RO-2017-106 Mainline locomotives, Wrong-routing and collision with work vehicle, Invercargill, 16 November 2017

1. At 1503 on Thursday 16 November 2017, two coupled mainline locomotives were being moved from the main line to a refuelling area at Invercargill. However, the points were not set for the intended route and the locomotives were instead diverted into the rail maintenance depot.
2. The locomotives collided with a truck that was parked outside the maintenance depot, propelling it into a freight wagon that was parked inside the depot for repair work. Both ends of the truck were damaged, but nobody was injured.
3. A protective derailing device had been placed onto the rail outside the maintenance depot. The device was designed to derail any rail vehicle inadvertently entering the track that led to the depot. However, the cowcatcher on the front of the lead locomotive dislodged the derailer and prevented it derailing the locomotive.
4. The Transport Accident Investigation Commission (Commission) found that the locomotives were wrong-routed off the intended route and into the maintenance depot siding because the necessary checks to ensure that the points were set in the correct position for the movement were not made.
5. The Commission also found that the procedures in the Invercargill Joint Operating Plan for protecting the maintenance depot from unintended rail movements did not conform fully with the KiwiRail rules, and that there were indications that staff were routinely not complying with the procedures set out in the plan.
6. The level of audit and compliance testing of the Invercargill Joint Operating Plan was not robust in detecting and addressing compliance issues within the Invercargill yard.
7. The Commission identified one safety issue – that the level of audit and compliance testing of the Invercargill Joint Operating Plan was not robust in detecting and addressing compliance issues within the Invercargill yard.
8. KiwiRail Holdings Limited took a number of safety actions to address this safety issue. Consequently, the Commission has made no recommendations arising from this inquiry.
9. Key lessons arising from this inquiry include:

• it is important to ensure that documented rules, policies and procedures are compatible and consistent across all places of work in the rail network
• a culture of non-compliance can quickly develop if staff are not prompted to follow the proper procedures when undertaking their duties, and do not challenge their work colleagues if they observe them not following procedures.

1. The incident occurred at about 1503 on Thursday 16 November 2017. The NZ Transport Agency notified the Transport Accident Investigation Commission (Commission) on Friday 17 November. The Commission opened an inquiry under section 13(1) of the Transport Accident Investigation Commission Act 1990 to determine the causes and circumstances of the occurrence and appointed an investigator in charge.
2. Commission investigators travelled to Invercargill on Saturday 18 November 2017 and conducted a site examination.
3. Commission investigators interviewed the:

• train driver
• pilot for the setback movement
• maintainer who was present inside the maintenance depot at the time of the incident
• Invercargill Operations Manager.

1. The Commission obtained the following documents and records for analysis:

• the closed-circuit television recordings from the refuelling bay camera
• the Joint Operating Plan for the KiwiRail Invercargill facility
• the training records for the driver and pilot
• the roster details for the driver and pilot
• the event recorder download data from the locomotives
• the recording of radio communications between the train driver and Train Control before and after the incident.

1. On 21 November 2018 the Commissioners considered this draft report and approved it to be sent to interested persons for consultation.
2. Two written submissions were received. The Commission considered the submissions, and changes as a result of those submissions have been included in the final report.
3. On 21 February 2019 the Commission approved the final report for publication.

Narrative

1. At approximately 1455 on 16 November 2017, a freight train consisting of two locomotives and a number of freight wagons arrived at Invercargill. The driver contacted Train Control, cancelled the track warrant and obtained a proceed signal for a setback movement onto the Bluff main line to disconnect the wagons. The setback movement was under the control of a pilot. The driver radioed the pilot and obtained permission to setback.

