RO-2023-104 Passenger Train 104 (Te Huia) SPAD and potential conflict, Penrose, Auckland, 17 June 2023

What happened

1. On Saturday 17 June 2023, the Te Huia regional passenger train service named Te Huia was travelling from Hamilton to Auckland on a scheduled service.
2. At Penrose Station on the North Auckland line, the train passed a stop signal and entered the Onehunga branch line junction, damaging the junction points.
3. The track route and signals, which included the junction points, had been set for an Auckland One Rail commuter train (Service 6516) on the Onehunga branch line. That train was about to depart Penrose platform 3, which was located on the Onehunga branch line.
4. The signalling system detected that Te Huia had entered the junction, and the signals on the Onehunga branch line reverted to a stop sequence, alerting the commuter train driver that the route was occupied.
5. There were no injuries and there was no damage to the trains. However, Te Huia damaged the junction points, leading to a lengthy disruption to services.

Why it happened

1. The locomotive engineer on Te Huia incorrectly interpreted the signal for the Onehunga branch line (signal 312) as their own signal to proceed. The applicable signal (signal 308) for the line on which they were travelling was at stop but was not within their clear view.
2. There was no effective engineering control to prevent the signal being passed at stop or mitigate the consequences of the event, meaning Te Huia entered an area of potential conflict.
3. The locomotive engineer’s absence from operating on the North Auckland line meant they were unfamiliar with the route and the signalling system approaching Penrose Station.

What we can learn

1. Complex systems such as rail require robust engineering risk controls to guard against the outcomes associated with human performance limitations. Administrative controls are vulnerable to human error and non-compliance. They should not be solely relied on to keep a system safe.
2. Compliance with the rail standards and the management of the risks on the railway network require monitoring to assure those using the system that the risks have been managed appropriately.

Who may benefit

1. Rail personnel, rail operators, rail access providers, transport planners and anyone involved in safety auditing and assessments may benefit from the findings in this report.

Background

1. The Te Huia regional passenger train service (Te Huia) connected Waikato (Hamilton and Huntly) and Auckland (The Strand station). There were two return services each weekday and one return service on Saturdays. The service was operated by KiwiRail Holdings Limited (KiwiRail) on behalf of Waikato Regional Council.
2. The service had limited stops en route to pick up and set down passengers, with the last stop at Papakura before reaching its destination at The Strand.

Narrative

2. On Saturday 17 June 2023, at about 0735, Te Huia departed Hamilton via the North Island Main Trunk (NIMT) en route for Auckland.
3. The train service was crewed by one locomotive engineer (LE), a train manager and two train attendants.
4. Te Huia made a passenger stop at Papakura station and departed at about 0930, which was 10 minutes ahead of schedule (as an inter-regional service, Te Huia did not pick up passengers at Papakura Station, but passengers could disembark to catch other metro connections)
5. At about 0949 Te Huia travelled through Westfield, leaving the NIMT at the Westfield junction and moving on to the North Auckland line (NAL) headed towards Penrose (see Figure 3).

1. At about 0950 Te Huia approached Penrose, where the sequence of signals indicated that a stop at Penrose Station had been planned by the Train Controller (see Figure 4).

1. Signal L012 was displaying a green aspect, authorising movement in the track section between Westfield and Penrose. The signal was a single unit equipped with a marker disk as the lower light and an ‘A’ light (see Figure 5).

1. Te Huia then crossed Church Street level crossing, located beyond signal L012 (see Figure 4) and was approaching the next signal, L016, which was displaying a flashing yellow top unit with a red aspect in the bottom unit. The signal was supplemented with a flashing white numeral ‘20’, which indicated that the next signal was at caution and the maximum speed at the next signal was 20 kilometres per hour (see Figure 6).

1. Te Huia passed this signal at about 0951 and was then approaching signal 304, the home signal to Penrose Station. The signal was displaying a steady yellow aspect in the top unit with a red aspect in the bottom unit. The signal was supplemented with a steady white numeral ‘20’, which indicated a caution and that the next signal could be at stop. The maximum permitted speed for Te Huia was 20 kilometres per hour after passing that signal (see Figure 7).

1. Te Huia passed signal 304 at a speed of about 36 kilometres per hour. The LE was still applying power, with the train’s speed decreasing to about 32 kilometres per hour. The track on approach to Penrose was on an ascending grade of about 1:50, with the track curving to the right on approach to the station.
2. At about 0952, with the speed still at about 32 kilometres per hour, the LE sighted signal 312 at Penrose Station. The signal was displaying a Normal clear with a green aspect in the top unit and a red aspect in the bottom unit (see Figure 8). This signal was located to the left of the track.

