, incursions into work zone limits, and movements through a switch left in the wrong position). As noted by the Transportation Safety Board of Canada (2022):

In the Australian freight rail network, there is no obligation to implement positive train control / automatic train protection style systems. At this time, there is very low coverage of these systems, and no such system existed on the track section between Perth and Kalgoorlie. The same situation also applies on some suburban rail networks in Australia. The ATSB encourages rail industry organisations to consider, develop and / or implement technical solutions that reduce the reliance on rail crews’ observance of signals as a single point of failure, noting that the continual improvement of safety within the rail system is a shared responsibility between rolling stock operators and rail infrastructure managers.

The following sections discuss Pacific National and Arc Infrastructure’s risk controls for managing SPAD risk between Perth and Kalgoorlie, given the absence of technical solutions (for example, automatic train protection). As noted in later sections, the train control system (TCS) did have a SPAD alarm, a reactive or recovery risk control that could reduce the potential consequences of a SPAD. However, processes associated with this risk control reduced its potential effectiveness.

Pacific National risk controls for reducing the risk of SPADs

Overview

As already noted, the safeworking system for rail traffic between Merredin and Perth was primarily reliant on train drivers correctly observing and responding to rail signals to prevent an overrun of their limit of authority. As such, the rolling stock operator’s risk controls in place sought to reduce the likelihood of SPADs by ensuring train drivers were familiar, alert and attentive to the rail environment, including through the use of onboard vigilance systems and the fatigue risk management system.

Limitations of preventive fatigue management

Key to Pacific National’s risk controls for ensuring drivers were able to remain alert during train journeys (and therefore avoid SPADs) was the fatigue risk management system. Rostering processes provided opportunity for sleep prior to the driver’s journey to Perth, however the driver probably did not obtain sufficient sleep on this occasion and (as already discussed) their performance was impaired during the accident journey. As such, this accident illustrates that driver fatigue can develop through many different mechanisms, including those outside of an operator’s control.

Due to the variable nature of individual circumstances, it is likely that over a sufficiently large number of shifts there will always be instances where drivers have not achieved enough sleep prior to commencing work, regardless of the rostering rules applied. The risk of fatigue is inherently greater for operations conducted at night, particularly during the window of circadian low. Due to circadian patterns of sleep and alertness, drivers conducting night journeys will experience lower levels of alertness and will typically find it much more difficult to obtain restorative sleep during the day.

The safe management of fatigue in this situation required the driver to not drive on the night of the accident, having probably not had sufficient sleep for work, or to seek additional mitigators (such as a rest break). The rolling stock operator’s fatigue risk management system included procedures requiring drivers to self-report if they were fatigued, however (as already discussed) there was limited assurance that this process would be effective. With the driver commencing the journey while likely experiencing a level of fatigue known to adversely influence performance, it was no longer possible to rely on the driver for adequate levels of attention and alertness. The safety system therefore relied on systems on board the train or within trackside or network infrastructure to ensure the safe journey.

Pacific National documentation included the onboard locomotive vigilance system as one of the risk controls for mitigating against driver performance being compromised by fatigue and leading to a SPAD. As summarised in Effectiveness of the vigilance system, the effectiveness of locomotive vigilance systems for assuring driver attention, or for preventing fatigue-related impairment other than complete incapacitation, is inherently limited.

Risk management for driver only operations

The Pacific National operational model for its rail operations between Perth and Kalgoorlie included the use of driver only operations (DOO), including at night and during the window of circadian low. DOO involved significant differences to the hazards from multi-rail traffic crewed operations, both in terms of the management of fatigue risks and the ability to prevent, detect and manage the consequences of driver errors.

Multi-rail traffic crewed operations present opportunities for fatigue management that are not possible in DOO journeys. As a preventative control for fatigue-related errors, train drivers can share duties along the journey, facilitating rest breaks and reducing time on task. The second crew member can help identify the signs and symptoms of fatigue, increasing the likelihood of the primary driver either having a break from the driving task, or utilising another form of fatigue countermeasure.

In addition, error management controls appliable to multi-rail traffic crewed operations include the requirement for the rail traffic crew to conduct cross-checking of each signal, reducing the likelihood that a signal will be missed or misread. The second driver can also remind the primary driver of the aspect of the preceding signal, helping reduce the risk of errors where the primary driver misperceives or forgets the previous signal. Although these procedural controls are imperfect and rely on the second driver actively engaging in the train driving task, they afford multiple opportunities to correctly observe rail signals and minimise the risk of one driver experiencing fatigue. Driver completely missed SPADs and (occasionally) collisions do still occur in multi-rail traffic crewed operations, but overall the risk is reduced through the use of procedural controls.

The Pacific National fatigue risk management system sought to reduce the likelihood of driver fatigue during DOO journeys by including greater restrictions on working hours, such as shorter shift times and longer breaks between shifts, more restrictive FAID thresholds, and reduced vigilance system cycle times. However, there were no risk controls that mitigated the risk associated with a fatigued (or otherwise inattentive) driver missing or misperceiving signals. A single-person operation cannot facilitate a cross check or reminding process. DOO operations are therefore reliant on a single driver confirming and remembering rail signals; in other words, they are a single point of failure system. The operator’s safety management system did not explicitly identify the absence of cross-checking or reminding as a potential for greater risk during DOO, and there were no additional controls that met that function. 

Analysis of driver only operations safety records

Pacific National had analysed the safety records for DOO and multi-rail traffic crewed operations and concluded there was no evidence of higher incident rates for DOO. However, this analysis included incorrectly categorised safety incidents. When the safety incidents were categorised correctly, the data indicated a higher SPAD rate for DOO journeys.

Had Pacific National correctly identified the higher rate of SPAD for DOO, this should have prompted a review of DOO risk management and the inclusion of additional risk controls for these operations. In other words, the incorrect categorisation resulted in a missed opportunity to review the risk controls for DOO SPAD and fatigue management.  

Summary

Among the risk controls identified by the operator to manage the risk of a train driver not attending to rail signals was a vigilance system, which was unlikely to effectively reduce the risk in the case of driver fatigue. Although, the fatigue management system provided rest opportunity to train drivers prior to DOO shifts, there were residual risks of driver fatigue, particularly during the window of the circadian low.

Without any technical solutions or engineering controls that assured rail traffic separation, or detected when a driver was fatigued and not attentive to the rail environment, the safety management system for Pacific National DOO relied on the single driver being attentive to rail signals for safe operations: this was a single point of failure safety system. In situations when the driver was fatigued or inattentive for other reasons, there were no risk controls in place that would identify driver inattention or prevent inattention from leading to a major accident.

In summary, the ATSB found that Pacific National had limited controls for managing the risk of signals passed at danger during driver only operations, including incidents associated with driver fatigue. The safety system relied on a single driver correctly observing and responding to signals at all times, including during the window of the circadian low (when fatigue risk is greatest).

Arc Infrastructure risk controls for managing the risk of SPADs

Overview

As noted in Use of technical solutions to manage SPAD risk, the safeworking system for rail traffic between Merredin and Perth was primarily reliant on train drivers correctly observing and responding to rail signals to prevent an overrun of their limit of authority. However, there were various risk controls that the rail infrastructure manager used, and others that also could have been used, to minimise the risk associated with driver completely missed SPADs. Prior to discussing such risk controls, this section briefly discussed the extent to which the driver of 7MP5 was aware of the location of train 2K66.

Driver awareness of 2K66

As described in the section on Expectancy, the driver of 7MP5 probably had a low level expectation of encountering a restrictive aspect signal approaching Jumperkine, based on prior experiences at that location and because of the 33 consecutive green signals encountered during the journey.

The driver maintained their train at about 72 km/h after passing signal 12L at stop and did not commence braking until about 8 seconds and about 160 m after passing the signal. The timing of this brake application was shortly after the train passed over a set of points. The ATSB considered the audible clunking sound triggered by passing over the points likely stirred the driver into a more alert state. The driver’s recognition of the points also likely alerted them to their location and arrival at the TSR location at Jumperkine.

At this time the driver’s initial braking application was limited to a service brake application. The use of service brake was consistent with the train driver attempting to reduce the speed of their train. The most likely explanation for this action was that the driver identified their arrival at Jumperkine, then recalled the long-standing temporary speed restriction and attempted to comply with it by slowing the train.

This initial service brake application was not consistent with the driver intending to stop the train after passing the signal at stop, or to stop before train (2K66) shortly ahead. That is, had the train driver known or recalled 2K66 was stopped at Jumperkine, even if signal 12L was missed, the expected response upon identifying their location at Jumperkine would have been to stop the train.