1. The train then setback onto the Bluff main line, where the pilot disconnected the wagons from the locomotives (position i in Figure 2). The pilot then told the driver to contact Train Control and request a signal to move the locomotives forward past a set of points that would give the locomotives access to the siding that branched into the storage yard, the refuelling area and the maintenance depot. The intention was to move the locomotives into the refuelling area. When the correct signal was obtained the driver moved the locomotives forward and stopped beyond the points (position ii in Figure 2).
2. With the locomotives clear of the points to the Bluff Main Line (position ii in Figure 2), the pilot was able to set the points and authorise the locomotives to setback to enter the siding for the refuelling area. Once in the siding the locomotives had to pass through two more sets of points in order to reach the refuelling area. The first set of points could direct trains to the maintenance depot and the second set could direct trains to either the storage yard or the refuelling area.
3. The pilot walked from the Bluff main line, where the wagons had been disconnected, directly to the second set of points to set them for the locomotives to enter the refuelling area (see Figure 3). The pilot observed that on the adjacent maintenance depot line a derailer and stop-disc were in place, protecting the maintenance depot. In the pilot’s previous experience, the presence of the depot protection meant that the first set of points was not directing rail vehicles to the maintenance depot, so did not visually check the setting of the points.

1. The pilot advised the driver that the points were set and authorised the driver to setback towards the refuelling area. However, the first set of points were set for rail vehicles to enter the maintenance depot (see Figure 4). The driver was positioned in the trail locomotive so could not see ahead in the direction of travel, but proceeded to reverse the locomotives at about 15km/h under the instruction of the pilot. As the locomotives setback, the pilot used a road vehicle to drive approximately 150 metres to the refuelling area to meet the locomotives and call a halt to the movement.

1. As the locomotives reversed the driver noticed they had diverted and were heading towards the maintenance depot instead of the refuelling area (position iii in Figure 2). The lead locomotive overcame the maintenance depot protection by knocking the stop-disc flat and dislodging the derailer, which instead of derailing the locomotive as it was designed to, became dislodged from the rail and dragged along the ballast (see Figure 5).

1. The driver applied the locomotive brakes and brought them to a stop, but not before the lead locomotive had collided with a maintenance truck parked on the track outside the depot.

2. The maintenance truck had been parked in neutral over the track leading to the maintenance depot, with the handbrake lightly applied. The coupler at the rear of the locomotives struck the maintenance truck.

3. The truck was propelled back approximately 15 metres and collided with the coupler of a freight wagon that was chocked (to use a chock to prevent the movement of the wheels and therefore the wagon) inside the maintenance facility (see Figure 6). The maintainer was in another room in the depot when the collision occurred. The front and rear of the truck suffered moderate impact damage.

Key personnel

1. The driver was based at Invercargill and had 38 years’ experience driving trains. The driver held current certification for the role, and according to KiwiRail records had not been involved in any incidents.

2. The maintainer was based in Dunedin and worked at the Invercargill maintenance depot part-time, two days every fortnight. The maintainer had 12 years’ rail experience and held current certification for the role.

3. The pilot had 35 years’ rail experience and held current certification for the role. According to KiwiRail records the pilot had not been involved in any previous incidents.

4. In accordance with the operator’s policy, all three personnel underwent a post-incident drug and alcohol test. All produced negative (clear) results.
5. The train driver and pilot worked for KiwiRail Operations, and the maintainer worked for KiwiRail Mechanical.

Introduction

1. The wrong-routing of the locomotives occurred because the points had been incorrectly set for the intended movement. Once the locomotives diverted towards the maintenance depot, the derailer device should have caused the lead locomotive to derail and prevented its unintended entry to the maintenance depot.
2. The following analysis discusses the circumstances that led to the collision. It also discusses the safety issue whereby the level of audit and compliance testing of the Invercargill Joint Operating Plan was not robust in detecting and addressing compliance issues in the Invercargill yard, including:

• procedures for the completion of safety-critical tasks were either poor or missing
• there was poor adherence to existing safety procedures.