1. The LE responded by increasing power and taking the train’s speed up to 50 kilometres per hour as it continued towards Penrose Station. The signal the LE had observed, signal 312, was the signal for the Onehunga branch line (OBL), and not a signal for the NAL on which Te Huia was operating.
2. The signal applicable to the NAL was signal 308, which was located to the right of the track beyond the station platform and not in the LE’s view. This signal was displaying a red aspect in the top and bottom units, meaning trains had to stop and proceed only when authorised (see Figure 9). The signal was set to stop to allow for the passage of a commuter train onto the NAL through the 373A points (items of permanent way that may be aligned to one of two positions to guide a train towards either the straight (Normal) or diversion (Reverse) track) at the OBL junction.

1. As Te Huia continued past the station, the LE saw the red aspect of signal 308 in their peripheral vision. They realised that they had identified the incorrect signal for the route, and responded by applying the train’s brake handle into a ‘handle off’ position. The LE thought they had applied the train brake handle to the emergency position (the Transport Accident Investigation Commission has previously identified the issue concerning the use of emergency braking in inquiries RO-2020-102 and RO-2022-104).
2. Te Huia continued past signal 308 and travelled a further 195.2 metres before coming to a stop. The train could not be stopped and ran through and damaged the 373A points at the OBL junction (see Figure 10).

1. The Train Controller had set the train control system for the intended passage of the Auckland One Rail (AOR) commuter service from the OBL to the NAL. The system had moved the 373A points to reverse at the junction as required.
2. The commuter service had stopped at Penrose platform 3, which is located on the OBL and is a separate platform from the main station. There was a greater-than-usual number of passengers boarding the train, which delayed the departure from the platform.
3. The commuter service was about to depart the station platform on a proceed signal when Te Huia passed signal 308 at stop. As a result, the signals applying to the commuter train (signals 320 and 312) reverted to the stop sequence.
4. Signal 320, located at the departure end of the station platform, reverted to a caution to stop aspect (yellow signal), while signal 312, which permitted entry to the NAL, reverted to a stop aspect (red signal).
5. The train driver on the commuter service observed the aspect change in signal 320 at the platform and responded immediately by applying their emergency brake, preventing their train passing the signal.
6. This action left a clear section of about 320 metres (this comprised the distance between the three-car stopping position on Platform 3 Penrose and signal 320, the distance from signal 320 to signal 312 and the overrun distance past signal 312 to the fouling point where two trains could collide) of track between the two train services.
7. At the time of the incident there were 95 passengers on board Te Huia. There were no injuries to the train crew or passengers on either train service.
8. The passengers on board Te Huia were delayed on the service for about two and a half hours before disembarking at the Penrose Station platform.
9. The line remained closed until the evening of 18 June 2023 to facilitate repairs to the 373A points.

Personnel information

1. The LE of Te Huia was freight and passenger certified, with 48 years’ service with KiwiRail. Their safety observations were current.
2. The LE had been assessed as fit for duty in accordance with the National Standard for Health Assessment of Rail Safety Workers (the National Transport Commission Standard for Health Assessment of Rail Safety Workers provides a framework for rail operators to manage the risks to safety posed by the ill health of rail safety workers on the National Rail System)
3. Following the incident the LE was tested for the effects of drugs and alcohol; the results were negative (clear).

Train information

Te Huia regional passenger train service (Te Huia)

1. Te Huia was a purpose-built service that had commenced operation in April 2021.
2. Te Huia comprised four passenger carriages and two diesel electric locomotives coupled at each end. Its total length was 110 metres and it weighed 326 tonnes.
3. Te Huia was fitted with Electronic Train Protection (ETP), but the system was isolated and not operational (discussed further in Section 3: Engineering risk controls).

Auckland One Rail commuter service

1. The AOR commuter service (train 6516) was an AM class20 Electric Multiple Unit operated by AOR (see Figure 11).
2. This class of vehicle had been introduced to the Auckland electrified network in 2014 and was fitted with the European Train Control System (ETCS) Level 1. The ETCS was an engineering control system that supervised the train’s movements (discussed further in Section 3: Engineering risk controls).

Signalling system

1. The signalling layout on approach to Penrose was contained in the Signalling and Interlocking Arrangements diagram 3195, dated 25 March 2016 (see Figure 12).

1. KiwiRail’s signalling rules define not only the authority to occupy sections of track but also the maximum speed at which trains may travel.
2. Signals provide authority to train drivers to pass or stop at signals and also information about the signals ahead. This information provides warnings to the drivers about the actions they may need to take to control their trains.
3. In 2010 signalling was renewed and upgraded to ensure its compatibility with a new 25-kilovolt overhead traction system. The opportunity was also taken to deploy an automatic train protection system, and ETCS Level 1 was selected for this purpose. Track circuitry was replaced with axle counters to accommodate ETCS on the commuter network. The upgrade programme included the replacement of all existing points machines and signals with a fully computerised system to control train movements.

Recorded data

1. The locomotive was fitted with a Tranzlog data recorder. Information from the recorder is used in this report where appropriate.
2. The Tranzlog data recorder recorded the train’s position along the route, including the LE’s brake and throttle inputs (see Figure 13).

