RO-2018-102 Freight train SPAD and wrong routing, Taimate, 1 October 2018

What happened

1. On 1 October 2018, three track maintenance groups were repairing the track in the area between Seddon and Ward. At the end of the shift one of the work groups parked three heavy track maintenance rail vehicles in the crossing loop at Taimate.
2. There was a set of rail points coming off the adjacent main line at each end of the loop. The points were supposed to have been isolated and manually set for the main line to prevent trains travelling on the main line entering the loop and colliding with the mobile track maintenance vehicles.
3. Later that evening a freight train passing through Taimate on the main line was diverted into the loop at a speed of about 20 km/h. The freight train driver at the last moment noticed the points were set to divert the train into the loop. The driver applied emergency braking but was unable to stop the train before it had travelled some 80 metres into the loop line towards the parked maintenance vehicles. There was no collision and nobody was injured.

Why it happened

1. The Transport Accident Investigation Commission (Commission) found that the freight train was wrong-routed into the crossing loop because a staff member had inadvertently left the points in the wrong position, and there was no independent verification to confirm that the required protection had been put in place.
2. A SPAD (signal passed at danger) occurred when the driver slowed the train rather than stopping at the Red signal. This was likely due to a confirmation bias that the points were correctly set. Confirmation bias is a common human factor where individuals interpret information in a way that affirms a prior belief. Had the train stopped at the Red signal, it was likely that the driver would have noticed the incorrectly set points and stopped the train before it was wrong routed.
3. The Commission also found that a number of procedural errors had been made in the two days prior to the incident that were factors in the incident, and that a better system of check and challenge, and good communication, could have prevented the train being wrong-routed into the loop.
4. The report refers to a previous recommendation the Commission made in an earlier report that is equally applicable to this incident. KiwiRail has taken a number of safety actions that address the issues raised in this report. Therefore, no new recommendations have been made.

What we can learn and who may benefit

1. The key lessons arising from this inquiry are:

• knowledge and strict following of rail operating rules and procedures is key to safe rail operations and will help prevent incidents and accidents
• train drivers have an obligation to confirm for themselves that the information they have had from other parties is correct, and drive with caution until the information is confirmed.

Narrative

1. On Sunday 30 September 2018, the Kaikōura earthquake rail-recovery work on the Main North Line was underway in preparation for the reopening of the line to passenger trains. There were three track maintenance groups working between Seddon and Ward under the protection of a single track warrant issued that morning by train control (referred to as a multiple worksite protected work area). The track warrant was held by the rail protection officer (RPO) who was located at one of the worksites (Wharanui). The RPO was responsible for the safety of all three work groups.
2. At the end of the work shift, two of the work groups stabled their track maintenance vehicles in sidings at Wharanui and Lake Grassmere. Because there were no sidings located in the Taimate area, the Taimate work group stabled their maintenance vehicles on the main line crossing loop at Taimate (see Figures 1 and 2). The RPO relayed this information to train control. The team leader for the work group at Taimate also informed train control that their track maintenance vehicles were stabled on the loop.