What happened

1. The maintainer arrived at the Invercargill maintenance depot and checked the work schedule for the day. A shunt locomotive was scheduled to arrive at the depot later in the day to have the driver’s seat repaired.
2. While working on the freight wagon inside the depot, the maintainer received a phone call advising that the shunt locomotive would arrive at Invercargill after midday.
3. The maintainer left the depot around midday to collect welding gas cylinders. While away from the depot the maintainer received a further phone call advising that the shunt locomotive had arrived in Invercargill. Rather than wait for the shunt locomotive to be delivered to the maintenance depot, the maintainer drove to where the shunt locomotive was located, removed the driver’s seat and took it back to the maintenance depot to repair it.
4. On returning to the maintenance depot the maintainer noticed that the derailer and stop-disc had been removed by someone, most likely in preparation for bringing the shunt locomotive into the maintenance depot, which was now no longer required. It could not be established who had removed the protection; however, the maintainer was the only person authorised to do so. The maintainer reinstated the stop-disc and placed the derailer back on the track without padlocking it in place.
5. The design of the derailer meant it could be padlocked in place, and a padlock was provided for this purpose. The maintainer had been trained in the use of the derailer padlock; however, the Invercargill Joint Operating Plan did not document a requirement for the derailer to be padlocked in place.
6. The Invercargill Joint Operating Plan detailed how staff from KiwiRail Mechanical and KiwiRail Operations worked together in and around the maintenance depot. While the maintainer was responsible for removing and reinstating the derailer and stop-disc depot protection, operations staff, in this case the pilot, were responsible for setting the points correctly.
7. After completing the repair to the driver’s seat, the depot maintainer drove back to the shunt locomotive and refitted it. The maintainer then returned to the maintenance depot and parked the maintenance truck on the track outside the doorway to the building.
8. Meanwhile, adjacent to the maintenance depot, the pilot and train driver were preparing to move the locomotives to the refuelling area. The pilot walked across and confirmed that the points to the refuelling bay were set correctly, but did not check that the points to the maintenance depot were set correctly. The pilot assumed that they were set correctly because he saw the derailer and stop-disc in place.

9. Once the train driver was authorised to setback to the refuelling area, the pilot drove to the refuelling bay as the locomotives setback. When piloting from a vehicle, Rule 4.2.1 of the New Zealand Rail Operating Code states in part that:

   Range of Vision

   Maintaining a Range of Vision when Piloting by Quad bike or Vehicle

   - Travel a safe distance ahead of the movement immediately adjacent to and clear of the intended route

10. Due to the setback movement being a relatively short distance, the pilot drove ahead to the refuelling area in order to be in the desired place to call the rail movement to a halt when the locomotives arrived. This was an accepted and normal action among pilots. However, by not travelling the intended route just ahead and clear of the locomotives, the pilot missed the opportunity to observe the locomotives diverting towards the maintenance depot.
11. A post-incident re-enactment revealed that the derailer protruded sufficiently above the rail to make contact with the cowcatcher of the leading locomotive. The design specification of the derailer permitted it to have a height of up to 120 millimetres above the top of the rail, while the cowcatcher was permitted to have a height above the rail as low as 100 millimetres. As a result the cowcatcher tore the derailer off its mounts before it could perform its purpose of derailing the locomotives (see Figure 8). KiwiRail is undertaking a review of the suitability of its derailers for its current rolling stock.

Rules and procedures

Safety issue – The level of audit and compliance testing of the Invercargill Joint Operating Plan were not robust in detecting and addressing compliance issues in the Invercargill yard.

Protection for the maintenance depot

1. As previously discussed, the procedures in the Joint Operating Plan specified that operations staff were responsible for all rail rolling stock movements and mechanical personnel were responsible for the placement and removal of the derailer and stop-disc.
2. This split of responsibility required operations staff to liaise with mechanical staff to have the maintenance depot protection removed before any rail movements into or out of the maintenance depot siding could take place.
3. The design of the derailer allowed it to be padlocked in place to prevent unauthorised removal. However, the Joint Operating Plan did not mention the need to use a padlock and therefore the derailer was often left unlocked. In not using the padlock it was easy for any staff to remove the derailer for rail vehicle movements into and out of the depot. Even when it was locked the key was easily accessible, which meant the protection could be removed by anyone, including operations personnel.
4. The practice of operational staff removing and reinstating the depot protection was a violation of the instructions in the Joint Operating Plan. The practice had never been identified by the site management.

5. Rule 909 of the New Zealand Rail Operating Rules and Procedures refers to working in non-interlocked areas, where the movement of a rail vehicle is controlled by manually operated points and authorised by a pilot. The rule states (in part):

   If points can be set to prevent entry into the track(s) being protected they must be locked/spiked or bolted in this position.