ATSB analysis showed that application of the train’s emergency brake at this time may have prevented the collision, and if not, almost certainly would have reduced the impact forces. The driver of 7MP5 applied the emergency brake about 175 m before the collision. This emergency brake application coincided with the rear of 2K66 coming into view around a left curve. This set of evidence indicates that the driver of 7MP5 was reacting to what was seen, further supporting a summary of the analysis above that the train driver was almost certainly not aware that signal 12L was at stop and that 2K66 was stopped ahead when they arrived at Jumperkine.

In summary, the ATSB found that, upon arrival at Jumperkine, the driver of train 7MP5 was almost certainly unaware that they had passed signal 12L at stop (red) and that train 2K66 was stopped at Jumperkine. The driver did not commence emergency braking until the rear of 2K66 became visible on the track ahead, at which point it was too late to avoid a collision.

Pathing options and provision of traffic advice to drivers

In order to comply with a work directive and facilitate the movement of train 3PM4 on the up track past 2K66 on the down track, the NCO stopped 2K66 at Jumperkine. At this time, 7MP5 was pathed towards the stopped 2K66. Although not without risks of their own, defensive opportunities existed that could have been considered to potentially reduce the likelihood and/or consequence of a driver completely missed SPAD involving 7MP5. These opportunities included:

• defensive pathing of 7MP5 towards the un-occupied middle road at Jumperkine (proactive but not optimal as it created a risk of derailment if the train exceeded the turn out points speed limit)
• stopping 7MP5 at the previous controlled absolute signal at Moondyne about 18 km away from signal 12L (provided more time to execute overrun of the limits of authority process if a SPAD occurred at Moondyne)
• the NCO directly communicating with 7MP5 and confirming receipt of advice from the driver that there was a stopped train ahead (proactively providing traffic information and confirming awareness to reduce the likelihood of a SPAD).

Although such potential defensive operational options were available, there were no Arc Infrastructure operational processes, rules, or guidance requiring these options to be considered or applied by NCOs. As a result, reliance on drivers responding to displayed signal aspects became even more critical to control the risk of collision when trains were closely routed towards stopped trains.

In addition to the displayed signal aspects, at the time of the accident a defensive opportunity existed where drivers could gain supplementary situational knowledge of what was happening around them from listening to open channel communications between NCOs and other rail traffic crews. In the case of 2K66, the NCO did proactively communicate to the rail traffic crew that they would be brought to a stop at Jumperkine. Although 2K66’s rail traffic crew acknowledged receipt of this open channel communication, there was no requirement for the following driver of 7MP5 to acknowledge and repeat back the advice that they too would need to stop. In the absence of a repeat-back confirmation from the driver of 7MP5, the NCO was unaware whether the driver had received and/or understood the open-channel communication.

The NCO’s proactive open channel communication was heard by other rail traffic crews. In the absence of recorded sound within the cab of 7MP5, the ATSB could not confirm if the open channel communication was received by 7MP5’s radio and heard by the driver of 7MP5. The driver was required to listen out for communications on the open channel and there was no obvious reason why the driver would have turned the volume of the radio down or been distracted by other radio communications or tasks at the time. However, without a specific communication directed to the driver of the 7MP5 to inform them that they would also be required to stop behind 2K66, and confirm their receipt of this message, there was no assurance that the driver understood the situation.

Additionally, there was also the potential that the driver heard the communication between the NCO and the crew of 2K66 and then did not later recall it when approaching or after arriving at Jumperkine. Remembering information about the stopped train and anticipating signals to slow the train would require prospective memory (Loukopoulos and others 2009). Prospective memory refers to an intention to perform an action at a later time, and a delay between forming the intention and acting on it. It is known to be vulnerable to failure and has been associated with many incidents in aviation and other work domains (Dismukes 2012). Conditions that increase this vulnerability include the delay between the intention to do a task and the execution of the task being filled with other activities, an interruption to a task sequence, and the cues or prompts to retrieve the intention from memory not being explicit (Dismukes 2012). In the case of train 7MP5, the driver probably did not have any strong cues or prompts for recalling the presence of the train ahead. In addition, there was a significant delay between the radio call to 2K66 (0134) and 7MP5’s arrival at Jumperkine (0159).   

In previous ATSB investigations, findings have been made about the absence of pre-warning advice of stopped trains to rail traffic crews, in particular collisions at Mile End, South Australia, in March 2015, and at Yass, New South Wales, in December 2010. The trains instigating the collision in both of these accidents proceeded into sections of track occupied by stopped trains, without knowledge of the stopped train ahead. Although these trains were authorised via low speed / calling on signals, with administrative rules that were not observed, the drivers operated their trains without awareness that there was actually a train stopped ahead of them. Due to local environmental circumstances, upon sighting the stopped train ahead neither of the rail traffic crews could stop their trains before a collision.

In summary, in the case of the Jumperkine accident, defensive opportunities existed that could have been applied to potentially reduce the likelihood and/or consequence of a driver completely missed SPAD. More specifically, the Arc Infrastructure practice of pathing a following train up to the same section of track occupied by a stopped train, coupled with no requirement for the NCO to communicate and confirm rail traffic crews were aware when approaching another stopped train, increased risk.

In this instance, it is probable that due to the effects of fatigue, the driver of train 7MP5 was not attending to rail signals at Jumperkine. In addition, there was insufficient evidence to determine if the driver had heard and attended to radio calls from the NCO when approaching Jumperkine. Given this context, there was insufficient evidence to determine whether the pathing of 7MP5 up to the section of track occupied by train 2K66 and no direct advice to the driver of 7MP5 was contributory to the development of the accident. Stated alternatively, it is possible that the collision could have still occurred even if additional defensive opportunities had been utilised.

Response to SPAD alarm

Introduction

Train 7MP5 passed signal 12L at about 0159:24 and a SPAD alarm was recorded by the train control system (TCS) alarm log file at about 0159:25. The time the SPAD alarm was displayed to the NCO was not recorded. However, based on simulations, it is very likely that it was displayed about the same time.    

At about the time that the emergency brake commenced application on 7MP5 (0200:00), 34 seconds had elapsed since the SPAD alarm was very likely displayed to the NCO. The timing of the NCO’s initial attempt to contact the driver of 7MP5 was 0200:07, which was very likely about 42 seconds after it was displayed to the NCO. The NCO’s initial call was also about 5 seconds prior to the collision (0200:12) and 12 seconds after the driver had already applied the emergency brake.

There are 2 key aspects of the NCO response that require further discussion: the response time and the type of response.

Response time

A range of factors can influence the time it takes to respond to an alarm or similar situation. For example, Stanton and others (2008) discussed the model of alarm initiated activity (AIA), which includes a number of stages: observation (detection of the alarm), acceptance, analysis (assessment and prioritisation), investigation (of the underlying reasons), correction (implementing the response), monitoring (the effectiveness of the response), and resetting (or extinguishing the alarm).[92] Each of these phases adds to the total response time, with the analysis and investigation phases involving more complexity and often contributing most to the overall time. A range of different factors can influence the time taken in each phase, including the way the alarm system is designed, and the expectancies and workload of the person involved.

Stanton and Baber (2008) discussed the specific case of the collision at Ladbroke Grove in the United Kingdom between 2 passenger trains. They noted that the official inquiry questioned why it had taken 18 seconds for the NCO (known as a ‘signaller’) from the onset of the SPAD alarm to implement an action (in this case switching the next signal for the train that exceeded its authority to stop). Using a critical path analysis technique, the authors modelled an expected response time of about 19 seconds for such a response. Stanton and Baber also noted that expectancy could play a key role in such events, with the signaller involved in the Ladbrook Grove accident stating that in every other SPAD they had been involved with the train had stopped within the overlap, and that in this case they initially monitored the situation expecting the train to stop.[93]

The alarm system, task and context involved in the Ladbrook Grove accident was different to the Jumperkine accident, and it is difficult to extrapolate an expected response time from Stanton and Bader’s analysis. However, based on the system described, it appeared that the task of locating the alarm message and interpreting that message would probably have been simpler in the Jumperkine accident.[94] Nevertheless, due to a range of potential factors, there are likely to be significant differences between NCOs in responding to any particular situation, and significant differences between a particular NCO’s responses to similar situations.