1. Around 0930 the next day, 1 October 2018, the work group returned to Taimate crossing loop along with their site protector. Again, they worked under a track warrant held by the RPO at Wharanui, covering three separate worksites. After a daily safety briefing they ‘locked on’ (a system for ensuring track workers are clear of the rail corridor before a train is allowed to pass through a worksite) and prepared (preparing rail maintenance vehicles include conducting daily checks on vehicle safety systems, such as brakes and communication equipment) the three rail maintenance vehicles.
2. At the end of their shift at approximately 1730, the work group returned to Taimate and stabled the maintenance vehicles in the crossing loop. Once all the rail maintenance vehicles were secured, the work group ‘locked off’. The site protector then contacted the RPO at Wharanui by mobile phone and reported the track machines at Taimate as “off and clear of the main line” and stabled in the loop, after which the site protector left the site.
3. After the site protector had left, the team leader of the work group radioed train control to report that the track machines were stabled on the crossing loop at Taimate overnight. The train controller asked for confirmation that the points at both ends of the crossing loop had been set to protect the equipment stabled on the loop. The team leader had not been asked to do this on the previous day.
4. The team leader sent the second-in-command of the work group to set the northern end points manually to the ‘normal’ position to prevent rail vehicles diverting from the main line into the crossing loop (see Figure 2). The second-in-command left the points isolated8 so they no longer worked automatically (see section 4.2.5 for more detail). The team leader drove to the southern end of the crossing loop to set and isolate the points there. However, the team leader inadvertently left the points set in the ‘reverse’ position, which would direct northbound rail traffic into the crossing loop. After a short radio conversation with the second-in-command, the team leader informed train control that both sets of points were correctly set and isolated in the ‘normal’ position.
5. The radio conversation between the team leader and the train controller was overheard by the train driver who would be taking the next northbound train through the area later that night. The train driver made a mental note that the points at Taimate were correctly set for trains to pass through on the mainline.
6. At approximately 2205 the train driver took over the train at Pines and train control issued a track warrant to the train driver for the train to continue northbound. The track warrant authorised the train to proceed from Pines to Seddon. The track warrant referenced the maintenance vehicles stabled on the crossing loop at Taimate. The train driver confirmed with the train controller what they had overheard earlier in the day, that the points at Taimate were set and isolated for the freight train to pass through on the main line.
7. At about 2250 the freight train went past the Taimate ‘crossing loop ahead’ sign (see Figure 3) at approximately 65 kilometres per hour (km/h). The train driver started to apply the train brakes and by the time the train was 400 metres (m) from the southern set of points for the crossing loop the train driver had slowed the train to around 25 km/h and released the brakes. The train was travelling at around 23 km/h when the train driver observed that the points ahead were not correctly set for the main line, and immediately applied full emergency brake.

1. The train passed through the points, entered the crossing loop and stopped approximately 80m beyond the points, but well short of the track machines at the other end of the crossing loop (see Figure 3). The train driver radioed train control to report the incident.
2. The train controller on duty when the work group reported that the track machines had been stabled on the Taimate crossing loop had 18 months’ train control experience. The train controller on duty when the freight train was wrong-routed into the Taimate crossing loop had 45 years’ rail experience. Both held current certification for the role.
3. In accordance with the operator’s policy, the train driver underwent a post-incident drug and alcohol test. The members of the track work group were all drug and alcohol tested the next day. All returned clear (negative) results.
4. The RPO worked for a subcontractor to KiwiRail and had seven years’ rail experience. The site protector at Taimate also worked for the same subcontractor and had 10 years’ rail experience. Both held current certification for their roles. Neither was drug and alcohol tested because KiwiRail considered their actions were not likely to be factors contributing to the incident.

Introduction

1. The wrong-routing of the freight train into the crossing loop was a serious event. A collision between a loaded freight train and heavy track maintenance rail vehicles has the potential to cause significant damage, and injury to persons. In examining the various KiwiRail rules and standard operating procedures, it appears that if they had all been followed correctly, the route for the train would not have been set for the loop, and even if it had been, the train driver would have stopped the train before it entered the loop.
2. The following analysis discusses the circumstances that led to the incident, and several factors that either directly or indirectly contributed to the incident.

What happened

Crossing loops

1. Crossing loops allow trains travelling in opposite directions on a single-track section of line to cross safely. Train control issues track warrants that specify which crossing loops will be used to cross opposing trains. The track warrant states which train will use the main line and which will enter the loop. The crossing loops of the type at Taimate are semi-automatic. Train control has no visibility of how the points are set or what the signals are displaying. Some manual input is required from train drivers to activate the points to enter a crossing loop.
2. When a train is required to enter a crossing loop for an opposing train, the train driver stops the train short of the signal and unlocks the manual input box (see Figure 4). The train will have activated the track circuit located 400 m back from the crossing loop. The train driver is able to press the ‘loop’ button to set the points to access to the loop. An
3. The points then automatically reset to their standard position, for trains to pass straight through on the main line. All signals then return to Red until the next train triggers one of the track circuits within 400 m of the crossing loop. See Appendix 1 for diagrams.
4. ‘L’ illuminates on the signal when the points are set. Once the train has entered the loop, the points and signals automatically reset to allow the opposing train to pass on the adjacent main line. When the opposing train has passed clear of the crossing loop track circuits, the points and signals automatically reset to allow the train sitting in the loop to depart through the opposite end of the loop.

