RO-2023-105 Derailment of Tamper 703, Purewa tunnel, Auckland, 9 October 2023

What happened

1. Just after midnight on 9 October 2023, the operator of a group of three track machines obtained permission for the machines to depart Westfield rail depot in Otāhuhu, Auckland and enter an area of line that was closed to rail traffic as part of the Rail Network Rebuild project. The area was controlled by a Rail Protection Officer (RPO).
2. The track machines were connected and running as a single unit, led by Tamper 703. It was intended that the machines would travel through the project area into Auckland.
3. As the group made its way through the project area, further permission to pass signals at red (stop) was required from train control (at the time of the incident, the Auckland train control centre was located in KiwiRail’s Westfield rail yard. Train control is responsible for track authorisations and the safe movement of rail traffic) in conjunction with the RPO.
4. Neither train control nor the RPO was aware that an area of track within the project area had been removed from within a tunnel along the route on which the tamper group was travelling.
5. When the tamper group entered the tunnel, the operator on Tamper 703 noticed the missing track and applied emergency braking.
6. Tamper 703 was unable to stop before driving off the end of the track and into ballast, where it travelled for 16.4 metres before stopping. The rear two machines were able to stop and remain on the track.
7. None of the four crew was injured, but Tamper 703 was significantly damaged.

Why it happened

2. Safety-critical information about the removal of the track within the project area was not provided to the track protection team because the key staff who were responsible were absent.
3. The track protection team did not have the resources to check all the track within the project area, and there was no requirement for track safety verification before rail traffic was authorised to move.
4. Key staff were unsupported while working in safety-critical roles and had very high work volumes.

What we can learn

1. Relying on administrative controls to prevent accidents and incidents may not be sufficient for safety-critical operations. Safety-critical systems requiring any human interactions should include protection and/or preventive engineering controls additional to those currently applied.

Who may benefit

1. Organisations and anyone responsible for managing or working within a safety-critical environment may benefit from the findings and recommendations in this report.

Narrative

1. Since May 2023, KiwiRail had been undertaking a major upgrade of the Auckland rail network in preparation for the planned opening of the City Rail Link (CRL) in 2025.
2. As part of this upgrade, work was required to remove temporary speed restrictions and modernise the existing network.
3. With funding from NZ Transport Agency Waka Kotahi, KiwiRail had developed a programme of work – the Rail Network Rebuild (RNR) – that would replace the formation under the tracks and improve drainage in the rail corridor to limit disruption from weather events (see Figure 3).

1. The RNR project was intended to result in more reliable and smoother train rides across the city and allow more frequent trains to align with CRL capacity.
2. The work being conducted in Purewa Tunnel (tunnel 19) was part of RNR Stage 2. Work for RNR Stage 2 on the Eastern Line included:
   • excavating and replacing 6932 metres (m) of formation (the rock foundation below the track)
   • replacing 19,110 m of ballast (the larger rocks on which the tracks sat)
   • improving 24,678 m of drainage
   • replacing 1383 m of rail and sleepers
3. The RNR project was being carried out 24 hours a day using KiwiRail teams working in shifts.

Events that led to the derailment

1. On the morning of 7 October 2023, a KiwiRail work group received clearance to enter the RNR project area and carry out work in tunnel 19.
2. The RNR project involved multiple worksites, and entry to the project area was protected by a ‘track and time permit’ issued by train control. The permit was known as a Mis.60 (see Appendix 1).
3. The issuance of a Mis.60 prevented rail traffic and personnel entering the protected area unless specifically named in the permit and permission was sought from and granted by the Rail Protection Officer (RPO) holding the Mis.60.
4. The work group had arranged access with the on-duty RPO (RPO1) to conduct the work. This work had not been approved and was not included in the weekly plan issued by the Access Manager. Planned work was supposed to be approved by way of a Track Access Request (TAR) at least two weeks before the intended work date.
5. Although this requirement was not completed, RPO1 assigned the work group a Site Protector (SP), who was responsible for locking the work group onto and off the site in accordance with KiwiRail procedures.
6. A pre-start briefing was held in which the work group discussed the work they would be doing and general health and safety details for the task.
7. Both RPO1 and the SP were present at this briefing.
8. On completion of the work, which was the removal of a section of track in preparation for formation repair, the work group locked off with the SP and left the site.
9. The SP informed RPO1 that the work group had completed the work and had left the site, before the SP also left the site.
10. Although not written in procedure, the usual practice once track had been removed was for a project engineer to email the on-duty RPO advising the location of the track that had been removed, making the area impassable to rail traffic.
11. On this occasion the project engineer responsible for providing this information was overseas on leave, and no arrangement had been made to delegate this task to another person while they were away.
12. As a result, RPO1 did not receive confirmation that a section of the rail track had been removed inside the tunnel, and therefore they did not note it in their handover briefing.
13. At about 1800, RPO1 left the site and commenced rostered days off as the RNR project shut down for a rest day until 1800 on 8 October 2023.
14. At about 1800 (times in this report are New Zealand Daylight Time and are expressed in the 24-hour mode) on 8 October 2023, a different RPO (RPO2) commenced work as the holder of the Mis.60 for the multiple worksites in the project area.
15. RPO2 was in possession of the handover briefing completed by RPO1 the day before. However, the briefing made no mention of the section of missing track in tunnel 19.
16. Because there was no record that track had been removed from tunnel 19, the default position was that the tunnel remained open to rail traffic operating according to the Mis.60 instructions.

