What happened
In March and May 2025, Wellington Station's signalling system experienced two outages that caused significant disruption to commuter services.
On both occasions, the same power supply module* stopped charging its backup battery bank. The resulting loss of power caused the signalling computer to shut down and all signals in the area to revert to ‘stop’.
The signalling system failed safely, preventing trains from entering the affected area. However, two outages within six weeks pointed to a reliability problem within a critical safety system.
* Power supply module: a hardware box that converts power from one voltage to another. In this case it provided a DC voltage to charge a battery bank
Why it happened
The Commission identified safety issues with KiwiRail’s standards for design and project management and with the ineffective alarm system meant to alert train control operators.
Design and project management standards
This issue relates to the KiwiRail’s design and assurance process for the power supply system. The installed power supply module had less spare capacity than required by the design criteria. KiwiRail's design and project management standards were not fully applied, and KiwiRail did not review the DC power supply design.
Human factors in alarm presentation
The alarm system to alert train controllers that a fault existed in the signalling system that could affect train operations, was ineffective. Before the first outage, a remote alarm at KiwiRail’s Train Control facility** indicated that the power supply module had failed. But nobody noticed the alarm and nobody investigated the fault; the alarm was visual only, inconspicuous, appeared only briefly on screen, and operators had not been trained to understand its significance or how to respond to it. The train controllers, signaller and signal maintenance staff all remained unaware of the power supply issue until the outage occurred.
** Train Control: office where train controllers direct rail vehicle movements and track access
Avoiding similar incidents in future
The report provides useful information for engineers who design monitoring and alarm systems for high-reliability infrastructure, as well as infrastructure managers, rail system owners, train control operators and the people who train them.
- Major infrastructure upgrades involving critical safety systems require robust design assurance, independent review and effective project management. [3.19 - 3.27]
- Power supply systems that support critical safety equipment need sufficient capacity and reliability to maintain continued operation during faults and abnormal conditions. [3.6-3.7, 3.13 - 3.18]
- Alarm systems should be designed with human factors in mind. They need to provide timely and meaningful information to the people who need it, in a form that attracts attention and prompts action.[3.28 - 3.39]
- Operator training also needs to match system changes to ensure staff understand the alarms, monitoring systems and procedures they are expected to use. [1.7, 3.38-9]
Safety actions by KiwiRail
KiwiRail has already taken action to address the issues identified in this investigation, including improving alarm displays, redistributing loads to improve power supply spare capacity, phasing out the power supply module involved and improving the robustness and assurance of the design process.
There was no need for the Commission to issue recommendations.