Level crossing irregularities involving freight train 3PM7, Werribee, Victoria, on 4 December 2020

Executive summary

What happened

At about 0825 (local time) on 4 December 2020, Pacific National (PN) freight train 3PM7 was passing through Werribee, about 32 km from Melbourne. The train was travelling from Perth (Western Australia) to Melbourne (Victoria) on the Australian Rail Track Corporation (ARTC) standard gauge network. 

When the train approached the level crossing at Werribee Street, the crossing’s protection equipment did not operate. However, road traffic signals that were linked to rail systems did operate to stop road vehicles. The train continued through Werribee Station with its crew under the impression that road traffic at Werribee Street had been appropriately stopped.

The next level crossing encountered by train 3PM7 was at Cherry Street which was located about 940 m east of the Werribee Street level crossing. When the train approached the level crossing, the crossing’s protection equipment also did not operate, and the train’s crew observed road vehicles crossing ahead. In response, the crew made an emergency brake application and sounded the horn. The train entered the crossing travelling at approximately 48 km/h, with motor vehicles clearing the crossing less than 2 s before the train’s arrival. 

What the ATSB found

The non-operation of the level crossing equipment occurred during signalling works associated with the removal of the level crossings at Werribee and Cherry Streets by the Western Program Alliance (WPA). Metro Trains Melbourne (MTM) was the accredited infrastructure manager for the level crossings and a member of WPA. 

With a track occupation scheduled to run from 29 November to 7 December, the broad gauge lines were closed to rail traffic while signalling circuits were being rewired, tested and commissioned. During these broad gauge works, the standard gauge line was to continue to operate normally. To facilitate the operation of the 2 level crossings for the standard gauge traffic, required control circuits were isolated from broad gauge systems being modified.

It was found that the failure of the Werribee Street and Cherry Street level crossings was due to the isolation arrangements being disrupted. This occurred at about 0800 on the morning of the incident (4 December) when function testers replaced 2 fuses that had been disconnected as part of the isolation arrangement. The testers were not familiar with the isolation arrangement. Reinstatement of fuses was not unusual in their role of function testing completed circuits.

Relevant events prior to 4 December included:

• The isolation design was changed on 27 November and involved the powering down of the Werribee relay room. The isolation arrangements also required the removal of 2 fuses and the installation of temporary (jumper) wires to facilitate a false power feed to the Werribee Street and Cherry Street crossing control circuits. 
• When installing the isolation arrangements on the night of 29–30 November, the fuses to be removed and secured were instead folded out with one end remaining in the fuse holder. This made the fuses vulnerable to reinstatement.
• Power to the Werribee relay room was returned on 2 December with temporary jumper wires for the isolation retained. In this condition, reinstatement of the fuses would result in the level crossing circuits being energised and prevent operation of the level crossing equipment.

There were several safety factors identified with regard the late change to the isolation arrangements. Critically, the changed level crossing isolation arrangements were not reflected in planning and program documentation, nor effectively disseminated to all those potentially affected by the change. An earlier internal audit of this project also identified instances of scope changes not being documented.

The ATSB also found that:

• Road traffic management was an available risk control that was not used for normal standard gauge rail traffic during testing. 
• There were opportunities for the updated isolation design to incorporate additional risk controls to reduce the likelihood of premature replacement of removed fuses.
• Although approved by MTM, the isolation and reinstatement plans were not reviewed in accordance with MTM design approval processes. 

Other identified safety issues requiring consideration are:

• MTM standards and procedures did not specifically address requirements associated with fuse removal and securement in safety critical scenarios. 
• Contrary to the requirements of relevant standards and procedures, there was probably no independent check of the installed isolation arrangements. An earlier internal audit of this project also identified instances of testers in charge checking their own work.

What has been done as a result

The Western Program Alliance and Alliance member Metro Trains Melbourne (MTM) have taken several safety actions that should address identified safety issues in testing and commissioning practices and assurance. Safety actions include the update of assurance frameworks and associated procedures, and awareness initiatives. 

As an active participant of Victoria’s Signalling Strategy Taskforce (SST), MTM is contributing to the development of consistent signalling practices and enhanced competency frameworks. The work of the SST has the potential to provide an industry-wide framework for, and contribute to, addressing safety issues like those identified in this investigation.

Safety message

This occurrence highlights the importance of considering the implications of late design changes, updating plans and programs, and ensuring all affected parties have a clear understanding of the implications for their work activities. This is particularly the case in complex projects that involve consortia, contractors, sub-contractors, and the responsible rail infrastructure manager.

The occurrence

Overview

At about 0825 (local time) on 4 December 2020, Pacific National freight train 3PM7 operating on the Australian Rail Track Corporation (ARTC) standard gauge network was travelling through Werribee towards Melbourne.[1] The train was to pass through level crossings at Werribee Street and Cherry Street which were located either side of Werribee Railway Station (Figure 1). For the passage of train 3PM7, the level crossing protection equipment at both Werribee and Cherry Street level crossings did not activate. 

Figure 1: Location of Werribee Street and Cherry Street level crossings

Source: eWay Electronic Melway Street Directory – 2017 Edition, annotated by the Office Chief Investigator (OCI)

Events prior to the non-operation of level crossing protection

Level crossing removal 

As part of the Level Crossing Removal Project (LXRP) for Melbourne, works had commenced to remove the Werribee and Cherry Street level crossings which serviced standard and broad gauge rail traffic.[2] The Werribee Street crossing was to be replaced with a rail flyover, and the Cherry Street level crossing was to be closed and a road overpass constructed to its east.

The LXRP in Werribee was being delivered by the Western Program Alliance (WPA) which included the network operator Metro Trains Melbourne (MTM). MTM was also the responsible rail infrastructure manager for the operation of the 2 level crossings. Several contractors and subcontractors were involved in signalling works associated with this removal project.

By November 2020, progress on infrastructure works meant that broad gauge tracks were only operational east of and up to Werribee Railway Station. This meant that only the standard gauge track was operational through the Werribee Street level crossing (west of the station) whereas both standard gauge and broad gauge tracks remained operational at Cherry Street.

Signalling works from 29 November 2020

Modification of the signalling systems at Werribee included extensive re-wiring of circuits in the Werribee relay room and their testing. The works, testing and commissioning were scheduled to take place from 29 November to 7 December. For this period, trains would not operate on the broad gauge lines,[3] while the single standard gauge track would remain operational. The level crossings at Werribee Street and Cherry Street were to remain operational for standard gauge rail traffic only. 

The Testing and Commissioning Plan (TCP) for the 29 November to 7 December works was finalised as issued for construction (IFC) on 4 November. The TCP provided the methodology for level crossing isolation. 

Subsequently, there was a change to the isolation strategy and an alternative isolation plan developed which included the powering down of the Werribee relay room. This change was made after the risk of circuits being undesirably energised in the relay room during the re-wiring works was identified. The new isolation arrangements were prepared by signalling contractor Active Railway Signalling (ARS) and isolation and reinstatement plans approved by MTM on 27 November. 

The alternative isolation arrangements involved the cutting of the power supply to the relay room while providing an alternative power supply, referred to as a ‘false feed’, to circuits required for the operation of level crossing equipment for the passage of standard gauge traffic. The TCP was not updated to reflect the new isolation arrangements. 

Implementation of isolation

On the night of 29 November, the Werribee relay room was powered down[4] and the temporary circuit configuration installed. Fuses 9C2 and 9C4 were disconnected by them being rotated through 90° (Figure 2) and temporary jumper wires were installed (Figure 3). In total there were 4 jumper wires installed in the Werribee relay room, and 3 in location cases near the level crossings.

Figure 2: The probable state of fuses removed on the night of 29 November

Source: MTM, taken on the morning of 4 December prior to the incident, annotated by OCI

Figure 3: One of the jumper wires installed in the Werribee relay room on 29 November

The jumper wire shown in this figure was identified as ‘number 2’. Personal details on the wire label have been redacted.

