SAFETY OF RAIL MAINTENANCE AND INSPECTION VEHICLES

Department for Planning and Infrastructure Government of Western Australia Office of Rail Safety SAFETY OF RAIL MAINTENANCE AND INSPECTION VEHICLES Prepared for the International Railway Safety Conference (I.R.S.C.) 2008 Denver, USA. Dr Sid Hay Manager Railway Operations Iron Ore Rio Tinto Mr Rob Burrows General Manager Office of Rail Safety Department for Planning & Infrastructure Western Australia

INTRODUCTION The relevant conference theme is Risk Reduction Strategies prevention of accidents, trespasser fatalities, employee health / wellness This presentation looks at some accidents involving road-rail vehicles and related safety data and efforts by one railway company to reduce the accident risk. ABSTRACT Rail maintenance and inspection vehicles have featured in a significant number of safety occurrences in recent years including collisions, derailments and near misses. Many have occurred in remote areas where immediate assistance is not normally available. High risk events in metropolitan areas, including a runaway vehicle travelling through several level crossings, have also occurred. On board safety equipment is usually limited to radio or telephone. Only in part of Australia are these vehicles required to be fitted with vigilance systems to help ensure drivers have not gone to sleep and are focussed on the task of driving. Mostly track occupancy for these vehicles is authorised by train controllers issuing access authorities to the operator. When on track these vehicles are required to comply with established rules and procedures that are designed to provide more levels of risk protection. Accidents have occurred through human error and technical deficiency. Failure to follow rules and procedures, unclear communication between train control and the vehicle operator, and company failure to provide error tolerant systems all contribute to accidents. In signalled territory these vehicles are not normally heavy enough to provide adequate electrical contact that would inform track circuitry of their presence and reliably drop the block. The result is these on-track vehicles are normally not visible on train controller displays panels and train controllers have made the mistake of removing the track protection to allow another train into the occupied section. The rail industry is responsible for providing rail safety solutions. However a Code of Practice for Rolling Stock recently published by the Australian RISSB is not strong in terms of requiring safety equipment on these vehicles. This presentation will look at a range of rail occurrences involving lighter railway track inspection and maintenance vehicles and a system being developed by Rio Tinto using GPS technology integrated with train control systems to reduce the risk of collisions involving these vehicles. The presentation will review the evolution of signalling technology in use on Rio Tinto s iron ore railway in the Pilbara and discuss how this latest development complements the existing and future signalling and operating technologies. i

INTRODUCTION In this paper we will share some observations and experience concerning the safe operation of rollingstock for rail maintenance particularly road-rail vehicles. Rob Burrows, the Rail Safety Regulator in Western Australia (WA), will illustrate safety risks by discussing some accident history and data. This analysis led to discussions with some railway network mangers to encourage them to work on relevant risk reduction strategies. Dr Sid Hay manages rail operations for Rio Tinto s Iron Ore Group in the Pilbara region in the north of WA. Rio Tinto has been considering related risk issues following a couple of potentially serious incidents on its heavy haul railway. The company approached Rob for advice about systems that existed elsewhere in the world to ensure road-rail vehicles dropped the block in CTC signalled systems. Rob asked some of his network of contacts from the IRSC for information and several responses were received. These were discussed further with Rio Tinto. Based on its own research and some of this information Rio Tinto then determined to develop and implement a GPS based method of locating and tracking road-rail vehicles. This was not the end of the story because Rio Tinto continues its work to improve rail efficiency and safety, two complementary goals. It has a history of progressively introducing and improving use of technology in its Pilbara railway operations. This paper goes on to discuss some real safety improvement that Rio Tinto has been working on and how this GPS based system will be integrated with them. It is appropriate to mention that in Western Australia the Regulator and Companies operate in a legislated co-regulatory framework. This form of regulation is not prescriptive but involves the parties working co-operatively and in Western Australia it has been common to see the Regulator and railway companies collaborating for that purpose on particular projects. In many cases a strong working relationship has evolved and the railway companies have mostly been proactive in making continuous improvements to their safety systems. Working together on this presentation typifies what we are about. 1