1. With track maintenance machines stabled in the crossing loop, the points at both ends were supposed to have been manually set for trains to pass straight through on the main line, and isolated (left in manual operation mode). This would have prevented the crossing loop automatically setting the points to allow the maintenance equipment out of the loop after a train had passed by.
2. Points isolation is accomplished by removing a crank handle from the locked crank handle box (see Figure 4) by the points and hand winding (sometimes referred to as ‘hand winding points’; refers to manually operating a set of points by utilising a hand crank or lever to set the route) them into the correct position, before placing the crank handle loosely in the bottom of the crank handle box. This means the crossing loop is no longer automatic, and train drivers approaching the crossing loop encounter a Red signal that does not automatically change to yellow as the trains approach. The team leader of the workgroup had overall responsibility for ensuring that the points were correctly set and isolated (rule 914 of the New Zealand Rail Operating Rules and Procedures: Mobile Track Maintenance Vehicles (MTMVs) (e) Safeguards).
3. Stabling track machines on a crossing loop is an acceptable practice within the rail operating rules. However, in doing so operating flexibility may be compromised by leaving one less crossing point available, which could have an effect on schedules and production. When possible, it is preferable to stable track machines in a siding or other such area and leave crossing loops clear. Utilising sidings also means the equipment is further removed from the mainline and therefore reduces risk.

The worksite – communications and responsibilities

1. Train control has overall responsibility for the safe movement of rail vehicles and track access on the controlled network. This includes directing and recording the movements of all trains on a train control diagram (see Appendix 2), as well as authorising maintenance work groups to work on track.
2. Within track warrant territory, train control authorises an RPO of a multiple worksite protected work area to occupy the appropriate section of track by issuing a track warrant (Section 10.1 Train Control, 12.0 Track Warrant Control (TWC) of the New Zealand Rail Operating Rules and Procedures). If a train is required to pass through the track warrant controlled area, the train driver liaises with the RPO to ensure that the track is safe and clear before the movement is authorised to enter the protected area.
3. When the RPO calls train control and cancels the track warrant, this only confirms that the mainline is clear and available for normal traffic to resume. A track warrant does not cover sidings, yards or other non-main-line areas such as crossing loops.

4. KiwiRail Rule 902 (rule 902 Managing a Protected Work Area (PWA) of the New Zealand Rail Operating Rules and Procedures) explains the flow of information through a multiple worksite protected work area (see Figure 5). Each individual worksite has a site protector who co-ordinates with the RPO, who in turn communicates directly with train control to control the movement of rail vehicles through the protected work area.

   

5. RPOs and site protectors are not required to be trained or authorised to operate signals or points, but work group team leaders and the drivers of maintenance rail vehicles are. Staff who are appropriately trained within work groups liaise directly with train control to obtain permission to, in this case, stable equipment on a crossing loop. It is then their responsibility to ensure that the points at both ends of the loop are properly set and isolated, and pass this information to train control (see Figure 5 – dotted blue line).

The day before the incident

1. The above procedure was not carried out the day before the incident. The equipment was stabled on the Taimate crossing loop without the points being manually set and isolated. When the team leader called train control to let them know that the maintenance vehicles were occupying the loop for the night, the train controller on duty at the time did not confirm the status of the points with them and did not mark the status of the points on the train control diagram. Consequently, the crossing loop was left in semi-automatic mode for the entire night, with maintenance vehicles essentially unprotected. Fortunately, no trains were scheduled through the area that night.
2. The train controller did not confirm the status of the points with the workgroup team leader based on an interpretation that the points had not failed and were not subject to an outage (see Figure 6). That controller’s interpretation was not shared by other senior controllers who were asked which was the correct procedure to apply. Correct practice would see the train controller confirm with the workgroup the points were correctly set and isolated, and then mark the train control diagram accordingly.

