Public Transport Safety Victoria

Guideline

Accreditation Guideline

A guide to obtaining and maintaining accreditation for rail operators in Victoria

Incorporating risk management and management of change guidelines.

September 2006

Contents

1 Introduction 1

1.1 Overview 1 1.1.1 The purpose of this manual 1 1.1.3 General principles of rail safety 3 2 Scope of accreditation 5

2.1 What is accreditation? 5 2.1.1 Purpose of accreditation 5 2.1.2 Offence not to be accredited 5 2.2 Who does not need to be accredited? 6 2.2.1 Definition of “railway” 6 2.3 Exclusions from accreditation 6 2.3.1 Railways excluded from the RSA 6 2.3.2 Exemptions for private sidings 7 2.3.3 Exemptions for tourist and heritage operators from ongoing risk management requirements 12 3. Safety Duties 16

3.1 Rail Safety 16 3.1.1 Safety duties of rail infrastructure managers 16 3.1.2 Safety duties of rolling stock operators 17 3.1.3 Safety duties of rail contractors 18 3.1.4 Safety duties of rail safety workers 20 3.1.5 So far as is reasonably practicable 20 4 Categories of Accreditation 22

4.1 Rolling stock operators and rail infrastructure managers 22 4.1.1 Rail infrastructure managers 22 4.1.2 Rolling stock operators 23 4.1.3 Combined application 24 5 Transitional provisions 25

5.1 Approach to transition period 25 5.2 Existing accredited rail operators seeking accreditation 25 5.3 Operators seeking accreditation before 1 August 2006 27 5.4 New operators seeking accreditation 27 6 Applying for Accreditation 28

6.1 Application process 28 6.2 Application 28 6.2.1 Nature, character and scope of proposed operations 29 6.3 Supporting documentation 29

Public Transport Safety Victoria | ACCREDITATION GUIDE  6.3.1 Documentary evidence of competence and capacity 30 6.3.2 Documentary evidence of consultation 31 6.3.3 Documentary evidence of the existence of and compliance with SMS 31 6.3.4 Evidence of capacity to meet potential accident liabilities 32 6.3.5 Documentary evidence of safety interfaces 32 6.3.6 Documentary evidence of rights of access 33 6.3.7 Any other information required by the Safety Director 34 6.4 Compliance with risk management requirements 34 6.4.1 Identification of incidents and hazards, and risk assessment 34 6.4.2 Measures to control consequences of incidents 35 6.4.3 Emergency planning 36 6.5 Signing 37 6.6 Fees 38 6.7 Assessing accreditation 40 6.7.1 Criteria on which accreditation will be assessed 40 6.7.2 Time frame in which Safety Director must make a decision 41 6.7.3 Notification and reasons if accreditation refused 41 6.7.4 Notice of accreditation 41 7 Operations in another State or Territory 43

7.1 Process for mutual accreditation 43 7.1.1 Obtain key documents from interstate regulator 43 7.1.2 Further requirements 43 7.1.3 Time frame in which Safety Director must make decision 44 7.2 Changes to interstate accreditation 44 8 Conditions of accreditation 45

8.1 Conditions applying to all rail operators under the legislation 45 8.1.1 Conditions for all rail operators 45 8.1.2 Conditions for operators accredited outside Victoria 47 8.1.3 Failure to comply is an offence 48 8.2 Conditions imposed by the Safety Director 48 8.3 Restrictions imposed by the Safety Director 48 9 Changes to Accreditation 49

9.1 Variation and surrender of accreditation 49 9.1.1 Application by rail operator to vary 49 9.1.2 Variation by Safety Director 52 9.1.3 Surrender of accreditation 52 10 Ongoing Compliance 54

10.1 Duration of accreditation 54 10.2 Maintaining accreditation 54 10.2.1 Record maintenance 54

ii ACCREDITATION GUIDE | Public Transport Safety Victoria 10.2.2 Reporting requirements 55 10.2.3 Ongoing risk management 56 10.2.4 SMS compliance 57 10.2.5 Emergency plan 57 10.2.6 Accidents and incidents 58 10.3 Audits 61 10.3.1 Safety audits 61 10.3.2 Medical records audit 61 10.4 Inspections and Investigations 62 10.4.1 Compliance inspection 62 10.4.2 Disciplinary inquiry 63 10.4.3 Investigation 65 10.5 Disciplinary action 65 10.5.1 Improvement notices 65 10.5.2 Prohibition notices 67 10.5.3 Suspension of accreditation 67 10.5.4 Cancellation of accreditation 68 10.5.5 Disqualification of rail operator 68

