What happened At about 1654 on 15 January 2014, a Sydney Trains service made up of two four-carriage Tangara electric multiple units, entered the underground section of the Eastern Suburbs Line under Sydney city centre heading towards its destination, Bondi Junction. Some smoke and a burning smell were apparent emanating from the train at Central station and at all subsequent stations to Bondi Junction. A number of station and train crewing staff were aware of this but the condition was not reported to the appropriate network control officer as required under Sydney Trains’ Network Rules and Procedures. The train terminated at Bondi Junction where a different driver took control of the train before it departed on its return journey. It then travelled to the next station, Edgecliff. Shortly after departure from Edgecliff, at 1726, the lead bogie of the third carriage derailed due to a broken axle on the leading bogie of the third carriage. A piece of angle iron that became dislodged from the track infrastructure penetrated the floor of the third carriage and entered a space occupied by passengers. Source: Office of Transport Safety Investigations (OTSI) What the ATSB found The ATSB found that an unauthorised, non-standard repair had been carried out on the axle in December 1998 or January 1999 which introduced stress initiators, causing a crack to develop which over time propagated to the extent that the axle failed in service. It was also determined that a number of organisational factors contributed to the incident with examples of poor communication and lack of adherence to procedures and reporting lines leading to the train continuing in service and subsequently derailing. What has been done as a result Sydney Trains and their maintenance contractors undertook an archival document search and determined that seven axles, including the failed axle, had been repaired in the same way. All were immediately removed from service. Sydney Trains, after conducting its own investigation into the circumstances surrounding the incident, produced a number of safety recommendations which the organisation is considering through its own Safety Action Management procedures. Safety message Rail operators should ensure that maintenance procedures are followed and that non-standard repairs comply strictly with an approved variation and do not introduce new risks to operations. Also, rail operators should review their internal training and communication pathways both within and between business units / operational areas to ensure that critical communication can occur in line with best current Rail Resource Management principle.

The occurrence

Events prior to derailment Background Passenger service 602M consisted of two 4-carriage electric multiple unit Tangara sets, T10 and T35, coupled together to form an 8-carriage train. Carriage N5222 of T10 had the bogie with the incident axle fitted as part of routine maintenance in January 2012. The drive axle concerned had previously been inspected in September 2011 when it was found necessary to replace the crown wheel as it was cracked. No other defects had been identified during visual inspection or non-destructive testing of the axle. No faults had been reported in relation to this axle or the bogie prior to the day of the incident. Service 602L In the afternoon of 15 January 2014 sets T10 and T35 formed a train, designated run 602L, operating between Cronulla in Sydney’s south-east and Bondi Junction in Sydney’s eastern suburbs (Figure 1). The train departed from Cronulla at 1604:50 EDT, [1] (approximately two minutes late, when compared to the timetable). It was driven by a trainee driver under the supervision of a driver trainer. The journey was initially overground through Sydney suburbia on the Cronulla branch line before joining the Illawarra line at Sutherland. Between Sutherland and the next station, Jannali, the wheel slip light (WSL) illuminated for four seconds during braking. For the rest of the journey, according to analysis of the data logger download, the WSL illuminated 20 more times at irregular intervals before arrival at Redfern station. Source: Sydney Trains The train crew members present in the cab, including another driver who had joined the train at Mortdale, reported that they did not observe these illuminations. No illuminations were recorded between Redfern and Central stations where the trainee and driver trainer alighted and the other driver took over driving duties. At Central, a train crew shift manager (TCSM) on duty on platform number 24, an underground platform, noticed a burning smell and smoke towards the rear of the train. The TCSM hurried towards the rear of the train and looked inside and around the last carriage. He was joined by another TCSM. A customer service attendant (CSA) was waiting to raise a white flag to signal a right of way for the guard to commence the closing of doors and departure sequence. The guard was travelling in the leading end of the fifth carriage, as is normal for that class of train. The TCSM reported the smoke and odour by phone to the train crewing liaison officer (TCLO) located within the Rail Management Centre (RMC). CCTV images show the first TCSM talking on his mobile phone during the latter part of the inspection. Having completed his inspection, the TCSM signalled to the CSA to allow the train to proceed. CCTV images show a smoky haze towards the rear of the train. The haze was not present prior to the train’s arrival. CCTV images show a member of the public, at the Redfern end where the rear of the train had been, sniffing the air and looking up and about apparently for the source of a smell, about a minute after the train departed. The information regarding the smoke and odour was also passed on to a CSA at the next station, Town Hall. At Town Hall, the CSA informed the train’s guard. At interview the guard stated that he could not see or smell anything and there was no noise or any other indication that there was a problem with the train. The train continued towards Martin Place. A little over half way between Town Hall and Martin Place the WSL illuminated for four seconds while the train was coasting. The driver reported that he was unaware of this. The train stopped at Martin Place, passengers got on and off as usual and the train departed. The burning smell rose to the concourse level where the Martin Place duty manager (DM) was located. The smell was of an intensity and nature that prompted the DM to call the Sydney Trains Emergency Response Unit (STERU). He requested that the unit attend, in case there was a fire on the station premises. The DM identified the burning smell as being similar to tyres burning. En route to Kings Cross, the guard called the driver to inform him of the report of smoke and a burning smell, as relayed to him by the CSA at Town Hall. The guard commented that he hadn’t smelt anything and, in his position in the front of the train, neither had the driver. However, while they were having this conversation, the driver noticed a fault indication on his Train Management System (TMS) screen which indicated that there was a fault on the sixth position carriage. The driver asked the guard to check the train at the next station, Kings Cross. Between Martin Place and Kings Cross, a journey that took a second less than two minutes, the WSL came on seven times, including once for five seconds about 30 seconds before Kings Cross. On arrival at Kings Cross the guard and a staff member who was on the platform inspected the suspect carriage from the platform and internally before the train continued. The guard called the driver again and confirmed that beyond ‘a bit of a smell’ he could discern nothing wrong. After departing Kings Cross, the driver called the fleet operations controller, located within the RMC, and reported the sequence of events since Central. He stated that he had a repeated indication of a wheel slip protection (WSP) brake fault on carriage N5222 and that the WSL was flickering. As the train arrived at Edgecliff, at 1724:45 CCTV images show sparks emitting from the trailing bogie of the sixth carriage. At about the same time, a train heading in the other direction reported to Network Control that there was a smouldering wooden half sleeper on the viaduct between Edgecliff and Kings Cross. Edgecliff did not have platform staff and neither the guard nor the driver (who stepped out of his cab to look along the train) noticed anything unusual. The train then continued to the line’s terminus, Bondi Junction. En route, the driver asked the guard to tell the incoming driver at Bondi Junction of the issues with the train. This was necessary because, at Bondi Junction, the incoming driver was stationed at the opposite end of the train to the outgoing driver. Between Kings Cross and Bondi Junction, the WSL came on 14 times. As Run 602L travelled between Central and Bondi Junction a number of conversations about the train took place variously between station staff, train crewing staff, train crew and various positions within Sydney Trains’ RMC. However, no formal incident or condition report was made in conformance with Sydney Trains’ rules and procedures and no one person was aware of all the facts. Turnaround at Bondi Junction On arrival at Bondi Junction another driver trainer and a trainee were waiting to take over control of the train. They walked to the Sydney end of platform 1 as the train arrived. Once the train was stationary, the original driver made an emergency brake application (normal procedure), applied the parking brake and cut out his controls. He then left his cab and, noticing that there was ‘quite a plume of smoke’, walked briskly to the centre of the train. On the way, he spoke to a TCSM (one of two on duty at the time) who went to fetch the second TCSM who was an ex-Operations Standards Manager [2] who had driving and fault-finding experience. The driver trainer had also observed that there was an issue and, leaving the trainee driver in the cab, walked back to the centre of the train from the Sydney end. The original driver reported that he voiced his concerns to the driver trainer; however, the driver trainer (at interview) said he did not recall this. The driver trainer did recall that the smell was ‘between brake pads and oil’ and because of this he had considered the possibility of there being a problem with an air compressor. The original driver also spoke further to both of the TCSMs and inspected the suspect area of the train from the platform with the second TCSM. The second TCSM was also talking on his mobile phone to the TCLO in the RMC. The original driver commented, ‘there was a lot going on’. It was apparent to him that a decision had been made for the train to continue in service. Meanwhile, as requested by the original driver, the guard passed on the message about the issues with the train. However, as the driver trainer was on the platform, the message was received by the trainee who was then in the cab on his own. Under the instruction of the driver trainer the trainee had cut in his controls and the brake pipe recharged (that is, built up air pressure). He was then instructed by the driver trainer to make an emergency brake application. This reduced the brake pipe pressure to zero once more. This is the procedure commonly applied when sticking brakes are suspected. A CSA on the platform had noticed an unusual vibration and heavy smoke coming from carriage N5222 on its arrival. The CSA became increasingly concerned about the amount of smoke present and the burning smell and made an emergency ‘fire fire fire’ broadcast on his hand held radio to alert other station staff. The DM called the Security Control Centre (SCC) within the RMC to request the attendance of STERU and NSW Fire and Rescue. STERU, who were still proceeding to Martin Place, were asked to respond (that is, travel with lights and sirens on) to Bondi Junction. NSW Fire and Rescue were also requested to attend by the SCC. An intending wheelchair passenger and attendant were present on the platform but the CSA declined to allow them to board, advising them to proceed to the other platform, platform 2, as he did not expect the train on platform 1, now designated 602M, to depart. Station staff state that the driver was notified that emergency services were en route but the driver cannot recall this. Train crewing staff assumed that the issue was caused by sticking brakes and decided to allow the train to continue in service to Central where a train technician would be available to inspect it. Since the train was now travelling in the opposite direction, the incident carriage was the third carriage of the new run. The trainee driver was in control of the train and, with the driver trainer supervising and the second TCSM in the third carriage, 602M departed from Bondi Junction back towards Sydney CBD. Service 602M Incident train 602M was overdue for departure from Bondi Junction. The driver trainer who had met the train at Bondi Junction and was now in charge of it had, in consultation with the second TCSM and through him to the TCLO in RMC, decided to proceed. 