Research

Previous occurrences

1. In 2022 a shunt locomotive derailed in Auckland and overturned. The Transport Accident Investigation Commission (the Commission) found that complex systems required robust engineering risk controls to guard against variable human performance within the systems. KiwiRail’s locomotive fleet was not equipped with ETCS, which could have slowed or stopped the locomotive entering the set of crossover points at excessive speed. Had the locomotive been fitted with ETCS, the derailment and rollover almost certainly would not have occurred (TAIC RO-2022-102 L71 Mainline Shunt, derailment and subsequent rollover, Tamaki, 1 June 2022).
2. In 2020 a passenger service from Southern Cross to Melton in Australia passed a signal at stop. The signal was at stop to protect the movement of another passenger service that was to cross ahead of it. The train passed the signal at about 23 kilometres per hour and continued for about 200 metres before stopping across the junction. The report on the Australian Transport Safety Bureau’s investigation (ATSB RO-2020-019 Signal passed at danger involving passenger train and near collision with another passenger train Docklands, Melbourne, 23 November 2020) commented that the occurrence highlighted the importance of passenger rail networks having engineering controls in place to detect Signal Passed at Danger (SPAD) events and prevent potential consequences, such as a collision.
3. In 2019 a SPAD event occurred involving a passenger train passing a signal at stop in the Wellington Station limits, entering a track section already occupied. The Commission found there were no additional mitigations in place to prevent a train passing the red stop signal and colliding with another train (TAIC RO-2019-107 Passenger service SPAD and near collision, Wellington, 6 November 2019).
4. In 2018 a Queensland Rail suburban passenger train was en route to Brisbane Airport when it passed a signal that was displaying a red aspect (stop indication). The train stopped 220 metres past the signal and 126 metres before a conflict point that another suburban passenger train had just cleared. The driver had mistaken another signal on an adjacent line that was displaying a green aspect for the applicable signal. The Australian Transport Safety Bureau investigated the accident and found that Queensland Rail’s management of driver competency assessments did not include planned assurance activities or regular and effective auditing (ATSB RO-2018-002 Signal ME45 passed at danger involving suburban passenger train TP43 and near collision with another suburban passenger train, Bowen Hills, Queensland, 10 January 2018).
5. In 2014 a Transdev Auckland train passed signal 308 at stop at Penrose, Auckland. The train had passed the preceding signal 304 at a caution (yellow) signal. As the train rounded the right-hand curve, the driver observed a proceed signal, which they took to be the next signal for their movement. However, as the train got closer the driver realised that the signal was for a movement on the OBL. The driver applied full braking but was not able to stop before passing signal 308. While the Commission did not open an inquiry, KiwiRail carried out an investigation (see Appendix 1 for a summary of the KiwiRail report).

Organisational information

1. KiwiRail is a New Zealand state-owned enterprise. It operates trains and rail vehicles, controls rail movements on the national rail network and maintains the railway infrastructure as the access provider. KiwiRail was the rail operator, infrastructure owner and access provider for the network on which Te Huia operated.
2. The commuter train service on the OBL was operated by AOR, a licensed passenger service operator. AOR provides services on behalf of Auckland Transport. These include employing drivers and other train staff, developing timetables, undertaking station operations and maintenance, security and customer-facing activities, and managing the Auckland Network Access Agreement and KiwiRail interface.

Introduction

1. The movement of a train to a section of track for which a route has been set for use by another train is a serious incident. A collision of two trains, even at relatively low speeds, has the potential to result in serious injury to people and significant damage to property.
2. Those responsible for safe rail movements rely on LEs to respond appropriately to information conveyed via trackside signals. For this to occur, LEs must correctly identify and interpret the signals in time to react using a three-step process of signal detection, signal interpretation and deciding on the correct course of action.
3. Integral to this safe operation is the need for accurate recalls of signal locations, which are obtained through training and familiarisation with the routes so that approaches can be planned by the LEs.
4. The timely detection and accurate perception of a signal’s aspect is facilitated through the correct positioning of signals, having regard to the track alignment, topography and infrastructure. Applying the maximum signal sighting times provides an assurance that the appropriate signals will be identified in sufficient time for the LE to take the appropriate actions in response to the signals aspect.
5. This section analyses the circumstances surrounding the event to identify the factors that increased the likelihood of the event occurring or increased the severity of its outcome. It also examines safety issues that have the potential to adversely affect future operations.

Site information

1. The Commission’s investigators conducted and recorded in-cab observations of the signalled route from Otahuhu Station to Westfield on the NIMT, and then on the NAL from Westfield to Penrose Station. Further in-cab observations were made from the Penrose Station to Newmarket Station limits, the sections of track beyond where the incident took place. The observations followed the route on which Te Huia had operated and were conducted in a similar locomotive. The recordings showed that of the 10 signals applicable to Te Huia’s direction of travel between Otahuhu and Penrose Stations, eight were located to the left of the track and two were to the right (see Figure 14).
2. Of the two signals to the right, one was on a signal gantry (signal WSF1608) and was clear of obstructions, with signal 308 at Penrose the only pole-mounted signal on the right.