Appendix A Application form for accreditation Appendix B Application form for private siding exemption Appendix C Application form for tourist and heritage exemption from ongoing risk management requirements Appendix D Start dates for legislative provisions Appendix E Content of SMS for non-accredited rail operations Appendix F Investigation reports Appendix G Risk management and ‘so far as is reasonably practicable’ Appendix H Corporations Act - disqualifications Appendix I Management of Change (MoC) guidelines

iii ACCREDITATION GUIDE | Public Transport Safety Victoria iv ACCREDITATION GUIDE | Public Transport Safety Victoria 1 Introduction

1.1 Overview

1.1.1 The purpose of this manual

The Accreditation Guide is intended to:

• consolidate the various accreditation provisions contained in the Rail Safety Act, the Rail Safety Regulations and the Transport Act;

• arrange these provisions logically and by subject matter;

• identify mandatory requirements for accreditation;

• refer rail operators to relevant provisions of the RSA and the regulations;

• provide explanation by way of definitions and cross references;

• interpret provisions of the legislation where relevant; and

• provide examples where relevant.

The key three pieces of legislation that govern accreditation in Victoria are:

Rail Safety Act 2006

Rail Safety Regulations 2006

Transport Act 1983

The RSA and the Regulations are collectively referred to as “the legislation” throughout this Guide. From 1 August 2006, the legislation will govern accreditation of all rail operators in Victoria. It is therefore essential that existing rail operators and prospective rail operators familiarise themselves with the new scheme of accreditation. The Accreditation Guide will help to guide rail operators on how to obtain and maintain accreditation.

It is expected that this Accreditation Guide will be updated and modified to reflect changes to legislation and feedback from industry and other rail safety regulators.

This Accreditation Guide is intended to be a guide only. It is not intended to replace the legislation or to limit or expand the scope of the legislation. In the event of an inconsistency between this Accreditation Guide and the legislation, the legislation will prevail. It is recommended that you obtain your own, independent legal advice about the legislation.

This Accreditation Guide will make references to the legislation throughout,

Public Transport Safety Victoria | ACCREDITATION GUIDE  allowing you to go directly to the source of the relevant obligations. References to legislation will appear in a column down the right hand side of the page.

The following abbreviations are used for references to specific legislation:

RSA Rail Safety Act 2006

Regulations Rail Safety Regulations 2006

TA Transport Act 1983

The office of Director, Public Transport Safety (Safety Director) is established under the Transport Act 1983. The Safety Director is responsible in Victoria for TA 9V the safety regulation of mass transit passenger transport (train, tram and bus operations) as well as rail freight operations and tourist and heritage operations.

In performing or exercising his or her functions or powers, the Safety Director must have regard to:

• ensuring that the public transport system achieves the highest safety standards reasonably practicable

• ensuring that societal costs are assessed and considered such that the benefits resulting from performing or exercising a function or power are proportionate to those costs, and

• the objects of the RSA, as set out in section 11.

The office is known as Public Transport Safety Victoria (PTSV). Its contact details are:

Public Transport Safety Victoria

Telephone: (03) 9655 8949

Facsimile: (03) 9655 8929

PO Box 2797

MELBOURNE VICTORIA 3001

Web: www.doi.vic.gov.au/publictransportsafety

Email: [email protected]

 ACCREDITATION GUIDE | Public Transport Safety Victoria The following definitions, abbreviations or acronyms are used in some parts of this Accreditation Guide and have the following meanings:

ARO Accredited rail operator

Safety Director Director, Public Transport Safety

PTSV Public Transport Safety Victoria

SMS Safety Management System

RSA Rail Safety Act 2006

Regulations Rail Safety Regulations 2006

TA Transport Act 1983

1.1.3 General principles of rail safety

In carrying out its role in regulating the safety of the Victorian public transport system, PTSV seeks to ensure that principles of rail safety underpin all its activities.

The RSA places key emphasis on rail safety. The following principles of rail safety should be taken into account by all parties with responsibilities to comply with the requirements of the RSA, including those seeking accreditation.

Principle of shared responsibility which provides that there are a number of RSA 13 persons who share responsibility for safety and who form part of the rail safety chain of responsibility.

Principle of accountability for managing safety risks which provides that RSA 14 managing risks associated with the carrying out of rail infrastructure operations or rolling stock operations is the responsibility of the person best able to control that risk and that this will be the person carrying out those operations.

Principle of integrated risk management which provides that if approaches RSA 15 to managing risks associated with a particular railway have a potential impact on other railways or railway networks, the best practicable rail safety outcome should be sought.