As with most types of SPAD alarm systems, the Arc Infrastructure SPAD alarm included an auditory tone as well as a visual dialogue box. The NCO recalled looking at the TCS screen when the SPAD alarm appeared and attempting to contact the driver soon after noticing the SPAD alarm. Although it is known that NCOs may prioritise making safe existing safety-critical tasks before actioning new tasks like responding to SPAD alarms, the ATSB could not determine if the NCO had any other high priority tasks at the time or the nature of any specific contextual reasons for the 42-second response time taken by the NCO. However, it is noted that the response time in this case was not unusual (relative to available response times to 2 other driver completely missed SPADs on the same network and others on a network with a similar system). In addition, as discussed in the next section, the rail infrastructure manager’s processes did not explicitly require an immediate response.

Type of response

Considerations about the effectiveness of the NCO response time need to allow time for the NCO to verbally communicate the essential information via radio, the driver to understand the information and determine the required response, the time to initiate the braking action, and the time for the emergency brake application propagation.[95] The overall time to achieve braking action following the start of an NCO radio call will not be immediate, and could vary significantly depending on several factors.

The initial radio call from the NCO to the driver of 7MP5 only included the train number and a request for the driver to contact the NCO, with no urgency attached and no emergency call. Accordingly, it could have taken several seconds for the driver to respond to the NCO’s radio call and then the nature of the problem to be conveyed by the NCO. The driver’s response to the initial call may have been delayed if they were busy with other tasks, still experiencing the effects of fatigue, or experienced a significant degree of surprise regarding the situation. In addition, as already discussed, the volume setting of the radio in the locomotive could not be determined, although the driver was required to be maintaining a listening watch.

Given these types of aspects, it is clear that an initial radio call from an NCO to a driver that is an emergency call to stop the train is very likely to significantly reduce the time to stop a train compared to a standard call. Again it is noted that the type of NCO response in this case was not unusual relative to that used in other SPADs on the same network referred to in this report and, as discussed later, the rail infrastructure manager’s processes did not explicitly require an emergency call. In contrast, the ATSB is aware through previous investigations of prompt, emergency calls by NCOs to drivers of trains that have exceeded their authority on multiple other networks, many of which played an important role in reducing the risk associated with those SPAD events.

Potential influence of the NCO response

As already noted, the NCO’s initial call to the driver occurred after the driver had already applied the emergency brake. Therefore, the call was too late to have any influence on the consequences of the accident.

The ATSB considered the extent to which an earlier response by the NCO to the SPAD alarm could have had on the outcome. However, such an analysis was complicated by a number of factors:

• There was limited information available to determine what would be regarded as a reasonable response time or a normal response time range for an NCO on this type of system (assuming the NCO was required to and intending to provide an immediate or high-priority response). A person’s overall response time varies significantly depending on a range of factors, including workload, focus of attention, expectations, the salience of the event or hazard, and the complexity of the response (Wickens and McCarely 2008, Wickens and others 2013). In addition, response times are not normally distributed, and consequently design standards in some contexts are based on an 85^th or similar percentile response rather than a median or mean response time.
• As already discussed, the type of NCO radio call will also have an influence on a driver’s response time. An emergency call will very likely be more effective than a standard radio call, but there can be variations in exactly how either type of radio call is delivered that could influence a driver’s response.
• There was uncertainty regarding how quickly the driver would have responded to a radio call, particularly given their state of alertness. Although it is very likely that a response to an emergency call would have been quicker than a standard radio call, there may still have been some delay. It is noted that the driver appeared to respond promptly when applying a service brake application to the stimulus of running over the points. However, the extent to which a radio call would have had the same effect as this stimulus is unclear.
• There was uncertainty regarding the actual deceleration rate being achieved by the train. Although the available recorded data indicated that the train’s braking performance was better than the applicable requirements, the actual braking system response could not be determined with certainty.
• There was uncertainty regarding what speed would have resulted in significantly less serious consequences.

The ATSB notes that the median response time for an NCO to make an emergency call in 4 other occurrences it has investigated with known NCO response times (and emergency calls) on other networks was 9 seconds (ranging from 6 to 17 seconds). If an emergency call was made within 9 seconds and emergency braking commenced within 12 seconds of the SPAD alarm on this occasion, then it is likely that the train would have stopped prior to the collision or a collision would have resulted in only minor consequences. However, for the reasons stated above, there is uncertainty whether such an overall response time could have reasonably been achieved on this occasion and also some uncertainty regarding the effects of slower responses times.

Although determining the influence of different response times in this case was difficult, this accident has shown that response times to SPAD alarms need to be quicker than 42 seconds to effectively reduce collision risk, depending on the separation between the signal and the end of a train or other hazard ahead.

Summary

In summary, after the Arc Infrastructure train control system generated a signal passed at danger (SPAD) alarm when train 7MP5 passed signal 12L at stop (red), it was very likely about 42 seconds after receiving the alarm before the NCO began calling the driver of 7MP5. The timing of this call was not effective in communicating the need to stop the train in time to avoid the collision or reduce the speed of the train prior to the collision. In addition, the NCO’s call was not an emergency call and did not indicate a level of urgency. Even if the NCO had made an emergency call rather than a normal call to the driver, a significantly faster response time would have been required to have had a meaningful influence on the consequences of the accident.

SPAD alarm response processes

The SPAD alarm functionality within Arc Infrastructure’s train control system was a reactive or recovery risk control, in place to minimise the consequences of a train passing a signal at stop and overrunning its limits of authority. Given that there were no technical solutions or engineering controls in place to automatically prevent a train from overrunning its limits of authority (or automatically stop a train that had overrun its limits of authority), the SPAD alarm had a potentially important role in minimising the consequences of a driver completely missed SPAD. However, the success of a SPAD alarm at preventing a more serious consequence following an overrun of the limits of authority was reliant on both the time available before a train reaches a point of conflict, and the immediacy and nature of both the NCO and rail traffic crew response.

The Arc Infrastructure Network Safeworking Rules and Procedures – Overrun of Limit of Authority, Rule Number 6001, in respect to rail traffic crews, required immediate action upon awareness of an authority overrun. In contrast, the rail infrastructure manager’s requirements for NCOs, although mandatory, were not required to be immediate. This was a significant point of divergence from the template Rail Industry Rail Industry Safety Standards Board (RISSB) Australian Network Rules and Procedures Rule 6001, which the Arc Infrastructure Rule 6001 was based on.

In addition to not explicitly requiring an immediate response, the rail infrastructure manager’s procedures with respect to its NCOs also did not explicitly require an emergency radio call in response to a SPAD alarm. More broadly, Arc Infrastructure had also not specified its performance criteria for NCO responses to SPAD alarms or had any system in place to monitor this performance. Overall, this situation was consistent with the potential importance of SPAD alarms not being appropriately recognised within the rail infrastructure manager’s safety management system. In particular, its risk register had not specifically identified or considered the immediacy of NCO responses to a SPAD alarm as a potential risk mitigation for a collision.

In summary, the Arc Infrastructure processes for the management of rail traffic overrunning its limits of authority were reliant on the immediate actions of the rail traffic crew and did not explicitly require immediate actions from the NCO. This situation increased the risk of driver completely missed SPAD events, particularly in cases where the rail traffic crew’s awareness or capacity was potentially compromised.

Post SPAD actions

After 7MP5 proceeded past signal 12L at danger, the NCO and rail traffic crew were required to action their responsibilities of the Arc Infrastructure Network Safeworking Rules and Procedures – Overrun of Limit of Authority, Rule Number 6001. These requirements included the rail traffic crew who had overrun their limit of authority broadcasting an emergency radio call if they believed there was an immediate danger (to other rail traffic or other parties). The RISSB Australian Network Rules and Procedures and Arc Infrastructure versions of Rule 6001 included a similar requirement.

In contrast, although the NCO was required by the Arc Infrastructure rule to arrange to stop rail traffic that had overrun its limits of authority and other rail traffic movements that were at risk, there was no explicit requirement to broadcast an emergency radio call (or to do this immediately). The RISSB rule also included no explicit requirement for an emergency radio call, although it did require the NCO to ‘immediately’ arrange to stop rail traffic.

Relying only on rail traffic crew to broadcast an emergency call has obvious limitations. In the case of a driver completely missed SPAD, the driver of the train that has overrun its authority has no awareness of the SPAD. Therefore, they have no awareness of the need to make such an emergency radio call until they become aware of the situation. For example, the driver of 7MP5 only became aware of the situation shortly before the collision, too late to prevent the collision or reduce the severity of its consequences.