602M departed at 1721. The TCSM rode in the train to listen for any abnormal sounds, especially in the suspect carriage. The train departed, and STERU (now an estimated two or three minutes away from Bondi Junction) and NSW Fire and Rescue were stood down. STERU was asked to proceed to Central where, along with a train technician, they would inspect the train. Between Bondi Junction and Edgecliff the TCSM did not detect any abnormalities from within the passenger areas of the train other than a sound indicating a possible wheel flat, usually caused by a wheel locking up under braking, which is very rare in a Tangara. At interview, both the driver trainer and trainee stated that they received no WSL indications. However, the data logger recorded a two second pulse about 30 seconds after departure and multiple pulses over 11 seconds about 30 seconds before arrival at Edgecliff. En route and in between these wheel slip events, the crew switched the train’s brakes from the usual electro-pneumatic (EP) mode to the stand-by automatic mode and made two brake applications before returning the brake setting to EP. This was intended to assist in clearing any sticking brakes on the train. On arrival at Edgecliff a CSA was present on the platform in anticipation of the alighting wheelchair passenger (who was not on the train). When the train pulled in the CSA ‘…saw a lot of smoke’ and noted a burning smell emanating from the train. He spoke to the guard about his concerns for the train. He also communicated his concerns to the DM who could smell the train from the concourse level and he supported the CSA’s advice that the train should not proceed. The guard, who was speaking on his personal mobile telephone, acknowledged the CSA’s comments but took no further action. Meanwhile, the TCSM made his way back to the driver’s cab. The train departed from Edgecliff at 1726. The derailment As Run 602M departed from platform 1 of Edgecliff Station one wheel of the leading axle of the third carriage, N5222, derailed just beyond the end of the platform. The right hand wheel (in the direction of travel) of the leading axle of the first bogie had slipped into the space between the two rails at 4.668 km. The wheel continued in a derailed state for 17 m where it collided with a concrete slab used to allow road / rail maintenance vehicles to be put on or taken off track. This is evidenced by the damage apparent to the concrete. Lengths of ‘angle iron’, pieces of steel formed into a right angle section, were fitted to protect the edge of the slab. The first one began a short distance after the start of the slab. This piece was dislodged by the wheel and remained in the flange way between the slab and the rail (Figure 2). Source: OTSI The second piece of angle iron was also dislodged and was picked up by the derailed train. Approximately 25 m beyond the slab there was a set of points which allowed trains that had terminated on the other platform to return towards Central and join the track that 602M was travelling on. The derailed wheel interacted with this set of points such that the other wheel on the axle and both wheels on the bogie’s other axle also derailed towards the outside of the rail corridor (that is, towards the left in direction of travel). The driver trainer, standing behind the trainee, observed the WSL come on and felt the train markedly decelerate. He reached over the trainee and applied the brakes to bring the train to a stand. One end of the piece of angle iron, that had been removed from the concrete pad and caught under the train, fouled on a piece of infrastructure causing the other end to wrap around the second axle on the bogie. It bent upwards, penetrating the vestibule floor and entering the passenger space. The angle iron continued upwards, missing passengers in the area, before marking the carriage’s ceiling. The angle iron fell back slightly from this position, remaining stuck through the floor with its end above head height (Figure 3).The train came to a stand after travelling a little over 200 m with the lead bogie of the third carriage derailed. Source: OTSI The driver trainer immediately directed (using hand signals) the driver of Run 603L, which was approaching from the opposite direction, to stop. He then initiated an emergency call using the train radio. The call was automatically directed to the controlling signaller (located within Sydney Signal Box) but it failed to connect. After a 30 second time-out, the call was transferred to the Illawarra train controller. After a further 16 seconds, the Illawarra train controller (TC) answered the call. The driver trainer reported ‘…I’m not too sure if I’ve got a locked axle or not.’ He then went on to say that he had a faulty parking brake indication on carriage N5222. (Note: At interview the TC stated that he did not hear the reference to a possible locked axle). The conversation then focused on a likely parking brake failure and the TC asked if the driver could release it before trying to proceed. The signaller called RMC during the above conversation and the call was answered by the TC’s supervisor. A discussion took place about how to manage rail traffic on the Eastern Suburbs Railway (ESR). Meanwhile, in parallel, the TCSM who was now in the cab was also talking to the TCLO on his mobile phone about the train’s issues. Second movement The driver trainer built up air but the parking brake fault indication remained. The driver trainer looked out along the side of the train but could see nothing untoward. He remained unaware of the train’s derailed state. The driver trainer intended to take the train to the next station, Kings Cross. He used a partial throttle setting (second notch of four) and reached a maximum speed of 17 km/h. The WSL came on along with a fault indication on the TMS screen, so the driver brought the train to a stand again. During this movement, or immediately after, passengers knocked on the driver’s compartment door to alert him to a problem. Passengers also pressed the emergency communication buttons but these were not responded to by the train crew. The train had travelled approximately 120 m in 41 seconds with one bogie in a derailed state (Figure 4). The driver trainer was now aware that the train had derailed and informed the signaller of this via another emergency train radio call. The signaller immediately set the appropriate signals to stop to protect the area of the derailed train before informing the TC. At the same time, the TCSM informed the TCLO of the derailment who then also informed the TC. The driver of the other train, stationary on the down track, noticed that 602M was derailed as the derailed carriage moved towards and past his location. Source: OTSI Passengers There were an estimated 700 passengers on board 602M. Some were standing in the vestibule area at the front of carriage N5222 during the incident, close to where the angle iron penetrated the passenger space. Some passengers pressed the emergency communication button and / or ran through the train to knock on the drivers’ compartment door to alert the crew after the train moved off again. One female passenger was reported to have been about 0.5 m from the location where the angle iron penetrated the floor with its end rising to the roof. She suffered shock from the incident and was assessed on site by ambulance officers. Otherwise, no injuries were reported. Post incident Incident notification The RMC shift manager attempted to contact the Sydney Trains on-call officer a number of times, but the calls went unanswered. The Sydney Trains on-call officer duties included notifying the Australian Transport Safety Bureau (ATSB) of the incident. However, through social media and news media reports the state-based Office of Transport Safety Investigations (OTSI) and NSW personnel of the Office of the National Rail Safety Regulator (ONRSR) became aware of the incident. Two OTSI investigators deployed to the incident location on behalf of the ATSB, arriving at about 1900. ONRSR representatives attended also. Emergency response coordination The STERU unit that had arrived at Central to meet 602M was now requested to respond to its derailment at Edgecliff. The unit arrived between 1740 and 1745. Units of NSW Fire and Rescue, Ambulance and Police also attended as did a second STERU vehicle, arriving at 1800. As well as STERU, the Sydney Trains Incident Emergency Response Unit included Incident Rail Commanders (IRC). However, IRCs were operationally under the direction of the RMC Shift Manager (RMC SM). There was only one IRC on duty in the Sydney metropolitan area at the time of the incident and he had been deployed to an infrastructure failure at Glenfield Junction, about 43 km from the derailment site. The failure had been rectified shortly before the derailment and so, when the IRC was notified at 1735, he was able to set off immediately to attend the site. However, unlike STERU, the IRC did not have an emergency response vehicle and therefore he had to travel through the evening peak period traffic obeying the road rules. The IRC arrived at the site at 1845, after 602M had been evacuated. The IRC then assumed control and coordination of the site for Sydney Trains. An off-duty IRC who was in Sutherland, about 30 km from the derailment site was also contacted to attend the derailment site, arriving about 20 minutes after the first. While the IRCs were en route, the TCLO continued to direct the actions of the TCSM while the RMC SM decided, in the absence of an IRC, to use the guards of the two trains 602M and 603L as site contacts. On arrival, the officer in charge of the STERU unit (who reported to the SCC manager in the RMC) coordinated with the emergency services and other Sydney Trains employees on site: the guards, drivers, another driver who had been travelling as a passenger on 602M and the TCLO. In the absence of an IRC, procedures indicate that an Officer in Charge (OIC) is appointed, by default, on site. However, until the IRC arrived, no individual person on site co-ordinated Sydney Trains activities. The station staff at Edgecliff could see Run 602M just outside the station but were unaware of the fact that it had derailed. The duty manager received a call from Electrical Control who asked if the electrical overhead wires were down but the DM asserted that there was no such incident. An intending passenger, who had been hoping to catch a later train, told him that a relative on the train had called her by mobile phone and said that it had derailed. Emergency services started to arrive and told staff at Edgecliff Station that the train had derailed. The train information boards (controlled from the RMC) still showed train destinations and no advice was received from Sydney Trains operations staff at the RMC about the incident. However, on realisation that an incident had taken place the DM and his staff took action to stop selling tickets, prevent members of the public from entering the station and made suitable announcements giving information to people waiting on the platforms. Passenger evacuation In the absence of an IRC, train crewing employees on site prepared to evacuate the passengers on-board 602M. Two possibilities were considered: moving all the passengers into the rear portion of 602M and returning to Edgecliff or transferring the passengers to 603L, stationary on the adjacent line, via the guards’ compartments in the centre of the trains. On the arrival of the IERU at 1740, the team leader took a leadership role in passenger evacuation and emergency service coordination on site. Evacuation ladders, available at intervals beside the track, were fitted to the front and rear of 