Principle of enforcement which sets out the purposes for which enforcement of RSA 16 the RSA and regulations is to be carried out.

Principle of transparency and consistency which provides that rail regulatory RSA 17 decision making processes should be timely, transparent and nationally

Public Transport Safety Victoria | ACCREDITATION GUIDE  consistent.

RSA 18 Principle of participation, consultation and involvement of all affected persons which provides that the people and organisations who share responsibility for rail safety should participate and be involved in the management of risks associated with rail operations.

 ACCREDITATION GUIDE | Public Transport Safety Victoria 2 Scope of accreditation

2.1 What is accreditation?

2.1.1 Purpose of accreditation

RSA 35 The purpose of accreditation is to attest that a rail operator has demonstrated to the satisfaction of the Safety Director that the rail operator has the competence and capacity to manage the risks to safety associated with the rail operations for which accreditation was sought.

The Safety Director’s key concern is to ensure that accredited rail operators are able to manage the risks to safety associated with their rail operations. Ultimately, accreditation is designed to promote the safe operation of rail services in Victoria.

In assessing applications for accreditation, the Safety Director will focus on major risks to safety and the competence and capacity of the applicant to control, mitigate or lessen these risks. The Safety Director will therefore pay particular attention to the risk of major incidents occurring, such as collisions, derailments and fires. RSA 36 2.1.2 Offence not to be accredited

A rail infrastructure manager must not operate, or allow to be operated, rolling stock on rail infrastructure controlled by the rail infrastructure manager unless the rail infrastructure manager is accredited or has been exempted from accreditation.

It is important to note that the scope of this provision goes beyond the situation where a rail infrastructure manager operates rolling stock without being accredited. It will also be an offence if a rail infrastructure manager who is not accredited allows rolling stock to be operated on the rail infrastructure it controls.

A rolling stock operator must not operate rolling stock on rail infrastructure RSA 37 unless the rolling stock operator is accredited under the RSA or has been exempted from accreditation.

There are serious penalties for a rail infrastructure manager or a rolling stock RSA 36, operator who operates rolling stock, or causes it to be operated, without being 37 accredited.

Part 4 of this guideline sets out in more detail about who needs to be accredited.

Public Transport Safety Victoria | ACCREDITATION GUIDE  2.2 Who does not need to be accredited?

Not every person associated with a railway needs to be accredited. The RSA excludes some types of railways and also permits some operators to apply for an exemption from the need to be accredited.

2.2.1 Definition of “railway”

The RSA applies to railways. A railway is a guided system designed for the movement of rolling stock that has the capability of transporting passengers or freight or both on a railway track with a railway track gauge of 600 millimetres or more, together with its rail infrastructure.

“Railway” includes:

• a heavy railway

• a light railway

• a monorail railway

• an inclined railway

• a tramway

• a railway within a marshalling yard or passenger or freight terminal

• a private siding

• a railway that is prescribed by the regulations to be a railway (currently there are no other railways prescribed in the regulations).

2.3 Exclusions from accreditation

2.3.1 Railways excluded from the RSA

RSA 6 The RSA does not apply to all railways. The RSA (including provisions relating to accreditation) does not apply to:

• a railway in a mine that is underground, or chiefly underground, and that is used in connection with the performance of mining operations

- the railway must be used as part of the operation of a working

 ACCREDITATION GUIDE | Public Transport Safety Victoria mine. So a passenger train which uses part of a mine would not be excluded from the RSA.

• a railway that is operated solely within an amusement or theme park

- an amusement park is a site containing a variety of mechanical rides, equipment and other attractions for the purpose of public amusement, sightseeing or entertainment. A theme park is a site in which all of the entertainments and facilities are designed around a particular subject or idea. To be excluded, the railway must be enclosed and self-contained. It must have no interfaces with other railways or vehicular traffic, unless that traffic is associated solely with the park itself (for example, for ingress and egress). A theme park does not include a site which was previously operated as a working mine.

• a slipway

• a railway used only to guide a crane, or

• an aerial cable operated system.

2.3.2 Exemptions for private sidings

People who carry out rail operations using or in relation to a private siding can apply to the Safety Director for exemption from accreditation. Exempt rail operators must still comply with certain conditions.

A rail operator is a rail infrastructure manager and/or rolling stock operator. RSA 63(1)

Rail operators who can apply for an exemption

A rail infrastructure manager or rolling stock operator who carries out operations RSA 3 in or relating to a private siding can apply to the Safety Director for an exemption from the requirement to be accredited.