1. Even if there was some doubt, it would have been good non-technical-skills practice to confirm anyway, rather than relying on an assumption that the points were set for trains to pass by on the main line.

The day of the incident

1. On the day of the incident, the work group at Taimate called the train controller on duty (a different controller from the one who was on duty the previous day) to say the track machines were stabled on the crossing loop. The train controller reminded the work group that they needed to manually set and isolate the points to protect the track machines (rule 914(e) Mobile Track Maintenance Vehicles (MTMV) of the New Zealand Rail Operating Rules and Procedures – Safeguards – “When berthed/stabled … in a siding, the operator in charge of the MTMV(s) [track machinery] must ensure all practicable steps are taken to protect the machine(s) from collisions, including but not limited to ‘Setting a diverging route’. When MTMVs [track machinery] are required to berth on a crossing loop … Train Control permission must first be obtained”) (as per Rule 914). Once this protection was confirmed, the train controller noted on the train control diagram that the track machines were on the loop and that the points had been set and isolated in the normal (main line only) position.
2. The correct procedure was applied on this day. The issue was that the team leader had inadvertently set the points in the wrong direction, so the information passed to the train controller was incorrect. This failure in human factors terms is called a lapse, and was a failure in the first procedure designed to protect the stabled vehicles from collision. The fact that nobody else was cross-checking such an important task is a failure in itself. Humans make mistakes, and if the system requires no alternative means of verification, these one-person errors can result in incidents (in this case) or accidents in other circumstances. The potential for the same error to occur at the opposite end of the crossing loop also existed without a second person confirmation.

The train driver’s perspective

1. The train driver was travelling in a car when the train controller and the team leader were discussing the status of the Taimate crossing loop points on the radio. The car had a KiwiRail portable radio inside, so the train driver overheard the conversation. The conversation was of interest to the train driver because they would be taking the next northbound train through Taimate later that evening. The train driver noted that the workgroup team leader and train controller confirmed that the route was set for all trains to travel straight through on the main line.
2. The train driver took over the freight train and was later issued with a track warrant by the same train controller, authorising the train to proceed from Pines to Seddon, through Taimate and several other locations. Despite having overheard the earlier conversation between the team leader at Taimate and the train controller, the train driver still confirmed with the train controller that the points at Taimate had been “isolated in the correct normal position”.
3. The train driver had then twice received confirmation that the route would be set straight through Taimate on the main line. The conversation the train driver overheard between the workgroup and train control contained incorrect information, which was later repeated by train control directly to the train driver.
4. The signal at the crossing loop was Red, and that was what the train driver was expecting to see. Effectively, the track warrant authorised the train to pass the Red signal without further communication with train control, but only after the train driver had complied with Rule 422 of the Operating Rules and confirmed that the route was correctly set.
5. Rule 422 states that on encountering a Red Stop signal with no ‘A’ light illuminated at a crossing loop, the first action should be to stop at the signal before confirming the reason for the signal being at Red (see Figure 7). In this case the train driver had received several reports confirming that the signal was Red due to the points being manually set for the correct mainline route.

1. Even though the train driver expected the route to be set correctly, the train approached the Taimate crossing loop signal cautiously at about 20 km/h. However, the train driver had stopped braking and was preparing to let the train coast through the station when he noticed in the locomotive headlights that the points ahead were set for the loop. The driver had received information that the points were correctly set on two previous occasions and as a result likely had confirmation bias, which resulted in the decision to not stop at the Red light. The train coasted through the Red signal and in doing so it resulted in a SPAD (signal passed at danger).
2. The result was that the train was not able to stop before entering the loop, in spite of the emergency brakes being applied. In other words, the train was travelling too fast to stop in the visual distance ahead, a second failure in defences designed to protect the vehicles stabled on the loop.