602M and 603L respectively. The access door on the front of 602M had to be secured in the open position by a rope. This was due to the angle of the carriage which otherwise caused the door to shut under the effect of gravity. Once the ladders were in position and the door secured, the evacuation of passengers from 602M to 603L commenced. By 1830, the evacuation had been completed without incident and the passengers were aboard 603L. This train took them to Edgecliff station. Other trains In addition to 602M, a total of nine other trains approaching the incident site were either alongside platforms or stationary in tunnels immediately after the derailment. These trains were managed such that, if necessary, they were brought at least partially onto platforms so that passengers could disembark. Once the evacuation of 602M was complete, one of these trains was advanced from Kings Cross to Bondi Junction past the derailment site. Vehicle recovery The pantographs on 602M were lowered to allow the derailed bogie to be rerailed by Sydney Trains’ Emergency Train Rescue Unit and the broken axle was placed on a pony bogie (Figure 5) to support it on the journey to Mortdale Maintenance Centre (MMC). Once rerailing was complete, the pantographs were raised again to allow the train to move under its own power to MMC. The transfer was at a reduced speed, as dictated by the use of a pony bogie. When the train was inspected at MMC on 16 January, it was found that power had not been isolated from the derailed bogie during the train’s transfer to MMC resulting in multiple TMS fault codes being generated. This caused the TMS, which has limited memory, to over-write the incident fault codes. This meant that only the data logger, which does not record the same operational parameters, was available for analysis. The incident bogie was removed from carriage N5222 and transported by road to UGL-Unipart’s facility at Maintrain, Auburn. The train itself was later transferred by rail to Maintrain for further examination and repair. Post incident crew management The crew were breath tested at the train by the NSW Police and then, once they had been relieved by another crew, made their way to Edgecliff Station. There was some discussion about whether drug testing was to be conducted at Edgecliff or Central stations. The guard departed for Central and could not be contacted subsequently. Shortly after 2000, the others (the driver trainer, the trainee driver and the TCSM) were tested for the presence of drugs at Edgecliff station by Sydney Trains’ contractors. The drivers and the TCSM left the site and were transported to MMC. At MMC they were interviewed by Sydney Trains (train crewing) management, eventually departing for home at about 0100 on 16 January. Infrastructure repairs Repairs to infrastructure, sufficient to allow trains to run, were completed overnight and the line was reopened at 0436 in time for the next day’s timetabled services. However, the crossover was booked out of use pending later replacement of damaged components. The main route was available for use, allowing train services to recommence. __________

Context

Location The derailment of 602M occurred on the Up Eastern Suburbs Railway Line as it was departing Edgecliff Station which was located approximately 4.8 km by rail from Central Station, Sydney (Figure 6). Source: Geoscience Australia with annotation by OTSI Eastern Suburbs Railway (ESR) The Eastern Suburbs Railway (ESR) was opened in 1979 and connected the Illawarra line near Erskineville, about 2.75 km south of Central, to Bondi Junction, 6.8 km by rail from Central (Figure 7) a total of 9.55 km. The first 5.4 km including Redfern, Central, Town Hall and Martin Place stations, was constructed in underground tunnels. To the east of Martin Place, the line emerged and passed onto Woolloomooloo viaduct before again going underground to Kings Cross Station. The track then emerged onto another viaduct, Rushcutters Bay viaduct, before entering a tunnel once more on approach to Edgecliff. The rest of the track to Bondi Junction was also underground with the exception of a short stretch at the unused station of Woollahra. Figure 7: Eastern Suburbs Rail line diagram Source: OTSI Edgecliff Edgecliff was located about 2 km east of Sydney city centre, just under 5 km by rail from Central Station and less than 2 km from Bondi Junction. As the ESR left Edgecliff, heading towards Kings Cross, it curved to the right and exited an underground or covered section. After the line transited from under to above ground, just before Glenmore Road, it passed onto an overhead structure, Rushcutters Bay viaduct. The ESR then ran straight for about 100 m, before, still on the viaduct, curving to the left in the direction of King Cross (Figure 8). Source: Google Maps with annotations by OTSI Organisation Sydney Trains started operating on 1 July 2013, taking over the operation of Sydney’s metropolitan rail network from RailCorp. RailCorp in turn had taken over from the State Rail Authority (SRA). All three were NSW government owned entities. Sydney Trains were a vertically integrated railway responsible for all aspects of Sydney Trains and NSW TrainLink rolling stock maintenance and for station staff, passenger information, train signalling, operations, infrastructure maintenance and incident management on the Metropolitan Rail Area (MRA) network. The incident occurred on the MRA network. Sydney Trains largely kept the same operational structure that existed in RailCorp and there were no significant changes in the various roles in stations or the RMC. Similarly, the RailCorp Emergency Response Unit became the STERU and the old Network Operations Superintendent’s (NOS’) incident response responsibilities were taken over by the Incident Rail Commander (IRC). There were a total of 17 IRC’s available, in contrast to 46 suitably qualified personnel under the previous structure. However, there was a change in the way drivers were supervised. The position of Operations Standards Manager (OSM), qualified ex-drivers who provided supervision, guidance and support to drivers, was abolished. The role of Train Crewing Shift Manager (TCSM) was substituted. This role required no rail qualification or experience and provided personnel management and supervisory functions only. TCSMs were recruited from the ranks of the OSMs, from other RailCorp positions and from outside the rail industry. The TCSM who initially became aware of the problem at Central was an ex OSM as was the TCSM at Bondi Junction who was asked by his supervisor, the TCLO located in the RMC, to intervene. While it is clear that both these TCSMs were acting outside their new Sydney Trains defined roles, as ex OSMs, both possessed current technical competencies. The Central TCSM who looked at the train at Central reported the matter to the TCLO. If a TCSM who was not an ex OSM had been on duty the TCLO could have asked for the train to be held while a train technician came down from ground level. However, the TCLO stated at interview, ‘burning smell…often brakes are hot at Central as it’s all downhill from Redfern.’ He did not regard it as unusual or noteworthy. It seems likely that he would not have held the train even if a TCSM who had not been an ex OSM had been the reporter. The TCSM at Bondi Junction was asked to get involved by the TCLO. The TCLO knew that he was another ex OSM. While the TCSM was acting outside the role parameters he was not acting outside his area of competency. The TCLO’s own role had not changed. However, his direct reports in the field had changed from OSMs to TCSMs with the accompanying change in roles. He chose to use the ex OSM TCSMs in their old OSM role for expediency. The TCLO was seated in close proximity to the relevant train controller and overheard him talking to the shift supervisor about reports of smoke at a subsequent station. He checked and ascertained that these reports coincided with the passage of Run 602L. However, because the report from Martin Place was of a smell like burning tyres he did not intervene to pass on information about Run 602L. The TCLO could have passed information about the train on to RMC operational staff but did not. Infrastructure Track Unlike conventional track, at the point of derailment, the rails were secured to polymer concrete half sleepers which were in turn fixed to and supported by concrete slabs (Figure 9). In the Sydney Trains’ network, using either concrete or wooden half sleepers, is peculiar to parts of the ESR and Sydney underground railway. At Edgecliff, the Up ESR ran alongside platform 1 of Edgecliff station and curved to the right. After a transition, the curve was constant at a radius of 402 m and a superelevation of 65 mm. At the derailment site there was a known wide gauge of 27.5 mm. That is, the distance between the rails was 1462.5 mm rather than the standard gauge of 1435 mm. No other defects were noted. About 35 m beyond the platform there was a concrete pad to allow road / rail maintenance vehicles to be placed on or removed from track. For some of its 22 m length, the pad had lengths of steel angle section affixed to its edge, parallel to the rail, to protect the concrete. The section was manufactured from steel 6 mm x 55 mm. The length that 602M picked up was 8.3 m long. A further 25 m after the pad, the Up ESR was joined by a crossover from the Down ESR provided to allow trains to terminate and turn back from platform 2. The points (905 points) where the crossover joined the Up ESR were trailing points, that is they allowed two routes to merge into one towards Kings Cross station. At this point the ESR emerged from the underground section and transitioned onto Rushcutters Bay viaduct. Overhead traction system The ESR was provided with structures supporting overhead wiring which was supplied with electricity at 1500 V DC to power trains. This was fed to trains via contact wires and pantographs located on the roofs of the end carriages of each four carriage set. During the derailment, the trailer carriages (on which the pantographs were mounted) were not affected and there was no damage to the overhead wiring or supporting structures. The power remained on which provided continuous air conditioning within the train. Site observations OTSI Investigators deployed to the site after the incident, arriving at about 1900: all passengers had been evacuated by this time. It was found that the train had travelled a total of 385 m from its stationary position alongside Edgecliff station. The front bogie of the third carriage in the direction of travel had derailed towards the cess. On entering the train, a length of right angle sectioned steel (angle iron) was found to have penetrated the floor of the vestibule above the derailed bogie. It entered the passenger area to the extent that it marked the roof of the inside of the carriage before falling back a little with its leading edge remaining above eye level within the carriage. There was some damage to the bodywork of the third carriage (Figure 10) and line-side infrastructure consistent with the leading end of the third carriage travelling in a derailed state. The wheels of the derailed bogie were suspended above the rail infrastructure with the weight of the carriage being borne by the traction motor resting on the Up rail. Source: OTSI There were numerous and extensive areas of damage on No. 8 wheel consistent with skidding of the wheel (Figure 11). Also, some skidding on No. 8 wheel was offset, indicating that it had not been tracking normally on the rail head when the damage occurred. While the No. 7 wheel displayed some damage, including damage consistent with a derailment, the damage did not correspond in location or severity with damage evident on the other wheel. Source: OTSI Other damage of note was to pipe-work and a pressure gauge associated with the N5222’s parking brake. The first evidence of derailment was found at 4.668 km, 17 m after the end of the platform corresponding with a 27.5 mm wide track gauge. Marking on the gauge face of the rail indicated that No. 7 wheel had slipped off the Down (right hand) rail and into the four foot between the rails (Figure 12). Source: OTSI The No. 8 wheel, at the other end of the axle, remained on the Up (left hand) rail. There was further evidence of wheel No. 7 running in a derailed state in the four-foot until the concrete pad was reached. The concrete