Source: MTM, taken on 4 December 2020, annotated by OCI. 

Reinstatement of power to the Werribee relay room

The changeover[5] of circuits in the Werribee relay room was noted in the commissioning log[6] as complete and ready for testers on the morning of 2 December. The entry for the completion of the changeover was not annotated with a time, however, log entries either side were made at 0500 and 0700 suggesting that the changeover completion was between these times. It was reported that power to the relay room was also restored on the morning of 2 December, although this was not recorded in the logs. 

The temporary isolation arrangements put in place on 29 November to facilitate the operation of level crossing equipment for standard gauge trains were not removed when the power was restored to the relay room following the changeover of circuits. The temporary jumper wires and disconnected fuses 9C2 and 9C4 remained as they were.

Signalling circuit function testing in the Werribee relay room

Signalling circuit function testing commenced in the Werribee relay room on 2 December and continued during the (12-hour) day shifts and (12-hour) night shifts between 2 and 4 December. The teams undertaking testing were independent of, and not involved with, the isolation installed on the night of 29 November. At the commencement of function testing, the program was behind schedule and the commissioning was unlikely to be completed by 7 December. 

On 4 December, the day shift test team commenced at 0700. Soon after, a standard gauge train 5AM5 travelled through Werribee and the level crossing protection at both Cherry and Werribee Streets operated normally. 

The function tests involved the replacement of fuses as required to complete circuits for testing. This was normal practice. At about 0800 and following discussions with others in the project regarding the need to progress the testing of all circuits, the lead tester instructed one of the team to reinstate fuses 9C2 and 9C4 (Figure 4). The testers were not aware that several temporary jumper wires had been installed as part of the level crossing isolation arrangements. 

Figure 4: Fuses 9C2 and 9C4 replaced in Werribee relay room

Source: MTM, taken on 4 December after the incident, annotated by OCI

With the jumper wires still in place, control relays remained energised when the fuses were replaced, inhibiting the operation of the level crossing equipment at both Werribee and Cherry Street level crossings.[7] 

The passage of train 3PM7 through Werribee

Passage through Werribee Street level crossing

At about 0825 on 4 December, train 3PM7 approached the Werribee Street level crossing travelling at about 50 km/h. The train was detected by rail control systems, but the level crossing equipment did not operate. However, road traffic signals on Werribee Street, which were interfaced with the train detection system, did operate and stopped road traffic. 

The crew of train 3PM7 reported sighting traffic management staff at the Werribee Street level crossing and acknowledged their presence by an application of the train horn. Although the traffic management staff were present, they were not actively engaged in managing traffic at that time.

Passage through Cherry Street level crossing

Shortly after, train 3PM7 approached the Cherry Street level crossing travelling at about 52 km/h. The train crew observed that road vehicles were crossing, and that the crossing protection had not activated. In response, the crew made an emergency brake application and sounded the train horn several times. The train entered the crossing travelling at about 48 km/h. The lead locomotive came to a stand about 200 m past the crossing.

CCTV equipment installed at Werribee Railway Station showed motor vehicles crossing on Cherry Street ahead of train 3PM7 (Figure 5). It is estimated that the cars probably cleared the path of the train less than 2 s before the train occupied the crossing (Figure 6).

Figure 5: CCTV images showing road vehicles on Cherry Street as train approaches

Source: MTM, annotated by OCI

Figure 6: CCTV image showing the locomotive entering the level crossing

Source: MTM, annotated by OCI

Post incident management

In immediate response to the incident, the level crossings were secured with traffic management and (after being notified) ARTC train control applied a signal block to prevent standard gauge rail traffic from entering the section. 

On inspection within the Werribee relay room, an MTM infrastructure team identified that fuses in positions 9C2 and 9C4 had been reinstated with temporary jumper wires still in place. The fuses were removed and secured, the crossing systems tested and the ARTC signal block removed later on 4 December to allow the resumption of standard gauge services. 

For the remainder of the works, level crossing keepers[8] were put in place at the Werribee Street and Cherry Street level crossings to ensure level crossing operations. 

Context

The train and actions by crew

Train 3PM7 was a Perth to Melbourne intermodal freight service operated by Pacific National (PN) on the Australian Rail Track Corporation (ARTC) standard gauge network. The train consisted of 2 locomotives and 26 wagons, was approximately 1.4 km long, and had a crew of 2. 

Approaching the Werribee Street level crossing, the crew were controlling train speed at about 50 km/h and within the 60 km/h permitted speed. The horn was sounded about 400 m from the Werribee Street crossing and near the crossing to acknowledge track workers.

Records indicate that approaching the Cherry Street level crossing, the train was travelling at a speed of about 52 km/h, still within the permitted speed. Then, in response to the crew detecting cars on the crossing, an emergency brake application was made by the crew when the train was about 150 m from the crossing. The speed of the train commenced to slow and entered the level crossing travelling at about 48 km/h. Records indicate the train horn was sounded by the crew several times on the approach to the Cherry Street level crossing in response to road vehicles continuing to cross. 

There was no evidence to suggest that train handling contributed to this event.

Infrastructure

Location

The Werribee Street and Cherry Street level crossings were on the Werribee line of the Melbourne metropolitan rail network and located either side of Werribee Railway Station which was about 32 rail-km from Southern Cross Station in Melbourne (Figure 7). Rail lines through the location included 2 broad gauge lines and a parallel single bi-directional standard gauge line.[9]

Figure 7: Location of Werribee Railway Station to the west of Melbourne

Not all railway stations on the Werribee line are shown in this figure.

Source: Department of Transport, annotated by OCI

Infrastructure management

Metro Trains Melbourne (MTM) was the rail infrastructure manager (RIM) of the broad gauge lines through Werribee and ARTC was the RIM of the standard gauge line. MTM was the responsible RIM for the level crossing equipment and control systems for the Werribee and Cherry Street level crossings.

Werribee Street Level crossing

The Werribee Street level crossing was located about 680 m on the down side (away from Melbourne) of Werribee Railway Station.[10]The road crossing was equipped with active protection that included flashing lights, audible warning (bells) and half-boom barriers, and an active pedestrian crossing was to its east. The railway crossing systems were also interfaced with traffic control systems (traffic signals) to assist the management of road traffic through the level crossing.

At the time of the occurrence, the rail flyover that would replace the level crossing had been constructed and new broad gauge tracks had been installed. Standard gauge traffic was still operating through the level crossing (Figure 8).

Figure 8: Aerial view of Werribee Street level crossing and rail flyover in December 2020

Source: nearmap on 12 December 2020, annotated by OCI

Cherry Street level crossing

The Cherry Street level crossing was located about 215 m¹⁰ on the up side (towards Melbourne) of Werribee Railway Station. The road crossing was equipped with active protection that included flashing lights, audible warning (bells) and half-boom barriers (cover photo). Unlike the arrangements at Werribee Street, there were no road traffic lights (interfaced with the railway systems) installed for road vehicles approaching the Cherry Street level crossing.

On the day of the occurrence, the layout of the Cherry Street level crossing included 2 broad gauge lines and a single bi-directional standard gauge line crossing Cherry Street (Figure 9).

Figure 9: Aerial view of Cherry Street level crossing in December 2020

Source: nearmap on 12 December 2020, annotated by OCI

Level crossing control

Both crossings were within the Werribee signal interlocking area. The operation of the active protection for the 2 level crossings involved train detection and signal interlocking functions.[11] Control circuitry was in trackside location cases (at each crossing) and the Werribee relay room located on the Werribee Railway Station platform (Figure 10).

Figure 10: Aerial view of Werribee Railway Station and relay room

Source: nearmap on 12 December 2020, annotated by OCI

Systems were designed so that energised control relays prevented the activation of level crossing equipment. Following the detection of an approaching train, the relays would be de-energised, activating the protection equipment. This design configuration was failsafe in that a loss of power to the control system would result in relays becoming de-energised and level crossing protection systems activating. 