In addition, other rail traffic crews will often not be aware of the situation prior to a collision or, in many cases, after a collision. For example, no other rail traffic crews had any awareness of the SPAD involving 7MP5 prior to the collision. After the collision, the rail traffic crew of 2K66 were aware that they had observed a bump in their train that coincided with a locomotive train line fault alarm. However, due to the absence of an emergency call, the crew of 2K66 were unaware of the overrun of the limit of authority immediately behind them by 7MP5. While the crew of 2K66 were suspicious of a collision, the normal brake pipe and brake pipe flow rates observed at that time coupled with the rarity of main line collisions likely focused their attention on troubleshooting the source of the locomotive train line fault alarm within their trailing locomotive.

At the same time the NCO, aware of 7MP5 overrunning its limit of authority but unaware of a collision, was focussed, as required by Rule 6001, on trying to contact the driver of 7MP5 to either confirm they had stopped or direct them to stop. The NCO made 5 attempts to make direct contact with the driver of 7MP5 (with no emergency call or explanation of the situation) before requesting the crew of an approaching train, 3PM4, to try to make contact with 7MP5. In the absence of any collision advice, the NCO, was unaware of the collision between trains 7MP5 and 2K66, and did not appear to consider 3PM4 to be at risk entering Jumperkine adjacent to the location of trains 7MP5 and 2K66.

Overall, the rail traffic crew of 2K66 and the NCO were in possession of partial information. This partial information, if shared between the rail traffic crew of 2K66 and the NCO, could have enabled the NCO to become aware of the collision and identify the risk to 3PM4. Rather than waiting to understand the full nature of the situation, a more effective approach would be to require an NCO to make an emergency call to all affected rail traffic in any situation where a known SPAD has occurred.

In summary, although the NCO received a SPAD alarm involving 7MP5 passing signal 12L at stop, there was no collision advice available to the NCO and the NCO was unaware of the train's collision with the stationary train 2K66. Accordingly, the NCO did not take action to stop train 3PM4 entering the same location, increasing the risk of a secondary collision involving 3PM4 operating on the adjacent track.

More broadly, Arc Infrastructure’s procedures included no requirement for an NCO to make an emergency call and advise potentially ‘at risk’ trains that another nearby train had overrun its limit of authority. In addition, although RISSB’s procedures required an NCO to ‘immediately’ stop other rail traffic, they did not explicitly require the use of an emergency call.

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.  Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the collision of freight train 7MP5 into train 2K66 at Jumperkine, Western Australia, on 24 December 2019.

Contributing factors

• Train 7MP5 passed absolute entry signal 12L into Jumperkine at stop (red aspect) and continued into a section of track that was occupied by train 2K66.
• Due to a combination of insufficient sleep in the 48 hours prior to the accident and operating in the window of the circadian low, the driver of 7MP5 was likely experiencing a level of fatigue known to adversely affect performance.
• Consistent with the known limitations of locomotive vigilance systems, the system on board train 7MP5 did not identify when the driver was fatigued and not attentive to rail signals.
• Pacific National had limited controls for managing the risk of signals passed at danger during driver only operations, including incidents associated with driver fatigue. The safety system relied on a single driver correctly observing and responding to signals at all times, including during the window of the circadian low (when fatigue risk is greatest). (Safety issue)
• Upon arrival at Jumperkine, the driver of train 7MP5 was almost certainly unaware that they had passed signal 12L at stop (red) and that train 2K66 was stopped at Jumperkine. The driver did not commence emergency braking until the rear of 2K66 became visible on the track ahead, at which point it was too late to avoid a collision.

Other factors that increased risk

• Pacific National's fatigue management procedures required train drivers to not work if they felt fatigued. This requirement primarily relied on drivers self-reporting if they felt fatigued, and there was no proactive assurance that drivers had obtained adequate sleep, including for higher fatigue risk situations. Self-reporting mechanisms were very seldom utilised and Pacific National had not conducted surveys or used other audit mechanisms or processes to identify any perceived or actual barriers to drivers self‑identifying fatigue. (Safety issue)
• Pacific National’s rostering and fatigue management system used the FAID biomathematical model of fatigue to assess the fatigue risks associated with train driver rosters, applying a threshold FAID score of 80 for driver only operations and 100 for other operations. The operator had not conducted analysis to determine that train drivers working rosters according to these thresholds were sufficiently rested to conduct driving duties. (Safety issue)
• Pacific National analysis of the comparative safety records for driver only and multi-rail traffic crewed operations relied on incorrectly categorised safety incidents, and incorrectly concluded that there was no difference in the safety records of the 2 operational modes. This incorrect analysis resulted in a missed opportunity to review the risk controls for driver only operations SPAD and fatigue management.
• The Arc Infrastructure practice of pathing a following train up to the same section of track occupied by a stopped train, coupled with no requirement for the network control officer (NCO) to communicate and confirm rail traffic crews were aware when approaching another stopped train, increased risk. (Safety issue)
• After the Arc Infrastructure train control system generated a signal passed at danger (SPAD) alarm when train 7MP5 passed signal 12L at stop (red), it was very likely about 42 seconds after receiving the alarm before the network control officer (NCO) began calling the driver of 7MP5. The timing of this call was not effective in communicating the need to stop the train in time to avoid the collision or reduce the speed of the train prior to the collision. In addition, the NCO’s call was not an emergency call and did not indicate a level of urgency.
• The Arc Infrastructure processes for the management of rail traffic overrunning its limits of authority were reliant on the immediate actions of the rail traffic crew and did not explicitly require immediate actions from the network control officer (NCO). This situation increased the risk of driver completely missed signal passed at danger (SPAD) events, particularly in cases where the rail traffic crew’s awareness or capacity was potentially compromised. (Safety issue)
• Although the network control officer (NCO) received a signal passed at danger (SPAD) alarm involving 7MP5 passing signal 12L at stop, there was no collision advice available to the NCO and the NCO was unaware of the train's collision with the stationary train 2K66. Accordingly, the NCO did not take action to stop train 3PM4 entering the same location, increasing the risk of a secondary collision involving 3PM4 operating on the adjacent track.
• Arc Infrastructure’s procedures included no requirement for a network control officer (NCO) to make an emergency call and advise potentially ‘at risk’ trains that another nearby train had overrun its limit of authority. (Safety issue)
• Although the Rail Industry Safety and Standards Board Australian Network Rules and Procedures (ANRP) product, and its replacement the National Rules Framework, included a requirement for a network control officer (NCO) to immediately arrange to stop rail traffic that had overrun its limits of authority and other rail traffic that was at risk, it did not require the NCO to make an emergency call to advise potentially ‘at risk’ trains that another nearby train had overrun its limit of authority.

Other findings

• The speed of train 7MP5 was not reduced to comply with the 30 km/h temporary speed restriction (TSR) located at Jumperkine.
• The braking systems of train 7MP5 likely worked as designed.
• Train 7MP5 was not fitted with in-cab voice or video recording devices, nor was there any requirement for such devices. Had such technology been in use it would have enhanced the ability of the investigation to understand the actions and state of the driver in the period leading up to the collision.

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation. Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Pacific National use of FAID

Safety issue number: RO-2019-022-SI-01

Safety issue description: Pacific National’s rostering and fatigue management system used the FAID biomathematical model of fatigue to assess the fatigue risks associated with train driver rosters, applying a threshold FAID score of 80 for driver only operations and 100 for other operations. The operator had not conducted analysis to determine that train drivers working rosters according to these thresholds were sufficiently rested to conduct driving duties.

Pacific National fatigue reporting processes

Safety issue number: RO-2019-022-SI-06

Safety issue description: Pacific National's fatigue management procedures required train drivers to not work if they felt fatigued. This requirement primarily relied on drivers self-reporting if they felt fatigued, and there was no proactive assurance that drivers had obtained adequate sleep, including for higher fatigue risk situations. Self-reporting mechanisms were very seldom utilised and Pacific National had not conducted surveys or used other audit mechanisms or processes to identify any perceived or actual barriers to drivers self-identifying fatigue.

Pacific National limited risk controls for driver only operations

Safety issue number: RO-2019-022-SI-02

Safety issue description: Pacific National had limited controls for managing the risk of signals passed at danger during driver only operations, including incidents associated with driver fatigue. The safety system relied on a single driver correctly observing and responding to signals at all times, including during the window of the circadian low (when fatigue risk is greatest).

Arc Infrastructure network control procedures – stopping advice

Safety issue number: RO-2019-022-SI-03

Safety issue description: The Arc Infrastructure practice of pathing a following train up to the same section of track occupied by a stopped train, coupled with no requirement for the network control officer (NCO) to communicate and confirm rail traffic crews were aware when approaching another stopped train, increased risk.