   The Joint Operating Plan had not considered using the points leading to the maintenance depot building as part of the depot protection.

6. Subsequent to this incident the use of the derailer has been discontinued and the points leading to the maintenance depot siding are now set away from the depot and padlocked in this position. The maintainer now controls the use of the padlock key and the system now complies with Rule 909.

Piloting trains

1. When piloting a rail vehicle, Rule 124 of the New Zealand Rail Operating Rules and Procedures states in part that the pilot must:

   Check that any points are correctly set between the train and the agreed feature/location (destination).

2. As previously mentioned, the pilot did not fully check the setting of the points to the maintenance depot to ensure that they were set for the intended movement, instead making an assumption that they were correctly set based on the presence of the stop-disc and derailer protection.
3. The Commission noted that Rule 124 is titled ‘Propelling of Vehicles on Main Line’, however it found that pilots are trained to apply this rule to all lines including depots, terminals, yards and sidings. In the field, pilots actively demonstrate the principle of applying Rule 124 to all lines. KiwiRail are aware that Rule 124’s wording is not aligned with current practice and are working to update the rulebook.

Refuelling procedures

1. As the original plan was for the locomotives to be taken to the refuelling area for refuelling, the Commission sought to review the procedures for this task, but there were no procedures. Refuelling is a task that has potential environmental and safety risks. Although not a factor contributing to this incident, it is another example of a system that would benefit from another level of audit and control.

Summary

1. The incident highlights the importance of having clear, documented procedures in place that conform with any overarching rules and/or standards. It also highlights the importance of following procedures that are in place, namely:

• had the set of points leading to the maintenance depot been controlled in accordance with Rule 909, it is very likely that they would have been set in the correct position for the movement
• had the set of points to the maintenance depot been checked before the locomotives entered the siding, it is virtually certain that it would have been noticed that they were set incorrectly
• notwithstanding these first two points, had the moving locomotives been within sight of the pilot, it is about as likely as not that the wrong-routing would have been noticed in time to avoid a collision at the maintenance depot
• had the incompatibility between the designs of the derailer and the cowcatcher on the lead locomotive been identified, it would have been known that without a redesign the derailer would not have performed its function and derailed the lead locomotive before it reached the maintenance depot.

2. An effective check and audit regime ought to have identified one or more of these issues, and the incident avoided. Indications are that there was little in the way of auditing the Invercargill Joint Operating Plan. Consequently the non-conformities and examples of non-compliance found within the yard went unchecked.
3. KiwiRail has since undertaken safety actions to address this safety issue at the Invercargill yard and to improve compliance in other yards throughout its New Zealand network.

1. The locomotives were wrong-routed into the maintenance depot because the necessary checks to ensure that the points were set correctly for the movement were not made.
2. The procedures in the Invercargill Joint Operating Plan for protecting the maintenance depot from unintended rail movements did not conform with the KiwiRail rules.
3. Indications are that staff were routinely not complying with the procedures set out in the Invercargill Joint Operating Plan.
4. The level of audit and compliance testing of the Invercargill Joint Operating Plan were not robust in detecting and addressing compliance issues in the Invercargill yard.

1. The level of audit and compliance testing of the Invercargill Joint Operating Plan were not robust in detecting and addressing compliance issues in the Invercargill yard.

General

1. The Commission classifies safety actions by two types:

   (a) safety actions taken by the regulator or an operator to address safety issues identified by the Commission during an inquiry that would otherwise result in the Commission issuing a recommendation

   (b) safety actions taken by the regulator or an operator to address other safety issues that would not normally result in the Commission issuing a recommendation.

Safety actions addressing safety issues identified during an inquiry

2. In response to this incident, and due to the recent high number of collisions in yards, KiwiRail introduced a maximum speed limit of 15km/h for all movements within yards, terminals and sidings.
3. On 21 November 2017 KiwiRail held a one-hour safety stop meeting at each facility to discuss with all staff the reasons for shunting collisions occurring and to identify ideas for preventing collisions. A total of 472 pieces of feedback were received, including 369 regarding why collisions might be occurring and 72 ideas to prevent collisions.
4. On 11 June 2018 a follow-up safety stop meeting was held to feed back on progress made from the initial meeting and to share ideas across different teams and locations.