Summary

1. There were a number of procedural failures, of which some did not directly contribute to the incident but are nevertheless of concern.
2. The day before the incident, the correct procedures for protecting the rail vehicles stabled in the loop had not been followed by the work group, and their error had not been picked up or challenged by the train controller on duty at the time.
3. It is about as likely as not that the same would have occurred on the day of the incident had it not been for a different train controller on duty challenging the work group into following the proper procedure. In spite of the workgroup being reminded of the proper procedure, an error resulted in the south-end points being left in the wrong position anyway.
4. The train driver, having twice received confirmation that the points would be correctly set for the train, then assumed that to be the case and did not slow the train sufficiently to stop, resulting in a SPAD.
5. KiwiRail undertook a range of safety actions to address those procedural errors, negating the need for the Commission to make safety recommendations (see section 6).
6. There were several examples in the incident sequence where better communication and the practice of good non-technical skills could have detected one or more of the errors made and prevented the incident. The Commission has previously commented on the standard of non-technical skills in the rail industry in its report RO 2011-10117. This recommendation is repeated in section 7 of this report.

Stabilised approach technique

1. The stabilised braking approach is a relatively new KiwiRail initiative where train drivers are taught to reduce the speed of their trains to certain targets at specified distances from a desired or potential stopping. Figure 7 provides an example set of target speeds that can be adjusted according to the prevailing circumstances of the situation, including weather, visibility and the weight/length of the train. This staged braking technique ensures that the train driver has the train under control and able to stop, in this case before the signal at Red Stop.

1. In this case the train driver had achieved the desired speed of 20 km/h about 200m out from the signal. In the absence of trackside distance markers, the train driver had to rely on route knowledge to know when to start reducing the speed of the train to stop before reaching the signal. The stabilised approach initiative could be enhanced by placing distance markers at appropriate distances from potential stopping points where drivers’ views are restricted by terrain.

1. The freight train was wrong-routed into the crossing loop at Taimate because a staff member had inadvertently left the points in the wrong position, and there was no independent verification to confirm that the required protection had been put in place.
2. A SPAD (signal passed at danger) occurred when the driver slowed the train rather than stopping at the Red signal. This was likely due to a confirmation bias that the points were correctly set, based on information that the driver had received on two previous occasions. Had the train stopped at the Red signal, it was likely that the driver would have noticed the incorrectly set points and stopped the train before it was wrong routed.
3. A number of procedural errors were made in the two days before the incident that are of concern but did not necessarily directly contribute to the incident.
4. There were situations where better check and challenge, and better communication, could have prevented the train being wrong-routed into the loop.

General

1. Safety Issues are an output from the Commission’s analysis of factors that have contributed to the occurrence. They typically describe a system problem that has the potential to adversely affect future operations on a wide scale.
2. Safety Issues may be addressed by safety actions taken by a participant, otherwise the Commission may issue a recommendation to address the issue
3. Recommendations are made to persons or organisations that are considered the most appropriate to address the identified safety issues.
4. In the interests of transport safety, it is important that safety actions are taken, or any recommendations are implemented without delay to help prevent similar accidents or incidents occurring in the future.

Safety issues

1. No new safety issues identified.

Safety actions

General

1. The Commission classifies safety actions by two types:

   (a) safety actions taken by the regulator or an operator to address safety issues identified by the Commission during an inquiry that would otherwise result in the Commission issuing a recommendation

   (b) safety actions taken by the regulator or an operator to address other safety issues that would not normally result in the Commission issuing a recommendation.

Safety actions addressing safety issues identified during an inquiry

1. In response to the Taimate crossing loop incident, KiwiRail has initiated some revalidation and retraining of both the workgroup and the train driver involved. Additionally, the work group and KiwiRail have developed an ‘end of day’ checklist to ensure a standardised approach to leaving a worksite each day.

2. On 14 December 2018 and 11 and 25 January 2019 KiwiRail issued ‘Rule of the Week’ discussion documents related to the Taimate incident for discussion at team Toolbox and/or Tailgate safety briefings (see Appendices 3 to 5).