Arc Infrastructure network control procedures for an immediate response to a SPAD

Safety issue number: RO-2019-022-SI-04

Safety issue description: The Arc Infrastructure processes for the management of rail traffic overrunning its limits of authority were reliant on the immediate actions of the rail traffic crew and did not explicitly require immediate actions from the network control officer (NCO). This situation increased the risk of driver completely missed signal passed at danger (SPAD) events, particularly in cases where the rail traffic crew’s awareness or capacity was potentially compromised.

Arc Infrastructure network control procedures for an emergency call following a SPAD

Safety issue number: RO-2019-022-SI-05

Safety issue description: Arc Infrastructure’s procedures included no requirement for a network control officer (NCO) to make an emergency call and advise potentially ‘at risk’ trains that another nearby train had overrun its limit of authority.

Safety action not associated with an identified safety issue

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

Additional safety action undertaken by Pacific National

Following the accident, Pacific National offered an enforceable voluntary undertaking (EVU) to the Office of the National Rail Safety Regulator (ONRSR) in April 2023, which was accepted by ONRSR in May 2023, and varied in October 2023. Commitments in the EVU included:

• engage a full-time fatigue risk manager and a full-time human factors specialist to develop an updated fatigue management standard and guideline in relation to fatigue-related hazards, the core principles of fatigue risk management, and how to develop a decision-making pathway for applying those principles so that rail freight operational risks can be better managed
• procure training for train drivers in relation to updated fatigue management documents
• engage a services provider to implement a physical health and wellbeing program for intermodal freight train drivers
• host a rail freight safety conference for participants in the rail freight sector (including rail safety workers) to encourage and promote safety in the industry
• convene a meeting with an accredited rail infrastructure manager to discuss signal visibility and review the procedures for train handling in the vicinity of the accident site
• trial driver advisory systems to support the driver in remaining vigilant and alert through the early detection of signals and obstructions to assist in the prevention of safety incidents such as proceed authority exceedance (PAE) and collision events, for which driver fatigue and distraction is a contributing factor. Additionally, it will participate as an observer in a similar trial being conducted in the United Kingdom.

Additional details of the Pacific National EVU can be found on the ONRSR website.

Additional safety action undertaken by Arc Infrastructure

Following the accident, Arc Infrastructure offered an enforceable voluntary undertaking (EVU) to the Office of the National Rail Safety Regulator (ONRSR) in June 2022, which was accepted by ONRSR in June 2022. Commitments in the EVU included:

• work with the owner of Arc Infrastructure’s train control system (TCS) to install a SPAD specific audible alarm (to differentiate SPAD alarms from other TCS alarms)
• appoint (on 4 January 2022) a network control technical trainer and assessor, with the role of providing relevant and practical training to NCOs
• upon the introduction of its new TCS, develop a dedicated training facility to allow NCOs to undertake simulation or scenario-based training and assessment (including emergency incident response), with a requirement for all NCOs to undertake a minimum of 1 day simulation training each year.
• establish a SPAD Working Group. The working group was established in November 2020 and it provides a forum for industry collaboration and ongoing engagement between industry members on initiatives to reduce the risk of SPADs on the rail network and to share key learnings.

Additional details of the Arc Infrastructure EVU can be found on the ONRSR website.

Additional safety action undertaken by the Rail Industry Safety and Standards Board

In relation to the safety factors for this accident, the RISSB has advised that it intends to undertake a number of activities, including: 

• a development group was established in December 2023 to develop a code of practice to assist rail transport operators implementing driver only operation to so far as is reasonably practicable (SFAIRP).  
• the development of a code of practice to address vigilance timing cycles
• finalise and publish Australian Standard (AS) 7531 Rollingstock Lighting and Visibility

It also advised that it had recorded a change request for RISSB Degraded Operation Rule 4[100] for consideration of the ATSB investigation findings at the next scheduled review of this product. 

RISSB advised that these activities will be incorporated into the RISSB work plan for 2024 and 2025.

Glossary

CTC	Abbreviated term for 'centralised traffic control'. A safeworking system of remotely controlling the points and signals at a number of locations from a centralised control room.
Down	Identification of the track or train direction of travel. In respect to Jumperkine, Down refers to rail traffic travelling away from Perth.
DOO	Driver only operation is where one rail safety worker has the responsibility for the control, operations and procedures of a train.
ONRSR	The Office of the National Rail Safety Regulator. Administered and enforced compliance with the Rail Safety National Law and Regulations.
Mixed gauge	In the Arc Infrastructure context at this location track that is constructed with a mixture of both standard gauge (1435 mm) and narrow gauge (1067 mm) widths utilising a common rail.
NCO	Network control officer, a competent worker who authorises, and may issue, occupancy authorities, and who manages rail traffic paths to ensure safe and efficient transit of rail traffic in the network. The competent worker may also be referred to as a train controller, network controller or signaller.
Rail infrastructure	Defined in RSNL as facilities that are necessary to enable a railway to operate, and includes: railway tracks and associated railway track structures service roads, signalling systems, communications systems, rolling stock control systems, train control systems and data management systems notices and signs electrical power supply and electric traction systems associated buildings, workshops, depots and yards plant, machinery and equipment, but does not include— rolling stock any facility, or facility of a class, that is prescribed by the national regulations not to be rail infrastructure.
RIM	Rail infrastructure Manager. Defined in RSNL as a person that has effective management and control of rail infrastructure.
RISSB	Rail Industry Safety and Standards Board. Responsible for the provision of standards, codes of practice, guidelines, rules, safety data and analysis for the Australian rail industry.
Rolling stock	Defined in the RSNL as a vehicle that operates on or uses a railway, and includes a locomotive, carriage, rail car, rail motor, light rail vehicle, train, tram, light inspection vehicle, self propelled infrastructure maintenance vehicle, trolley, wagon or monorail vehicle, but does not include a vehicle designed to operate both on and off a railway when the vehicle is not operating on a railway
RSNL	Rail Safety National Law, as administered by ONRSR.
RSO	Rolling Stock Operator. Defined in RSNL as a person who has effective control and management of the operation or movement of rolling stock on rail infrastructure for a railway, but does not include a person by reason only that the person drives the rolling stock or controls the network or the network signals.
RTO	Rail transport operator. Defined within the RSNL as either a rail infrastructure manager, rolling stock operators, or both.
Running Line	Defined in the RSNL as a railway track used primarily for the through movement of trains.
Siding	Defined in the RSNL as a portion of railway track, connected by points to a running line or another siding, on which rolling stock can be placed clear of the running line.
SFAIRP	So far as is reasonably practicable
SMS	Safety management system. A systematic approach to rail safety aligned to the requirements of RSNL.
SPAD	Signal passed at danger. Defined as unauthorised passing of a signal displaying a stop aspect.
Up	Identification of the track or train direction of travel. In respect to Jumperkine, Up refers to rail traffic travelling towards Perth.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• event recorders and front of train camera from 7MP5
• rail traffic crews of 2K66 and 3PM4
• Pacific National management representatives
• Pacific National
• Arc Infrastructure
• network control officer
• rolling stock operator of train 2K66
• Western Australia Police Service
• SCT Logistics
• Office of the National Rail Safety Regulator
• Australian Rail Track Corporation
• workplace health and safety regulator
• health assessment service provider
• Services Australia
• mobile phone service providers.

References

Akerstedt T and Wright KP (2009) ‘Sleep loss and fatigue in shift work and shift work disorder’, Sleep Medicine Clinics, 4:257-271.

Australian Rail Operations Unit (AROU) (November 2002), Draft Code of Practice for the DIRN – Volume 5: Rollingstock standard.

Banks S and Dinges DF (2007) ‘Behavioral and physiological consequences of sleep restriction’, Journal of Clinical Sleep Medicine, 3:519-528.

Battelle Memorial Institute (1998) An overview of the scientific literature concerning fatigue, sleep, and the circadian cycle, Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, United States Federal Aviation Administration.

Bes F, Jobert M and Schulz H (2009) ‘Modeling napping, post-lunch dip, and other variations in human sleep propensity’, Sleep, 32:392-398.

Blaivas AJ, Patel R, Hom D, Antigua K and Ashtyani H (2007) ‘Quantifying microsleep to help assess subjective sleepiness’, Sleep Medicine, 8:156-159.

Briest S, Karrer K and Schleicher R (2006) ‘Driving without awareness: Examination of the phenomenon’, Vision in Vehicles XI, 89-141.