The derailment

1. At about 0001 on 9 October 2023, the tamper group, consisting of two tampers and a regulator with a total crew of four, departed Westfield rail depot in Otāhuhu, Auckland (Westfield), travelling north on the North Island Main Trunk (NIMT) up main line. The tamper group intended to carry out track tamping on the down main line at Ōrākei (a suburb of Auckland city) and conduct a final operational check to commission the newly acquired lead tamper (703) into KiwiRail service.
2. The tamper group planned to travel to Auckland Port on the up main line, then turn through Auckland Port and return to Ōrākei on the down main line (see Figure 4). The distance of the trip from Westfield to Auckland was approximately 18 kilometres (km).

1. Although it had been planned under the RNR access process to travel through the project area, the work of the tamper group that night was routine maintenance as part of the tamper commissioning process and was not work related to any RNR project requirement.
2. To facilitate the movement of the tamper group through the project area, an SP was assigned to assist and act as a pilot (a person qualified to guide rail traffic).
3. The normal procedure was for the pilot to be on board the lead tamper to communicate directly with the operator. However, on this occasion the pilot drove ahead by road to wait near the location at which the tamper group was intending to work, on the down main line near Ōrākei.
4. RPO2 gave authorisation for the tamper group to enter the Mis.60 protected work area.
5. The points protecting entry to the Mis.60 protected work area were kept locked by the signals maintainer, and permission to open them was provided by train control after consultation with RPO2.
6. The tamper group then travelled towards Auckland on the up main line (see Figure 5).

1. Because signals were held at stop within the Mis.60 protected work area, verbal authority from train control was required to pass intermediate signals (in automatic signalling areas, a signal governing entry to a section of track inside a block section (see below). Intermediate signals may be passed at red on verbal authority of the train controller) along the way.
2. The lead tamper arrived at the departure signal (signal 508) on the southern side of tunnel 19 and required written authorisation by way of a Safe Working Authority (SWA) from train control to pass the signal at red (stop) in accordance with KiwiRail’s Automatic Signalling Rules (see Appendix 2).
3. Once the SWA had been received, the tamper group made its way towards tunnel 19 on the up main line.
4. No one involved in the SWA process was aware of the track being removed in tunnel 19.
5. When the tamper group cleared the section, the SWA was cancelled and train control gave the operator verbal authority to pass signal M6736, the last signal before entering tunnel 19.
6. At about 0026 the tamper group entered the southern portal of tunnel 19, arriving at the location where track had been removed at an estimated 20–30 kilometres per hour (km/h), causing the lead tamper to drive off the end of the track and derail.
7. The tamper continued over the end of the track for 16.4 m, coming to a stop in the track ballast.
8. No crew members were injured in the derailment; however, the abrupt stop threw them off their seats. Equipment on the underside of the tamper was significantly damaged, requiring repairs costing several hundred thousand dollars.
9. The site was frozen pending an investigation of the circumstances of the incident.

Personnel information

1. The tamper operator had more than 20 years’ experience. They were current in all required competencies for their role.
2. RPO1 held senior RPO qualifications. They were current in all required competencies for their role.
3. RPO2 held senior RPO qualifications. They were current in all required competencies for their role.
4. The train controller had been certified for two years. They were current in all required competencies for their role.
5. The project engineer had 10 years’ experience.

Train/Vehicle information

1. All three track machines (Tamper 703, Tamper 622 and Regulator 676) were coupled and running as Train AV2. Tamper 703 was undergoing testing for commissioning into the KiwiRail fleet.

Site and wreckage information

1. Tunnel 19 was a 596 m long, concrete-lined tunnel between 673 and 674 km NIMT.
2. Visibility was low, as the incident occurred during the hours of darkness inside a tunnel.

Organisational information

1. KiwiRail Holdings Limited (trading as KiwiRail) was the infrastructure owner and the employer of all personnel involved.

Previous occurrences

RO 2023-104 Passenger Train 104 (Te Huia) signal passed at danger and potential conflict

1. On Saturday 17 June 2023, the Te Huia regional passenger train service was travelling from Hamilton to Auckland on a scheduled service. At Penrose Station on the North Auckland line, the train passed a stop signal and entered the Onehunga branch line junction. A potential conflict with a commuter train on that line was avoided when the signalling system reverted signals for the commuter train to stop.
2. The Transport Accident Investigation Commission (the Commission) identified several key lessons, including: systems that rely on human performance to maintain adequate levels of safety require robust engineering controls that intervene when human error or non-compliance renders an operation unsafe; and systems should focus on preventive risk controls that work to prevent harm.