1. A further cab run beyond Penrose to the Remuera station limits recorded six signals, all of which were to the left and were clearly visible on approach.
2. On approach to Penrose Station, signal 312 (the departure signal on the OBL) was located to the left of the track and was the only visible signal.
3. Parallel signals on curved approaches pose a particular risk of being ‘misread’ if signals on other lines are initially more visible and the signals become visible at different times.
4. Signal 312 was located adjacent to signal 308 and had retrofitted shields mounted to the right side of the shroud. The purpose of the shields was to prevent the possibility of the LE misreading a signal, known as making a ‘read across error’ (see Figure 15).

1. The shields had been fitted following a SPAD incident in 2014. The observations by the Commission’s investigators when visiting the site were that signal 312 was still clearly visible on approach, and the shields were largely ineffective.
2. Signal 308, the correct signal, was obscured by the station walkway, the platform veranda and other lineside equipment. When signal 308 was at red, only the bottom colour aspect could be seen, as the top aspect was obscured until observations were made closer to the signal. The Commission investigators determined that the first point at which the signal was clearly and continually visible was approximately 190 metres away from the signal.
3. The design of an operating environment will affect human work performance and reliability – in this case either by supporting the availability of correct information to enable decision-making, or by creating an opportunity for errors to be made. The signals from Westfield to Penrose preceding signal 312 were all to the left, except for one signal on a gantry.
4. The placement of signals in this manner and the absence of a clear view of signal 308 likely led to an ‘expectation bias' by the LE that signal 312, also located to the left, was applicable to their authority to depart.

Signal identification and interpretation

1. Signals are used to control train movements along various sections of track. The time it takes for a train to respond to brake and throttle inputs from LEs means that signal indications need to be progressive; that is, the preceding signal indicates what the next signal will potentially display. In this manner, signal indications convey speed instructions for the section of the track into which the train is entering, as well as advance information for the section beyond.
2. On weekdays, the AOR commuter service on the OBL did not extend through the junction, instead terminating at Penrose platform 3. However, on weekends the service proceeded through the junction to the NAL and terminated at Britomart Station. The AOR commuter train was running on time, but Te Huia was running about 10 minutes early. In normal circumstances Te Huia would not have stopped at Penrose Station, instead continuing to the last stop at The Strand.
3. The unscheduled stop by Te Huia was to allow the AOR commuter service to proceed ahead through the junction. While not a requirement, commuter rail was given precedence over other rail traffic on the Auckland metro rail network.
4. On the day of the incident, the LE of Te Huia was not expecting to stop at Penrose Station. As the LE departed Westfield Station towards Penrose, they encountered restricted signalling aspects of flashing yellow and yellow signals, indicating that a stop at Penrose had been planned by the Train Controller. The LE assumed that this signal sequencing was a consequence of their following another train on the network.
5. In the absence of a complete set of information on a situation, an individual will draw on familiarity and expectation to shape their mental model. If their mental model is inaccurate, information can be perceived incorrectly, and errors made. Interferences can come from environmental distractions, as well as individual’s mental model of their situation.
6. When interviewed by the Commission, the LE stated that they had thought they were following another train on approach to Penrose, given that the signals ahead were flashing yellow and yellow. With the signal at Penrose at green, they assumed that the other train had ‘gotten away’. The observation of signal 312 at green to proceed, together with the LE’s mental model that they were following a train, was likely taken by the LE to mean that the train ahead had cleared the section and a clear run through Penrose was available.

Signal commissioning process

Safety issue 1: The risk assessment for the commissioning of signal 308 was incomplete and did not identify all the hazards associated with the positioning of the signals. The opportunity to implement risk controls to address those hazards was missed, resulting in the correct signal not being observed and a wrong signal being responded to, increasing the risk to rail users.