pad was significantly marked by the passage of the derailed wheel and a protecting angle iron had been broken away from the concrete and pushed towards the rail while a second piece of angle iron had been carried away. Further on at the trailing points, more significant damage was observed with further witness marks indicating that the bogie had derailed its other three wheels as it traversed this piece of infrastructure. Rolling stock The Tangaras were ordered from Goninan’s in 1986 and entered service between 1988 and 1995. The end carriages (control trailer carriages) of each 4-carriage unit were equipped with driver compartments and had pantographs to take power from the overhead wire to supply traction motors located in the bogies of the middle two carriages (the motor carriages). The control trailer carriages had a mass (TARE) of 42.3 t with a combined seating and standing capacity of 246 passengers. The motor carriages had a mass of 40.1 t and a combined seating and standing capacity of 276. An 8-carriage train, made up of four motor carriages and four control trailer carriages, therefore had a designed total passenger capacity of 2088 passengers. A total of 185 motor cars were built by Goninan’s, plus a further 40 outer suburban Tangaras with the same axle design. This represents a total of 900 drive axles (plus spares). Both axles on power carriages were driven through an oil bath gear box mounted on the axle. The axles had an infinite design life, that is they were expected to remain in service indefinitely without a need to replace them after a time or distance limit. Wheel slip/slide protection Tangaras were fitted with a pneumatic disc braking system. In normal operation they worked in an electro-pneumatic mode. Compressed air was fed to reservoirs located on each carriage which, through an electrically controlled valve, provided air as demanded by the driver’s brake control, to brake cylinders forcing brake pads onto the brake discs. The brakes could also be used in automatic mode. This was a purely pneumatic system using air controlled valves to regulate braking. The latter system provided effective braking but required a different driving technique. There was also a spring actuated parking (or spring) brake. A spring in this brake forced the brake on if there was no air pressure in the braking system. When a train was in service, the driver could release the parking brake by allowing compressed air to enter the parking brake’s cylinder which overcame the pressure exerted by the spring thereby releasing the brakes. To prevent wheel lock up under braking and resultant loss of braking efficiency and damage (flat spots) to wheel treads, an electronically controlled WSP system monitored all axles adjusting braking effort as required to maximise braking effort while preventing wheels from locking up and sliding along the rail head. Conversely, through the same monitoring function, the system controlled traction power to prevent wheel slip and to maximise acceleration. An indicator light was provided on the driver’s dashboard which illuminated when the wheel slip/slide protection was operating (Figure 13). It was a common occurrence for the light to flash, especially during braking or power application on wet or greasy rails as traction was momentarily lost on one or more axles. However, if the light stayed illuminated for longer periods, or stayed on permanently, then the driver was required to report the occurrence and take steps to determine the cause. Source: OTSI As axles were of a solid construction, there was only one monitoring device per axle. In the unlikely event of an axle breaking, as occurred on run 602, the monitor would only react to one portion of the axle. Even if the other half was seized, the system would not create a fault or alarm. In the case of Run 602, the portion of the axle which was driven and turning more freely had the monitor positioned on it, reducing the frequency and period of warning indications. Train Management System Tangara rolling stock was also equipped with a Train Management System (TMS) which recorded defects and provided the driver with an in-cab display. The driver who was in charge of the train from Central to Bondi Junction, when the wheel slip / slide protection light illuminated multiple times, noted that the TMS showed a brake fault on the sixth carriage in direction of travel (N5222). If the driver acknowledged the fault displayed in the TMS, as seems likely, then the fault would not appear on the display in the other cab. The next driver would only have been able to access this information by interrogating the TMS. The next driver was not required by the procedures to do so. A TMS download, when performed by maintenance staff, yielded the last 100 faults. The system continually overwrote itself once 100 faults were reached with only the most recent 100 being available. The power was not removed from the traction motors of the incident bogie during recovery operations to Mortdale Maintenance Centre when the broken axle was supported by a pony bogie. The TMS continued recording faults, exceeding its capacity and overwriting the incident data which was therefore lost to the safety investigation. Data logger The train was fitted with a data logger. This device recorded certain parameters such as speed, brake and power applications and WSL activations. However, unlike the TMS, it only recorded WSL activations for the train as a whole and provided no information on which carriage the WSL activated. The data logger was successfully downloaded and the information analysed as part of the safety investigation. The analysis identified that the axle most likely failed between Sutherland and Jannali where the wheel slip indication light activations began to occur. Bogie The bogie, MKA0379, was a two-axle rigid framed bogie with traction motors mounted in the frame (Figure 14). This bogie arrangement has been used on electric passenger trains in NSW since 1972. Source: Sydney Trains Metallurgical investigation Following the accident, bogie MKA0379 was removed from N5222 and was transported to UGL Unipart’s maintenance facility at Maintrain, Auburn. There the bogie was examined and it was noted that the gearbox casing attached to axle 881228 exhibited evidence of overheating (Figure 15). Source: OTSI The axle, with gearbox, was removed and stripped down under the supervision of OTSI investigators. The axle was found to have broken within the gearbox between an oil flinger and a bearing (Figure 16). Source: Sydney Trains Sections from either side of the defect were cut out of the axle and transported to the ATSB’s laboratories in Canberra for detailed analysis. Due to their relative differential rotational speeds as they rotated against each other after the axle broke, much of the evidence of the defect initiation on the axle fracture surfaces had been destroyed. However, it was determined that a stress fracture had developed over time (see Appendix A: Technical examination of a fractured rail axle from passenger train 602M). Of particular note was the discovery of a laminated layer on the axle’s surface with machining marks visible beneath (Figure 17). Source: ATSB It was determined that a metal spraying process had been used to repair the axle and that this rendered the axle susceptible to the initiation of fatigue cracking. Axle, axle maintenance, inspections and tests The incident axle was a motor carriage driven axle. That is, it was an axle fitted through a gearbox that transferred the drive from an electric motor to the driving wheels. It was manufactured in 1988 and went into service in July of that year. The axle’s last overhaul was performed between 6 September 2011 and 12 March 2012. Ultrasonic Testing (UT) was performed with the low speed gear wheel in place. On this occasion, a defect (crack) was discovered in the gear and the oil flingers, bearings and gear were pressed off. The axle passed various dimensional and surface finish checks and magnetic particle inspection. It was then reassembled with a new gear and low speed gear box bearings. Including this occasion, the axle had been overhauled a total of eight times during its service life. In 1998, during a routine overhaul, it was discovered that damage had been sustained to the surfaces on the axle that accepted the interference fit low speed bearings and oil flingers that were located on either side of the crown wheel. These low speed bearings supported the gearbox on the axle. On inspection, it was determined that the axle could be repaired. Repair methods During the routine overhaul of axles, it was sometimes found that the axle surface at the axle ends, where the bogie axle box bearings were pressed on, were undersize. This was due to the repeated pushing on and off of the bearings removing material and so compromising the interference fit of the bearings to the axle. It was an approved repair to build up the surface using Electro Chemical Metal Deposition (ECMD). The ECMD method is an electrolytic process where new material is deposited onto the cleaned parent metal. ECMD was not generally viable if the deposition required exceeded a depth of 0.25 mm. In the case of axle 881228 (and any others which were subsequently repaired using metal spraying), a grooved defect was likely to have been present which exceeded 0.25 mm. Thermal Metal Spraying therefore became an option as it is suitable for greater cover thicknesses. Thermal Metal Spraying requires machining of the parent metal on a lathe such that a depth of at least 0.5 mm new material can be achieved. The machining produces a grooved surface with a pitch of between 0.25 mm and 0.35 mm and a depth of 0.5 mm. The job is then pre-heated to between 100°C and 140°C and a bonding coat (depth 0.1 to 0.15 mm) of nickel/molybdenum/aluminium alloy is applied. This is closely followed by the application of 420 grade stainless steel. Application is by using twin electric arcs to heat the wire fed material such that it can be sprayed onto the surface to be repaired (Figure 18). Build up and adhesion of the material is a mechanical rather than fusion process: the material is not heated to a molten state but, being both heated and given velocity, has the malleability and kinetic energy to flatten as it hits the repair, joining with and building up the surface progressively as the job is rotated, at approximately 80 RPM on the lathe. Once material has been built up to a depth such that the diameter is 2 mm oversize, it is ground to produce the final surface finish and specified dimension. Source: A1 Metallising Services Pty Ltd Authorisation There was no standard repair method for this location on these axles. Authorisation for a non-standard ECMD repair was provided for by raising an Application for Deviation from Specification form (the deviation). This form, dated December 1998, was signed by the requesting engineer at Maintrain (UGL Unipart’s predecessor organisation) and approved by the State Rail Authority (SRA), a predecessor organisation to Sydney Trains. The deviation was marked as ‘Applies Indefinitely’, that is, it gave ongoing approval for further axles to be reclaimed in a like way. However, the contractor, A1 Metallising Services Pty Ltd (A1 Metallising), determined that a repair could not be carried out using an ECMD technique as specified in the deviation. A1 Metallising reported this was probably due to the depth of the defect. A1 Metallising quoted to repair the axle, and another one with similar damage, using a thermal metal spraying technique. No evidence was available as to how, or if, this change was approved by Maintrain. However, A1 Metallising stated that any job would always require a written quote to be accepted by the customer before they would proceed. The final invoice, issued on 31 January 1999, identified that the axles had had the following work: ‘metallise and grind on 2 positions each (that is, on both low speed bearing / oil thrower positions, one on each side of the crown wheel)’. The invoice was therefore non-specific and did not identify the actual process applied. Other axles It was found, through A1 Metallising’s archive search, that a total of 7 axles were recorded as having had a metal spray repair, including axle 881228. Two had been scrapped or were in the process of being scrapped while 4 were examined for defects. No further defective axles were identified. All