RO 2022-102 Main line shunt, derailment and subsequent rollover

1. On 31 May 2022, a three-person train crew was transporting freight wagons between the Wiri rail yard and the Port of Auckland on the NIMT. Because of the configuration of the train, the Locomotive Engineer was reliant on another crew member to observe and report signals along the way. Due to a miscommunication the train entered a section of track restricted to 25 km/h at a speed of 77 km/h. The locomotive derailed and overturned, causing injuries to the three crew.
2. The Commission identified several key lessons, including: complex systems require robust engineering-risk controls to guard against variable human performance within the system; and administrative controls, which are vulnerable to human error and non-compliance, should not solely be relied upon to keep a system safe.

Introduction

1. A series of factors led to the derailment of the tamper when it entered an area where track had been removed.
2. The following section analyses the circumstances surrounding the event to identify those factors that increased the likelihood of the event occurring or increased the severity of its outcome. It also examines any safety issues that have the potential to adversely affect future operations.

Background

The project

1. The RNR project was necessary to upgrade the performance of the existing Auckland railway in preparation for a projected increase in the number and frequency of commuter trains on completion of the CRL project. It was among the largest projects undertaken by KiwiRail since its formation in 2008.
2. Before the RNR project, the largest recent project involving KiwiRail had been the North Canterbury Transport Infrastructure Recovery (NCTIR) project. This had been set up by the then government in late 2016 to restore the earthquake-damaged infrastructure (both road and rail) between Picton and Christchurch.
3. NCTIR was a partnership between NZ Transport Agency Waka Kotahi, KiwiRail and several major contracting companies. The RNR project differed in that it was conducted by KiwiRail using in-house assets, employees and teams of contractors, and existing methods of protection specified in KiwiRail’s Rail Operations Rules and Procedures.

Protection methods

1. The primary method of protection for both rail vehicles and people within the RNR project area was a Mis.60. Once the Mis.60 was in effect, the track was closed to rail traffic, except for work trains and Mobile Track Maintenance Vehicles (MTMVs) specifically included in the Mis.60 instructions. No passenger or freight trains were included in those instructions (see Figure 6).

1. The Mis.60 was issued by train control to an RPO for a specified time. Once it was issued, the on-duty RPO was responsible for all worksites and rail movements within the boundaries of the Mis.60 area.
2. The on-duty RPO kept a record of active worksites and all rail traffic operating within the Mis.60 area. This information was updated as necessary and handed over to the incoming RPO at the end of the shift. The accuracy of the handover was dependent on the information recorded by the RPO.
3. As the RPO could not physically be present at every worksite within the Mis.60 area, KiwiRail also employed SPs who remained in the vicinity of each work group and liaised with the RPO on the status of activities.
4. Individual worksites within the Mis.60 area were required to operate under the guidelines of KiwiRail’s Rail Operations Rules and Procedures Rule 902 – Managing a Protected Work Area (PWA). Rule 902 protection included a requirement that each worker lock on to the worksite by using the frame and padlock system (see Figure 7 and Appendix 4).

1. Once the PWA was active, the RPO or SP could not authorise any rail traffic to enter until all personnel had left the worksite, returned to a place of safety and removed their individual padlocks from the frame.
2. Once this had been completed, the RPO or SP could authorise rail traffic through the area. Once the last rail movement had confirmed it was clear of the PWA, personnel could be authorised to repeat the locking-on process and return to work within the PWA.

Secondary protection and line impassable

Safety issue 1: The RNR project covered a large area of the main line with multiple worksites and included sections of track that were at times impassable. The secondary protection and administrative controls that were in place to address any risks were not enough to mitigate them adequately, putting rail vehicles and personnel at risk.

Definition of line impassable

1. KiwiRail’s definition of impassable track (‘line impassable’) was:

   Planned work that requires the closing of the track to normal train movements for a period of time to allow for maintenance work to be carried out. [Emphasis added]

2. However, this definition did not fully account for the type of work that was undertaken by the RNR project in that:
   • it did not provide for unplanned work
   • normal train movements in the above context referred to daily freight or passenger services, not work trains or MTMVs included in the Mis.60 instructions.
3. The type of work being carried out was not ‘maintenance’ but part of a project that required the complete removal and replacement of sections of track in a months-long timeframe.
4. KiwiRail was asked for clarification on whether ‘line impassable’ correctly described the type of work occurring within the Mis.60 protected area. It responded that a more correct term would be ‘non-traversable’.
5. However, KiwiRail advised that ‘non-traversable’ was not defined or formalised, and that additional processes required for non-traversable track had not yet been finalised.
6. To avoid confusion, and for the purposes of this report, the term ‘impassable’ is used to describe a section of track that should have been closed to all rail traffic.

Secondary protection – hierarchy of controls

1. The most effective way to manage a hazard is to eliminate its source; if the hazard does not exist, no risk is posed. If it is not possible to eliminate the hazard, the next most efficient control is to reduce any potential risks. This can be achieved in several ways; however, some methods are more effective than others (see Figure 8).