1. Signal sighting assessments are used by the rail industry to confirm that persons tasked with operating rail vehicles on the network can read, interpret and respond to signal aspect indications reliably. The application of signalling principles, standards and processes ensures that risks are appropriately managed. The application of standards includes those for signal positioning and sighting.
2. The Auckland electrification project in 2010 coincided with an upgrade of the Auckland signalling system. The upgrade included the production of a new signalling principles document where previous codes and code supplements had applied.
3. KiwiRail developed a standard for signal sighting (standard S-ST-SG 2124 Signal Sighting) that followed accepted railway practices. The standard set expectations for and stressed the importance of minimum signal sighting distances and the need to prevent read-across errors such as a rail vehicle operator mistaking an adjacent signal on a parallel line as authority to proceed (see Appendices 2 and 3).
4. The standard required a minimum sighting time of 12 seconds. This meant the distance for sighting a signal on approach to Penrose Station at the maximum permitted line speed of 80 kilometres per hour was 267 metres. The standard permitted a reduced sighting time of 10 seconds in exceptional circumstances and required the reasoning to be documented. The sighting time included the ability to see all aspects of the signals on approach, clear of any obstructions. Any justification for not carrying out a full sighting exercise had to be recorded.
5. Signal commissioning was a static exercise that did not include in-cab testing at line speed for each signal aspect to check for issues. No modelling was done on signal 308 and its surroundings.
6. The purpose of completing a Signal Sighting Form during the commissioning process was to provide assurance that the construction and positioning of a signal placed on the network met the requirements of the standard. In situations where a sighting standard could not be met, there were opportunities to use additional measures such as banner signals37 to provide additional warnings of signal aspects.
7. The standard also required signals that faced in the same direction and were positioned on parallel lines to be given additional consideration in their placements to avoid the possibility of read across errors by LEs (see Appendix 4).
8. Following any concerns expressed by rail operators or reports of incidents where sighting issues were alleged, the standard required the convening of a Signal Sighting Committee to review the signals’ visibility. These processes were in addition to normal operating processes that required the signals to be inspected annually.
9. The Commission obtained the Signal Sighting Form completed at the time of the signal upgrade at Penrose, dated 11 October 2010. It recorded the recommendations of the Sighting Committee (see Figure 16). Some sections of the form were incomplete.
10. The required minimum sighting distance recorded for signal 308 was 222 metres at 10 seconds when travelling at 80 kilometres per hour. The ‘maximum sighting distance available’ was left blank.
11. The section in the form asking whether there was ‘Confusion with other signals/Read through risk’ was completed as N/A (not applicable).

1. On the form, under ‘Obstructions affecting approach view’, the footbridge ramp and the station veranda were noted.
2. Under ‘Special Requirements / Remarks’ on the form, a request to move the signal 73 metres in the Up direction (further from the station) was declined on the basis that it hampered operations and would ‘offer no additional sighting benefit’.
3. The section asking whether re-inspection was required and ‘reason/when’ was also incomplete.
4. Based on the Commission’s site visit, the uninterrupted sighting distance was calculated as approximately 190 metres, some 32 metres short of the required minimum distance listed at 222 metres at 10 seconds, and 77 metres short at 267 metres using 12 seconds.
5. Had the signal sighting process for signal 308 been fully completed, the hazards of an inadequate sighting distance and the possibility of a read across error with signal 312 would likely have been identified and the associated risks managed appropriately.
6. No further action or follow-up assessment of signal 308’s compliance with the standard was undertaken. Without a further analysis of the risk, the opportunity to identify and remediate the hazards was missed.

Engineering risk controls

Safety issue 2: The use of different engineering risk controls on rail vehicles using the Auckland metro network results in varying levels of protection, increasing the complexity of the rail system.

1. Rail transportation is a complex, safety-critical system where the prevention of accidents and incidents requires robust risk controls. These include controls associated with human performance limitations. In this incident, the existing administrative controls were not effective in preventing the signal being passed at stop.
2. ETP was an engineering risk control, providing a safety system that monitored a train’s progress at signal limits. It used electronic loops on the track known as balises, which communicated with trains fitted with the appropriate receivers. ETCS was also an engineering risk control, providing a safety system designed to reduce the consequences of a SPAD incident. The balises in the Auckland commuter network were common to both the ETP and ETCS systems.
3. Te Huia was retrofitted with ETP, but the system was isolated and not operational at the time of the Penrose incident.
4. KiwiRail initially planned the introduction of ETP to coincide with change to the push-pull mode operation in the Te Huia service. The vehicle modifications and staff training for these changes were to be done as a package. ETP was subsequently separated from the push-pull mode change and was introduced to services from 10 July 2023, about a month after this incident.
5. When a signal is at stop, the ETP system reads a ‘signal at stop’ message from the ETCS balise and applies the emergency brakes. The system relies on positive transmission between the balise and the train receiver. Since the train’s system does not know where to expect a balise message, it will never know if the transmission is disrupted. For this reason, ETP cannot be considered fail-safe. The information on the ETP system’s status could be observed by the LE through the driver machine interface (see Figure 17).
6. For the ETP system to have been effective, the train would have needed to be stopped before signal 308 at stop. If this had not occurred, the train would have needed to have been stopped within the overlap before it entered the fouling zone. The overlap distance beyond signal 308 was 90 metres, less than the optimum of 150 metres required by the standards and principles of signalling set out in KiwiRail’s safety system. The reduced overlap distance was due to the constraints of the existing railway infrastructure.