these axles were quarantined to ensure that they were not returned to service after the incident and will be scrapped. Operational staff All operational staff involved in the incident were employed by Sydney Trains. A number of operational employees had a significant part in the build up to the incident, the incident and/or the response to it. Train drivers, including trainee and driver trainers Five driving staff were directly involved with Run 602 during the incident sequence, plus a driver who was travelling as a passenger on the train and who assisted post incident. The train was under the control of a trainee supervised by a driver trainer at the likely time of the axle breaking. Neither of them, nor the other driver travelling as a passenger, were aware of anything amiss nor did they observe any WSP indications en route to Central station. From Central to Bondi Junction, a single driver was in the cab. He became aware of the issues with the train when informed by the guard, between Martin Place and Kings Cross, of the reports of an odour and smoke coupled with WSP indications and a TMS fault. The driver reported this to the TCLO and requested that ‘someone check it at Bondi or somewhere’. He also instructed the guard to pass on a message regarding the train’s condition to the new driver at Bondi Junction. On arrival at Bondi Junction, the guard passed on the message to the trainee driver while the driver spoke directly to the new driver (a driver trainer) on the platform. However, apparently the message was not fully received or heard by the new driver. The driver trainer, in consultation with a TCSM, instructed his trainee to blow down the brakes and decided to continue the train in service. Between Bondi Junction and Edgecliff the driver trainer instructed the trainee to switch from EP to automatic brakes and back again in an attempt to clear an assumed sticking brakes problem. Neither trainer nor trainee noticed anything wrong, nor did they notice any WSP warning light activity. After Edgecliff, when the train derailed, the driver trainer responded by applying emergency brakes. He stopped a train on the other (Down) line, 603L, by using emergency hand signals and then initiated an emergency call to Network Control. After speaking to the train controller, he elected to try to proceed to Kings Cross. When it became apparent that there was a serious problem with the train he immediately stopped the train once more. Train guard The guard of 602M had qualified in September 2013 with 12 months previous experience as a customer service assistant (CSA). The guard was first alerted to a problem with the train by a CSA at Town Hall. He informed the driver of the problem after departure from Martin Place. Under instruction from the driver he had a look at the train at Kings Cross but could find nothing wrong (other than a smell). He passed on a message about the train to the trainee driver at Bondi Junction but took no part in the decision to continue in service. At Edgecliff he was approached by the CSA who expressed his view that the train should not proceed. The guard, who was reportedly talking on his personal mobile phone at the time, did not act on the CSA’s concerns or pass it on to the driver trainer. In the lead-up to the incident, the guard had his work supplied mobile phone switched off, only turning it on after the derailment. After the derailment, the guard contacted the RMC SM to ask if there was anything that the RMC SM wanted him to do. The guard of service 603L that stopped adjacent to the incident train also made contact with the RMC SM by phone and was proactive in planning for the evacuation of 602M to 603L. Train crewing shift managers The Train Crewing Shift Manager (TCSM) is a relatively new position introduced with the inception of Sydney Trains on 1 July 2013. The TCSMs replaced the previous Operations Standards Managers (OSM). While an OSM was required to have had driving experience and to maintain safeworking qualifications, the new TCSM position has been defined more as a personnel management role. There is no requirement for train driving experience or indeed any rail experience at all. The current TCSM personnel were recruited for Sydney Trains and comprises a mix of previously employed OSMs, other ex-RailCorp employees and people recruited from outside the industry. A TCSM, who was an ex-OSM, located at Central was the first employee to notice something amiss with Run 602L. He looked at the rear carriage of the train as it was alongside the platform. He reported the issues of smoke and burning smell to the TCLO and, on the TCLO’s advice, allowed the train to proceed. Two TCSMs were on duty at Bondi Junction. One was relatively inexperienced with no previous rail industry experience while the other had formerly been an OSM. The former had limited input into the discussions and decision making at Bondi Junction but expressed a view, after the derailment, that he was surprised that the train had continued in service. The other, experienced, TCSM had been contacted by the TCLO before 602L arrived and warned that the train might have sticking brakes. When the train did arrive, the TCSM in communication with the TCLO by phone and the driver trainer on the platform proceeded on the assumption that the train did have sticking brakes and volunteered to go with the train to Central. Under instruction from the TCLO he rode in the passenger area to be alert for any tell-tale signs of an issue, especially in carriage N5222. The TCSM did notice what he thought was the sound of a wheel flat spot and reported this to the TCLO. On departure from Edgecliff station the TCSM entered the driver’s compartment. He noticed a parking brake failure warning after the incident and reported this to the TCLO. The TCSM, closely coordinating with the TCLO, took an active part in establishing the state of the derailed train and assisting with the response. Train crewing liaison officer The TCLO received the initial report of a problem with 602L from the TCSM at Central station. He did not notify operational staff within the RMC nor did he notify the responsible fleet operations controller. Hence an opportunity was lost to (i) create an awareness with responsible operations staff to a train with an issue and (ii) to have the train checked by a qualified train technician (present on ground level at Central). The train technicians are under the control of fleet operations controllers. The TCLO was seated in close proximity to the relevant train controller and overheard him talking to the shift supervisor about reports of smoke at a subsequent station. He checked and ascertained that these reports coincided with the passage of Run 602. He did mention this to the TC but, because the report from Martin Place was of a smell like burning tyres, he did not pass on any further information about Run 602. Subsequently, the TCLO alerted the TCSM at Bondi Junctionto the imminent arrival of run 602L and asked for his involvement. During this conversation he introduced the idea to the TCSM that the problem was sticking brakes. The TCSM was known by the TCLO to be experienced in fault finding as an ex driver and OSM although this function was no longer within his remit as the TCSM’s role did not include such operational involvement. The TCLO and the TCSM remained constantly in communication, by mobile phone, for much of the time that the train was alongside the platform. The TCLO’s direction of the TCSM was done without any reference to other RMC staff who had responsibilities in relation to train defect management and operational decisions. The TCLO could have passed further information about the train and/or coordinated with RMC operational staff, but did not. RMC staff The RMC is a purpose built control centre which, in one space, accommodates all Sydney Trains’ train controllers, a shift supervisor, the shift manager (SM), fleet operations controllers (3), the TCLO, security (SCC) staff and passenger information employees. The relevant train controller (TC), TCLO and the fleet operations controller are allsituated in close proximity to one another. Three operations staff in the RMC were directly involved: the TC, the Shift Supervisor and the SM. The Illawarra TC reports, through the shift supervisor, to the SM. Staff were aware of different pieces of information about the train as it travelled to and changed direction at Bondi Junction but none had full information. The SM was unaware of there being an issue until the train was ready to depart from Bondi Junction. He then walked over to speak to the SCC supervisor within RMC and on being updated as to the extent of the problem made the decision, on operational grounds, to terminate the train. This decision came too late to prevent 602M from leaving Bondi Junction. The next station at which it could practicably be terminated (other than in an emergency) was Central, where a train technician was to meet it. After the derailment, the SM was involved with incident response to and on the site, arranging for the IRC to make his way there and, in the IRC’s absence, coordinating on site activities with the train guards. The TC and shift supervisor were closely involved in managing trains on the remaining available network to minimise passenger disruption. The SM assumed a coordination role after the incident, communicating with the guards of the trains (in the absence of an IRC). Station staff A number of station staff were involved. Of particular relevance was the involvement of station staff at Martin Place, Bondi Junction and Edgecliff stations. At Martin Place, the DM was sufficiently concerned by the burning smell that he made a direct request to STERU to attend as he thought, by the nature of the smell, that there could have been something burning on the station premises. The DM did not channel the request through the RMC as required by Sydney Trains Incident Management Framework (IMF). The CSA at Bondi Junction noted the vibration, smell and smoke from Run 602L and immediately informed his superior (the DM) via a hand-held radio. Later the CSA took action to inform all station staff of the emergency via a further radio call. He used the prefix “emergency emergency emergency” to alert staff to the seriousness of the situation. He also took the initiative to prevent a wheelchair passenger from boarding as he expected that the train was not going to depart. The DM was sufficiently alarmed by the quantity of smoke and the smell of burning to request (through the SCC) the attendance of STERU and the emergency services and to prepare for the evacuation of the station and the trains alongside the platforms. When the TCSM then told him that they were going to take the train out, the DM told the TCSM and the driver trainer that the emergency services had been called but train crewing staff made the decision for the train to continue in service. The CSA at Edgecliff, who met the train expecting the wheelchair passenger to disembark, saw the smoke and smelt the odour emanating from the train and went straight to the guard’s compartment. He expressed his concern to the guard along with his opinion that the train should not proceed and informed the DM of the situation by radio. No station staff member at any of the locations reported the issues with the train to the network control staff as required by the IMF. Fleet operations controllers The fleet operations controllers manage the disposition of electric traction rolling-stock across the network and are the contact for drivers for any technical difficulties that arise. The controller who should have received the notification of the problem with run 602 was absent from his desk and the call from the driver of 602L when travelling between Kings Cross and Edgecliff on the outbound leg of the journey was taken by a second controller. This controller acknowledged the call in a conversational manner and noted down details but did not notify anyone else or take any further action. The first controller, on his return, was aware of the note, but as it appeared to be routine in nature, did not call the driver back. A train technician was detailed to meet the train on its return to Central and was subsequently sent to the derailed train at Edgecliff. The fleet operations controllers did not take any further part in the incident. Fatigue The investigation reviewed the fatigue scores of employees