A private siding is a siding that is managed by a person other than a person who controls the rail infrastructure that the siding connects with or has access to. It does not include:

• a marshalling yard

• a siding used mainly to enable rolling stock to pass other rolling stock that is on the same track

Public Transport Safety Victoria | ACCREDITATION GUIDE  • a passenger terminal.

Example 1

ABC Pty Ltd operates rolling stock exclusively within a siding owned by DE Pty Ltd. The siding is used by ABC for the maintenance of rolling stock owned by other companies. The siding has access to the mainline to the XYZ Pty Ltd network. DE is responsible for the day to day management and maintenance of the siding.

As the siding is managed independently from the mainline network to which it connects:

• ABC is entitled to apply for exemption as a rolling stock operator,

• DE is entitled to apply for exemption as a rail infrastructure manager.

Example 2

MNO Pty Ltd own a siding on its land which connects to the QRS Pty Ltd network. QRS is also a rolling stock operator on its mainline, and carries out all movements of rolling stock into and out of the MNO siding. MNO only moves rolling stock using a rubber tyred tractor, and does not have any rail-mounted vehicles.

As the siding is managed independently from the mainline network to which it connects:

• MNO is entitled to apply for exemption as a rail infrastructure manager, but is not required to be a rolling stock operator as it has no rolling stock.

• QRS is not entitled to apply for exemption either as a rolling stock operator or as a rail infrastructure manager as it operates on the mainline, so it must be accredited.

Example 3

TUV Pty Ltd carries out shunting movements on a siding owned and managed by JKL Pty Ltd, who also manages the mainline to which the siding connects.

As the siding is not managed independently from the mainline network to which it connects:

• Neither TUV nor JKL are entitled to apply for exemption.

 ACCREDITATION GUIDE | Public Transport Safety Victoria Application for an exemption

The application to the Safety Director for an exemption must be made on an RSA 63(2) “Application for exemption” form. A copy of the form is set out in Appendix B. It must be accompanied by documents set out in the application form, including an interface coordination plan. See 6.3.5 below for a discussion about interface coordination plans.

Assessment by the Safety Director for exemption

The Safety Director will decide whether to grant or refuse to grant an exemption. RSA 63(3) The matters that will be taken into account by the Safety Director in making this RSA 63(4) decision are:

• the scale and complexity of the private siding

• the extent of the railway track layout and other rail infrastructure of the private siding, and any associated rolling stock operations

• the risks to safety associated with the operation and use of the private siding

• details of how the rail infrastructure and/or rolling stock is to be maintained

• the interface coordination plan accompanying the application, and

• any other matters that the Safety Director considers relevant.

If the Safety Director refuses to grant an exemption, the Safety Director must: RSA 63(7) RSA 63(8) • notify the accredited rail operator in writing

• inform the accredited rail operator of its right to seek review of the decision, and

• give reasons for the refusal.

A rail operator can seek review of the Safety Director’s decision by an application to the Victorian Civil and Administrative Tribunal (VCAT). Application forms and further details about the process for review can be found on VCAT’s website: www.vcat.vic.gov.au. VCAT can be contacted on (03) 9628 9755.

Requirements on exempt rail operators

It is important to note that all rail operators who are granted an exemption from RSA 63(5) accreditation by the Safety Director are still subject to certain conditions. These include the conditions contained in the Regulations or conditions imposed by the

Public Transport Safety Victoria | ACCREDITATION GUIDE  Safety Director.

Currently, there are no conditions contained in the Regulations. However, RSA 65(5) applicants for exemption should be aware that the following conditions will be applied to operators of exempt private sidings by the Safety Director:

• Immediately after becoming aware of the occurrence of a railway accident or incident (as defined in regulation 41 of the Regulations), the exempt rail operator must notify the Safety Director of the occurrence of that notifiable accident or incident.

• Immediately after becoming aware of a major incident (as defined under section 3 of the RSA), the exempt rail operator must notify:

- the emergency services, and

- the Safety Director

of the occurrence of that major incident.

• Within 7 days, the exempt rail operator must notify in writing the Safety Director of any change to information relating to the exempt rail operator’s application for an exemption, including changes to the person responsible for implementing the SMS.

• The exempt rail operator must not permit rail safety work for the exempt rail operator to be carried out by a rail safety worker who has not passed a health assessment in accordance with regulation 37 of the Regulations within twelve months prior to the date on which it is intended the rail safety worker would carry out the rail safety work.