Chang AM, Aeschbach D, Duffy JF and Czeisler CA (2015) ‘Evening use of light-emitting eReaders negatively affects sleep, circadian timing, and next-morning alertness’, Proceedings of the National Academy of Sciences, 112:1232-1237.

Charlton SG and Starkey NJ (2011) ‘Driving without awareness: The effects of practice and automaticity on attention and driving’, Transportation research part F: traffic psychology and behaviour, 14:456-471.

Civil Aviation Safety Authority (2014) Biomathematical fatigue models. Retrieved from https://www.casa.gov.au/biomathematical-fatigue-models-guidance

Dawson D, Darwent D and Roach GD (2017) ‘How should a bio-mathematical model be used within a fatigue risk management system to determine whether or not a working time arrangement is safe?’, Accident Analysis & Prevention, 99:469-473.

Dawson D and McCulloch K (2005) ‘Managing fatigue: It’s about sleep’, Sleep Medicine Reviews, 9:365-380.

Dawson D, Noy YI, Härmä M, Åkerstedt T and Belenky G (2011) ‘Modelling fatigue and the use of fatigue models in work settings’, Accident Analysis & Prevention, 43:549-564.

Dawson D and Reid K (1997) ‘Fatigue, alcohol and performance impairment’, Nature, 388:235-235.

Dawson D, Sprajcer M and Thomas M (2021) ‘How much sleep do you need? A comprehensive review of fatigue related impairment and the capacity to work or drive safely’, Accident Analysis and Prevention, 151:105955.

Dinges DF (1995) ‘An overview of sleepiness and accidents’, Journal of Sleep Research, 4:4-14.

Dismukes RK (2012) ‘Prospective memory in workplace and everyday situations’, Current Directions in Psychological Science, 21:215–220.

Dorrian J, Chapman J, Bowditch L, Balfe N and Naweed A (2022) ‘A survey of train driver schedules, sleep, wellbeing, and driving performance in Australia and New Zealand’, Scientific Reports, 12:3956.

Dorrian J, Roach GD, Fletcher A and Dawson D (2007) ‘Simulated train driving: Fatigue, self-awareness and cognitive disengagement’, Applied Ergonomics, 38:155-166.

Dunn NJ and Soccolich S (2023), The fatigue and safety of locomotive engineers and conductors, Technical Report DOT/FRA/ORD-23/17, US Department of Transportation, Federal Railroad Administration.

Federal Railroad Administration (2010) Procedures for validation and calibration of human fatigue models: The fatigue audit InterDyne tool, Technical Report DOT/FRA/ORD-10/14, US Department of Transportation.

Ferguson SA, Baker AA, Lamond N, Kennaway DJ and Dawson D (2010) ‘Sleep in a live-in mining operation: the influence of start times and restricted non-work activities’, Applied Ergonomics, 42:71-75.

Ferguson SA, Kennaway DJ, Baker A, Lamond N and Dawson D (2012) ‘Sleep and circadian rhythms in mining operators: limited evidence of adaptation to night shifts‘, Applied Ergonomics, 43:695-701.

Härmä M (2006) ‘Workhours in relation to work stress, recovery and health’, Scandinavian Journal of Work, Environment & Health, 32:502-514.

Haworth N, Regan M and Larsson T (1998) Investigation into Effectiveness of Driver Vigilance Control Systems on Locomotives – Research Undertaken for FreightCorp, Monash University Accident Research Centre.

Hertig-Godeschalk A, Skorucak J, Malafeev A, Achermann P, Mathis J and Schreier DR (2020) ‘Microsleep episodes in the borderland between wakefulness and sleep’, Sleep, 43: zsz163.

Hildebrandt G, Rohmert W and Rutenfranz J (1974), 12 and 24 h rhythms in error frequency of locomotive drivers and the influence of tiredness, International Journal of Chronobiology, 2:175‑180.

ICF Incorporated (2015) Evaluation of single crew risks: Comparative risk assessment, Report prepared for the Association of American Railroads.

Independent Transport Safety Regulator (2010) Transport Safety Alert 34 - Use of bio-mathematical models in managing risks of human fatigue in the workplace.

Independent Transport Safety and Reliability Regulator (2006) Driver safety systems, Discussion Paper retrieved from http://pandora.nla.gov.au/pan/61442/20060809-0000/www.transportregulator.nsw.gov.au/publications/reports/engineering_defences_rec31/Driver_Safety_Systems_Discussion_Paper.pdf.

International Civil Aviation Organization (2016) Fatigue management guide for airline operators, second edition.

Jackson CL, Patel SR, Jackson WB 2nd, Lutsey PL and Redline S (2018) ‘Agreement between self-reported and objectively measured sleep duration among white, black, Hispanic, and Chinese adults in the United States: Multi-Ethnic Study of Atherosclerosis’, Sleep, 41(6).

Karrer K, Briest S, Vohringer-Khunt T, Baumgarten T and Schleicher R (2005) ‘Driving without awareness’, in G Underwood (ed) Traffic and Transport Psychology: Theory and Application, Elsevier, Oxford.

Larue GS, Rakotonirainy A and Pettitt AN (2011) ‘Driving performance impairments due to hypovigilance on monotonous roads’, Accident Analysis & Prevention, 43 pp.2037-2046.

Lauderdale DS, Knutson KL, Yan LL, Liu K, and Rathouz PJ (2008) ‘Self-reported and measured sleep duration: how similar are they?’, Epidemiology, 19:838–845.

Lim J and Dinges DF (2010) ‘A meta-analysis of the impact of short-term sleep deprivation on cognitive variables’, Psychological Bulletin, 136:375-389.

Loukopoulos LD, Dismukes RK and Barshi, I (2009) ‘The perils of multitasking’, AeroSafety World, 4(8):18-23.

Moray N, Groeger J and Stanton N (2017) ‘Quantitative modelling in cognitive ergonomics: predicting signals passed at danger’, Ergonomics, 60:206-220.

Multer J, Rudich R and Yearwood K (1998), Human factors guidelines for locomotive cabs, Technical Report DOT-VNTSC-FRA-98-8, US Department of Transportation, Federal Railroad Administration.

Multer J, Safar H, Roth E and France M (2019) Why do passenger trains pass stop signals? A systems view, Technical Report DOT/FRA/ORD-19/19, US Department of Transportation, Federal Railroad Administration.

Naweed A and Balakrishnan F (2013) Safety case for driver only operations: Qualitative analysis and real world observations, report prepared for the CRC for Rail Innovation.

Naweed A, Every D, Balakrishnan G and Dorrian J (2014) ‘One is the loneliest number: exploring the role of the second driver in Australian rail operations’, Ergonomics Abstracts, 1:1-8.

Naweed A, Balakrishnan G and Dorrian J (2018) ‘Going solo: hierarchical task analysis of the second driver in “two-up” (multi-person) freight rail operations’, Applied ergonomics, 70.202-231.

Oliver Wyman (2015) Analysis of North American freight rail single-person crews: Safety and economics, Report prepared for the Association of American Railroads.

Raslear TG, Gertler J and DiFiore A (2013) ‘Work schedules, sleep, fatigue, and accidents in the US railroad industry’ Fatigue: Biomedicine, Health & Behavior, 1:99-115.

Roach GD, Fletcher A and Dawson D (2004) ‘A model to predict work -related fatigue based on hours of work’, Aviation, Space, and Environmental Medicine, 75:61-69.

Roach GD, Reid KJ and Dawson D (2003) ‘The amount of sleep obtained by locomotive engineers: Effects of break duration and time of break onset’, Occupational and Environmental Medicine, 60:e17.

Rudin-Brown, CM, Harris, S and Rosberg, A (2019) ‘How shift scheduling practices contribute to fatigue amongst freight rail operating employees: Findings from Canadian accident investigations‘, Accident Analysis & Prevention, 12:664-69.

Rudin-Brown, CM and Rosberg, A (2021) ‘Applying principles of fatigue science to accident investigation: Transportation Safety Board of Canada (TSB) fatigue investigation methodology’, Chronobiology International, 38:296-300.     

Sallinen, M and Kecklund, G (2010) ‘Shift work, sleep, and sleepiness—differences between shift schedules and systems’, Scandinavian journal of work, environment & health, 36:121–133.

Stanton, N and Baber, C (2008) 'Modelling of human alarm handling response times: a case study of the Ladbroke Grove rail accident in the UK', Ergonomics, 51:423-440.