RAIL NETWORKS IN WA The following map shows the railway networks in WA There are over 8000 Km of track, most of which is in very remote areas sometimes hundreds of kilometres from major towns. There are five larger railway track systems and several other minor railways. About 25% of the track networks in WA operated with CTC and automatic signals and the rest generally operate using a form of train order system. Road-rail vehicles and other on-track vehicles are out travelling on all of the large networks every day. BHP Railways FMG(TPI) railway Rio Tinto Railways WESTERN AUSTRALIA WestNet Rail ARTC Perth PTA Kalgoorlie MAP SHOWING RAILWAY NETWORK MANAGERS IN WESTERN AUSTRALIA 2

ROAD RAIL VEHICLES Road-rail vehicles are common in the rail industry across Australia. They are vehicles that can travel on road and can also travel on rail by use of a hydraulically operated rail wheel guidance system. They are but one of many types of on-track vehicles used for a variety of purposes including: Track laying; Track condition monitoring; Track maintenance work; and Emergency response / Recovery. Some road-rail recovery vehicles are specifically designed as ambulances for use in case of emergency. Some may pull a trailer and others may be fitted with a range of equipment including trench diggers, cranes, weed sprayers, etc... Road-rail vehicles come in all shapes and sizes as can be seen with this larger vehicle operated by Speno on Rio Tinto s Pilbara railway. ROAD-RAIL VEHICLE ON TRACK IN THE PILBARA The typical road-rail vehicle in Australia is often referred to as a Hi-rail vehicle. 3

A TYPICAL ROAD-RAIL VEHICLE BEING READY FOR AN INSPECTION RUN The standard road-rail vehicle in Australia is usually a modified 4 wheel drive road vehicle. They are usually air-conditioned providing for driver comfort but other safety equipment normally found on board a locomotive won t usually be found. For example they may not have a vigilance system or data logger. They are built to meet Australian road vehicle design rules for operation on roads. Unlike the UK which has engineering rules for acceptance of road-rail vehicles there are no common design or operational rules for these vehicles to be on rail. The UK design and acceptance rules cover such things as: Track conditions for travelling mode and working mode Gauging (the swept envelope) Travelling speeds (limit of 56 km/h or 35 mph) with a speedometer that works in both directions and an audible warning if speed exceeded Speed limiters Horns and sirens Fire equipment Security systems 4

Rail wheels diameter, profile, flange back spacing and loading Rail wheel guidance system integrity, locking and suspension Dynamic and static stability On and off track system Steering positively locked straight ahead on track Traction drive system Brakes Movement limiting devices Visibility and audibility Driving and operating in cabs Failure recovery methods Mobile elevating work platforms Electrical equipment and earth bonding Cranes Testing; and Attachments OPERATION OF ROAD-RAIL VEHICLES Mostly track occupancy for road-rail vehicles is authorised by train controllers issuing train orders to the operator. When on track these vehicles are required to comply with established rules and procedures that are designed to provide some risk protection. Operating rules appear to be unique to a specific rail network. Therefore rules and standards for road-rail vehicles differ as you move from one network to another and may change from one operator to another. For example a requirement of Rio Tinto that these vehicles be fitted with a rotating orange beacon light on the top of the cab and to operate the lights when the vehicle is on track is not the requirement on all other networks. Specific operating rules and standards for these vehicles are sometimes determined by the maintenance contractor that operates the vehicles rather than the track manager. This means different operators on the same track could have different standards. Some may have procedures and requirements to fit and use vigilance systems, data loggers, rotating beacon lights and air bags and others may not. In one case, as a result of an accident, a contractor fitted vigilance to its vehicles operating on one side of a State border and not those operating on the other side despite operation on the whole track being controlled by the same track manager. Under rail operating rules road-rail vehicles are treated as a working train while on track. A feature of rules for road-rail vehicles is that they are allowed to follow trains into sections. This has often presented a particular risk of 5