• The exempt rail operator must not make any change to the abovementioned rail operations or to the manner of carrying out the abovementioned rail operations if the change would materially alter:

- the scale and complexity of the private siding

- the extent of the railway track layout and other rail infrastructure of the private siding and/or the extent of rolling stock operations within the private siding

- the risks to safety associated with the operation and use of the private siding, or

- the interface co-ordination plan,

as set out in the exempt rail operator’s application for exemption from the requirement to be accredited.

10 ACCREDITATION GUIDE | Public Transport Safety Victoria • The exempt rail operator must take reasonable steps to ensure that a rail safety worker who carries out, or is about to carry out, rail safety work for the exempt rail operator:

- does not have any concentration of alcohol in his or her blood or breath, and

- is not impaired by a drug.

• The exempt rail operator must take reasonable steps to ensure that rail safety workers have the required competence to carry out rail safety work.

An exempt rail operator (that is, a non-accredited rail operator) must still comply RSA 27 with the requirement to have in place an SMS. The SMS of a non-accredited rail Regs 13(b) operator must include the following: Regs Sch 3

• processes for the identification of potential risks to the safety of rail operations carried out by that rail operator for the purposes of developing an interface coordination plan

• copies of all interface coordination plans developed by the rail operator

• so far as is reasonably practicable, processes for the identification of incidents and hazards and the assessment of all possible incidents and hazards identified

• a description of the control measures adopted by the rail operator

• a risk register that includes:

- a comprehensive listing of hazards

- risks associated with each hazard

- the control measures applicable to each hazard

- nomination of the person responsible for each control measure

- key engineering, operational and maintenance standards applicable to each control measure, and

- any relevant cross-referencing to other related aspects of the SMS or regulations

• processes to ensure, so far as is reasonably practicable, that rail safety work is prioritised so that those hazards representing the greatest risk are given priority, and

Public Transport Safety Victoria | ACCREDITATION GUIDE 11 • details about how rail infrastructure and rolling stock within the private siding are to be maintained by the rail operator.

RSA 63(6) Rail operators who are granted an exemption must comply with any terms, conditions or limitations that are specified in their exemption. Failure to comply is an offence.

RSA 64 Revocation of accreditation exemptions

If the Safety Director considers that a private siding no longer meets the criteria set out for an exempt rail operator, then the Safety Director can revoke the exemption. The effect of this would be that the person operating the private siding would need to make an application for accreditation.

The Safety Director can only revoke an exemption by notice in writing. This would require the Safety Director to send a letter to the address identified on the application form. It is therefore essential that an applicant for accreditation ensures that the Safety Director is informed of any change in contact details.

RSA 66(2) 2.3.3 Exemptions for tourist and heritage operators from ongoing risk management requirements

An accredited tourist and heritage railway operator can apply to the Safety Director for exemption from the obligation to demonstrate ongoing compliance with risk management requirements.

RSA Accredited tourist and heritage railway operators 66(10) If an accredited rail operator is carrying out accredited rail operations for the purpose of operating a tourist and heritage railway, the Minister can declare the accredited rail operator to be an accredited tourist and heritage railway operator.

The Minister can make this declaration by publishing a notice in the Victorian Government Gazette stating that the accredited rail operator is an accredited tourist and heritage rail operator.

RSA 66(2) Application for an exemption

An accredited tourist and heritage railway operator can apply to the Safety Director for exemption from the obligation to demonstrate ongoing compliance with risk management requirements (see 6.4 - Risk Management).

An application must include a summary justification for exemption, explaining why the rail operator considers the application is justified.

12 ACCREDITATION GUIDE | Public Transport Safety Victoria An application must also include the following required information:

• estimated passenger journeys, train kilometres operated and expected number of operating days per year

• type of motive power, type of construction of passenger carriages, and expected carriage passenger loadings

• maximum speed of operation

• where more than one train or vehicle will be operational at any one time, an outline of how the infrastructure is controlled/arranged to minimise the possibility of a collision occurring

• the principle structures present

• a description of level crossings, including types of road crossed, types of protection, the associated traffic volumes and train speed of approach, and

• a copy of the rail operator’s risk register.

An application for exemption should demonstrate that the rail operator has consulted with parties or stakeholders who could reasonably be expected to be affected by the exemption (for example, other railways with running rights on the track of the applicant railway, municipalities, road authorities, private road owners). The application should provide summaries of their responses.

Finally, an application should provide details of any prosecutions or enforcement orders that have been made by other regulators or local authorities. If the rail operator is aware of any current or pending litigation against the rail operator then this should be declared.