A Rail Interface Control Unit (RICU) was also installed at the Werribee Street level crossing to manage the interface functions between the railway crossing system and road traffic control system. The RICU was operational at the time of the incident and on detection of the approaching train by the rail systems, nearby road traffic signals were triggered to stop traffic. This arrangement was not in place at Cherry Street.

Level crossing removal project

Administration

In 2015 the Victorian State government established the Level Crossing Removal Authority (LXRA), an administrative office within the then Department of Economic Development, Jobs, Transport and Resources (DEDJTR). LXRA was responsible for the Level Crossing Removal Project (LXRP). In 2019, administrative responsibility associated with the LXRP was transferred to the Major Transport Infrastructure Authority (MTIA), an administrative office within the Department of Transport (DoT). MTIA used an alliance contracting model and grouped level crossing sites for contracting to program alliances.

Western Program Alliance (WPA)

WPA was one of the 4 alliances established by MTIA to deliver the LXRP. The alliance comprised McConnell Dowell as the principal contractor, Arup and Mott Macdonald as design partners, and Metro Trains Melbourne (MTM) as the rail infrastructure manager. In February 2020, WPA was contracted to remove level crossings at Old Geelong Road in Hoppers Crossing, and Cherry Street and Werribee Street in Werribee.

Stage 3 works at Werribee

To facilitate the removal of the level crossings at Werribee, the infrastructure changes were delivered in 4 main stages. The signalling cabling assets were confirmed during the first stage. Stage 2 comprised civil and structural enabling works, the removal of decommissioned equipment to the west of Werribee station, and interlocking changes. Stage 3 included the commissioning of the broad gauge flyover west of Werribee Station, the installation and commissioning of a new axle counter[12] configuration and the reconfiguration of the Werribee relay signal interlocking. Broad gauge train movements west of Werribee were scheduled to return after testing and commissioning of the new system.

John Holland Group (JHG) and Active Railway Signalling (ARS) were subcontracted to undertake the signalling works associated with stage 3 of the project. Traffic Diversions Group (TDG) was contracted to implement the road traffic management plan. 

Metro Trains Melbourne (MTM)

As the accredited RIM,[13] MTM was responsible for ensuring that the design, construction, and commissioning of rail infrastructure was carried out in a way that ensured safety of railway operations. MTM was also listed as being responsible for signalling design within the WPA design and engineering management plan (WPA 2020d).

Works commencing 29 November 2020 

Background

In mid-2020, Werribee Railway Station became a terminus for broad gauge trains, allowing construction works to the west of the station. Construction, testing and certification works from September to December would bring the new broad gauge signalling layout, which incorporated the elevated section (the rail flyover) over Werribee Street, into service. 

Activities scheduled between 29 November to 7 December included extensive re-wiring of broad gauge circuits in the Werribee relay room, and testing and commissioning works. To enable these works, the project implemented a track occupation[14] and broad gauge trains were terminated at Laverton, about 10 km to the east of Werribee. This meant there would be no broad gauge traffic in Werribee during the occupation from 29 November to 7 December. 

The bi-directional standard gauge line through Werribee was not part of the occupation and remained operational. It was planned that the level crossings at Werribee Street and Cherry Street were to be operational for standard gauge rail traffic for the duration of the broad gauge track occupation.

WPA management plans and guides

WPA produced a commissioning management plan (WPA 2020b) which described the framework for the pre-commissioning and commissioning activities. The WPA also developed a works guide (WPA 2020e) which, along with other track and civil works, described the high-level signalling tasks to be undertaken. It also stipulated that working shifts were to be back-to-back 12-hour shifts from 1900 on 29 November to 0700 on 7 December. 

Test and commissioning plan

The Alliance produced a test and commissioning plan (TCP) (WPA 2020c) for the works to be undertaken between 29 November and 7 December. The plan was approved by the project’s management and issued for construction (IFC) on 4 November. The purpose of the document was to ensure that required testing and commissioning activities were identified and planned. The TCP outlined the structure of the test and commissioning team (Appendix A) which included the following key personnel:

• The Tester in Charge (TIC): The TIC was an ARS employee. They were scheduled to work the 0700 to 1900 day shifts. They prepared the TCP issued on 4 November and were responsible for the satisfactory completion of system testing and commissioning requirements in readiness for service.  
• The Shift Tester in Charge, also referred to as the Alternate Tester in Charge (ATIC): The ATIC was contracted from HJW Signalling Services Pty Ltd and was scheduled to work the 1900 to 0700 night shifts. They oversaw testing and commissioning activities during the night shifts. 
• Testers and test assistants: Testers were contracted workers from Lineside Signalling, Dragon Rail and ARS. They were responsible for testing the function of circuits.
• The Principles Tester (PT): The PT was employed by MTM and was responsible for confirming that the newly installed system operated in accordance with the relevant signalling principles and safeworking rules and regulations. 

Consistent with the MTM standard for testing and commissioning of safety related railway signalling systems (MTM 2018a), the TCP stated that management and testers involved in the works should attend a pre-commissioning briefing. An invitation to a signalling pre-commissioning meeting (with draft TCP attached) was issued by WPA on 22 October 2020 and the meeting was held on 12 November. ARTC was included in the distribution of the TCP. The briefing was not attended by several personnel either because they did not receive the invitation or they chose not to attend. This briefing was held prior to the changes made to the level crossing isolation arrangements.

Level crossing isolation design changes

Isolation plan specified in TCP issued for construction

The testing and commissioning methodology section of the TCP issued for construction (IFC) on 4 November advised that the ARTC standard gauge line would remain operational. The TCP referred to a drawing for the isolation of Cherry Street level crossing which specified an isolation methodology consistent with that used for previous stages of the project. This isolation design did not require powering down of the relay room, did not specify the removal of any fuses, and required 1 temporary jumper wire. Testing work instructions in the TCP were also consistent with these arrangements.

Isolation design changes

About 3 weeks after the finalisation of the TCP, the decision was made to power down the Werribee relay room for the re-wiring works due to concerns that circuits may be undesirably energised during the works. As a result, an updated isolation arrangement was required.

On 25 November, the TIC instructed the ARS design team to develop a temporary feed arrangement for the isolation of the Cherry Street and Werribee Street level crossings. An alternative supply, referred to as a ‘false feed’, would power the control circuits required for the operation of level crossing equipment for the passage of standard gauge traffic. 

The design was completed by ARS on 27 November. A simplified representation of the design concept for the Cherry Street level crossing isolation and power feed is shown in Figure 11.

Figure 11: Simplified representation of isolation for the Cherry Street level crossing

Image shows a simplified representation of the level crossing circuits for Cherry Street level crossing. Temporary jumper wire number 1 was put in place to bypass the broad gauge approach and signal interlocking circuits for Cherry Street level crossing. Temporary jumper wire number 2 was put in place to accommodate the planned shutdown of the relay room power supply.

Source: ATSB and OCI.

Temporary jumper wires were installed to isolate the broad gauge train detection circuits from the level crossing control circuits (label 1). During the planned shutdown of power to the relay room, the temporary jumper wire also allowed an alternative power supply (from the level crossing location case) via the control relay in the relay room to the repeater relay at the location case (label 2). The temporary modification required the removal of the power supply to the relay room by the removal of a fuse (label 3) and opening the relay room power supply circuit breaker (label 4).[15]

The isolation plan included instructions to switch circuit breakers off and provided details of temporary wiring changes and fuse removal. Construction notes on the isolation drawings included the instructions ‘install temporary purple jumper wire with green tape in the vicinity of the end of the wire’ and ‘fuses to be removed and secured’ in relation to fuse bay locations 9C2 and 9C4 (Figure 12). 

Figure 12: Construction note extract from isolation plan

Source: ARS, extract by OCI

A second set of drawings (reinstatement plan) contained instructions for the reinstatement of power to the relay room. The drawings included instructions for circuit breakers to be switched back on, fuses to be reinstalled, and temporary jumper wires to be removed. 