collision with the train it is following. Despite similar operating environments rules defining minimum separation distances vary with one network requiring at least 200 m and an adjoining network requiring 500 m. Due to the nature of their work, which can involve regular starting and stopping to do spot work in signalled or non-signalled track, the operating rules and safety risks can be very different to those experienced by a normal train. On different railways this results in application of a variety of specific operating rules to help protect the vehicles and to provide track worker protection. Hi-rail vehicles will not reliably activate track circuits if at all. They are usually not fitted with track circuit activators that may inform track circuitry of their presence. Consequently when working in signalled territory they generally don t drop the block or activate level crossing equipment. The result is these on-track vehicles are normally not visible on train controller displays panels and several times train controllers (signallers) have made the mistake of removing the track protection to allow another train into the occupied section. Sometimes operating rules require the application of a shorting strap across the track when a road-rail vehicle stops and before workers commence inspection or maintenance work. This strap will drop the block and secure possession of the track section in signalled territory. An example of the problem caused by failure to activate track circuits was highlighted at Mount Lofty in Adelaide, South Australia in 2004. A track machine (ballast regulator) ran away unmanned through five level crossings without activating any boom gates and flashing lights. It ran uncontrolled for 6.5 km for about 11 minutes. Electrical insulation is installed inside the ballast regulator to prevent detection of the machine by the signalling system. It was lucky there was not a catastrophic collision at any of the level crossings. The vehicle was not fitted with a vigilance system that would have stopped it. ROAD-RAIL OPERATING ENVIRONMENT Road-rail vehicles operate in all geographic regions and in areas that experience climatic extremes. In some locations the only method to get around the country after severe rain storms is by road-rail vehicle. Often operation is in very remote locations and there may only be one person on board. Long distances, boredom and fatigue can become an issue affecting operator attention. Road-rail vehicles are equipped with radio and satellite phones to communicate with train control. The following picture shows a high-rail vehicle sent out to inspect track following a cyclone in the Pilbara. Floodwaters have done serious damage to rail infrastructure. 6

CYCLONE DAMAGE ON A PILBARA RAILWAY The next picture is of a road-rail vehicle operating on the Nullabor Plains on main east-west railway that crosses Australia a very remote area indeed. A ROAD-RAIL VEHICLE ON THE NULLABOR PLAINS 7

ROAD-RAIL VEHICLE ACCIDENTS Data shows that rail maintenance and inspection vehicles have featured in a high proportion of significant safety occurrences including collisions, derailments and near misses. Most have occurred in remote areas where immediate assistance is not normally available. The rate of road-rail vehicles colliding into the rear of trains that they have been permitted to follow is of concern. It is evident that this type of occurrence is relatively common and is overrepresented in the number of train to train collisions. Following are some examples of road-vehicle accidents. Te Wera, New Zealand In the 2004 IRSC in Perth we were treated to an excellent presentation from Denis Bevan from TAIC in New Zealand. He spoke about an investigation very rich in contributing factors that is an excellent rail accident case study. A train derailed and for a considerable time no one knew it was missing. Eventually train control realised something was wrong and set up a search. No one knew exactly where the train was so they sent out road-rail vehicle from each end of the track to help in the search. One road rail was travelled through a tunnel and collided with the wreckage when it came out the other end. It transpired that if train control had used information from earlier radio transmissions from the train that indicated the location of the nearest trackside radio beacon then the collision may have been avoided. Contributing factors in other road-rail vehicles are more common. Leigh Creek, South Australia, September 2004 In this fatal accident a road-rail vehicle derailed and rolled over several times at about 11.30 in the morning. The driver was badly injured but conscious, and managed to exit the vehicle and move himself close to the access road to await assistance and attention. He lay alone and unsheltered from the rain in this remote location for several hours. Train control and fellow workers took a long time to work out the vehicle was overdue. When they realised there was a problem they didn t exactly know where it was. They had the wrong number for the driver s satellite phone. An ambulance arrived about 1700 hrs and took the driver to hospital but he died about 36 hours later. Mechanical design and operating procedures were all found to be deficient. The accident highlighted the need for better industry standards and certification procedures for road-rail vehicles. Unfortunately the more recent development of rolling stock standards has not addressed the problem. 8