The application for an exemption must be made in writing on the form provided RSA 66(3) in Appendix C. It must be accompanied by any other information reasonably required by the Safety Director.

Assessment by the Safety Director of exemption for tourist and heritage RSA 66(4) operators from ongoing risk management requirements RSA 66(5)

The Safety Director will decide whether to grant or refuse to grant an exemption. The matters that must be taken into account by the Safety Director in making this decision are:

• The scale and complexity of the accredited operations carried out by the accredited tourist and heritage railway operator:

- this can be demonstrated by reference to matters such as

Public Transport Safety Victoria | ACCREDITATION GUIDE 13 passenger train kilometres operated, number of passengers carried and train speed.

• The extent of the railway track layout and other rail infrastructure used for accredited tourist and heritage rail operations:

- this can be demonstrated by listing the principal structures present

- when more than one train will be operational at any one time, the application should show how infrastructure and layout is used to reduce the risk of a collision

- the application should contain a description of level crossings, including types of roads crossed, the associated traffic volume and train speed of approach.

• The risks to safety associated with the operation and carrying out of accredited rail operations:

- the application should explain why the railway is of a kind that can be exempted, referring to the risks presented by its operations and the relative simplicity of exercising control over them

- the application should include a list of titles and dates of all documents in the rail operator’s safety management system that describe how the rail operator will meet risk management requirements.

• Any other matters that the Safety Director considers relevant.

Applicants for exemption should be aware that administrative convenience and the cost of regulation are not determinative factors in issuing an exemption.

RSA 66(7) If the Safety Director refuses to grant an exemption, the Safety Director must: RSA 66(8) • notify the accredited rail operator in writing

• inform the accredited rail operator of its right to seek review of the decision, and

• give reasons for the refusal.

A rail operator can seek review of the Safety Director’s decision by an application to the VCAT. Application forms and further details about the process for review can be found on VCAT’s website: www.vcat.vic.gov.au. VCAT can be contacted on (03) 9628 9755.

Exemptions granted by the Safety Director are subject to the terms, conditions

14 ACCREDITATION GUIDE | Public Transport Safety Victoria and limitations specified in the exemption that are imposed by the Safety RSA 66(6) Director or set out in the Regulations. There are currently no conditions or limitations set out in the Regulations.

The relevance and appropriateness of the exemption will be reviewed at each annual safety audit.

Public Transport Safety Victoria | ACCREDITATION GUIDE 15 3. Safety Duties

3.1 Rail Safety

“Safety” as it is used in the RSA encompasses ideas of:

• protection from the risk of harm or injury

• minimising risk of harm or injury, and

• developing competency, capacities and systems to ensure safe operations.

RSA 101 The safety duties set out in the RSA are consistent with the safety duties in the Occupational Health and Safety Act 2004 (Vic) (OH&S Act).

Relevant provisions under the OH&S continue to apply to accredited rail operators and must be observed in addition to the safety duties under the RSA. Where a duty in the OH&S Act is inconsistent with a duty in the RSA, accredited rail operators must follow the OH&S Act.

If an accredited rail operator breaches one or more of its duties under the RSA, serious penalties apply. These penalties include significant fines and imprisonment.

RSA31 In certain circumstances, two or more breaches that arise out of the same circumstances can be charged as a single offence.

RSA 32 If an accredited rail operator breaches its safety duties, this will not give rise to a right on the part of another person to sue the accredited rail operator.

3.1.1 Safety duties of rail infrastructure managers

RSA 20 A rail infrastructure manager must, so far as is reasonably practicable, ensure the safety of rail infrastructure operations carried out by the rail infrastructure manager. Failure to meet these obligations is an offence. These obligations apply to all rail infrastructure managers, not just accredited rail infrastructure managers.

A rail infrastructure manager will be considered to have breached this obligation if he, she or it fails to, so far as is reasonably practicable:

• provide or maintain infrastructure that is safe

• provide or maintain systems of rail safety work that are safe

• provide:

16 ACCREDITATION GUIDE | Public Transport Safety Victoria - information, instruction, training or supervision to rail safety workers so that they can perform their rail safety work in a way that is safe, and

- information to persons on railway premises to ensure their safety.

A rail infrastructure manager must also:

• take steps to ensure that safety workers carrying out work for the rail infrastructure manager are complying with their rail safety duties

• take steps to ensure that rail contractors carrying out work for the rail infrastructure manager are complying with their rail safety duties.

When the Safety Director (or a transport safety officer) audits the accredited rail operator, the Safety Director will require evidence that these steps have been taken.

