Safety concern regarding Automatic Train Protection (ATP) failures on [Operator] locomotives.
The reporter advises that since early April 2021, drivers at the [Location] depot, have encountered an ATP issue with south bound trains at the northern end of [Location] station, which is on the north coast line between [Location A and Location B]. The error drivers are receiving is a transponder proximity error and a system failure warning which gives a brake penalty that stops the train and requires an ATP recycle. More recently, this has also been occurring on northbound services. The problem only effects [Operator] locomotives. Other operator locomotives are unaffected.
To recycle the ATP on a train can take 10-15 mins and because the station is served by passenger trains there is a bit of pressure from control to cut the ATP and run to a more convenient location for the controller, and perform the recycle there. On southbound trains this isn't as much of an issue as the area is in non-ATP territory. However, northbound is a problem and trains are operating for an hour or more before there is an opportunity to cut the ATP back in. This is done so other services aren't affected.
Drivers believe that the problem is being caused by the TSR (temporary speed restriction) ahead board just on the northern end of [Location]. This board has ATP transponders with it to count down the 2, 500 m to the restriction that is on the section ahead. Drivers have made network control aware of this as well as [Operator] management and the fleet maintenance provider, [Operator 2].
[Operator 2] have advised that the issue is [Operator's] ATP runs an older version of software, whereas other operators run newer versions of the software are not affected by this fault because of this. Drivers have been told that [Operator] believes it is a network issue, but network control and [Operator 2] believe it is a [Operator] issue. The concern is that a critical safety system in the ATP will fail at a point en-route and no-one wants to take responsibility for it.
The issue at [Location] has now been resolved by network control moving the TSR Transponders away from the home signals transponders. The problem has now moved to [Location 2] where instead of exiting ATP correctly on entering the Suburban Area, the ATP gives a Transponder error which stops the train, requiring the driver to cut it out in order to continue.
The reporter believes that [Operator's] ATP needs to be upgraded to newest version of software but there appears to be resistance to do so. As a result, drivers are being put into a position where they're being asked to break the rules by over running with the ATP cut out.
Based on the number of reported events over the last three-months, the frequency of failures has been reduced. The most significant reduction is on the [Location] line. A result of [Infrastructure Manager's] decision to reposition the TSR Transponder away from the home signals transponders.
[Operator] monitors ATP failures and reports of failures closely to identify early trends and opportunities. [Operator] continues to work with and influence the Network to address the identified areas where ATP errors are occurring and will explore the raised issue, when entering the Suburban Area at [Location 2].
[Operator] will continue to work with and reinforce with [Infrastructure Manager], the importance of reliable ATP performance given it is a critical control to our safe operations. [Operator] will need to continually evaluate the use of ATP as a control, if Network is unable to provide a high level of systems reliability and respond satisfactorily to system issues raised.
The reporter is correct in identifying a newer version of the software is available. [Operator] have worked with the manufacturer, and have been advised they will not support / restart issuance of the newer version for implementation into the [Operator] fleet.
[Operator] reinforces that they do not expect any driver to not adhere to safe train handling rules and procedures and encourage drivers to report any known hazards, so [Operator] can be in the best position to address or influence other key stakeholders for improvements in safety.
ONRSR can confirm it has received ATSB REPCON report number RR2021-00070, dated 23 September 2021 regarding Automatic Train Protection (ATP) issues on the rolling stock operated by (the Rolling Stock Operator – RSO) on the network managed by (the Rail Infrastructure Manager – RIM).
ONRSR has reviewed the reporter’s concerns and also the RSO’s response noting the changes made to date and the limitations on the availability of system upgrades by the software manufacturer.
ONRSR is aware that ATP is used by the RSO for its Driver Only Operations (DOO) on the RIM’s network and it is a critical risk control. ONRSR is aware that in the event of an ATP failure, the RSO conducts a fatigue risk assessment on the driver before the train is allowed to continue as an DOO service. It is also noted that the failure of a control such as ATP is a notifiable occurrence and is required to be reported to ONRSR. Operational data related to ATP failures is monitored by ONRSR and considered in regulatory activities undertaken as part of the National Work Program.
In May 2021, ONRSR conducted a series of compliance inspections on the RSO’s operations which included ATP in the scope. Opportunities for improvement were identified in the area of managing driver fatigue risk assessments following an ATP failure and internal assurance activities on maintenance of ATP systems. The RSO has implemented or is currently implementing corrective actions and has provided supporting evidence to ONRSR. A future regulatory activity is planned for the RSO’s operations on the RIM’s network where ATP is in use and will include management of fatigue risks for DOO services, ATP reliability and risk management.