5. The safety stop meetings were used to reinforce the New Zealand Rail Operating Code, Section 5.1, Shunting Procedures – Rule 4.2.1:

   4.2.1 Range of Vision

   Range of vision means that a member of the shunt crew must signal the movement from a position at or near the head of the movement in the direction of travel; this will ensure a clear view of the intended route.

   The range of vision will be influenced by things like weather, buildings, grade and time of day and may require significant movement on the part of the shunter in order to maintain range of vision.

   Maintaining a Range of Vision when Piloting by Quad bike or Vehicle

• Travel a safe distance ahead of the movement immediately adjacent to and clear of the intended route

• Pilot vehicles must be restricted to designated road vehicle route when piloting

• The movement must be stopped and the way must be clear before driving across or fouling the track on which the vehicles are moving

  • When driving a quad bike approved hands-free equipment must be used if operating a radio or cell phone.

1. Additionally, New Zealand Rail Operating Code, Section 5.1 – Rule 5.3.2 Radio Commands was reinforced:

   5.3.2 Radio Commands When shunting and piloting:

• The pilot / shunter MUST maintain radio contact with the Locomotive Operator

• The pilot / shunter MUST initiate radio communications at 10 second intervals

• The movement is to be stopped if there is no communication, or communication is broken.

  The initial instruction to move must:

• Advise where the movement is to move from taking account of position of the locomotive and where it is to end. In other words the direction and distance to travel must be identified.

• The person receiving the information must repeat it back to confirm the instruction is understood before the movement commences.

• Where appropriate the actual road or siding name is to be used.

• The Locomotive Operator must have a clear understanding of what direction to move in given their knowledge of the yard layout.\

  The Locomotive Operator must be advised if the movement is into an empty or occupied road. If the movement is into an occupied road the distance to the stationary vehicles must be called.

  The Pilot / Shunter must start calling lengths to go towards any stationary object with a wagon “countdown” as follows:

  10 – 8 – 6 – 4 – 2 – 1 – ½ – STOP

  (Repeat the command “STOP” several times until the Locomotive Operator has responded to the call.)

  Terms such as “Steady”, “Stop”, “Ease Up”, and “Out Short” will apply when a member of the shunting gang is giving instructions to the Locomotive Operator for example bogies to go.

  The other members of the gang are to maintain radio silence to enable the Locomotive Operator to hear the instructions.

1. The protection of the Invercargill maintenance depot building was changed, with the use of the derailer discontinued and replaced by padlocking the points to the depot building siding. The depot mechanical staff have sole control of the padlock key. The Joint Operation Plan has been updated to document the new depot protection regime.
2. Based on the design interference that led to the derailer being torn from its sleeper mounts by the locomotive cowcatcher during this incident, KiwiRail is undertaking a review of the suitability of derailers for its current rolling stock.
3. Based on the lack of formal review or auditing of the Joint Operating Plan at the Invercargill maintenance depot, KiwiRail’s Zero Harm Assurance team has established a programme whereby the Joint Operating Plan and associated documents, policies and procedures will be reviewed on a formal rolling basis to ensure they are fit for purpose and being adhered to in practice. This is on top of the existing five-year formal review of Joint Operating Plans.

General

1. The Commission may issue, or give notice of, recommendations to any person or organisation that it considers the most appropriate to address the identified safety issues, depending on whether these safety issues are applicable to a single operator only or to the wider transport sector. Due to the safety actions taken by KiwiRail subsequent to this incident, no new recommendations have been made as a result of this inquiry.

Recommendations

2. Due to the safety actions taken by KiwiRail subsequent to this incident, no new recommendations have been made as a result of this inquiry.

1. It is important to ensure that documented rules, policies and procedures are compatible and consistent across all places of work in the rail network.
2. A culture of non-compliance can quickly develop if staff are not prompted to follow the proper procedures when undertaking their duties, and do not challenge their work colleagues if they observe them not following procedures.