For example, the Safety Director may look to the procurement policies and procedures of the rail infrastructure manager, such as contractual arrangements with contractors which the rail infrastructure manager has in place, including standards and procedures that the rail infrastructure manager has specified to its contractor. In addition, the Safety Director may have regard to the training, required procedures or information (as appropriate) given to or required of rail safety workers with whom the rail infrastructure manager has dealings. In short, the Safety Director will be looking for evidence that a rail infrastructure manager is not just turning a blind eye to the conduct of a contractor or a rail safety worker in respect of safety, but has done what is reasonable and within its power to do.

3.1.2 Safety duties of rolling stock operators

A rolling stock operator must, so far as is reasonably practicable, ensure the RSA 21 safety of rolling stock operations carried out by the rolling stock operator. Failure to meet these obligations is an offence. These obligations apply to all rolling stock operators, not just accredited rolling stock operators.

A rolling stock operator will be considered to have breached this obligation if he, she or it fails to:

• provide or maintain rolling stock that is safe

• provide or maintain systems of rail safety work that are safe

• provide:

- information, instruction, training or supervision to rail safety

Public Transport Safety Victoria | ACCREDITATION GUIDE 17 workers so that they can perform their rail safety work in a way that is safe

- information to persons on railway premises to ensure their safety.

A rolling stock operator must also:

• take steps to ensure that safety workers carrying out work for the rolling stock operator are complying with their rail safety duties

• take steps to ensure that rail contractors carrying out work for the rolling stock operator are complying with their rail safety duties.

When the Safety Director (or a transport safety officer) audits the accredited rail operator, the Safety Director will require evidence that these steps have been taken.

For example, the Safety Director may look to the procurement policies and procedures of the rolling stock operator, such as contractual obligations the rolling stock operator has in place, including standards and procedures that the rolling stock operator has specified to its contractor.

In addition, the Safety Director may have regard to the training, required procedures or information (as appropriate) given to or required of rail safety workers.

In short, the Safety Director will be looking for evidence that a rolling stock operator is not just turning a blind eye to the conduct of a contractor or a rail safety worker in respect of safety, but has done what is reasonable and within its power to do.

Providers of rolling stock no longer need to be accredited. However, if providers meet the definition of a “rail contractor”, they will have certain statutory safety duties (3.1.3 - Safety Duties of Rail Contractors).

3.1.3 Safety duties of rail contractors

A rail contractor is a person who:

• designs, commissions, constructs, manufacturers, supplies, installs, erects, maintains, repairs, modifies or decommissions any thing that may be used as rail infrastructure or rolling stock (whether or not under an agreement with a rail infrastructure manager or a rolling stock operator), or

• is engaged directly or indirectly by a rail infrastructure manager or a rolling stock operator to supply rail infrastructure operations or rolling stock operations.

18 ACCREDITATION GUIDE | Public Transport Safety Victoria Rail contractors have a duty to ensure, so far as is reasonably practicable, that the “thing” to be used as rail infrastructure or rolling stock is safe if it is used for a purpose for which it was designed, commissioned, constructed, manufactured, supplied, installed, erected, maintained, repaired, modified, tested or examined.

The rail contractor must ensure that there is adequate information available RSA 22(1) about:

• the proposed use for the “thing”

• the results of any testing or examination carried out, and

• any conditions necessary to ensure the “thing” is safe if it is used appropriately.

If the rail contractor is decommissioning a “thing” used in rail infrastructure or rolling stock, the rail contractor has a duty to ensure, so far as is reasonably practicable, that the thing is decommissioned safely.

Rail contractors must carry out testing and examination necessary to comply with their duties, or arrange for such testing to be carried out.

If a rail contractor breaches one of the above duties under the RSA, serious penalties apply. These penalties include significant fines and imprisonment.

A rail contractor who supplies rail infrastructure operations or rolling stock operations to a rail operator must, so far as is reasonably practicable, ensure the safety of those operations. If a rail contractor breaches this duty, serious penalties apply.

A rail contractor will have failed to ensure the safety of its operations if it fails to: RSA 22(2)

• provide or maintain rail infrastructure that is, so far as is reasonably practicable, safe

• provide or maintain rolling stock that is, so far as is reasonably practicable, safe

• provide or maintain systems of rail safety work that are, so far as is reasonably practicable, safe

• supply rail infrastructure operations of rolling stock operations in accordance with the safety management system of the relevant rail operator

• provide information, instruction, training or supervision to rail safety workers to enable them to perform their work in a way that is safe

• provide information to persons on railway premises that is necessary to

Public Transport Safety Victoria | ACCREDITATION GUIDE 19 ensure their safety.