Salmon Gums, WA, May 2001 This involved a collision in train order territory and is typical of the many occasions that road-rail vehicles have collided with a train in Western Australia. The vehicle had been permitted to follow a train into a section of track near Salmon Gums. Due to driver in-attention, possibly a micro-sleep, the vehicle ran into the back of the train. The driver survived with a big headache. You can see his head print in the windscreen. Vigilance may have prevented this accident and an air bag would have limited the severity of the head and chest injuries. ROAD RAIL VEHICLE HITS REAR END OF TRAIN Road-rail vehicles operated by the network manger on this network, or by the maintenance company working on the network, are not required to be fitted with a vigilance system, a data logger or airbags. The maintenance operator is required to fit a vigilance system in vehicles it operates in Victoria! 9

Pelican Lyre, Pilbara, August 2005 This was a near miss collision in signalled territory. A road-rail vehicle didn t drop the block and was nearly hit by another train in the section. Rio Tinto called the Rail Safety Regulator and asked for help in finding out what systems existed elsewhere in the world to ensure road-rail vehicles dropped the block in CTC signalled systems. The Regulator emailed a number of his IRSC colleagues and received responses very quickly. Most indicated there was no reliable method but some ideas were provided. Rio Tinto worked through the responses and put their mind to the issue and later advised the Regulator they would be pursuing a GPS based solution. Later the Regulator passed on more information about GPS based systems seen developing elsewhere in the world, including the anti-collision system demonstrated at the Goa IRSC in 2007. This is a good example of Regulator and Operator cooperation and the value of the IRSC. Deakin-Reid June 2006 In train order territory a road-rail vehicle ran into the back of a road-rail welder truck it was following. The lead vehicle did not communicate it was stopping and the trailing vehicle did not comply with the rules on maintaining a minimum trailing distance of 500m. The driver of the trailing vehicle also failed a drug test after the accident. The investigation report advises that these vehicles have not been fitted with data recorders. Currently the SA vehicles are undergoing a vigilance and data recorder modification, allowing easier access to information in case of incidents, fatigue monitoring, GPS logging and other maintenance incentives. These vehicles are scheduled to be modified in the near future. It appears that the contractor proceeded with the equipment fit-out as found a year later in an accident in the Nurina-Haig section. Nurina-Haig, November 2007 In train order territory a road-rail vehicle that ran into the back of a train on the trans Australian railway about 1150 km east of Perth. The vehicle was operated by the same company as involved in the Deakin-Reid accident. Both the driver and assistant went to sleep and the report suggests fatigue was a factor. The required safe separation distance of 500m was not maintained. There was a speed restriction of 20 kph in force on the track at that time. The data logger showed the vehicle was travelling at 62 kph at 390m and 40 seconds before the collision point and that the vehicle had begun slowing gradually possible because the driver had gone to sleep. Interestingly the driver responded to the vigilance 23 seconds before collision (in his sleep?). The vehicle was travelling at 56 kph and the train at 20 kph at the collision point. 10

ROAD RAIL VEHICLE THAT RAN INTO THE END OF A FREIGHT TRAIN Further review suggests that the vigilance system should have a random response cycle to prevent automatic subconscious response by the driver. It was found that the vigilance system takes two minutes to shut down the vehicle engine when the driver fails to respond to the vigilance. In that time, travelling at a track speed of 80 kph the vehicle will travel 2.6 kilometres. Given that the operator is now reviewing what a safe distance to follow a preceding movement is or whether to change the time span on the vigilance system Banksia, Pilbara, December 2007 Banker locomotives ran into a road-rail vehicle parked on the track. The workers were out of the vehicle preparing to do work when the train came along and collided. Lights on the vehicle were not switched on. There is also a reliance on the vehicle operator to follow procedures. In this case he didn t. This accident again highlighted the problem that these vehicles are not designed to reliably activate track circuits. Consequently in train control centre the block is not automatically dropped in the train control system to provide protection to the road-rail vehicle. In this case a train controller had applied protection but the next shift controller inadvertently lifted the track protection and allowed the train into the section. A train controller usually relies on maintaining accurate hand markings on a train graph to help him remember 11