involved in the incident. Only one was identified as being of possible concern. The fleet operations controller who received the report from the driver of 602L, while the other fleet operations controller was absent, was approaching the end of a 12 hour shift. He had no scheduled breaks during the shift and had a Fatigue Score [3] for the shift of 108. He returned to work the next day with a score for the shift of 118. Both scores are well above industry norms for employees who are expected to process safety critical information. However, a fatigue score is only an indicator of the possible existence of fatigue. No other supporting evidence was identified in the case of the fleet operations controller so no definitive conclusion can be drawn as to his level of fatigue. Incident and Emergency Response Unit The Sydney Trains Incident and Emergency Response Unit (IERU) includes the Security Communications Centre (SCC), within the RMC, STERU and IRC staff. The SCC directed the STERU before and during the incident and remained the team leader’s contact in the RMC when on site. Sydney Trains Emergency Response Unit The STERU team has training and equipment akin to that of NSW Fire and Rescue, but with a specialised railway focus. The primary purpose of STERU is to provide a fire fighting response for Sydney Trains’ stations and trains, especially in Sydney’s city centre area. It falls under the control of the SCC and is a ‘first responder’ especially to fires or suspected thermal incidents. Depending on circumstances STERU might respond alone or it might respond alongside NSW Fire and Rescue. On arrival at the derailment site the STERU team leader coordinated with the emergency services and train crew. The team leader’s plan to use emergency evacuation ladders at the ends of the trains, rather than the vertical ladders at the guards’ compartment doors, was adopted. The STERU team leader obtained and fitted the ladders with his team and train crew. Operations at Bondi Junction During peak periods, trains arrive and depart frequently from the two platforms at Bondi Junction, platforms 1 and 2. Between 1700 and 1800 eighteen trains depart from these platforms and head towards the city centre, one train every 3 minutes 20 seconds on average. Since the introduction of this high frequency service with the new timetable in October 2013, a procedure has been introduced at this location only, known as ‘step back’. This procedure provides for a relief driver to be at the Sydney end of the platform ready to take charge of the train on its arrival. The driver who brought the train into the platform cuts out his control and leaves the train while the relief driver steps into the cab at the opposite end and prepares to depart. The guard does not change. Generally there will not be the opportunity for the drivers to talk to one another as happens at every other location where the driver of a train changes while in service. Any messages for the relief driver from the original driver may be relayed through the guard. There is a train crewing shift manager (TCSM) stationed at Bondi Junction. During peak times there are two: one is on the platform to ensure that drivers are in position on the correct platform and at the right time, the other is likely to be performing administrative duties in their office. The office is located on the platform level adjacent to a room where train crew can rest in between operating train services. The second TCSM is available to assist the first should the need arise. Rules and Procedures A number of rules and procedures are relevant to this incident. These include: NGE 206 Reporting and responding to a Condition Affecting the Network (CAN):This rule stated ‘Conditions that can or do affect the safety of operations must be reported promptly to the Network Control Officer responsible for the affected portions of line’. The Network Control Officer was the area’s signaller. The signaller was not informed until after 602M had derailed. All prior communications had been with various RMC personnel. The Incident Management Framework (IMF): The IMF provides a detailed framework in 3 parts, providing guidance on how incidents from Level 1 ‘Routine’ through to level 4 ‘Emergency’ are to be reported, assessed, escalated and managed. IMF part 1, section 4.3 shows that all incidents are to be reported to and managed by the train controller. This requirement was not met. The emerging incident was not reported to the train controller either promptly or directly: he received incomplete and second hand information only. NGE 204 Network Communication:This rule prescribes the rules for spoken communication in the Sydney Trains network. This rule states that communication must be: ‘clear, brief and unambiguous’ and that senders and receivers ‘must start the communication with identification of the receiver first and the sender second’. In these respects, NGE204 was generally observed by exception only, with the majority of the communication being conversational. Train Operations Manual, Operation and Management of Electric Trains (OMET) 220 ‘Wheel slip Light Indications’: This Sydney Trains procedure ‘details the instructions to be followed when a wheel slip, locked axle or slipped pinion (gear wheel) fault occurs’. For Tangara trains, intermittent or continuous activation of the WSL could mean wheel-slip, a slipping pinion or a locked axle. For activation due to wheel-slip, no action is necessary as the on-board system will respond automatically to resolve the issue. For a slipping pinion, normally indicated by a high pitched whine, a maximum speed of 25 km/h is mandated. When a locked axle is suspected, the train should be inspected from the ground to identify the locked axle (utilising the guard to watch the suspected axle(s) as the train is moved slowly). If a locked axle is confirmed, the train may be moved to the ‘nearest suitable siding’ if it is safe to do so, again at a maximum 25km/h. Recurring intermittent wheel slip indications can also indicate a faulty axle speed sensor. Train Working Procedure (TWP) 136 ‘Defective Wheels’: this procedure directed that ‘When a wheel defect is suspected or has been detected, stop and secure the train at the first suitable location and examine the wheels’. The Procedure then has detailed guidance on how to proceed dependent on the type and severity of a defect. The procedure also mentioned pony bogies, ‘designed to enable trains with broken or bent axles……to be moved’. There was no requirement to ensure that traction motors were cut out when using a pony bogie. NGE 404 Using brakes: ‘If, during travel, there is abnormal application of airbrakes…the Train Crew must: bring the train to a complete stop, and…if possible, determine the cause of the application or the extent of the defect…’ Beyond bringing his train to a ‘complete stop’, the driver of 602M did not attempt to comply with this part of NTR 404 beyond looking out of his cab. NGE 412 Defective running gear (including damaged wheels): In the event of wheel damage being suspected this rule directs that train crew tell the Network Control Officer and ‘determine the nature and extent of the defect’. A noise indicating a possible wheel flat was detected by the TCSM between Bondi Junction and Edgecliff but no action or reporting ensued. RMC General Order 11/13 dated 22 January 2013 ‘Added Responsibilities When Incidents of Skidded Wheels or Sticking Brakes Are Reported’. This order directed that train controllers are to ensure ‘that any reports of skidded wheels and / or sticking brakes are fully investigated’. This order was not complied with. Emergency response management Sydney Trains has an Incident Management Framework (IMF). The IMF has four classifications from Level 1 ‘Routine’ through Level 2 ‘Significant’ and Level 3 ‘Major’ to Level 4 ‘Emergency’. Network Control staff classified the incident as a Level 3 incident. A Level 3 incident requires that the General Manager Operations appoints an Incident Manager (IM) ‘to take overall responsibility for incident response management from the Shift Manager RMC’. However, the IM’s role in relation to the incident site itself is reliant on there being a ‘Rail Commander’ on site to take charge, coordinate with external agencies and report back through the RMC SM. A Rail Commander is: ‘A person qualified as Rail Commander that has been appointed by the Shift Manager RMC to liaise with emergency services and manage the rail industry response at an incident site’. At the time of the incident, Sydney Trains had 17 Incident Rail Commanders (IRC) who were qualified to take on the role of a Rail Commander. This contrasts with the situation prior to Sydney Trains’ formation on 1 July 2013 when there were 46 positions (Network Operations Superintendents, Station Operations Superintendents and Incident Response Officers) who were qualified and designated to adopt the position of Rail Commander when required. Also on 1 July 2013, NSW Trains took over the running of Interurban and country services but this did not significantly reduce the incident response task for Sydney Trains as it was still responsible for the operation of the full extent of the network previously operated by RailCorp. When the incident happened only two IRC were on duty in the metropolitan area. One was located on the NSW Central Coast, too far away to respond, while the other had been deployed to an incident at Glenfield. This led to a significant delay (over an hour) in the arrival of an IRC on site. Prior to the IRC arriving on site the IMF requires an Officer in Charge (OIC) to assume the role of the IRC. The Officer in Charge (OIC) ‘is responsible for first response activities and informs/liaises with the Train Controller…”. The OIC is a ‘default appointment’ and it falls to the appropriate person on site, such as the driver or station manager to adopt the role until the IRC arrives. Sydney Trains were asked to confirm who should have been in charge of the incident site before the IRC attended. Sydney Trains’ answer was, according to the IMF, ‘the train driver’. However, this view was not borne out by events on 15 January 2014, with no one being in effective control on site prior to the IRC arriving. The RMC SM communicated with the guards, the TCLO acted in parallel through the TCSM and the signaller communicated with the drivers. The STERU team leader, who communicated with the SCC took charge of aspects of the incident, such as coordinating with the Police. Communications A number of lines of communication were available between RMC staff and personnel on site and also Edgecliff Station. The train controller communicated with the drivers via train radio. The RMC SM talked to the two train guards by mobile phone. The TCLO was in contact with the TCSM again by mobile phone while the SCC was in radio contact with the STERU team leader. The signaller communicated with drivers via train radio as required. Due to the multiplicity of the communications channels there was a lack of clarity in regard to directing actions on site. At Edgecliff Station, train destination boards did not reflect the reality of the line being closed for traffic, advertising train destinations as per timetable. Station staff were not informed of the nature and extent of the problem by RMC staff but were informed by emergency services when they arrived. Sydney Trains post incident debrief The IMF states that, for Level 2, 3 & 4 incidents, debriefs should be held as soon as practicable afterwards. Such a debrief, termed an Operational Review, was undertaken by Sydney Trains on 24 January 2014. The review was chaired by the Signal Box Operations Manager. Of the 22 Sydney Trains employees who participated only one, the IRC, had responded to the incident site. None of the participants were involved in the incident reporting or initial response phases. While this process did produce a list of recommendations (22) for change within the organisation, it may have benefited from the inclusion of more ‘front line’ staff who had been involved in the incident. The debrief identified a number of key concerns; of note were the following: That staff frequently failed to identify themselves (contrary to Network Rules) and that safety communication was very informal Multiple staff (station staff and train crew staff) made multiple calls to different staff members within the RMC: ‘Too many calls were made