Stein C, Liu A, Brown DA and Porch A (2019) Monitoring engineer fatigue (MEFA), Technical Report DOT/FRA/ORD-19/48, US Department of Transportation, Federal Railroad Administration.

Thiffault, P and Bergeron, J (2003), ‘Monotony of road environment and driver fatigue: a simulator study’, Accident Analysis & Prevention, 35:381-391.

Transportation Safety Board of Canada (2022) TSB Recommendation R22-04 (Enhanced train control for key routes).

Tucker P and Folkard S (2012) Working time, health and safety: A research synthesis paper, Background Report to the International Labour Office for the ILO Tripartite Meeting of Experts on Working time Arrangements, Geneva: International Labour Office.

Watson NF, Badr MS, Belenky G, Bliwise DL, Buxton OM, Buysse D, Dinges DF, Gangwisch J, Grandner MA, Kushida C, Malhotra RK, Martin JL, Patel SR, Quan SF, Tasali E (2015) ‘Joint consensus statement of the American Academy of Sleep Medicine and Sleep Research Society on the recommended amount of sleep for a healthy adult: methodology and discussion’, Journal of Clinical Sleep Medicine, 11:931-952.

Whitlock A (2002) Driver vigilance devices: Systems review, Report No. 03 T024 QUIN 22, Rail Safety Standards Board, London.

Wickens CD, Hollands JG, Banbury S and Parasuraman R (2013) Engineering psychology and human performance, 4th edition, Pearson Boston, MA.

Wickens CD and McCarley JS (2008) Applied attention theory, CRC Press, Boca Raton, FL.

Williamson A, Lombardi DA, Folkard S, Stutts J, Courtney TK and Connor JL (2011) ‘The link between fatigue and safety’, Accident Analysis and Prevention, 43:498–515.

 

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the rail traffic crew of train 2K66
• the network control officer
• Pacific National
• Arc Infrastructure
• Watco (the operator of train 2K66)
• the Office of the National Rail Safety Regulator (ONRSR)
• the Rail Industry Safety and Standards Board (RISSB).

Submissions were received from the following directly involved parties:

• Pacific National
• Arc Infrastructure
• ONRSR
• RISSB.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – Train Braking Systems

Dynamic brake

The dynamic brake, independent brake, and automatic brake are sub-systems of the train’s overall braking system.

Dynamic braking is a locomotive braking function present in diesel-electric and electric drive locomotives. It is not a substitute for the train’s air braking but is a supplementary system that provides an additional means of speed control. A benefit of dynamic braking is to reduce the wear and heat generated by the friction style train braking equipment used by the independent and automatic braking sub-systems.

Dynamic braking uses the locomotive electrical traction motors as generators, converting the kinetic energy of a moving train into electrical energy. The electrical energy generated is dissipated into fan cooled electrical resistor banks. Increasing or decreasing the amount of electrical resistance in the resistor banks varies the load on the traction motor generator, which applies a corresponding resistance/braking effect on the rotating locomotive wheels.

Independent brake

The independent brake solely controls air brakes within the locomotive(s) and works independently of a train’s other braking control systems. The locomotive brakes are applied when the locomotive brake cylinder pressure is increased. This pressure can be increased or decreased via the driver’s independent brake control handle.

Automatic brake

The automatic brake controls the air brakes in the entire train, including the locomotive(s). An application of the automatic brake applies the locomotive(s) brakes by increasing locomotive brake cylinder pressure (similar to control via the independent brake system). The automatic brake simultaneously triggers the application of the train’s wagon brakes by reducing the air pressure within the train’s brake pipe. Maximum wagon braking effort is achieved when the brake pipe pressure is reduced to about 350 kPa, and wagon brakes are released when the brake pipe is charged to about 500 kPa.

The driver can vary the train’s braking effort by operating the locomotive’s automatic brake control handle. Brake pipe air pressure is reduced at the service rate for normal braking applications, or at the greater emergency rate when an emergency brake application is made. The driver also has a ‘bail-off’ feature whereby they can suppress the braking action of the locomotive(s) following an automatic brake application, therefore enabling only the wagon brakes to stop the train.

Train-line emergency brake application

In the event that the train’s brake pipe is broken or ruptured following a train separation, derailment, or collision, the train’s wagon and locomotive brakes are automatically applied at the emergency rate. This safety feature of the automatic brake is also known as a train-line emergency brake application.

To detect train separations, locomotives are fitted with braking control systems designed (among other control purposes) to detect the rapid reduction of the train’s brake pipe pressure. In the event that a rapid reduction of brake pipe pressure is detected, the braking control systems enable the locomotive(s) emergency braking systems to remove the locomotive drive and provide a faster braking response to bring the train to a stop. These additional emergency braking system actions can include:

• faster exhaustion of brake pipe air pressure towards 0 kPa via the locomotive’s brake control valves
• removal of the brake pipe charging source (compressor output) from attempting to re-charge the train’s brake pipe
• application of the locomotive brake
• de-energization of the locomotive traction power via the pneumatic control switch/power knockout switch (PCS)
• application of emergency adhesion sanding.[101]

 

Appendix B – Research on locomotive vigilance system limitations

The Rail Industry Safety and Standards Board (RISSB) standard AS 7511 Onboard Train Protection Systems identified vigilance systems as a partial control against ‘failures’ relating to the task of train driving or supervising the rail corridor. The standard describes vigilance systems as being:

There is widespread understanding within the rail industry that although vigilance systems are a useful control for detecting complete driver incapacitation, they are fundamentally limited for managing other forms of inattentiveness, particularly a low level of alertness. AS7511 provided a summary of the main limitations of vigilance systems, noting that:

Analysis by the US Federal Railroad Administration (Multer and others 1998) helps explain this limitation, and how it is inherent in the way vigilance systems work:

The potential for habitual and automatic responding to vigilance alarms is a known limitation to vigilance systems, with regulators and industry bodies making similar conclusions about the limitations of vigilance devices:

• The US Federal Railroad Administration (Stein and others 2019) summarised that although vigilance detection devices can identify when drivers are physically disengaged, if drivers are mentally disengaged but physically engaged using automatic behaviour then this scenario will not be identified.
• The New South Wales Independent Transport Safety and Reliability Regulator (ITSRR 2006) noted that drivers may respond automatically to vigilance demands, and that drivers may pre-empt the vigilance alarms.
• The UK Rail Safety and Standards Board (Whitlock 2002) summarised that ‘drivers are reported to respond to these types of vigilance devices in an automatic manner as a result of becoming used to their temporal spacing (habituation) or anticipating their action (prediction). Habituation and prediction can significantly reduce the effectiveness of traditional vigilance devices’.

There have been numerous examples where fatigued, distracted or otherwise inattentive drivers were still able to respond to vigilance system alerts prior to derailment and collision accidents:

• Collision at Sugar Valley, Georgia USA, 1990: The US National Transportation Safety Board (NTSB) report[103] found that the onboard vigilance detection system ‘was so easily reset that it could be done by a reflex action without conscious thought’.
• Collision at Beresfield, NSW, 1997 (see also Collisions with a pre-cursor SPAD: This investigation found that ‘Operating a train vigilance control was a task that would have been simple and automatic to the crew of DR396…The vigilance control system was ineffective in detecting reduced levels of alertness’. This investigation suggested that fixed-time alerting cycles were inferior for monitoring and assuring vigilance, compared to random intervals.
• Collision at Macdona, Texas, 2004: The NTSB report[104] identified that the engineer (driver) was able to respond to the vigilance device (called ‘alerter’ in the US), despite probably being impaired by fatigue. The report stated ‘That the engineer could have remained sufficiently alert to make train control inputs and yet be unable to respond to vitally important signal indications may be explained by the fact that making such inputs and manipulating the alerter are highly practiced, nearly reflexive, motor responses that require only lower level cognitive effort…[The engineer] could have been able to continue the reflexive control activities while being unable to perform the higher level cognitive tasks of extrapolating information from the signal indications.’
• Derailment at Benalla, Victoria, 2006: This ATSB investigation[105] found that the driver and co‑driver were probably in a state of degraded alertness prior to the accident, and that ‘The fixed time base vigilance system installed on (the locomotive) was possibly ineffective in ensuring an adequate level of driver alertness.’
• Uncontrolled run-back at Cumbria, UK, 2010: This UK Rail Accident Investigation Branch (RAIB) report[106] found ‘… the driver acted less frequently to control their train but more frequently to cancel warnings from the driver’s vigilance device and the automatic warning system. Cancelling frequent warnings is known to become habitual, particularly with reduced alertness and monotony.’