where rail vehicles are. It is thought that different practices by the train controllers of marking train graphs contributed to this error. Overall it highlighted the need to do more to make the system more error tolerant. LOCOMOTIVES HIT A PARKED ROAD-RAIL VEHICLE Kambalda, February 2000 and Repeated June 2008 In each case at the same location a road rail vehicle running in train order territory ran into the back of an iron ore train about 700 Km east of Perth. Given permission to follow the train drivers in both cases failed to maintain the minimum safe following distance of 200m required by the track manager. The trains were slowing to enter the station but the vehicle drivers were not paying attention. In the later accident the driver claimed he was doing some paper work and not watching. After reviewing safety data the Regulator found that rear end collisions by road-rail vehicles were overrepresented in train to train collisions on this network and generally. Data clearly shows an unacceptable risk and the need to develop and implement some positive safety improvements to reduce the risk of this type of collision, including consideration of random vigilance and airbags. The minimum following distance of 200m is less than on other networks and needs to be reviewed also. Discussions are proceeding with the track manager about these things. 12

KAMBALDA ROAD_RAIL VEHICLE COLLISION JUNE 2008 13

OCCURRENCE DATA In WA since 2000 rail occurrence data held by the rail safety regulator shows: 2000 2001 2002 2003 2004 2005 2006 2007 2008 Main Line Train to Train COLLISIONS (17+) ROAD-RAIL INVOLVED (9+) TRACK MACHINE INVOLVED (5+) 3 1 1 1 0 3 2 4 2+ 2 1 1 0 0 0 2 2 1+ 0 0 0 1 0 3 0 1 0+ TRAIN ONLY (3+) 1 0 0 0 0 0 0 1 1+ Main Line DERAILMENTS (198+) ROAD-RAIL INVOLVED (32+) TRACK MACHINE INVOLVED (11+) SAFEWORKING BREACH * (647+) ROAD-RAIL INVOLVED (27+) TRACK MACHINE INVOLVED * (22+) Number of times in above two rows where there vehicle was placed in CONFLICT WITH TRAIN or had NO PROTECTION / AUTHORITY (36+) 26 17 39 23 19 22 21 18 13+ 0 2 8 5 0 6 3 4 4+ 1 1 2 1 2 0 2 1 1+ 58 55 64 46 88 89 90 99 58+ 0 0 2 5 7 4 6 1 2+ 6 3 1 1 3 1 2 5 0+ 2 2 2 5 8 3 8 4 2+ + Half year up to June 2008 * Not counting the above Main Line Derailments and Collisions It can be expected that a portion of safeworking breaches would lead to derailments and collisions. Above it can be seen that the portion of road-rail vehicles and track machines involved in:- Safeworking breaches is low (7%) mainline derailments is higher (22%); and Mainline train to train collisions is worst. 14 of 17 (82%) train to train collisions on the mainline involved road-rail vehicles or track machines. 14

Safeworking Breaches In WA since 2000 there have been 47 serious safeworking breaches involving road-rail and other on-track machines where they were: operating on track without authority; put in direct conflict with a trains by train control; or operating in a section without protection. Twenty seven (27) of these involved road-rail vehicles. Derailments There were 198 mainline derailments involving all types of rolling stock. Forty three (43) or 22% of these involved road-rail vehicles and other on-track machines. Road-rail vehicles derailed 32 times. The cause of road-rail vehicle derailments is not analysed here but it is expected that common factors could involve speed, loading and mechanical issues. Collisions Train to train collisions are of most concern. There have been 17 collisions since 2000 and 60% involved road-rail vehicles. It is of concern that on 8 occasions a road-rail vehicle has run into the back of a freight train. On another occasion a passenger train hit a road-rail vehicle placed on track by error. COMMON CAUSES Analysis of accident reports involving road-rail vehicles often show factors such as: Driver inattention or sleeping; Remote location and possible boredom while driving; Fatigue of vehicle operator or train controller; Train control inattention or error; Train Control could not see where the road-rail vehicle was on the system or forgot it was on the system; Poor communication between or by train controller or vehicle operator; Failure to follow rules and procedures; and Systems are not error tolerant 15