1. Firstly, substitution of the hazard should be considered. This involves replacing the hazard source with something that presents less risk. If this is not reasonably practicable, an engineering control will provide the best defence. An engineering control is physical in nature and can be designed into a system to protect an individual from a hazard.
2. Less effective than engineering controls are administrative risk controls. These consist of measures such as providing workers with information about a hazard through training and having documented procedures or work instructions in place. Finally, personal protective equipment should be used to protect against any remaining risks.
3. Once risk controls have been established, they must be reviewed and, if necessary, revised to ensure that their effectiveness is maintained.

4. KiwiRail Operating Rules – Track Safety Rule 910 (see Appendix 5) stated in part:

   Secondary Protection must be applied when any work is undertaken on main lines or interlocked territory, using:

• Multiple Work Site Area, or
• Line Impassable.

1. The RNR project involved work being undertaken on a main line using multiple worksite areas and line impassable areas. KiwiRail advised that secondary protection was achieved by setting and locking points away from the Mis.60 protected area from both the southern end at Westfield and the northern end at Auckland.
2. At the time of the incident, additional protection such as signage, detonators, derailers and points being set away from a section of impassable track was not in place inside the Mis.60 area to provide further protection at individual worksites. The requirement for secondary protection had been met by setting and locking the points at each end of the Mis.60.
3. This meant that the only way operators of rail traffic moving within the Mis.60 area could be made aware that a section of track was impassable was by being advised by the RPO.
4. Further, the only way the RPO was formally made aware that a section of track within the RNR project area was impassable was via email from the project engineer on completion of the work.
5. On this occasion, track was removed while the project engineer was on leave, so the RPO was not advised by email that it was impassable. Consequently, rail operators intending to enter that section of the track were not informed by the RPO that it was impassable, and no protection was in place if a rail vehicle did enter the impassable track.
6. During this inquiry, the Commission was made aware during interviews of an incident on 9 April 2023 between Papakura and Pukekohe, when a section of track was removed without it being planned or promulgated, and without any warning boards in place. Fortunately, on that occasion the impassable track was noticed by a contractor before an incident could occur.
7. The Commission is concerned that KiwiRail was aware of this earlier incident but had not responded by taking steps to prevent a repeat incident. KiwiRail could have issued instructions to ensure impassable track was protected by additional controls, but it considered that the requirements for line impassable protection had been met through the Mis.60 secondary protection.
8. Had any form of additional protection been in place, it would very likely have alerted both RPO2 and the tamper operator that the track was impassable. It is virtually certain that had either party been aware of impassable track the derailment would not have occurred.
9. KiwiRail has taken some action to address this issue. This is discussed further in Section 5.

Planning of work

1. KiwiRail had an access and planning team whose role was to coordinate the work groups, protection personnel, rail movements and work requirements for the RNR project. Within the access and planning team, the Auckland-Northland Protection Manager was responsible for coordination and promulgation of the plan to the wider project team.
2. For planning purposes, all activities had to be approved by way of a TAR at least two weeks before the proposed work was carried out. The access and planning team would collate all TARs and ensure that the work did not conflict with other activities and that programmed protection personnel would be available. A draft plan was promulgated to relevant personnel, who were given a three-day window to amend any TARs before the plan was finalised.
3. Once the plan was finalised it was communicated to project stakeholders by email and referred to as the ‘Block of Line’ (BOL) pack.
4. The BOL pack contained information on the planned work, people involved, equipment required, estimated timeframes and protection arrangements.
5. Adherence to the plan was important, as any deviation could mean necessary personnel or equipment were not available, and unplanned work could interfere with the completion of planned work.
6. However, as the RNR project progressed towards the scheduled completion date, the level of adherence to the plan reduced as access to the track was required. This is discussed further in the section below.

Track access

1. On the morning of 7 October 2023, a KiwiRail track group contacted RPO1 and requested permission to carry out work inside tunnel 19.
2. This work involved removing track in preparation for formation repair. It had been organised with the track group by the project engineer, but as the project engineer had gone overseas on leave, the proper planning and approval processes had not been completed. As a result, the work was not in the BOL pack promulgated to project personnel.
3. Despite this, it had become routine for unplanned work to be approved by the on-duty RPO, as not approving it meant projects could be delayed.
4. Commission investigators were informed during interviews that on occasions when unplanned work was refused it would be ‘pushed up the chain’ and inevitably result in a senior manager instructing that the work go ahead.
5. This led to a level of acceptance among protection staff that the plan in the BOL pack had become little more than a guideline. This meant approval was usually granted for unplanned work without regard to the impacts on work in the BOL pack that had been planned through the correct channels.
6. Before formation repair work could be carried out, the rail track first had to be removed. The formation repair work itself was reliant on factors such as weather, staff availability, protection availability and equipment availability. Delays in formation repair work, and as a consequence track replacement work, were not uncommon.
7. When there was a delay, rather than waiting for the formation repair work to be completed, the work group would relocate to a different place in the RNR project area and remove track in preparation for formation repair work later.
8. Relocating as a response to delays was not planned, and it put protection staff in the position of having to either refuse the work or accommodate the work at the last minute without preparation.
9. Information received by Commission investigators during interviews was that, as the RNR project neared its scheduled completion date, the level of unplanned work that was expected to be accommodated was increasing. This led to perceived pressure on RPOs to allow work that was not included in the BOL pack to go ahead.
10. It was in this environment that RPO1 agreed to unplanned work in tunnel 19 and organised the assignment of an SP to the work group.