relaying similar information with no central party linking the information’ That there was a culture of prioritising on time running over safety and that train crew ignore particular alarms and indications. Rail resource management / risk based training needs analysis Sydney Trains was asked to provide details of Risk Based Training Needs Analysis (RBTNA) and corresponding training in Rail Resource Management (RRM) for their staff. RBTNA documents were supplied that related to train crew (drivers and guards). No RBTNA documents were supplied in relation to any other categories of employee. There was also an initiative sponsored by the rail regulation agencies (at the time) of New South Wales (ITSRR) and Victoria (PTSV) which led to the Rail Safety Regulators Panel (RSRP) [4] endorsing a comprehensive document entitled Guidelines for Rail Resource Management in 2007. The guidelines were intended to represent best practice at the time, being modelled on/adapted from Crew Resource Management (CRM) as successfully employed by the aviation industry. However, neither Sydney Trains nor its predecessor RailCorp had introduced Rail Resource Management (RRM), other than in a rudimentary form to train crew. Indeed, during interviews with 19 Sydney Trains employees as part of this investigation, not one (including train crew) were able to identify what RRM was. The exception to this was the RMC SM who was aware of RRM/CRM but that was due to his parallel qualification as a commercial pilot in the aviation industry. Immediate safety actions Once it was established that an axle had broken on N5222, a programme was immediately established, by Sydney Trains and its contractor UGL Unipart, to identify and withdraw from service all Tangara axles manufactured in the same batch of steel. However, once it was established that the issue was not of a batch related metallurgical type but a maintenance issue, this programme was discontinued. An archival search was conducted with the active assistance of the contractor, A1 Metallising, who had repaired the axle and who still held the records. Six other axles which had been similarly repaired using a metal spraying technique were identified. All axles that were still in service or available for service were withdrawn from service and / or quarantined. To give better guidance to drivers, the Train Operations Manual (OMET 220) has had the following note added: ‘NOTE: If the wheelslip indications persist and are inconsistent with the prevailing conditions (that is dry weather, level grade) Train Crews should be vigilant for signs of a locked axle or slipped pinion and carry out the following instruction.’ Also, a network wide search for access pads such as the one at Edgecliff where a potential for lengths of angle iron to be caught up under a train was completed. Only one such location was identified, also on the ESR. The angle iron lengths have been reduced on the edge of that pad. The Train Working Procedure (TWP) 136 Defective wheels has been amended directing that power is isolated on a bogie when a pony bogie is fitted. As well as initiating two internal (track and rolling stock) technical reports and engaging the services of a metallurgist, Sydney Trains contracted an external investigator to investigate the incident in its entirety. This report suggested 15 further safety actions which included some in the areas of RRM, safety critical communications and incident reporting. The ONRSR is taking a direct interest in Sydney Trains’ management of these safety actions. A new emergency number has been installed for staff to report incidents and unsafe conditions directly to operational staff at the RMC. When the number is called, a red light flashes and an alarm sounds to announce the emergency call. Other incidents Searches for comparable incidents were made on the internet including Australian jurisdictions, the UK Rail Accident Investigation Bureau and the US National Transport Safety Bureau. While there have been instances of axles breaking (for example, on freight wagons and the regional, diesel powered XPT rolling stock, currently operated by NSW Trains) there were no comparable incidents of an axle failure on a passenger EMU. However, the rail industry has many examples of incidents that have either occurred or been exacerbated due to poor communications and / or failures to follow communication protocols. Glenbrook 1999 On 2 December 1999 a passenger train collided with the rear of the Indian Pacific near the town of Glenbrook in the Blue Mountains near Sydney. Seven passengers were killed and 51 injured. A Special Commission of Inquiry was established to examine the circumstances of the accident and make recommendations. The Final Report [5] was issued in April 2001. Communications were identified as a major issue during the incident: ‘…evidence from witnesses….indicated that (communication) protocol was being ignored. The result of loose, informal or casual communication can only lead to a lack of clarity and possible misunderstandings which in turn can produce tragic consequences...’ [6] The inquiry also examined previous rail incidents and it was recorded that: ‘In the Glenbrook rail accident and the reports of eight other rail accidents which I have been asked to consider, deficiencies in communication played a significant causal role in most of these incidents.’ [7] The inquiry with Communications, Risk Analysis and Training / Competency represented the largest groupings of the 63 contributing factors identified (Figure 19) with 8 instances each. Source: Glenbrook Inquiry Final Report p107 The report made a number of wide ranging recommendations; two have particular relevance to the Edgecliff incident: Recommendation 2: ‘The training of railway employees should include (vi) ‘Emphasis on the importance of team work in rail operations including ensuring that operational employees have a clear understanding of the duties, roles and pressures involved in the work of other operational occupational groups.’ Recommendation 33: ‘All communications protocols should be strictly enforced by accredited rail organisations.’ Evidence would suggest that either these recommendations were not adequately addressed in the first place or that the required standards have not been subsequently maintained. Waterfall 2003 On 31 January 2003 a passenger train derailed on a curve at high speed and overturned near Waterfall station, south of Sydney. The driver and 6 passengers were killed while the guard and the remaining 41 passengers were injured. While communications were not identified as being causal, the Special Commission of inquiry report [8] states on page 139: ‘Although the Waterfall incident was not caused by communications failures as such, the evidence that caused concern was that there were deficiencies in the communication procedures after the incident, which could have had the effect of causing greater casualties.’ Relevant recommendations from this inquiry included: Recommendation 40: ‘All communications related staff should be selected upon the basis of the ability to convey information clearly, accurately and concisely and to follow strict communication protocols’; Recommendation 41: ‘All communications protocols must be strictly enforced by all accredited rail organisations’; Recommendation 68: ‘Train driver and guard training should encourage teamwork and discourage authority gradients’; and Recommendation 83: ‘RailCorp should develop a plan…to address deficiencies in the safety culture of RailCorp, including (9th item): the means whereby RailCorp proposes to ensure that communications protocols are followed by the employees of the RMC and all other employees engaged in safety critical work’. These recommendations were tracked by the rail regulator and assessed as satisfactorily implemented by RailCorp. A review was also undertaken of RailCorp’s (and the regulator’s) safety management systems and a further report was published in January 2005 as the Final Report of the Special Commission of Inquiry into the Waterfall Rail Accident Volume 2. In relation to RailCorp (and so Sydney Trains), it was concluded that there was a ‘lack of an integrated SMS’ (Safety Management System) and that RailCorp should ‘develop and implement a human systems integration program…’ including: ‘Customised human factors training for rail safety workers and management/supervisory level staff based on contemporary Crew Resource Management (now referred to, in the rail industry, as Rail Resource Management [RRM]) principles’. However, the conclusions reached by the Commission of Inquiry were not tracked and implemented as the previous recommendations had been. Milsons Point 2007 On 14 March 2007 a train with a damaged pantograph came to a halt on the approaches to Sydney Harbour Bridge near Milsons Point during the afternoon peak period. Many passengers were left stranded on trains for up to two hours. RailCorp’s investigation report concluded: ‘While on site staff and RMC Train Controllers were aware of the correct incident location, other staff in the RMC were not. This situation lasted over two hours after the initial notification. Team Leaders/Supervisors within the RMC were not made aware of the exact details of the incident. There was no common understanding of the incident facts and subsequently some sections of the RMC provided incorrect information to outside areas’. Parallels can be drawn between communications and coordination in this incident and the Edgecliff incident. London Underground 2013 There was a recent incident on the London Underground (25 August 2013) [9] which involved smoke emanating from/entering into a train in the underground. Due to poor inter-employee communications within the organisation, the opportunity to detrain the passengers and take the train out of service was missed. It continued in service and was halted half alongside a platform, half in a tunnel, after passengers raised the alarm. The incident was not properly reported and investigations only commenced when reports appeared in the media. RAIB recommended that the operator ‘review training and competencies of its staff to provide a joined-up response to incidents involving trains in platforms and to reinforce its procedures on the prompt and accurate reporting of incidents so that they may be properly investigated’. Bondi Junction May 2014 On 14 May 2014, four months after the derailment at Edgecliff, another electric train was observed to be emitting smoke from underneath the train at Bondi Junction (once in the morning and again in the afternoon). The train was allowed to proceed on both occasions, only being checked by a train technician on arrival at Central station. The cause (a leak of compressor oil onto a hot surface) was eventually identified after the train was shut down for the night. The management of the incident and decision making processes were broadly similar to those which occurred on 15 January in relation to run 602. __________

Safety analysis