3. On 14 January 2019 KiwiRail issued a Staff Briefing to all freight train drivers regarding the extension of the Arrival Signal track circuits from 400 m to 800 m, where there is an unobstructed range of vision. This document also reinforced the requirement for drivers to have their trains under such control as to be able to stop before a signal or other feature if the need arose (see Appendix 7).
4. On 16 January 2019 KiwiRail Zero Harm issued a Toolbox message regarding the isolation procedure for Nippon points (see Appendix 6). These were the types of points incorrectly set and isolated at Taimate.
5. Additionally KiwiRail is:

• reviewing and auditing the track warrant system for the effective control of stabilising equipment in crossing loops
• auditing communication to ensure points’ isolations are advised and processed in a standardised way
• reviewing current utilised communication-recording technology to understand the best method to ensure standardised communication across the rail network.

General

1. The Commission may issue, or give notice of, recommendations to any person or organisation that it considers the most appropriate to address the identified safety issues, depending on whether these safety issues are applicable to a single operator only or to the wider transport sector. In this case, no new recommendations have been issued.
2. In the interests of transport safety it is important that any recommendations are implemented without delay to help prevent similar accidents or incidents occurring in the future.

Previous recommendations

1. Good, positive communication is key to the safety of train operations. There were several examples in the incident sequence where better communication and the practice of good non-technical skills could have detected one or more of the errors made and prevented the incident.

2. In 2012, as part of inquiry RO-2011-101, the Commission issued a recommendation (002/12) to the Chief Executive of the NZ Transport Agency that they require: the Executive of the National Rail System Standards (NRSS) to develop standards to ensure all rail participants meet a consistently high level of Crew Resource Management (now non-technical skills); and communication to staff which includes the use of standard rail phraseology.

   On 31 March 2017 the NZ Transport Agency updated the Commission as follows:

   It is noted that the Commission issued its most recent recommendation on non-technical skills to the Transport Agency in 2012 and that this is still open. The recommendation required that the practice of non-technical skills be recognised in the National Rail System Standards. The Transport Agency continues to work with KiwiRail on this issue, and in December 2016 issued a Safety Improvement Plan Notice in accordance with section 36 of the Railways Act 2005 requiring KiwiRail to prepare a Safety Improvement Plan to address the implementation of non-technical skills into its rail operations.

   On 1 November 2017 the NZ Transport Agency updated the Commission as follows:

   The Transport Agency approved KiwiRail’s Safety Improvement Plan regarding non-technical skills in April 2017. In their most recent update on the Non-Technical Skills project KiwiRail reported that the project is on time, within budget and meeting the project specifications. As of 13 October 2017, the Transport Agency has also agreed to the integration of stabilised approach and risk-triggered commentary driving into the scope of the Safety Improvement Plan requirements.

1. Knowledge and strict following of rail operating rules and procedures is key to safe rail operations and will help prevent incidents and accidents.
2. Train drivers have an obligation to confirm for themselves that the information they have had from other parties is correct, and drive with caution until the information is confirmed.

1. The incident occurred at about 2254 on Monday 1 October 2018. The NZ Transport Agency (the Agency) notified the Transport Accident Investigation Commission (Commission) on 3 October 2018. The Commission opened an inquiry under section 13(1) of the Transport Accident Investigation Commission Act 1990 to determine the circumstances and causes of the incident and appointed an investigator in charge.
2. Commission investigators travelled to the incident site on 8 October 2018 to commence the investigation.
3. Commission investigators interviewed the:

• freight train driver (the train driver)
• train controllers
• track maintenance workers
• Rail Protection Officer (RPO) and site protector
• train driver trainer
• train controller trainer
• RPO and site protector trainer.

1. The Commission obtained the following documents and records for analysis:

• documents detailing how crossing loops of the type at Taimate function
• the training records for the train driver, the track workers and the train controllers
• the roster details for the train driver, the track workers and the train controllers
• the event recorder download data from the lead locomotive
• recorded communications between the train controllers and the track maintenance group, and between the train controller and the train driver.

1. On 22 May 2019 the Commissioners considered the draft report and approved it to be sent to interested persons for consultation.