Approval of design changes

In accordance with the requirements of its safety management system, MTM had developed an engineering management system framework (MTM 2019a), a design assurance procedure (MTM 2019b) and a signalling design technical review procedure (MTM 2017). The signalling design technical review procedure defined requirements and responsibilities of contractors and required that design documents applicable to works on MTM signalling infrastructure be submitted to MTM for technical review. Any signalling equipment that was required to be isolated, false fed[16] or removed during project work was to be checked and verified by the contractor and details provided to the MTM Engineering Design Review Group (EDRG) for review.[17] 

The revised isolation arrangements were sent by ARS to MTM for review and approval at 1838 on 27 November. Confirmation of approval by the MTM representative of WPA was sent to the contractor an hour later. This design was not issued to the MTM EDRG for review.

Management of the isolation design change

Procedures, guidelines and management plans

The MTM Design Assurance Procedure (MTM 2019b) applied to all MTM’s infrastructure and projects. This procedure defined a design change as a change occurring post-IFC and described the structure of a Design and Engineering Management Plan (DEMP) or Design Management Plan used to detail how the design change would be managed.

The TCP (section 6.5) noted that the process for the issue of design modifications may alter depending on project and contractors’ internal processes and the process being used for each project should be recorded within the design management plan.

The WPA Design and Engineering Management Plan existed as two documents, one referred to works at Werribee (WPA 2020d), the other was a program wide plan (WPA 2019). The purpose of a design change notification (DCN) referenced in the program wide plan was to provide stakeholders with a summary of the scope of a design change made to IFC documentation. The plan stated that a DCN resulting from a design change and the design change register (DCR) would be issued to the Level Crossing Review Group (LXRG) which would review the DCN. The program wide plan also stated that all temporary work that had the potential to impact train operations and/or have safety implications were required to be reviewed by the MTM LXRG. 

Dissemination and notification of isolation design change

DCNs were recorded in the DCR for the LXRP at Werribee. Between 20 August 2020 and 4 December 2020, 19 DCNs were recorded in the register, for all infrastructure types. However, the change to the isolation arrangements in the relay room approved on 27 November was not included in the DCR and the TCP was not reissued following the change to the isolation arrangements. There was no record of communication with the LXRG concerning the design change for isolation of the level crossing.

Design changes made following the occurrence

Following the non-operation of the level crossing equipment on 4 December 2020, a design modification was made to the isolation arrangements. The design modification, dated 14 December,[18] included the addition of construction note #3 which required the wires connecting the temporary jumpers to the fuse holder to be removed, sleeved and secured (Figure 13). This modification strengthened the arrangement in that reinsertion of the fuses (alone) would not complete the electrical circuit. 

Figure 13: Extract from design modification drawing, post incident

Source: ARS, extract by OCI

Implementation of isolation arrangements

Werribee relay room environment

At the time of the isolation, access restrictions associated with the COVID-19 pandemic were in place. The WPA Pandemic and Readiness response plan (WPA 2020a) required all buildings on site to have signage at the entry point displaying the maximum capacity for each building in accordance with a 4 m² per person rule. This applied to the Werribee relay room and probably limited free access to the room during isolation activities.

At the time of the isolation, there were several technicians from the John Holland Group inside the room undertaking electrical work. The ATIC was also present at the relay room.

Installation of isolation arrangements on 29 November 

The commissioning log recorded that the broad gauge track occupation started at 2100 on 29 November. The MTM level crossing disarrangement form showed that, as planned, the Werribee Street level crossing for broad gauge services was confirmed non-operational at 2220, and the Cherry Street broad gauge crossing non-operational at 2348. These times were consistent with entries in the commissioning log. The log also recorded that the Werribee relay room power was isolated at 0135 on 30 November 2020.

The isolation drawings and construction notes[19] required certain circuit breakers to be switched off, temporary jumper wires to be installed, other wires to be disconnected and sleeved and select fuses to be removed and secured. Based on available evidence, fuses 9C2 and 9C4 were not completely removed but were instead folded out (turned 90 degrees) with one end remaining in the holder. No specific instructions existed in the MTM specification for signalling supply, construction, and installation (MTM 2018b) on the method of securing a fuse bay to reduce the risk of premature reinstatement.[20]

The purple temporary jumper wires were installed broadly in accordance with the isolation drawings, excepting for the colour of identifying labels. White tape was used to label the wires instead of green as specified in the isolation drawings. The labels identified the designated number of the temporary jumper wire (in accordance with the isolation drawing) and the name of the installer as being the ATIC. The ATIC also annotated the isolation drawings, marking off the installation of each jumper wire and the removal of fuses. The ATIC had also added the annotation of ‘tested ok’ and signed the work instruction as having checked the work. 

Several temporary jumper wire installations were recorded on the isolation drawings and in the test strap register which were inconsistent with the identification of the installer on jumper wire labels.[21] An ARS testing assistant, a cadet railway signalling engineer[22] under the supervision of the ATIC, signed the test strap register and the isolation drawing as the installer of the temporary jumper wires in the Werribee relay room when they had only installed the jumper wire at the Cherry Street location case. 

Level crossing event during isolation

At about 2320 on 29 November during the application of the isolation, a freight train on the standard gauge line crossed the Cherry Street level crossing without activating the level crossing protection equipment. Traffic control was requested to stop road vehicles passing through the level crossing shortly before the train arrived. It was reported by the ATIC that this event may have distracted those involved in the isolation activities.

Testing

MTM engineering standards for testing and commissioning

The standard for testing and commissioning of safety related railway signalling systems (VRIOG 2008) was initially developed through the collaboration of members of the Victorian Rail Industry Operators’ Group[23] (VRIOG) and was adopted by the MTM as part of its engineering standard for testing and commissioning of safety related railway signalling systems (MTM 2018a). The practices specified in the standard applied to the testing and commissioning phases of new and modified railway signalling systems. 

The standard stated that the objective of the testing and commissioning of new or modified signalling systems, including where disconnected wiring may be reconnected, was to ensure that, before the systems were used for the control of train operations, the systems were to satisfy all specified requirements, safe working standards and any application‑specific requirements. 

Other sections of the standard pertinent to this investigation included:

• Independence – The standard specified the independence required of persons involved across different parts of the work.
• Pre-commissioning meeting – The standard required a pre-commissioning meeting to be held where key personnel involved in the commissioning works were briefed and a project scope, work sites and responsibilities were identified, and a test plan provided. This meeting was required to be separate from any occupation/safeworking or other discipline‑specific meeting associated with the project.
• Testing strategy – The standard required that a written statement of the proposed testing methodology be prepared, along with proposed layout and anticipated testing content in consultation with other involved parties at an early stage of the project. The standard required that the statement was kept up to date throughout the project development. Amongst other items, the testing strategy was to include:
  • creation of a preliminary testing program that included personnel resources 
  • a program of suitable and achievable work packages for individual testers to undertake any training needs
  • the limits of the testing, including responsibilities, interfaces (equipment interfaces, area interfaces, project interfaces), and stage work requirements 
  • identification of hazards, risks and control measures 
  • train operation and safe working arrangements.
• Operational requirements – The standard stated that if train running was unavoidable, any testing that was going to disrupt the train running should be carefully planned and completed in the time available. All hazards during testing and commissioning were required to be identified and appropriate contingency plans put in place. 
• Testing procedures – These were to provide details of the tests that were required to be carried out and included:
  • insulation resistance tests[24]
  • continuity tests[25]
  • wire counts[26]
  • null counts[27]
  • strap and function tests[28]

The standard provided instruction on the installation and removal of wires and advised that new wires should be stripped and crimped, continuity tested and then insulated and secured. The standard stated testing should not commence until all yellowed wires had been disconnected and removed. Yellowed wires were those wires that the design requires to be removed during a signalling changeover and are marked in yellow on the circuit diagram.

