Key points:
|
Change management and risk assessment processes, and unclear communication of a safety-critical action to train drivers, contributed to the runaway and derailment of a fully-loaded 42,500 tonne, 2.86 km iron ore train in Western Australia's Pilbara region, an Australian Transport Safety Bureau investigation has concluded.
The final report from the ATSB's systemic investigation into the 5 November 2018 accident describes the circumstances leading up to the train's runaway, which culminated in its intentional derailment, resulting in 2 remote locomotives, 245 ore cars and 2 km of track infrastructure being destroyed.
When the train, which was being operated by a single driver on BHP's Newman to Port Hedland railway, was about 211 km from its destination, an inter-car connector separated, severing trainline communications between the lead locomotive and the ore cars toward the end of the train. This initiated an automated emergency brake application, stopping the train as it approached Garden South, which was on a falling (downhill) grade.
Sixty minutes after the train stopped, and before the driver was able to secure enough of the ore cars' handbrakes, the affected car control devices shut down, and the brakes were released on the majority of the ore cars in the train.
The train then began to roll away without the driver on board. In the ensuing runaway, the train travelled more than 90 km over approximately 40 minutes, before BHP's Hedland control intentionally derailed it at a crossover to an adjacent track at Turner South, about 120 km from Port Hedland.
"A train runaway can cause injury or loss of life, and while there were no injuries as a result of this accident, it did carry a significant financial and economic cost," ATSB Chief Commissioner Angus Mitchell said.
"A certain set of specific circumstances meant not completing a single safety-critical action - placing the automatic brake handle in the pneumatic emergency position - had a significant consequence.
"This safety-critical action relied extensively on the driver's memory, and the investigation found there were limited processes in place to facilitate or cross-check a driver completing key safety-critical actions."
The investigation found that BHP did not clearly communicate the importance and reasons for this action to its drivers, reducing the potential for the drivers to correctly recall this action.
The same error had been made on a number of previous occasions by other drivers responding to a similar type of event.
Mr Mitchell said the ATSB considered more broadly why prevention of the runaway was dependent on a single safety-critical action.
"The ATSB's investigation found that, while integrating a new electronically controlled pneumatic braking (ECPB) system with a number of already complex systems into its iron ore trains, BHP managed this integration at an individual system level, rather than through the application of a structured engineering approach," Mr Mitchell explained.
Subsequently the operator did not identify and manage significant characteristics of how these systems interacted in response to certain fault conditions.
"As a result, BHP's trains configured for ECPB operation were potentially vulnerable to a runaway event should a unique combination of events and conditions occur," Mr Mitchell said.
In addition, the investigation identified that, while BHP's risk assessment for its rail network identified numerous causes and critical controls for incidents such as runaways, it was broad in scope and had limited focus on the causes and critical controls for a train runaway event.
"Although the operator had identified the need for the safety-critical action in its procedures in April 2017, this risk assessment did not include the procedure for responding to brake pipe emergencies and penalties as a critical control, and it did not test the effectiveness of this procedural control," Mr Mitchell said.
Following the accident, BHP reviewed the risk management framework associated with rail-mounted equipment interaction, updated the risk assessment, and added additional controls related to potential train runaway events.
It also made changes to its controls by revising the operating instruction for brake pipe emergencies. These included a form for drivers to complete confirming they had cross-checked the actions undertaken in response to a system generated emergency brake application with train control prior to leaving the locomotive cab, and amending the instruction to clearly advise the importance of placing the automatic brake handle in the emergency position.
Given that the train stopped at 0340 and the driver was conducting a series of 7 consecutive night shifts, the ATSB also examined BHP's processes for managing train driver fatigue.
The ATSB found that the BHP roster patterns for fly-in fly-out train drivers were conducive to result in cumulative sleep restriction and levels of fatigue likely to adversely influence performance on a significant proportion of occasions, and BHP had limited processes in place to ensure that drivers actually obtained sufficient sleep when working these roster patterns. However, based on the available evidence, the ATSB did not conclude that fatigue contributed to the runaway event.
The report notes BHP has commissioned external fatigue experts to undertake a range of evaluation and development activities, and has formed a working group to optimise train driver rosters.
"This investigation highlights that rail transport operators considering changes involving the integration of complex systems should utilise a systems engineering approach to identify hazards and then manage risk to ensure that the railway's operations remain safe," Mr Mitchell concluded.
You can find here the report: RO-2018-018: Runaway and derailment of loaded ore train M02712 Near the 211 km mark south of Port Hedland, Western Australia, on 5 November 2018
Last update 17 March 2022