1. For the ETP system to be effective and stop the train before it entered the fouling zone, Te Huia had to be travelling at or below the speed shown on the speed indicator. In this instance a speed any greater than 20 kilometres per hour reduced the effectiveness of the ETP in preventing entry into the fouling zone because of the trains increased stopping distance at higher speeds.
2. The risk to safe operations was the loss of separation assurance between rail vehicles after the signal was passed at stop, but the potential for serious consequences arose when Te Huia entered the fouling zone in potential conflict with another train.
3. Speed indicators were located above the signal aspects, and when illuminated with a steady white light they indicated to the LE the maximum speed of the train once passing that signal and until passing the next signal in advance. Speed indicators were introduced to the signalling system for non-ETCS-equipped trains to add another layer of defence. They relied on human performance without any further engineering controls (see Appendix 6).
4. Had the ETP system been active on Te Huia, it is virtually certain an emergency brake would have been applied.
5. The ETP system would not have prevented the SPAD and would not have prevented the train entering the fouling zone, because its speed at the time of passing signal 308 was approximately 50 kilometres per hour.
6. All AOR passenger services had been fitted with ETCS Level 1 as part of the interface specification for Electric Multiple Unit passenger trains operating in the Auckland Electrified Area.
7. The ETCS system monitored the appropriate signal aspect and authority limits set for the train’s movements. It monitored the operations through the supervision of train speeds and calculated the braking curves for the location where the train was required to stop.
8. The rules permitted speeds in excess of those displayed on the speed indicators for ETCS-equipped trains, as the system was designed to monitor the movement authorities and the speeds. The permitted speeds were determined by trains’ braking parameters, which were specific to each class of train.
9. If Te Huia had been fitted with ETCS Level 1, it is unlikely that this incident would have occurred. The system would have detected that Te Huia was operating outside the train’s braking parameters on approach to signal 308 at stop. The on board system would have provided an alert to the LE that a speed reduction was required to maintain safe operational parameters. Any delays by the LE to address the issue would have resulted in a system-induced brake application.
10. ETP was a mitigating risk control, meaning it was about managing the effects of an unwanted event after it had materialised. In comparison, the ETCS was a preventive risk control, meaning the system was designed to prevent an unwanted event.

Route knowledge training

Safety issue 3: KiwiRail’s locomotive engineer route knowledge training system was inadequate to identify gaps in knowledge or reduced frequency of exposure to a route. This means that locomotive engineers may have insufficient knowledge to safely drive on a particular route.

1. The KiwiRail Rail Operating Code required LEs to undergo training before operating trains over a section of track.
2. The training included site and area familiarisation, in which trainees visited locations in road vehicles to:
   • observe the geography of the areas
   • identify crew relief locations
   • observe access points.
3. The initial knowledge and train-handling skills gained on a particular track section, known as ‘route knowledge’, were obtained through on-job training supervised by experienced and qualified LEs. Route knowledge extended to include unique features of stations and junctions, track geometry, authorised speeds, signals and their locations, and other special operating instructions.
4. The on-job training was followed by assessments for certification undertaken by authorised personnel. Further assessments were required by the Operations Manager or supervisor over one route each month and again five, seven and nine months following certification.
5. These processes assured KiwiRail that the LE had received appropriate training and route familiarisation.
6. Before extending a route on which an LE normally operated, KiwiRail required consultation and communication between planning staff and the Line Haul Manager.
7. Similarly, routes on which an LE travelled infrequently, and the occasions on which an LE travelled to the limits of each route were to be documented by the Regional Roster Coordination Centre. The purpose of this was to ensure that the LE’s competency was maintained, as competence was considered to have expired once an LE had not travelled a route or parts of the route in the preceding 12 months.
8. The LE on Te Huia was not based locally, and their experience was predominantly between Hamilton and Westfield. The route along the NIMT via Westfield to Ōrākei was the more frequently travelled when required.
9. The deviation to the NAL was due to the closure of the NIMT from Westfield to Ōrākei as part of a staged rail network rebuild. This portion of the line had been closed from 20 March 2023 until 14 January 2024.
10. Training and familiarisation with the route on the NAL had not been provided to the LE, despite it’s being a requirement for route re-certification. The LE had been absent from the route for more than 12 months and had not undertaken a route revalidation by an authorised person, as required by the Rail Operating Code, Section 4.1 Training and Certification.
11. In KiwiRail’s competency management process, maintaining situational awareness and actively monitoring an operational environment were achieved using non-technical skills such as risk-triggered commentary train driving and the stabilised approach. However, these tools were only effective if relevant LEs had accurate recalls of route knowledge that enabled them to anticipate signal locations and plan their approaches.
12. In operational railways, train-driving competency assessments, which include tests of route knowledge, provide drivers with opportunities to discuss, learn about and refresh their knowledge of competencies not practised on a frequent basis. They also provide assurance that safe working practices are understood and are being followed.
13. The LE on approach to Penrose was familiar with the signalling aspects displayed by signal 304 at caution to stop and was anticipating a stop at the next signal. They were less familiar with the speed indicator signalling and the requirement to maintain a speed of less than 20 kilometres per hour until the next signal was passed. They were also unfamiliar with the location of signal 308, the signal applicable to the movement.
14. LE competency and route knowledge are integral to safe train operations. Rail operators should monitor and maintain competencies through adequate processes to provide assurance that train crew possess the skills and knowledge required to perform their tasks.