DESIGN AND OPERATING STANDARDS FOR ROAD-RAIL VEHICLES The Leigh Creek derailment highlighted the need for better industry standards and certification procedures for road-rail vehicles. In this regard the Australian Standards fall well short of those available in the UK from the RSSB website. Investigations and analysis of road-rail vehicle collisions also shows that standards in Australia are inconsistent and in many cases deficient. It appears reasonable to consider that the incidence of tail end collisions could be significantly reduced by requiring road-rail vehicles to be fitted with driver vigilance systems. The draft Australian standard on Driver Supervisory Systems Infrastructure produced by RISSB to require fitment of supervisory system on track machines and road-rail vehicles as a standard risk management control is unhelpful. That standard only seems to state copy what has been past practice on particular networks and does not appear to have been based on an adequate risk assessment or to address the significant risk of rear end collisions. There is no attempt to promote better practice to ALARP. Better practice could include data loggers and vigilance systems that operate with a random response time. Operating speeds and minimum following distances should also be reviewed. Road rail vehicles are primarily designed to meet road design rules and this can unwittingly bring with it a risk when on rail if cruise control is incorporated. Cruise control allows a driver to set the speed and sit back without having to positively operate the accelerator. While on track the driver doesn t have to steer the vehicle either so there is a higher risk that the driver could sit back and relax and possibly fall asleep. If a vehicle was fitted with cruise control then when on-tracking process systems should automatically disengaged it and switch on the driver supervisory system (vigilance). On the other hand road vehicle design standards can possibly assist in reducing the injury severity from collision accidents if, for example, air bags were incorporated in road-rail vehicles. The problems from road-rail vehicles not dropping the block is something Rio Tinto has been working on and is considered in the rest of this presentation. 16

SAFEWORKING SYSTEMS ON PILBARA IRON ORE RAILWAYS Rio Tinto's Iron Ore group operates and maintains a privately owned railway system which, following recent improvements, is currently operating at a haulage rate equivalent to more than 200 million tonnes per annum of iron ore The ore is hauled from nine mine loadouts to three ports in the Pilbara region of Western Australia. This railway operates as part of an integrated logistics chain from mine pit to ship, and the railway engineering, operation and maintenance are managed by one organisation. From this horizontal and vertical integration, safeworking systems have evolved without the potential barriers posed by multi-user rail systems with separate management at the rail-wheel interface or different regulatory regimes. The diagram below illustrates the evolution of the mainline safeworking systems on the railway since 1966, and some indication of future improvements. Automatic Train Operations Error Tolerance / Engineering Control Integrated Control and Signalling System (ICSS) 2 way GPS system - pseudo ICSS GPS Tracking System linked to block protection Track Circuits, Coloured Light Signals Train Orders Verbal Authority Trains & Track Machines hi-rails Trains Track Machines 1965 1970 1975 1980 1985 1990 1995 2000 2005 2010 2015 Evolution of safeworking systems on a heavy freight railway After a brief start-up period of operation on train orders, track circuits and coloured light signalling was introduced in 1972 incorporating full track circuiting, interlocking, and track protection in the control system. This increased the safety of ore train and track machine operations, however hirails safety gained little from this because of their inability to reliably shunt the track circuits ( drop the block ) to indicate their presence. There was a major change in the safety of train operations in 1998 with the introduction of the Integrated Control and Signalling System (ICSS) which 17