Other relevant standards

The Rail Industry Safety and Standards Board (RISSB) Australian Standard for signal testing and commissioning, AS 7717 (Standards Australia 2016), stated that:

… before certification function testing is commenced, testers shall ensure that circuit wiring testing is complete, that the circuit wiring is secured against interference, and that the approved final circuit wiring diagrams are correctly certified as bell continuity tested, wire counted, and insulation tested. 

Testing specified in the TCP

The testing regime outlined in the TCP described tests ‘broadly in the required sequence to be completed and some activities may be completed in parallel with others.’[29] In order of activity, these were:

• insulation (megger) testing 
• continuity (bell) testing
• wire / null count testing
• strap and function testing
• through testing.

Although the testing summary in the body of the TCP was consistent with AS 7717 and the MTM engineering standard, with the wire and null count testing listed for completion prior to strap and function testing, the detailed testing program differed. The detailed program in document WPA‑program v22 for 29/11-07/12 Occupation scheduled the strap and function testing before the wire and null counts (Figure 14). 

Figure 14: Extract from ‘WPA-program v22 for 29/11-07/12 occupation’ 

Source: ARS, annotated by OCI.

Implementation of testing from 2 December

Restoration of power to the relay room on 2 December

A detailed occupation program (WPA 2020g) was issued on 27 November which indicated that testing in the Werribee relay room was scheduled to start on the morning of 30 November. However, owing to a delay, the Werribee relay room was not available to testers until the morning of 2 December. Entry 38 (of that morning) in the commissioning log recorded that the Werribee relay room changeover was completed and included the comment ‘ready for testers’. Although no specific time was recorded against this entry in the log, evidence suggests it was probably made between 0500 and 0700. 

Power was restored to the relay room on the morning of 2 December to allow function testing although there was no record of this activity in the commissioning log. When power was restored to the relay room, it is very likely that technicians did not refer to the reinstatement plans. Isolation arrangements remained in place. Fuses 9C2 and 9C4 remained disconnected and a total of 7 temporary jumper wires remained in place, 4 in the relay room, one in the Cherry Street level crossing location case, and 2 in the Werribee Street level crossing location case.

Function testing

The commissioning log recorded that function testing in the relay room was conducted later on 2 December and continued into 3 December, during day and night shifts. Testing was undertaken by teams independent of those involved in the isolation of the relay room. 

Function testers reported ‘finding wires in the wrong spots’. The TCP required that wire and null count testing occur prior to the strap and function testing. Had testing occurred in the order required of the TCP it is probable that incorrectly positioned wires would have been identified and repositioned prior to the strap and function testing.

Testing of signalling circuits in the Werribee relay room required that fuses be restored to their normal positions. The function tester leading the testing team that started work on the morning of 4 December instructed one of their team members to reinstate the fuses. This was reported to have occurred following discussions between project team members where it was decided that all fuses should be reinstated. This was probably intended to expedite function testing due to testing and commissioning being behind schedule. 

As the temporary jumper wires used for the isolation were still in place, the reinstatement of the fuses and power being restored to the relay room meant the crossing control relays for both the Werribee Street and Cherry Street level crossings were inadvertently permanently powered.

Testing with redundant wiring and bare ends

The MTM standard for signalling installation (MTM 2018b) required that decommissioned signalling wiring should be removed immediately or should have its ends cut off, sleeved, tagged, and shall be removed prior to final testing and commissioning of any new works. The Australian Standard for Signalling testing process (Standards Australia 2017), though not mandatory, also stated that testing should not commence until all wires for removal have been disconnected and removed.

On 3 July 2020, the WPA submitted a request for information to MTM asking whether a standard waiver would be required from July to December 2020 to tag, cut, and sleeve redundant circuit ends while Werribee was being configured as a terminal station. MTM confirmed that a waiver was not required for the temporary retention of redundant equipment and that WPA’s proposal to remove all redundant equipment and wiring during the 29 November to 7 December occupation was acceptable. The project did not request a waiver nor had permission been given to conduct testing while bare ends were present on redundant wiring in the Werribee relay room.

For the December testing and commissioning activities, the TCP (section 6.5) referenced the need to remove redundant wiring from the Werribee relay room. Wires requiring removal were to be identified with yellow tape. The TCP stated that testing should not commence until all yellow wires[30] and equipment had been fully disconnected and permanently removed. However, the TCP also stated that yellow wires could remain subject to the approval of the MTM Head of Engineering Signalling and if the redundant wiring was not removed, it should be made safe using blind crimps[31] or terminated. 

On 2 December, the principles tester (after attending the Werribee relay room) contacted the TIC by email, stating that principles testing[32] could not be started while there were wires with bare ends present which produced a risk of stray wires causing energisation of circuits. The principles tester advised that ‘unrecovered redundant wiring needed to be removed, and if not they needed to be made safe’. The commissioning log recorded that sleeving of wires to protect bare ends was not completed until 1400 on 3 December. The redundant wires were made safe prior to the level crossing occurrence on 4 December.

The timings recorded in the commissioning log, along with interview evidence indicates that function testing was conducted while bare ends were present. This was contrary to the TCP and continuation of function testing while redundant wiring was being made safe was probably influenced by schedule pressures. 

Road traffic management

Applicable documents

Requirements and strategies for the management of road traffic risks were mentioned in several standards, guidelines and project documents. The following is a summary of those references:

• MTM standard for testing and commissioning (MTM 2018a) stated that all hazards during testing and commissioning were required to be identified and appropriate contingency plans put in place. 
• The Level Crossing Removal Project – Western Program Alliance Works Guide (WPA 2020e) stated that traffic management personnel would be in place between 29 November 2020 and 7 December 2020 at level crossings, including Werribee Street and Cherry Street, for ‘monitoring the traffic ….’
• The WPA Works Guide (WPA 2020e) also contained a section titled ‘Road Closures/Traffic Management’. For the period between the night shift of 29 November and the night shift of 1 December, the Works Guide required traffic management at Cherry Street to ‘Stop all lanes intermittently to allow Hi-Rail Access’.[33]For the period between the day shift of 3 December and the night shift of 6 December, the guide required traffic management at Cherry Street to ‘Stop traffic over level crossing intermittently to allow for principles testing & test trains’.[34]
• The TCP did not mandate traffic management outside of the times that test trains were planned. The occupation notice (MTM 2020a) attached to the works guide that captured the area of the Cherry Street level crossing gave no specific instructions for the protection of level crossings.
• The original isolation drawings issued for construction but subsequently superseded included a requirement for ‘crossing to be protected by traffic management and safe working at all times’. This requirement was removed from the revised isolation drawings that were approved on 27 November.
• A daily train notice was issued for the standard gauge which advised of works adjacent to the ARTC rail corridor. This notice was included in the works guide (WPA 2020e), the purpose of which was to outline the details of the broad gauge track occupation for 29 November to 7 December. The daily train notice did not make reference to traffic protection or operation of the level crossings for the ARTC standard gauge line. 

Implementation

The provision of traffic management at Werribee Street and Cherry Street was subcontracted to Traffic Diversions Group (TDG). A traffic guidance scheme produced by TDG (TDG 2020) for the occupation showed the provision of traffic controller staff at both crossing locations, for both directions of traffic. 

Traffic management staff are reported to have been available at level crossings if needed for broad gauge movements but were not actively managing traffic for normal standard gauge rail traffic. Level crossing protection was expected to operate normally for standard gauge trains.

Interview evidence indicates there were differences in opinion amongst project personnel on implementation of road traffic management and a lack of clarity on managing the risks during testing. ARTC, the RIM for the standard gauge track, was not consulted by WPA or MTM in the implementation of traffic management as a risk control during testing.