Track removal

1. About 0745 on Saturday 7 October 2023, after conducting safety briefings and locking on with the SP, the work group began removing track from the up main line in tunnel 19.
2. RPO1 and the SP were both present at this safety briefing. In interview, the SP recalled hearing during the safety briefing that a section of track would be removed. RPO1 stated during interview that they could not recall what was discussed during the briefing.
3. Once the work group entered the tunnel, the SP remained inside a road vehicle in a carpark area nearby and outside the rail corridor known as the ‘safe place’.
4. RPO1 left the area immediately after the safety briefing to undertake other duties.
5. The work group removed approximately 100 m of track and concrete sleepers from the up main line inside the tunnel. The concrete sleepers were stacked for storage on the remaining rail track of the up main line, on the northern side of the area that had been removed (see Figure 9 and Figure 10).

1. Both the missing track and the stacked concrete sleepers posed an extreme risk to any rail traffic that might have used the line. However, no warning signs or devices were placed for additional protection as this was not required within the confines of the Mis.60 area.
2. At about 1630, when they had completed the work, the work group exited the tunnel, leaving the missing track and concrete sleepers without putting in place any form of protection. They returned to the safe place to advise the SP that they had finished for the day and to complete lock-off procedures.
3. Once all personnel were locked off from the site, the work group departed.
4. The SP was not specifically informed by the work group that the up main line was now impassable to rail traffic. However, they were aware of the nature of the work from that morning’s safety briefing.
5. When the SP advised RPO1 that they were leaving the site for the day, they also advised that the work in the tunnel had been completed.
6. RPO1 acknowledged the SP’s leaving time. No documentation was updated to record that the track was impassable.

Administrative process

1. At the commencement of the RNR project, two project engineers and a project delivery manager had been assigned to plan and oversee the formation repair work.
2. Of these staff, one was on leave, and one had been seconded to a different project. The third had recently taken on a more senior role, while at the same time fulfilling RNR-related duties, and had travelled overseas on leave two days before the incident.
3. The process that had been in place during the RNR project was for the project engineer overseeing the track removal work to be sent an email by the worksite supervisors confirming the work that had been carried out that day. In turn, and on completion of the day’s work, the project engineer would send an email to the track protection team advising them of the sections of track that were impassable.
4. On receipt of this information, the on-duty RPO would update their records and pass on the information on handover to the incoming RPO.
5. On this occasion the work confirmation email was sent by the worksite supervisor, but was not acted upon because of staff absences.
6. The track was removed from inside tunnel 19 without its being on the plan in the BOL pack and without formal notification to those protecting the area, or any form of additional protection being put in place.
7. Although RPO1 was verbally advised of the track removal during the safety briefing, they were overseeing multiple worksites in the Mis.60 area and attending multiple briefings. RPO1 stated that they could not recall the specifics of that morning’s briefing.
8. The requirement for a single RPO to operate multiple worksites over a large area significantly increased the risk of their making errors. The controls in place to mitigate risks were administrative at best and inadequate for the size of the project.
9. RPOs were unable to conduct full inspections of the entire site, as some sections (including the insides of tunnels) were inaccessible by road or foot. Even if a visual inspection of the entire site had been possible, the RPOs would not have been responsible for assessing the structural integrity of the track within the worksite, nor its suitability for rail traffic, as they were not track engineers.
10. Situational awareness of the state of the track in the worksite was completely reliant on accurate information being provided to the RPOs by the responsible project personnel, and this information being accurately shared via the handover process.
11. There was no process for confirming that safety-critical information had been received and/or acted upon. Had the track protection team been made aware that the track within the tunnel was impassable, it was very likely that the incident would have been avoided.

Rail movement authorisation

Safety issue 2: KiwiRail’s process for authorising rail movements within the RNR project worksite was inadequate to ensure the safe movement of rail traffic and personnel within a protected work area. There was no verification of track integrity and no assurance that safety-critical information was held by the decision-makers.

1. The tamper group consisted of three machines: Tamper 703, Tamper 622 and Regulator 676. The machines were coupled and running as a train, identified as radio callsign AV2 for communication purposes.
2. AV2 was being driven from the leading machine, Tamper 703, by a qualified tamper operator. The remaining crew were seated in the rear two machines.
3. The newly acquired tamper was undergoing commissioning testing, and the crew were accompanied by an observer.
4. A pilot was arranged to be on board the lead machine as it traversed the Mis.60 area. However, it was decided on the previous night that the pilot (who was also acting as SP) would go ahead by road vehicle to the location at which the tamper group intended to conduct tamping and regulating work, as transportation by road would be needed once the work was complete.
5. Although this meant that the pilot was not seated next to the tamper operator, it did not contribute to the incident as the pilot was not aware that the line was impassable and therefore would not have prevented AV2 entering the tunnel had they been on board.
6. The movement of the tamper group had been promulgated in the BOL pack, having been pre-planned by the project engineer for AV2 to travel on the up main line to Auckland. It was also included in the daily Information Bulletin (see Figure 11).