The cause of the failure was a metal spraying repair carried out in the late 1990s which introduced stress initiators to the axle. Over time, stress cracking occurred and these grew to the point when, on 15 January 2014, there was no longer sufficient sound axle material to provide the necessary strength to prevent the remaining material from shearing. The initial indications of a fault were displayed in the driver’s cab through intermittent illumination of the WSL and through a fault evident from the train’s TMS display. However, there were less indications of an axle problem than might have been the case due to each axle only having one wheel slip protection sensor. This sensor was located on that part of the axle which was still connected through the gearbox to the traction motor. The other section was no longer attached to the drive train and the wheel on this section exhibited multiple significant wheel skids. However, as this wheel was no longer being monitored by the wheel slip protection system, instances of this wheel locking up or running out of speed synchronisation did not generate an alarm, fault or other signal. The differential speeds between the two parts of the axles and their relative movements as the train travelled along the track generated heat. This heat was transferred into the gearbox oil and the gearbox casing. The gearbox had a vent to atmosphere and the heated state of the gearbox oil caused fumes to be released which led to the reports of smoke and a burning smell at various locations. At 1726 on 15 January 2014 train 602M derailed due to a broken axle, shortly after departing from Edgecliff Station. The axle had probably broken about an hour (and about 32 track km) before the incident in the vicinity of the Sydney suburban station of Jannali. This was the first recorded instance of an axle breaking on Sydney Trains’ EMU rolling stock. The axle broke within the gearbox such that the break could not be seen until the bogie was disassembled. The gearbox provided support for the two parts of the axle so preventing an immediate derailment. While a broken axle of this type was outside the experience of any railway employee involved, there were a number of requirements relating to the action to be taken when the WSP activated and in regard to TMS faults, or sticking brakes or a possible seized axle. These were not followed, in a number of critical aspects, by operational staff. The first awareness of there being an issue with Run 602 was on its arrival at Central. At and from that location and time there were a number of decision points at which the train could have been properly inspected and/or removed from service. Due to correct communication and reporting protocols not being followed, critical operational employees, notably the RMC SM, were either not informed of the issues with Run 602 or were not aware of their severity. Once the train recommenced its journey from Bondi Junction, now travelling in the opposite direction, the axle became the leading axle on its bogie which increased the likelihood of it derailing and it did so while under acceleration at a point of wide gauge in the track on departure from Edgecliff. Once the incident had occurred, there was no IRC available to respond to the incident in a timely manner. No Sydney Trains employee was designated as being the OIC, the point of contact for external agencies or to take charge of matters at the incident site. The STERU unit which arrived shortly after the incident had a team leader who took the initiative, in line with his role and training, to liaise with the emergency services and Sydney Trains employees on site. STERU’s line of communications was to the SCC within the RMC and this was followed. Meanwhile, the RMC SM, in the absence of an IRC, decided to deal with the guards of the two trains as his best points of contact. He did not consider the STERU team leader as being a candidate to adopt the role of incident coordination until the IRC arrived. Sydney Trains have confirmed that according to their IMF in the absence of an IRC, in this case, it was the driver who should have become the point of contact (IOC) at the incident site. The lack of a suitable appointed site coordinator (OIC) led to some delays on site, in particular in relation to the evacuation of the passengers from one train to the other. This could have been critical in a more serious incident. Repair procedures The repair to axle 881228 in 1998 was recognised as being non-standard. Authorisation for a non-standard repair was granted using an ‘Application for Deviation from Specification’ form. This deviation was requested by a Maintrain engineer due to the seating for the low speed bearings and oil flinger being ‘undersize’. It is likely that the undersize issue was caused by a circumferential groove, possibly caused by the bearing casing rotating on the axle rather than a more general loss of material due to repeated pressing on and off of bearing and oil flinger parts. The authority was for a repair using the ECMD process: suitable for a small dimensional loss but not for a deeper groove type defect. However, the approved ECMD process was not the one used to repair the axle. On inspecting the axle the repairer recognised that the damage to the axle was not suitable for an ECMD repair. The repairer stated that a written quote to repair the axle (using metal spraying) was issued to and accepted by Maintrain. While the quote document is no longer in existence and so its wording cannot be verified, the final invoice which was available to the investigation was non-specific, listing the process as ‘metallise and grind’. It may be that the invoice was equally imprecise and/or that the invoice was approved through Maintrain’s normal procurement process without reference to engineering staff. The above, though not certain after an intervening period of some 15 years, may explain how the axle, repaired using a metal spraying technique, was accepted back into service. Non-destructive testing Non-destructive testing (NDT) was routinely carried out on axles during periodic overhauls. One of the two methods used was ultrasonic testing (UT) whereby a probe is set at an angle to the axle’s surface and an ultrasonic beam is generated which passes through the body of the axle. Any crack present in the axle, if in the path of the beam, will generate a non-standard return signal which can be observed by the operator. The last UT was conducted on axle 881228 in September 2011 and while a crack was discovered in the crown gear wheel (which was replaced) no defects were recorded for the axle itself. The axle was also subject to magnetic particle inspection (MPI). During MPI, iron particles in suspension are coated onto the axle surface. A magnetic field is applied and, due to variations in the magnetic field caused by a surface crack, the particles congregate at the defect and so identify its presence and exact location. Neither UT nor MPI detected any defects in axle 881228 in September 2011. While the fatigue crack had extended almost all the way through the axle diameter before axle failure, it is impossible to conclude whether or not cracking was present in the axle at the time of the last non-destructive inspection. The axle had been in operation for 22 months since that last inspection. The possibility exists that the crack was at or below the threshold of detectability at the time of the ultrasonic inspection, or that it initiated and developed after it was returned to service. On 4 March 2014 another axle (90744), identified as having been metal sprayed at the same time as 881228, was tested for the presence of fracturing. While UT did not indicate any issues, MPI did detect what appeared to be a well-defined crack. However, no defects were found when the axle portion was examined by the ATSB’s laboratories in Canberra. It is clear that the current NDT regime used to test axles at UGL Unipart does not give a reliable indication as to the presence or otherwise of cracks in rolling stock axles. Track condition The track at the point of the initial derailment of No. 7 wheel had a known wide gauge of 27.5 mm. This allowed the No.7 wheel of the broken axle to derail into the area between the two rails so initiating the derailment sequence. However, reference to tables in Sydney Train’s document TMC 203 Track Inspections shows that, given the prevailing speed of 60 km/h, this magnitude of wide gauge did not require an intervention such as a reduced speed limit or even the programming of a repair. Specifically, the table identified that a wide gauge of 27 - 28 mm in a track with a maximum allowable speed of 60 km/h represents a ‘P3’ defect. A P3 defect must be inspected within 28 days but thereafter, providing that it has been established that the defect is stable (that is, not likely to deteriorate rapidly), the specified action is to program for repair with no stipulated maximum timeframe. As the track was supported on polymer concrete half sleepers affixed to a concrete slab, a very rigid design, the likelihood of a rapid deterioration in gauge was very small. Thus, while the wide gauge triggered the derailment it could not be said to contribute. That is, it was the broken axle and not the track gauge that contributed to the derailment. The track gauge was within tolerance and the axle would most likely have derailed at some other point as the train continued towards Central. Effectiveness of incident response During the lead up to the derailment there were a number of opportunities when issues with Run 602 could have been identified to network control staff. These occurred from Central Station through to its departure from Edgecliff on the return journey. A decision for a train to proceed or not would generally be made by the driver or by network control staff. However, any Sydney Trains employee is empowered to prevent a train from proceeding in an emergency. Communication procedures and communication channels are laid out in Sydney Trains’ Network Rules and IMF documents. In particular, the requirement to report all conditions that can or do affect the safety of operations to the Network Control Officer was not followed. Communications channels utilised during the incident were not in conformance with the organisation’s expectations (see Appendix C). There was an opportunity at the initial point of detection, Central, to have held the train and had one of the train technicians who were present inspect the train. Had this occurred, while the train may have continued in service, it is likely that a decision to terminate it would have been made at Martin Place or at Bondi Junction. Once this opportunity was lost, until the train returned to Central, there was no possibility of a train technician attending the train as long as it remained in service. In between Central to Bondi Junction, communications generally followed usual business channels, for example train crewing staff to train crewing staff, station staff to station staff. As the train progressed towards Bondi Junction, station staff, train crew and the fleet operations officer variously became aware of a condition affecting the train (or, in the case of the Martin Place DM, erroneously, with the station). No one contacted the signaller to initiate the Condition Affecting the Network (CAN) procedure. Key Sydney Trains employees did not use the correct channels of communication during this phase of the incident. Consequential to the above, neither the train controller nor the RMC SM were aware of the extent of the symptoms evident on Run 602L. However, the train controller was aware of reports of sticking brakes on Run 602L and should therefore have taken action as per RMC GO 11/13 to ensure that the report was fully investigated. The General Order directs that the train controller (or the fleet operations controller) ‘should (where possible) establish direct contact with the train crew’. The train controller did not attempt to contact the crew, relying on second hand information from the TCLO. At Bondi Junction, although the original driver endeavoured to pass on both his information and his misgivings about the state of the train to the driver trainer, it appears that the information was either not received or not fully understood. The fact that the information failed to be imparted may have been exacerbated by the coincidence of there being a trainee driver in the cab. The original driver had taken the precaution of briefing the guard to pass on information in case the drivers did not have the opportunity to converse. The guard did call the driver’s cab and was answered by the trainee driver. The guard passed on reports (en route from Central to Bondi Junction) of a burning smell in or about the sixth carriage. By this time, the TCSM, being in constant telephone conversation with the TCLO, had taken charge of the situation on the platform. The incorrect assumption that the problem was caused by sticking brakes appears to have coloured the thinking of the TCLO and through the TCSM to the driver trainer. There was also an authority gradient apparent: from the TCLO through the TCSM to the driving staff and then to the guard. Despite the combination of heavy fumes, odour and the fact that sticking brakes were extremely rare on this class of rolling stock, sticking brakes were accepted as the cause, creating confirmation bias whereby other possibilities, such as axle, bearing or gearbox problems, were subordinated. Even the information imparted by the DM that NSW Fire and Rescue were on their way did not influence the decision for 602M to continue in service. Some employees, at interview, commented that a culture existed in Sydney Trains which emphasised the importance of keeping trains running over other considerations. There appeared to be a strong focus on ‘on 