MTM audit of the project in October 2020

Audit of signalling testing and commissioning works

MTM was responsible for ensuring the safety of railway operations during projects for which MTM was the accredited RIM. As part of its assurance program, MTM conducted an internal audit of testing and commissioning (T&C) activities on the Werribee project in October 2020 due to the number of incidents associated with T&C works performed in the field.[35]

The audit report (MTM 2020c) was published by MTM on 20 November 2020. The purpose of the audit was to determine the extent of MTM’s conformity with the requirements of the signalling works in TCPs. This project was selected as an audit subject as MTM had identified several new projects which were to be delivered by the Western Program Alliance (of which MTM was a member). Findings (and corrective actions as applicable) relevant to this investigation included:

• Evidence provided by the project team was not sufficient to demonstrate that changes in scope during testing and commissioning works were evaluated ‘by the relevant people’[36] to determine potential consequences. In addition, it was found that scope change details were not formally recorded in the commissioning log. The finding was categorised high priority and agreed corrective action[37] (by 23 December) required TIC to ensure that any changes in scope were clearly identified, assessed and documented, and the potential consequences documented. Assuring conformity of changes with current standards was also identified in agreed corrective action. 
• There were instances of a TIC certifying their own work at a commissioning in August 2020. The finding was categorised as medium priority and an agreed corrective action date of 15 December was specified.
• Some staff were not attending pre-commissioning meetings. No specific corrective action specified for this finding. 

The audit recommended communication of the findings to all project managers, signalling project managers, testers in charge and principles testers to share learnings from the audit and to prevent recurrence of similar findings in future works. The TIC at the time of the incident in December 2020 was included in the audit report dissemination list. 

Previous similar occurrence

Level crossing irregularity North Geelong, Victoria in 2019

The most recent example of a level crossing irregularity during infrastructure project works in Victoria involved the standard gauge passenger train 3MA8 at North Geelong, Victoria, on 8 January 2019 (ATSB 2020). The protection equipment did not activate for the passage of the train through the Thompson Road level crossing. In preparation for stage 1 track work, only the broad and dual gauge[38] tracks at the Thompson Road level crossing were to be isolated. The level crossing protections for the adjacent standard-gauge track were to remain active until stage 2 works at a later date. However, the signalling tester, having been provided with the isolation drawings for stages 1 and 2 as a single pack by the TIC, mistakenly isolated the level crossing for stage 2 work, in addition to stage 1. 

VicTrack, through their contractor UGL Engineering Limited, did not provide the TIC or signalling testers with specific instructions detailing the scope of work to be conducted at each stage of the project, but rather, only provided packaged isolation drawings for the entire project. The absence of these specific instructions increased the risk of the works being incorrectly implemented.

Safety analysis

Introduction

For the passage of train 3PM7 through Werribee on the morning of 4 December 2020, the level crossing equipment at Werribee Street and Cherry Street did not operate to stop road traffic. This led to a near-collision between train 3PM7 and road vehicles at the Cherry Street level crossing. The analysis discusses:

• The non-operation of the level crossing equipment
• Installation of isolation arrangements on 29 November
• The reinstatement of power and testing from 2 December
• Isolation design change processes and communication
• Testing protocols
• Traffic management.

The non-operation of level crossing equipment

In preparation for works on broad gauge systems, temporary isolation arrangements were established on the night of 29 November to facilitate the operation of the Werribee Street and Cherry Street level crossings for standard gauge rail traffic. The isolation included the cutting of power to the Werribee relay room, the removal of fuses 9C2 and 9C4, the disconnection of wires and the addition of temporary jumper wires in the relay room and in location cases near the level crossings. Implementation of the plans was successful in achieving activation of level crossing equipment for standard gauge traffic while works were undertaken on the broad gauge systems.

Following the completion of circuit changeover works on 2 December, power was restored to the Werribee relay room in preparation for testing. The temporary isolation arrangements that had been installed to facilitate level crossing operation for standard gauge trains, including the temporary jumper wires, remained in place.

When the fuses at positions 9C2 and 9C4 were reinserted by the testing team on the morning of 4 December with the temporary wiring still in position, operation of level crossing protection equipment at Werribee Street and Cherry Street was inhibited by the unintended permanent powering of the crossing control relays. Testers were not aware of the isolation arrangements and that their action would affect the operation of the level crossings.

Installation of isolation arrangements on 29 November

Removal of fuses 9C2 and 9C4

The isolation installation was not fully consistent with the isolation plans. Fuses were not removed and secured as described in construction notes. When implementing the temporary isolation arrangements on the night of 29 November, one end of each of the fuses in positions 9C2 and 9C4 were turned out from their holders rather than being removed and secured as described in design drawings. Although this achieved the objective of disconnecting the circuits, it left the circuits vulnerable to re-connection.

The practice of turning a fuse outward in its holder (to facilitate its disconnection) without implementing other control measures carries risk, in this instance a safety critical risk. MTM guidelines were not specific regarding the work practices required of the removal of fuses in safety critical scenarios and the application of risk controls either through more robust design and/or more robust practices to secure fuses and block fuse holders. 

Jumper wire labels

Construction notes on the isolation drawings provided the following instruction: ‘install temporary purple jumper wire with green tape in the vicinity of the end of the wire’. However, white tape was used as labelling on the jumper wires rather than the green as specified. This was a deviation from the isolation plans, although unlikely to have been noticed by testers who were not familiar with the isolation plan drawings.

Independent check of isolation arrangements

The principle of independent inspection and testing of new and altered work, including the design and/or installation of a vital circuit, requires that no person undertakes and then certifies their own work when that work produces a safety critical outcome.[39] 

It is likely that the ATIC undertook parts of the isolation works and then verified that those same works had been completed in accordance with the isolation plans. This absence of independent checking of some works was consistent with the findings of the MTM audit of this project 2 months earlier which found instances of TICs certifying their own work.

Also, documentation recording the name of the person who had installed the temporary jumper wires in the Werribee relay room was signed (as installed) by a person who was not physically present in the relay room and had not installed the wires. This was probably to ensure documentation met the independence requirements. 

Other factors

Other factors that may have influenced the installation and checking of isolation arrangements that night were considered, including project resourcing, access restrictions due to the COVID-19 pandemic, the presence of several other workers in the relay room, the passage of a standard gauge train at about 2320 during isolation implementation, and fatigue of involved personnel. Although one or more of these factors may have impacted isolation activities, there was insufficient evidence to conclude that any of these factors had significantly influenced the installation.

Project pressures to complete the testing and commissioning within the window of the track occupation probably did heighten the potential for error, particularly in the context of late changes to the isolation arrangements and limited dissemination of information on the changes to potentially affected parties. 

Reinstatement of power on 2 December 

Broad gauge works in the Werribee relay room were considered ready for testing on the morning of 2 December and power was restored to the relay room that morning. The arrangements specified in the isolation plans, including the positioning of jumper wires, were retained.

The investigation did not identify any evidence that the reinstatement plan was consulted by technicians when power was restored. The plan addressed the restoration of power to the relay room and the removal of the temporary isolation arrangements. 

There was also no provision in the reinstatement plans for the isolation (that included powering down of the relay room) to be replaced with a simplified isolation when power was restored to the relay room. It is probable that the reinstatement sequence, which included restoration of power for testing, was not fully considered in the design or the programming of testing and commissioning activities from 2 December to completion.

Isolation change processes and communication

Change to design

To facilitate powering down of the Werribee relay room while maintaining level crossing operation for standard gauge traffic, the TIC requested the ARS design team to develop a new isolation design. Isolation and reinstatement plans were developed, and the isolation plan implemented. The design achieved the desired function although it was vulnerable to the replacement of fuses with jumper wires still in position.

On the isolation plan, construction notes stated that fuses in fuse bays 9C2 and 9C4 were to be ‘removed and secured’. The risk associated with inadvertent reinsertion of fuses could have been reduced with more explicit construction notes pertaining to the labelling and protection of fuse bays, and/or the disconnection and sleeving of fuse holder terminal wires. A design modification made to the isolation plans after the event on 4 December specified disconnection of the terminal wires. 