1. On arrival in Auckland, AV2 was to turn and enter the down main line, making its way to Ōrākei to begin work.
2. The turn through Auckland was necessary to ensure all three machines were facing in the correct direction to carry out the required tamping work.
3. Although AV2 was listed on the Mis.60 instructions as having permission to enter the Mis.60 area, the work being conducted that night was not related to the RNR project. Instead, it was to conduct routine track maintenance work and perform commissioning tests on Tamper 703.
4. An alternative route for the tamper group that bypassed the Mis.60 area was not available because other unrelated track work was being carried out at the same time.
5. The procedure for AV2 to enter the Mis.60 area was complex. Permission had to first be sought from train control. Train control then confirmed with RPO2 that AV2 could enter the area under RPO control. Once confirmation was received, train control contacted a signals maintainer who unlocked the points protecting entry to the Mis.60 area. AV2 then contacted RPO2 to request permission to enter. Before moving into the Mis.60 area, AV2 also needed authority from train control to pass signals at stop. This authority was verbal until AV2 reached departure signal 508, where written authority was required (see Figure 12 and Figure 13).

1. Authority to pass departure signals at stop was given by train control by way of an SWA (see Figure 14).

2. The issuance of an SWA to pass signals at stop is required in situations where train control is unable to provide a proceed indication on a signal. This could be due to several factors, including signal failure, track defect or track occupation.

1. When AV2 reached signal 508, the tamper operator contacted train control by radio to request authorisation to pass the signal. The train controller issued the SWA, including a clause 8 – Other Instructions, that the tamper operator was also required to have authorisation from the RPO.
2. This clause 8 requirement for authorisation from the RPO was considered necessary as the RPO was responsible for safe working within the Mis.60 area, and there could have been a PWA in the section beyond the signal of which train control was unaware.
3. However, clauses 9a and 9b – Safety Assurances/Line Clearances were not completed because of the block of line, and train control had no record of the last train or last track occupancy.
4. This meant that the train controller had no way of knowing whether a section of track into which they were about to authorise a rail movement was safe for rail traffic, hence the requirement for RPO authorisation.
5. However, on this occasion the RPO authorisation was also given, even though they had no knowledge of the impassable track.
6. This meant that the operator of AV2 received permission from two authorities (train control and RPO2) to move towards a section of track that was impassable without the knowledge of either authority (see Figure 15).

1. Once AV2 had obtained permission to pass signal 508, it also passed signal M6728 and continued to the next signal, M6736, before stopping and contacting train control by radio.
2. Train control cancelled the SWA, as AV2 was now clear of the section protected by signal 508, before verbally authorising AV2 past signal M6736 at stop – the last signal before entry to tunnel 19 (see Figure 16).

1. Authorisation from the RPO was not required to pass signal M6736, as it was not classified as a departure signal.

2. KiwiRail’s Rail Operating Rules – Automatic Signalling Rules 612(a) – Speed of movement (see Appendix 3) stated in part:

   After passing a signal at stop or while travelling on a SWA authority, the movement must travel at restricted speed, the Operator being prepared to find and stop short of an obstruction, a displaced rail, or defective level crossing warning equipment…

3. Rule 612(a) is clear that, having passed a signal at stop, the responsibility was on the AV2 operator to be prepared to find and stop short of an obstruction. However, the operational conditions made it more challenging to find and stop short of an obstruction given that:

• it was dark with low visibility, as it was shortly after midnight
• they were entering a long tunnel with no internal lighting
• they had received authorisation to proceed through the area from two sources
• there was no information to suggest that the track may have been impassable.

1. After being authorised past signal M6736, AV2 entered the tunnel travelling at an estimated 20–30 km/h. The tamper operator saw what they thought was ballast on the track ahead before realising they could see only ballast ahead because the track was missing.
2. The tamper operator immediately activated emergency braking and called the occupants of the rear two machines by radio, warning them to stop, but it was too late to prevent the lead machine driving off the rails into the ballast.
3. It is likely that the swift actions of the tamper operator prevented the rear machines following Tamper 703 off the track and derailing.

4. During its inquiry, the Commission asked KiwiRail if any risk assessment had been conducted of the procedures for moving rail traffic within the Mis.60 area, whereby train control issued either verbal or written movement authorities to rail traffic. On 15 April 2024, KiwiRail responded:

   The procedures for MTMV/work trains to enter and move within a Mis60 area are defined in the relevant Rail Operating Rules and Procedures. No evidence that a risk assessment was considered for movements within this specific Mis60 is available.