1. The locomotive engineer of Te Huia had not undertaken recent training in and familiarisation with the new route on the North Auckland line, despite it being a requirement for route certification.

• The locomotive engineer misread signal 312 as applying to the North Auckland line, likely because of a combination of the following:

• They were not familiar with the route.

• They were expecting to sight the signal on the same side as the previous signals.

• They were not expecting to stop at Penrose.

• The applicable signal (signal 308) was partly obscured from view on approach to Penrose Station.

1. The locomotive engineer’s observation of signal 312 at green to proceed, their lack of route familiarity, and the mental model that they were following a train were likely taken to mean that there was a clear run available through Penrose Station.
2. Had the signal sighting process been fully completed for signal 308, the hazards of an inadequate sighting distance and the possibility of a read across error with signal 312 would likely have been identified and the associated risks managed appropriately.
3. The engineering risk controls used by KiwiRail and Auckland One Rail on the Auckland rail network are different (being Electronic Train Protection and the European Train Control System (ETCS)). They offer varying levels of protection, increasing the complexity of the rail system.
4. The ETP system fitted to Te Huia at the time of the incident was not connected. Had it been operating it would not have prevented the Signal Passed at Danger (SPAD) and would not have prevented the train entering the fouling zone, because the speed at the time of passing signal 308 was approximately 50 kilometres per hour.
5. Had Te Huia been fitted with ETCS, like all Auckland One Rail passenger services, it is unlikely the SPAD would have occurred, because the ETCS would have supervised the speed of the train as it approached the signal held at stop (signal 308).

General

1. Safety issues are an output from the Commission’s analysis. They may not always relate to factors directly contributing to the accident or incident. They typically describe a system problem that has the potential to adversely affect future transport safety.
2. Safety issues may be addressed by safety actions taken by a participant, otherwise the Commission may issue a recommendation to address the issue.

Safety issue 1: The risk assessment for the commissioning of signal 308 was incomplete and did not identify all the hazards associated with the positioning of the signals. The opportunity to implement risk controls to address those hazards was missed, resulting in the correct signal not being observed and a wrong signal being responded to, increasing the risk to rail users.

2. Since this incident, KiwiRail has identified two options to mitigate the sighting risk associated with signal 308:

   Option 1: Eliminate 312 Signal. This is KiwiRail’s preferred option but does require extensive re-signalling of the Onehunga Junction; or

   Option 2: Relocate signal 308 to the left-hand side of the Up Main suspended from a gantry structure and introduce a Banner Indicator on approach.

3. KiwiRail is continuing work to make a determination on the path forward for each option.
4. With respect to improving the process of commissioning signals, KiwiRail acknowledge this as part of its continuous improvement programme. In the decade since the AEP project, a number of initiatives have been adopted to improve the signals’ sighting process, including:

   1. The signals sighting standard S-ST-SG-2124 and associated task instruction S-TI-SG-2203, which were produced in 2017 to update and improve the requirements for signals sighting. This document outlines the requirements for new works and modifications, maintenance and post incident.

   2. With the emergence of digital engineering, virtual tools that are being used to determine signals’ sighting in areas where significant change is occurring. There are several recent examples of this in both the Auckland and Wellington suburban areas. This technology enables an initial signals sighting assessment (and removal of sighting constraints) at design stage, well in advance of construction. Final confirmation is still undertaken with a Signal Sighting Committee before being brought into use.

5. The Commission welcomes the safety action to date with respect to signal 308 and the signal commissioning process more generally. However, with respect to signal 308, as the mitigation measures have yet to be implemented, the Commission has made a recommendation in Section 6 to address this issue.

Safety issue 2: The use of different engineering risk controls on rail vehicles using the Auckland metro network results in varying levels of protection, increasing the complexity of the rail system.

1. The commissioning of ETP on Te Huia passenger services is a step towards the introduction of an engineering control that mitigates the event of a signal passed at stop. The Commission understands that there are other train services operating on the Auckland commuter rail network that do not have any engineering controls and operated in capacities similar to Te Huia’s at the time of the Penrose incident.
2. The Commission welcomes the safety action taken to date. However, it believes more actions need to be taken to ensure the safety of future operations. Therefore, the Commission has made a recommendation in Section 6 to address this issue.

Safety issue 3: KiwiRail’s locomotive engineer route knowledge training system was inadequate to identify gaps in knowledge or reduced frequency of exposure to a route. This means that locomotive engineers may have insufficient knowledge to drive on a particular route safely.