Design change approval

The signalling design technical review procedure contained specific requirements in relation to isolations and false feeds. Project works requiring any signalling equipment to be isolated, false fed or removed required an isolation/re-instatement design package which was required to be checked, verified by the contractor, and issued to the MTM Engineering Design Review Group (EDRG) for review. The isolation and reinstatement plans approved by MTM on 27 November 2020 were not reviewed by the EDRG or the MTM Level Crossing Review Group (LXRG). Review may have led to more robust plans.

Documenting change

Test and Commissioning Plan

Standard AS 7717 (Standards Australia 2016) recognised that on occasion, there may be a need to vary from the Test and Commissioning Plan (TCP). The standard stated that the TCP should ‘remain flexible enough to allow changes in direction when problems arise’ and ‘should be kept up to date throughout the project development’.

The change to the isolation strategy was made after the TCP was issued for construction on 4 November 2020, and before the occupation that commenced on 29 November. The TCP was not updated and reissued to reflect the change to the isolation arrangements and did not detail any planned strategy for the return of power to the relay room, a partial implementation of the reinstatement plan. The risk that the design change would impact signal testing was not documented by the TIC and was probably not assessed.

Registration of change

The change to the isolation arrangements in the relay room was not included in the register of design change notifications (DCN). Inclusion of project changes in the register was important for ensuring the change was captured by MTM’s scope of accreditation and providing additional opportunities for MTM to monitor the change. 

Incorporating change into program and work instructions

Excepting for the design drawing package, the change was not incorporated into program documentation. The reinstatement plan had been developed by ARS but the implementation schedule was not clearly documented in the work program and there was no evidence of consideration of how the reinstatement plan would practically be implemented when power was to be restored to the relay room for testing. An MTM audit of this project 2 months earlier also found instances of changes in scope not being assessed and documented.

The TCP did not contain instruction regarding the reinstatement of power to the relay room. The TCP lacked the relevant instruction because the IFC version was released on 4 November before the need to power down and repower the relay room had been realised.

Communicating change

Several key staff including the testing team working in the Werribee relay room on 4 December were not aware of the change to the isolation strategy and the temporary configuration. 

Along with the change not being included in the register of DCNs, an initial change impact assessment was not undertaken. There was no record that interface with stakeholders who would be impacted by the change, such as testers, had been considered.

Pre-commissioning briefings

Several key personnel did not attend the pre-commissioning meeting held on 12 November, either by choice or because they did not receive an invitation. Although this had no impact on this event, the importance of attendance of critical staff at briefings is reflected in the MTM engineering standard for testing and commissioning of safety related railway signalling systems (MTM 2018a) and was a requirement of the TCP. Key staff not attending pre-commissioning meetings was also a finding of the internal MTM audit report released on 20 November, shortly before the incident.

Testing protocols

Context

Function testing commenced on the morning of 2 December and involved teams on day and night shifts. Testers were independent of installation works, had not been involved in the installation of isolation arrangements and were not briefed on the isolation design which differed from recent crossing removal projects undertaken by WPA. The leader of the testing team on the morning of 4 December was not aware of the isolation configuration implemented during the works and stated that the temporary purple jumper wires installed during the isolation were in addition to other purple wires installed in the relay room.

Reinstatement of fuses was required for function testing, and it was therefore not uncommon for testers to reinstate turned fuses. Practices amongst testers were reported to vary, some taking a systematic circuit-by-circuit approach to restoring circuits, others a batched approached. On 4 December and following conversations with a member of the project team, testers reinstated fuses (9C2 and 9C4) which had been turned out as part of the isolation design. The reinstatement of fuses was not considered unusual practice for testers although this team was influenced by the advice of others within the project, and probably by pressures associated with the testing and commissioning being behind schedule.

Order of testing

Signal testing comprised the following 3 main elements, each of which should be undertaken by independent teams: 

• verification, during which installed relays and wiring are visually compared to the detailed design documents. This ensures circuits do not include any contact, terminal, or wires not shown in the circuit diagram. This is generally satisfied by conducting a ‘continuity test’, a ‘wire count’ and a ‘null count’ test.
• functional testing, undertaken by functional testers, during which the electrical operation of installed relays and wiring is checked against the detailed design documents. 
• principles testing, undertaken by principles testers using their knowledge of signalling principles.

The testing summary included within the main body of the TCP was consistent with this process and the MTM engineering standard for testing and commissioning of safety related railway signalling systems (MTM 2018a) which required circuit tests to be undertaken before the functionality of the signalling was tested.

Programmed and implemented testing varied from this approach. The function testing was conducted prior to the verification element being completed. Probably because the verification had not been completed, the testing team reported ‘finding wires in the wrong spots’ when they commenced function testing. The likelihood of wires being found incorrectly installed during function testing would probably have been reduced if the wire and null count testing had been concluded before strap and function testing. Undertaking function testing prior to verifying that the installed circuits were consistent with the drawings also increased the risk of an unintentional false feed being applied to affect working circuits. This risk was not directly associated with the non‑operation of the level crossings in this instance.

Redundant wiring and bare ends

Although the installation of the new signalling had been completed by the morning of 2 December, the removal of redundant wiring had not, and wiring with bare ends presenting a hazard was not reported as resolved until 1400 on 3 December. Function testing was conducted in the Werribee relay room while there were bare ends present. This was in contradiction to MTM’s procedures and Australian Standards for signal testing and increased the risk of erroneous signal testing results. This risk was not associated with the non-operation of the level crossings in this instance.

Traffic management as risk control

The isolation design drawings issued with the IFC version of the TCP on 4 November contained the instruction ‘Crossing to be protected by traffic management and safe working at all times’. However, this instruction was not present on the isolation drawings that were approved on 27 November. During testing, traffic management was limited to the protection of road rail vehicle movements on the broad gauge tracks as part of occupation works, and to mitigate circumstances where traffic might be caught queueing over the crossing. Traffic management was also to be used for test trains on the broad gauge lines.

The commissioning works for the level crossing removal project took place adjacent to the operational standard gauge railway managed by ARTC. Level crossing activation control equipment was located in the same relay room where signal function testing was being undertaken, and the risk of this testing affecting the safety of the operating railway was not sufficiently controlled. Traffic management for the passage of standard gauge rail traffic was an available, but unused, risk control during testing and commissioning activities. ARTC was not consulted on the use of traffic management as a risk control.

After the 4 December wrong side failure, level crossing keepers who could activate level crossing operation in the instance of a system failure were posted to the level crossings for the remainder of the testing and commissioning activities. 

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.  Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to level crossing irregularities involving freight train 3PM7 at Werribee, Victoria on 4 December 2020.

Contributing factors

• Changed level crossing isolation arrangements were not effectively reflected in program documentation, nor effectively disseminated to all those potentially affected. An earlier internal audit of the project also identified instances of scope changes not being documented. (Safety issue)
• When installing isolation arrangements on the night of 29–30 November, fuses to be removed and secured were instead probably folded out with one end remaining in the fuse holder. This made the fuses vulnerable to inadvertent reinstatement.
• Power to the Werribee relay room was returned on 2 December with temporary jumper wires for the isolation retained. There was no evidence of reference being made by technicians to the reinstatement plan and the vulnerability of the isolation arrangements was probably not appreciated.
• Fuses disconnected for the isolation were reinstated by testers on the morning of 4 December with the temporary wiring for the isolation still in position. With circuits in this configuration, operation of the level crossing equipment at Werribee and Cherry Streets was inhibited.