    

5. The Commission asked KiwiRail why train control had issued movement/safe working authorities to rail traffic in the Mis.60 area when they had very limited information available on which to issue those authorities and given that the RPOs were responsible for safe working and protection within the Mis.60. The KiwiRail Track and Time Permit (Mis.60) General Rule 24(a)(iii) states

   The RPO will be responsible for any safe working and protection of Track Maintenance Machines/Mobile Track Equipment and/or Work Trains when operating in conjunction with other work.

    

6. On 15 April 2024, KiwiRail responded:

   RPO is responsible for managing safe working of all vehicles within the PWA. This does not override ASR rules [automatic signalling rules] for passing signals at Stop. There is a requirement that TC [train control] issues any SWA or verbal authority in conjunction with RPO authority for the movement. This was captured in the SWA-01 issued in Clause 8 – RPO Authority also required.

    

7. Further, the Commission asked KiwiRail if any consideration had been given to the disarrangement/disconnection of signalling in Mis.60 areas and to provide a reason if this had not occurred. On 15 April 2024, KiwiRail responded:

   Consideration at project level determined it is not standard practice to fully disarrange signalling for track works –full disarrangement imports risk at handback to live operations. KR [KiwiRail] Rules indicate how MTMVs/WT [mobile track maintenance vehicles/work trains] are managed within a PWA.

    

8. The Commission acknowledges KiwiRail’s response. However, the routine removal of track was a major component of this project and the reliance on rules intended to authorise rail traffic past signals in a routine daily operational setting was not adequate for a major block of line operating for an extended period of time.
9. The requirement for two separate parties to authorise movements when neither had any knowledge of the track status likely led to a lower level of oversight than there should have been as each was expecting the other to have such knowledge.
10. There was no process for verifying, or requirement to verify, track integrity before movements were authorised. Had a risk assessment of the safety-critical works within the RNR project area been completed, it is likely it would have identified that track in a Mis.60 worksite should default to impassable until verified by inspection. It is virtually certain that the default position that the track was passable unless informed otherwise led to the derailment.

Project organisation

Safety issue 3: The vacancies in and lack of engagement by some senior roles involved in the RNR project meant that key staff were working in safety-critical roles unsupported and with very high work volumes. This increased the risk of errors and reduced the effectiveness of oversight by key staff.

1. The people responsible in the RNR project for access and protection (see Figure 17) faced challenges as the RNR project progressed. Some key staff who started the project were no longer fulfilling their roles because of leave of absence or secondment. This meant that other staff were having to take on the workloads of two or more roles to compensate.

   

2. The Chief Operations Officer, while nominally having executive oversight of the RNR project, including the track protection team, was not involved in its day-to-day work. Executive responsibility was also being transferred to the Chief Infrastructure Officer.
3. Senior management functions were the responsibility of the National Manager Infrastructure Operations (NMIO). The NMIO was based in Whangārei and oversaw several national infrastructure groups, including MTMVs. The NMIO was not involved in the project’s day-to-day operations and was overseas on business at the time of the incident.
4. The National Protection Manager (NPM) was responsible for directly supervising the Auckland-Northland Protection Manager.
5. Originally, two project engineers and a project delivery manager had been assigned to the RNR project. However, of these three staff, one was focussed on another job not related to the RNR project, one was on leave and the third had also taken annual leave overseas, leaving those roles temporarily vacant
6. No arrangements had been made for personnel to assume the responsibilities of any of the vacant roles. Some positions had been vacant for several months.
7. Key staff had raised concerns with management about the lack of support and about the high workload. KiwiRail was aware of concerns about aspects of the project and had engaged a consultant to assess them shortly before the incident.
8. High workloads, lack of support for key staff, and perceived time pressures for project requirements likely led to oversights and errors contributing to the incident.

1. The oversight of multiple worksites in a large area by a single Rail Protection Officer posed significant risks to rail vehicles and personnel within the Rail Network Rebuild project area. The procedures in place to mitigate these risks were administrative and inadequate for the size of the project.
2. The track was removed from inside tunnel 19 without its being on the plan in the Block of Line pack and without formal notification to those protecting the area or any form of additional protection being put in place.
3. There was no process to confirm that safety-critical information had been received and/or acted upon. Had the track protection team been made aware that the track within the tunnel was impassable, it is very likely the incident would have been avoided.
4. There was no process for verifying, or requirement to verify, track integrity before movements were authorised by train control or the RPO. Had a risk assessment of the safety-critical works been completed, it is likely it would have identified that track in a Mis.60 worksite should default to impassable until verified by inspection. It is virtually certain that the default position that the track was passable unless informed otherwise led to the derailment.
5. KiwiRail’s process for authorising rail movements within the project worksite was inadequate for ensuring the safe movement of rail traffic within a protected work area. The requirement for two separate parties to authorise movements when neither had knowledge of the track status likely led to a lower level of oversight as each was expecting the other to have such knowledge.
6. Had any form of additional protection been in place, it would very likely have alerted both RPO2 and the tamper operator that the track was impassable. It is virtually certain that had either party been aware of the impassable track the derailment would not have occurred.
7. The swift actions of the AV2 operator likely prevented the rear machines following Tamper 703 off the track and derailing.
8. High workloads, lack of support for key staff, and perceived time pressures with project requirements likely led to oversights and errors contributing to the incident.