There are consistent themes in these accidents, where drivers were able to respond to vigilance alarms and prevent penalty brake applications while not being sufficiently alert or attentive, due to habitual or automatic responding to the alarms. Pressing a vigilance acknowledgement pushbutton is very simple and drivers can respond to vigilance alarms without much thought or attention. On many freight train journeys, a driver may travel over long stretches of geographically uncomplicated track where their most frequent ‘task’ is acknowledging the vigilance alarm. This situation can further habituate the driver to the vigilance alarm and reduce the amount of attention allocated to responding.

After the Beresfield accident in 1997, the Monash University Accident Research Centre reviewed in-cab vigilance devices on board Freight Corp trains (Haworth and others 1998). Using interviews and in-cab videos, this study found:

The study observed examples of automatic responding to vigilance demands, and described anecdotes such as drivers returning from work pressing an imaginary pushbutton in their car, or pressing an imaginary pushbutton on their partner while they slept.

The Monash University study of Freight Corp vigilance systems identified 2 potential design features that may have been contributory to the drivers’ automatic responding to the vigilance warnings:

• Pre-emption of warnings: The study found that ‘One of the main contributors to the automaticity of the current [vigilance system] is the ability of drivers to respond prior to the presentation of the light. The drivers have developed a strategy of pre-emption which removes the requirement of looking at the light…the pre-emption response was found to be an extremely strong pattern of behaviours.’’
• Fixed cycle lengths: The study stated that ’major contributor to the automaticity of the current [vigilance system] is the fixed cycle length…this fixed interval is a fundamental flaw because it allows pre-emption to be a successful strategy for performing the task’.

In theory, pre-emption of the vigilance alert may reduce the effectiveness of the system as it allows the pushbutton press to become wholly divorced from the demands of the vigilance system. If the driver is continually pressing the vigilance acknowledgement pushbutton prior to the vigilance alert, the driver may never be alerted when the system detects inactivity. AS 7511 required vigilance systems allow a maximum of one pre-emption of the vigilance cycle, stating that:

The ATSB is not aware of any research comparing the sensitivity of vigilance systems that allow drivers to pre-empt warnings versus systems that do not allow pre-emption.

A report by ITSRR (2006) argued that varying the timing of vigilance demand cycles may not address the issue of drivers automatically acknowledging the alarm, since the automaticity was in response to the vigilance prompts rather than the constant prompting cycle. However, there is also no known research that empirically tested the effectiveness of fixed versus random interval cycles for vigilance devices.

Appendix C – Research on irregular roster patterns and fatigue risk

Irregular working hours are a common feature of rail scheduling. One plausible hypothesis is that irregular, unpredictable shift schedules contribute to fatigue risk because they interfere with the development and maintenance of a ‘sleep pattern’. Rail investigations by the Canadian Transportation Safety Board have identified ‘sporadic disruptions to normal sleeping patterns’ as factors associated with the development of several major accidents (Rudin-Brown and others 2019).

Dorrian and colleagues (2022) surveyed 751 train drivers from Australia and New Zealand, and found that over half reported that their shift patterns were either irregular or very irregular. This study found that workers with irregular and variable shift patterns tended to have less sleep on workdays, with greater variation in sleep lengths. As shown in Figure 20, irregular shift patterns were strongly associated with poorer self-reported sleep quality, and more frequent feelings of tiredness (Figure 20). 

Figure 20: Research findings from Dorrian and others (2022), showing self-reported sleep and tiredness of train drivers

Note: From Dorrian and others (2022). Vertical axes show perceptions of sleep amounts (left) and tiredness (right), split by schedule regularity (horizontal axis).

The Federal Railroad Administration (FRA) reported on a survey of over 9,000 train drivers in the US (Dunn and Soccolich 2023). This survey found that drivers regularly experienced irregular shift patterns. Over 90% reported 2 or more changes from day to night shifts each week, and over 60% reported day-to-day variation in start time of 8 hours or more.

The research conducted by the FRA included questions to measure self-reported fatigue. Analysis showed that irregular shift patterns were strongly associated with self-reported fatigue, for example showing that workers who reported very irregular working hours were 2.3 times more likely to be ‘highly fatigued’ than those who conducted the majority of their work during the day. When the drivers were asked which factors contributed most to fatigue at work, irregular working hours was the most commonly identified factor, nominated by over 80% of drivers.

Although some research indicates a link between irregular rosters and fatigue, an alternative hypothesis is that shiftworkers’ sleep and alertness does not adapt to the timing of work and therefore there is no such thing as an idiosyncratic ‘sleep pattern’ formed by the timing of recent shifts. In support of this, research has shown that most people will generally not adapt their sleep‑wake cycle while on night shifts (Tucker and Folkard 2012). Ferguson and others (2010, 2012) examined roster patterns in a mining environment with day shifts followed by night shifts. The amount of sleep did not increase over the week of night shifts, and various measures indicated that the workers’ sleep-wake cycles did not adapt during the week of night shifts.

Other research has shown that rapidly rotating shift schedules were associated with more sleep and greater levels of alertness than schedules that required workers to conduct consecutive night shifts (Harma 2006). This indicates that rapidly changing schedules presented a lower cost, in terms of fatigue risk, compared to working more shifts at night (with a more consistent ‘sleep pattern’).

To date, there has been limited systematic research evaluating the effects of irregular schedules of sleep and fatigue. Sallinen and Kecklund (2010) noted that:

The ATSB concluded that the evaluation described by Sallinen and Kecklund is probably still representative of the current state of research on irregular shift patterns, and that there is not sufficient evidence to conclude that irregular shift patterns produces a significant independent risk factor for the development of fatigue.

Appendix D ­– Additional contextual information about driver only operations

Research into driver only operations

Naweed and others (2013; 2014) conducted interviews with Australian freight and passenger drivers, and conducted cab-ride observations of freight and passenger driver only operations (DOO) and multi-rail traffic crew services. Observations from multi-rail traffic crewed main line driving operations showed that both drivers shared responsibility for calling out and confirming signs and signals, and the researchers noted that this:

The research was qualitative in nature, meaning there was no quantitative comparison of the safety of DOO compared to multi-rail traffic crewed operations.

Freight drivers tended to perceive that having multiple rail traffic crew on board was beneficial for safety, partly because the second driver provided a second pair of eyes for observing signals and other important tasks. Comments recorded in this research included:

The research also identified that some drivers perceived that the presence of a second driver could also have a negative effect on safety, because of conflict between drivers and because of the potential of the second driver to distract the primary driver.

More recent research (Naweed and others 2018) supported these findings, noting:

International assessment of driver only safety

In 2016, the United States Federal Railroad Administration (FRA) issued a Notice of Proposed Rulemaking (81 FR 13917) which outlined regulations that would require a minimum of 2 rail traffic crew members for US railroad operations, with some exceptions. In proposing these regulations, the FRA noted that due to an absence of high-quality incident data it could not ‘provide reliable or conclusive statistical data to suggest whether one-person rail traffic crew operations are generally safer or less safe than multiple-person rail traffic crew operations’.

Although not able to demonstrate an increase in accident risk through data, the FRA proposal cited several reports indicating potential risks associated with single driver operations, including the following relating to fatigue:

A report in submission to this proposed rule included analysis using publicly available data comparing the safety of DOO and multi-person rail traffic crew operations in the United States, showing no significant safety differences between the 2 modes of operation (Oliver Wyman 2015). The same report also included analysis of incident rates in the United States (where rail freight was primarily conducted with 2 drivers) and comparable European jurisdictions that primarily used DOO. The analysis found that European operations were typically as safe or safer than those in the United States. Significantly, all European operations examined in this analysis utilised a form of positive train control or similar.

Another report in submission to the proposed rulemaking analysed the risk of specific accident causes in US main line freight operations (ICF Incorporated 2015). The analysis determined that there were almost no differences between the safety of DOO and 2-person operations in rail networks where positive train control was fully implemented.

In 2019, the FRA withdrew the notice of proposed rulemaking for rail traffic crew requirements, stating ‘no regulation of train crew staffing is necessary or appropriate for railroad operations to be conducted safely at this time.’ In December 2020, the FRA announced the full implementation of positive train control across the United States freight network.

There is infrequent coverage of positive train control or automatic train protection systems upon the Australian freight rail network, and therefore the observations made in relation to other jurisdictions about the impact of DOO may not be applicable to the Australian network. The ATSB is not aware of any research that has evaluated the safety record of freight rail networks using DOO without positive train control or automatic train protection systems.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.