Other factors that increased risk

Isolation and reinstatement

• Metro Trains Melbourne standards and procedures did not specifically address requirements associated with fuse removal and securement in safety critical scenarios. (Safety issue) 
• There was probably no independent check of the isolation arrangements installed on the night of 29 November. An earlier internal audit of the project also identified instances of testers in charge checking their own work. (Safety issue) 

The change to isolation design

• There were opportunities for the updated isolation design to incorporate additional risk controls to reduce the likelihood of inadvertent replacement of removed fuses.
• Although approved by MTM, the isolation and reinstatement plans that included false feed arrangements were not reviewed in accordance with MTM design approval processes. 
• The change to the isolation design was not documented with a design change notification.

Other risk controls

• Road traffic management was an available risk control but not used during function testing. This became more critical following the reinstatement of power to the Werribee relay room. 
• Testing did not follow the order identified in the MTM engineering standard and the body of the Test and Commissioning Plan.
• Contrary to standards and procedure, function testing was conducted while there were signalling wire bare ends present on redundant wiring in the Werribee relay room. 
• Several staff critical to the testing program did not attend the pre-commissioning meeting for the testing and commissioning activities between 29 November and 7 December. An earlier internal audit of the project identified previous instances of this practice.

Other findings

• Records for the installation of temporary jumper wires in the relay room were signed-off as being completed by a worker who did not undertake the installation. 

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies. All directly involved parties were provided with the draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation. Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Change management

Safety issue number: RO-2020-020-SI-01

Safety issue description: Changed level crossing isolation arrangements were not effectively reflected in program documentation, nor effectively disseminated to all those potentially affected. An earlier internal audit of the project also identified instances of scope changes not being documented.

Guidelines for fuse removal

Safety issue number: RO-2020-020-SI-02

Safety issue description: Metro Trains Melbourne standards and procedures did not specifically address requirements associated with fuse removal and securement in safety critical scenarios. 

Independent checking of works

Safety issue number: RO-2020-020-SI-03

Safety issue description: There was probably no independent check of the isolation arrangements installed on the night of 29 November. An earlier internal audit of the project also reported instances of testers in charge checking their own work. 

Additional safety actions

Proactive safety action taken by the Australian Rail Track Corporation

Safety actions taken by the Australian Rail Track Corporation (ARTC) in response to this level crossing irregularity and a similar irregularity in Adelaide on 7 December 2020 include:

• Executive engagement with adjoining rail infrastructure managers on interim risk control measures at the shared active level crossings
• Updates to ARTC’s standard for bridging or false feeding signalling circuits including the ARTC requirement for bridging on the shared active level crossings
• The introduction of additional protocols for shared rail corridors and improvements to the rail/rail interface agreement with Metro Trains Melbourne, including communications.

Other relevant safety initiatives

Victoria’s Signalling Strategy Taskforce

The Signalling Strategy Taskforce (SST) was established in June 2021 as a specialist advisory group of the Office of the Director General within Victoria’s Major Transport Infrastructure Authority (MTIA). The MTIA was replaced by the Victorian Infrastructure Delivery Authority (VIDA) in April 2024.

The SST was established to address systemic issues affecting the efficient and effective delivery of signalling works required to support Victoria’s rail projects. VIDA advised that an objective of the SST is to identify and implement changes to practices, processes and methods of engagement to address key vulnerabilities identified as impacting signalling project delivery.

The SST is focused on delivering improvements in several areas of signalling planning, support and delivery. Of relevance to the circumstances of this occurrence are:

• The development of a uniform, objectively assessed, signalling competency attainment and recognition system, particularly in the areas of signalling design, testing and commissioning, that supports skills development and portability, including alignment with other national and internationally recognised schemes.
• The updating and unifying of Victoria’s railway signalling standards and related guidance material to prepare for and support the application of modern signalling and signalling control systems, as well as to reduce ambiguity and uncertainty.

ATSB comment

The successful implementation of the activities of the SST within VIDA should provide a framework for, and contribute to, addressing the safety issues identified in this investigation.

Glossary

AS	Australian Standard
ARS	Active Railway Signalling
ARTC	Australian Rail Track Corporation
ATIC	Alternate Tester In Charge
CCTV	Closed-circuit television
CSFGR	Cherry Street Level Crossing Control Relay
DCN	Design Change Notification
DCR	Design Change Register
DEDJTR	Department of Economic Development, Jobs, Transport and Resources
DoT	Department of Transport
EDRG	Engineering Design Review Group
IFC	Issued For Construction
JHG	John Holland Group
LXRA	Level Crossing Removal Authority
LXRG	Level Crossing Review Group
LXRP	Level Crossing Removal Project
MTIA	Major Transport Infrastructure Authority
MTM	Metro Trains Melbourne
ONRSR	The Office of the National Rail Safety Regulator
PN	Pacific National
RFI	Request For Information
RIM	Rail Infrastructure Manager
RTO	Rail Transport Operator
RISSB	Rail Industry Safety and Standards Board
SMS	Safety Management System
TCP	Test and Commissioning Plan
TDG	Traffic Diversions Group
TIC	Tester In Charge
TWI	Testing Work Instruction
UPS	Uninterruptable Power Supply
VRIOG	Victorian Rail Industry Operators’ Group
WPA	Western Programme Alliance

Sources and submissions

Sources of information 

The sources of information during the investigation included:

• Metro Trains Melbourne
• Western Program Alliance
• Active Railway Signalling
• Pacific National
• CCTV footage from Werribee

References

ATSB (Australian Transport Safety Bureau) (2020) Rail Occurrence Investigation Report RO‑2019-002 Level crossing irregularity involving passenger train 3MA8, North Geelong, Victoria, on 8 January 2019, Australia.

MTM (Metro Trains Melbourne) (2017) Signalling Design Technical Review Procedure, L1‑CHE‑PRO-035 -Version 2.

MTM (Metro Trains Melbourne) (2018a) Testing and commissioning of safety related railway signalling systems - engineering standard L1-CHE-STD-073, version 1.

MTM (Metro Trains Melbourne) (2018b) MTM L1-CHE-STD-070, Specification for signalling supply, construction and installation, version 1.

MTM (Metro Trains Melbourne) (2019a) Engineering Management System Framework, L1_CHE‑MAN-001 –Version 1.

MTM (Metro Trains Melbourne) (2019b) Design Assurance Procedure, 
L1-CHE-PRO-045–Version 1.

MTM (Metro Trains Melbourne) (2020a) Absolute Occupation Notice, 2101/2020.

MTM (Metro Trains Melbourne) (2020c) Internal Audit Independent Inspection Report, Western Program Alliance (WPA), Testing & Commissioning Compliance (WPA), 2 & 7 October 2020.

Standards Australia (2016) Signal testing and commissioning (AS 7717-2016), Rail Industry Safety and Standards Board (RISSB).

Standards Australia (2017) Signalling testing process (AS7716:2017), Rail Industry Safety and Standards Board (RISSB).

VRIOG (Victorian Rail Industry Operators’ Group) (2008) Testing and commissioning of safety related railway signalling systems, 012.5 revision A Issue Date: 11/12/2008.

WPA (Western Program Alliance) (2019) Design and engineering management plan WSP‑000‑WPA-PLN-XPN-0019.

WPA (Western Program Alliance) (2020a) Pandemic and readiness response plan, 2792‑0000‑OHS-PLN-0003.

WPA (Western Program Alliance) (2020b) Commissioning management plan, WPS‑000‑WPA‑PLN-XPM-0003, revision 5

WPA (Western Program Alliance) (2020c) Test and commissioning plan, 
WSP-050-C-WPA-PLN-09- WER-GSG-0003 Revision: 0 (IFC).

WPA (Western Program Alliance) (2020d) Design and engineering management plan, WSP‑030‑WPA-PLN-XPM-0019, revision 3. 

WPA (Western Program Alliance) (2020e) Works guide, LXRP-WPA-WES: 29 Nov to 7 Dec 2020.

WPA (Western Program Alliance) (2020g) Occupation plan WPA-WES DEC OCCO, version 22, date of issue 26/11/2020

Appendices

Appendix A – Organisation structure as specified in TCP

Source: WPA project TCP adapted by OCI

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.