2. Since the incident, KiwiRail has designed and delivered a route knowledge training package to all Te Huia LEs and those who drive freight. The training includes videos of the route from Westfield to The Strand (and return) along with Signal and Interlocking Diagrams with specific points to note (such as Speed Indicators and irregular signal positions). This training has also been observed in practice for each individual LE by the Occupation Competency Manager on week one of the Te Huia start up after this incident, month one, and month three, to ensure all staff are competent.
3. The Commission welcomes the safety action to date. However, it believes more actions need to be taken to ensure the safety of operations for all LEs on all routes, not just Te Huia LEs. Therefore, the Commission has made a recommendation in Section 6 to address this issue.

General

1. The Commission issues recommendations to address safety issues found in its investigations. Recommendations may be addressed to organisations or people and can relate to safety issues found within an organisation or within the wider transport system that have the potential to contribute to future transport accidents and incidents.
2. In the interests of transport safety, it is important that recommendations are implemented without delay to help prevent similar accidents or incidents occurring in the future.

New recommendations

1. On 25 September 2024, the Commission recommended that NZ Transport Agency Waka Kotahi work with rail operators to assess the benefits of all rail operators on the Auckland rail network using a common engineering safety system to improve the safety of all users of that network. (017/24)

2. On 17 October 2024, NZ Transport Agency Waka Kotahi replied:

   We note that this recommendation is a duplicate of 036/23 which was assigned to (and accepted by) KiwiRail following the Commission’s investigation into the L71 Mainline Shunt derailment and subsequent rollover at Tamaki, 01 June 2022 (Report RO-2022-102). An update by KiwiRail in the recent Transport Sector Activity Report Status Update on TAIC Safety Recommendations for 1 July 2023 to 30 June 2024 confirmed that; the extension of ETCS for freight locomotives in the Auckland Metro network is underway by KiwiRail.

   The benefits of using a common engineering safety system to improve the safety to all users of the Auckland Metro network are clear, they have been assessed, and steps are in hand to realise those benefits. NZTA will maintain oversight of this rollout through routine safety assessments and specific requests to KiwiRail for project progress reports.

3. On 25 September 2024, the Commission recommended that KiwiRail review the route knowledge training for locomotive engineers to ensure infrequent driving of the route and prolonged absences are identified so that locomotive engineers have the route knowledge to travel safely. (018/24)

4. On 8 October 2024, KiwiRail replied:

   This recommendation is accepted. A project is being established around incorporating route knowledge components into the KiwiRail Learning Exchange (KLE) with implementation into the business during second half of 2025.

5. On 25 September 2024, the Commission recommended that KiwiRail implement risk controls with respect to signal 308 to ensure that the hazards that have been identified are adequately mitigated. (019/24)

6. On 8 October 2024, KiwiRail replied:

   This recommendation is accepted and work continues on analysing the options available to manage the hazard.

Notice of recommendations

1. The Commission gives notice to KiwiRail and Auckland One Rail that it has issued recommendation (017/24) to NZ Transport Agency Waka Kotahi and that this recommendation will require their involvement.

1. Validation and verification processes ensure that systems have been installed correctly and conform with the required safety standards. They also provide assurance to the regulator that the risks are being managed appropriately.
2. Renewal projects predicated on the introduction of new technologies require reviews of the compatibility of engineering and operational practices.
3. Systems that rely on human performance to maintain adequate levels of safety require robust engineering controls that intervene when human error or non-compliance renders an operation unsafe. Systems should focus on preventive risk controls that work to prevent harm.
4. Training and access to tools that enhance the use of non-technical skills and help to maintain situational awareness are integral to safe rail operations.

1. On 17 June 2023, the NZ Transport Agency Waka Kotahi notified the Commission of the occurrence. The Commission subsequently opened an inquiry under section 13(1) of the Transport Accident Investigation Commission Act 1990 and appointed an investigator in charge.
2. The Commission obtained documentation and records that included:
   • Tranzlog data of the locomotive, signal logs, mobile phone records, maintenance records, track and infrastructure records, and train control voice recordings
   • training documentation
   • risk assessments and documentation
   • shift rosters
   • standards, rules and procedures.
3. The Commission conducted seven interviews with train crew, Train Controllers and signal engineers.
4. The Commission conducted various observational assessments from locomotive cab rides and recorded runs on the NIMT and NAL during July 2023, with the cooperation of KiwiRail.
5. On 29 May 2024 the Commission approved a draft report for circulation to four interested parties for their comments.
6. Two interested parties provided detailed submissions, and two interested parties replied that they had no comment. Any changes as a result of the submissions have been included in the final report.
7. On 25 September 2024 the Commission approved the final report for publication.

Rail Industry and Safety Standards Board. (2017, 09 21). https://www.rissb.com.au. Retrieved from Rail Industry and Safety Standards Board: https://www.rissb.com.au/products/as-7454-management-of-network-route-competence-2