incorporated cab signals, automatic train protection, full interlocking and track protection in vital field interlocking. The introduction of ICSS on ore trains indirectly increased the safety of track machine and hi-rail operation by eliminating the risk of an ore train exceeding its limit of authority and travelling into a section containing the track machine or hi-rail. The benefit for track machines was greater than for hi-rails because the ICSS system also prevents the train controller from setting a route for an ore train through a section occupied by a track machine that is detected by track circuits. With the implementation of ICSS, the system of protection for hi-rails consisted of verbal authority with vital protection (wayside interlocking) and verbal position reporting. The train controller manually applies an electronic protection block in the system based on the radio communication with the driver of the hi-rail. Investigation of Options to Improve Hi-Rail Safety There had been earlier investigation into GPS after a hi-rail derailment in 1995, where points were moved under the hi-rail movement. At this time, the purpose was to non-vitally lock the points. The concept proved difficult to implement with the available technology and procedural controls (reduced speed) were introduced instead. Investigation into stronger engineering controls for hi-rails was resumed in 2005-2006 following an increasing trend of hi-rail near miss incidents. Hi-rail collisions were assessed as the highest operational risk on the risk register. In contrast, ICSS has almost eliminated limit of authority and speed violations on mainline trains. While developing a long term engineering solution, other improvements were made to hi-rail safety. Procedures were changed in 2006 requiring the use of track access forms to ensure clear radio communications, and requiring application of a track circuit shorting cable to positively identify the hi-rail location prior to accessing track. These changes eliminated the occurrence of incidents where hi-rails accessed track in the wrong location. However incidents could still occur where human error resulted in the electronic protection for a hi-rail being removed when the hi-rail was still on track. This type of error was one of the causes in an actual collision between locomotives and a stationary hi-rail in December 2007. One source of such errors was that the electronic block used to protect hi-rails had the same visual appearance on the train control system screen as the electronic block used for general operational purposes. Changes to the train control system software were made early in 2008 to reduce the likelihood of confusing these blocks. Additional prompts were added in the software when a train controller initiates the process of removing the protection for a hi-rail. 18

Despite these improvements the visibility of hi-rails to the train controller was still not guaranteed. Review of practices on other rail systems found that others had attempted to make modification to hi-rails to drop the block, with mixed success. Several variations of this were trialled on the railway with limited success. Some heavier hi-rail machines now reliably 'drop the block' but the lighter hi-rails do not. GPS technology was trialled as a stand alone system in 2007. This trial proved successful in the areas of accuracy of location and availability of satellite communications system. However the stand-alone user interface was not acceptable to operators and the system still required manual application of the protection blocks based on observation of the hi-rail location on a separate screen, and so was not fully error tolerant. The Hi-Rail GPS Tracking System and other Future Developments The method chosen for implementation is the integration of GPS position information into the train control system. This project commenced in 2008 and has the following characteristics and timeline: Position reporting and non-vital occupancy indication to be integrated into train control system during 2008. Non-vital interlocking in train control system to be commissioned early 2009 including alarms for violations to controller (exceeding authority limits, on-track without authority, removal of protection while on-track). Communications to be migrated to wide area data network by 2011, allowing effective two-way data communication of authorities (equivalent of in-cab signal), vigilance on hi-rails, violations alarmed on vehicle. Similar improvements are being considered for track machines to include direct acting limit of authority supervision on these machines. We did not pursue fitting track machines with the ICSS because of the nature of their work. Many additional limits of authority (almost all track circuit boundaries) are used by track machines compared to trains. These are normally bi-directional in nature whereas while signalling limits of authority are often uni-directional. ATP would therefore only provide partial limit of authority supervision. The developments in safeworking technology underway at Rio Tinto s railway operations in the Pilbara represent a further evolution of the standard of operational safety that can be applied to a heavy freight railway. These developments complement the introduction of automation of to mainline train operations on sections of the railway over the next five years. 19

Further extension of the hi-rail system will be considered for applications such as protecting trackside workers in areas of automatic train operation. An important pre-requisite in the development and implementation of the safeworking systems discussed in this paper is a good working relationship between the railway organisation and the safety regulator. 20