General

1. Safety issues are an output from the Commission’s analysis. They may not always relate to factors directly contributing to the accident or incident. They typically describe a system problem that has the potential to adversely affect future transport safety.
2. Safety issues may be addressed by safety actions taken by a participant; otherwise the Commission may issue a recommendation to address the issue.
3. Three new safety issues were identified in this report

Safety issue 1: The RNR project covered a large area of the main line with multiple worksites and included sections of track that were at times impassable. The secondary protection and administrative controls that were in place to address any risks were not enough to mitigate them adequately, putting rail vehicles and personnel at risk.

1. On 30 October 2024, KiwiRail advised the Commission that the following safety action was in progress but had yet to be implemented:

   When sections of track are made non-traversable, the following mandatory requirements apply:

• Details of non-traversable track must reflect what is in the protection pack.
• Details must be discussed in the briefing pre works.
• Once track is made non-traversable, details are to be confirmed with the Site Protector and RPO.
• Stop discs are erected 50 m either side of the non-traversable section of track.
• When the section of track is made traversable again, this must be again confirmed with the Site Protector and RPO. Stop discs are to be removed and track reclassified as traversable with appropriate TSR [temporary speed restriction] mitigations in place.

1. The Commission welcomes the safety action taken to date. However, as this safety action has not been implemented, more action needs to be taken to ensure the safety of future operations. Therefore, the Commission has made a recommendation in Section 6 to address this issue.

Safety issue 2: KiwiRail’s process for authorising rail movements within the RNR project worksite was inadequate to ensure the safe movement of rail traffic and personnel within a protected work area. There was no verification of track integrity and no assurance that safety-critical information was held by the decision-makers.

1. No action has been taken to address the safety issue. Therefore, the Commission has made recommendations in Section 6 to address this issue.

Safety issue 3: The vacancies in and lack of engagement by some senior roles involved in the RNR project meant that key staff were working in safety-critical roles unsupported and with very high work volumes. This increased the risk of errors and reduced the effectiveness of oversight by key staff.

1. No action has been taken to address the safety issue. Therefore, the Commission has made recommendations in Section 6 to address this issue.

General

1. The Commission issues recommendations to address safety issues found in its investigations. Recommendations may be addressed to organisations or people and can relate to safety issues found within an organisation or within the wider transport system that have the potential to contribute to future transport accidents and incidents.
2. In the interests of transport safety, it is important that recommendations are implemented without delay to help prevent similar accidents or incidents occurring in the future.

New recommendations

1. On 28 May 2025, the Commission recommended that KiwiRail review and improve its process for authorising rail movements within worksites to ensure the safe movement of all rail traffic and personnel within protected work areas, including the verification of track integrity and the sharing of and access to safety-critical information. [031/25]

2. On 23 June 2025, KiwiRail replied:

   This recommendation has been accepted. In part this has been covered under our response to recommendation 032/25. Additionally, we are looking at amending the Track Access Request (TAR) form to make it clearer as to what information is required at the front-end planning stage, which is in progress.

    

3. On 28 May 2025, the Commission recommended that KiwiRail review and improve its rules and procedures relating to track maintenance work to require additional protection within worksites where the tracks have been made impassable. [032/25]

4. On 23 June 2025, KiwiRail replied:

   This recommendation has been accepted and implemented. A new rule TS02 Protected Work Area, Section 4, Worksites, 4.4 Speed Restricted or Unsafe Track was introduced and notified via Shield Alert No. 247. This was effective 31 March 2025.

    

5. On 28 May 2025, the Commission recommended that KiwiRail review its national project management structure to ensure there is sufficient oversight of and ongoing support for all project staff at all levels to maintain safe working conditions and manageable workloads. [033/25]

6. On 23 June 2025, KiwiRail replied:

   This recommendation is accepted and forms part of an ongoing improvement process.

    

Relying on administrative controls to prevent accidents and incidents may not be sufficient for safety-critical operations. Safety-critical systems requiring any human interactions should include protection and/or preventive engineering controls additional to those currently applied.

1. On 9 October 2023, NZ Transport Agency Waka Kotahi notified the Commission of the occurrence. The Commission subsequently opened an inquiry under section 13(1) of the Transport Accident Investigation Commission Act 1990 and appointed an investigator in charge.
2. Commission investigators attended the site and conducted a site investigation.
3. The Commission obtained records and information that included:
   • information from involved personnel
   • photographic evidence
   • train control recordings
   • train control graphs
   • Mis.60 records
   • SWA records
   • signal and interlocking diagrams.
4. On 26 March 2025 the Commission approved a draft report for circulation to 18 interested parties for their comment.
5. Three interested parties each provided a detailed submission and five interested parties replied that they had no comment. One interested party was interviewed for further clarification. The remaining interested parties did not respond despite efforts to contact them. Any changes as a result of the submissions have been included in the final report.
6. On 28 May 2025, the Commission approved the final report for publication.