The Safety Director is of the view that among the strategies employed to ensure compliance with these duties, it would be prudent for a rail contractor to include the risk management requirements set out at 6.4 Risk Management Requirements.

3.1.4 Safety duties of rail safety workers

RSA 3 A rail safety worker is a person who has carried out, is carrying out or is about to carry out rail safety work. It includes:

• a person who is employed or engaged by a rail operator to carry out rail safety work

• a person engaged by someone other than a rail operator to carry out rail safety work

• a trainee

• a volunteer.

RSA 23 A rail safety worker has the following duties:

• to take reasonable care for his or her own safety

• to take reasonable care for the safety of persons who may be affected by the rail safety worker’s acts; and

• to cooperate with the rail operator or rail contractor employing or engaging them with respect to any action taken by the rail operator to comply with a requirement under the RSA or the Regulations

• not to intentionally or recklessly interfere with or misuse something that is provided to them by the rail operator or rail contractor for safety purposes

• not to wilfully or recklessly place the safety of another person at risk.

When the Safety Director is determining whether a rail safety worker has failed to take reasonable care, the Safety Director will consider what the rail safety worker knew about the relevant circumstances.

3.1.5 So far as is reasonably practicable

RSA 19 The decision as to what is reasonably practical is essentially an exercise of professional judgment. It requires a person making a decision to:

20 ACCREDITATION GUIDE | Public Transport Safety Victoria • eliminate risks to safety so far as is reasonably practicable, and

• if it is not reasonably practicable to eliminate risks to safety, to reduce those risks so far as is reasonably practicable.

In determining what is reasonably practical in relation to ensuring safety, the following factors should be considered:

• the likelihood of the hazard or risk concerned eventuating

• the degree of harm that would result if the hazard or risk eventuated

• what the person concerned knows, or ought reasonably to know, about the hazard or risk and any ways of eliminating or reducing the hazard or risk

• the availability and suitability of ways to eliminate or reduce the hazard or risk, and

• the cost of eliminating or reducing the hazard or risk.

Further information about the definition of “so far as is reasonably practicable” can be found at Appendix G.

Public Transport Safety Victoria | ACCREDITATION GUIDE 21 RSA 36,37 4 Categories of Accreditation

4.1 Rolling stock operators and rail infrastructure managers

Rail infrastructure managers and rolling stock operators cannot operate rolling stock in Victoria unless they are accredited or exempt from accreditation.

4.1.1 Rail infrastructure managers

RSA 3 A rail infrastructure manager is a person who controls rail infrastructure.

Rail infrastructure means the facilities that are necessary to operate a railway safely and includes (but is not limited to):

• railway track

• associated track structures and works (such as cuttings, tunnels, bridges, stations, platforms, tram stops, excavations, land fill, track support earthworks and drainage works)

• over-track structures

• under-track structures

• service roads

• signalling systems

• rolling stock control systems

• communications systems

• notices and signs

• overhead electrical power supply systems

• associated buildings, workshops, depots, yards, plant, machinery and equipment.

Rail infrastructure does not include rolling stock.

RSA 5 A person will be considered to control rail infrastructure if the person:

22 ACCREDITATION GUIDE | Public Transport Safety Victoria • owns rail infrastructure and uses that infrastructure to operate rolling stock, or to allow another person to operate rolling stock

• is entitled to use rail infrastructure to operate rolling stock, or to allow another person to operate rolling stock

• is required under a binding access arrangement or dispute resolution decision to allow another person to operate rolling stock on a railway that forms part of rail infrastructure:

- owned by the person, or

- used by the person under a right conferred by legislation or an agreement.

4.1.2 Rolling stock operators

A rolling stock operator is a person who is entitled to operate rolling stock on a RSA 3 railway because the person is:

• also the rail infrastructure manager who controls the railway on which the rolling stock is operated, or

• a party to an agreement that allows them to operate rolling stock on that railway, or

• allowed to operate rolling stock on that railway under a binding access arrangement or dispute resolution decision.

Rolling stock means a vehicle or part of a vehicle that operates on or uses a railway and includes:

• a locomotive

• carriage

• rail car

• rail motor

• light rail vehicle

• train

• tram

• light inspection vehicle

Public Transport Safety Victoria | ACCREDITATION GUIDE 23 • road/rail vehicle

• trolley

• wagon or monorail vehicle.

Rolling stock does not include a vehicle or part of a vehicle designed to operate both on and off a railway track when the vehicle is not operating on a railway track. When the vehicle is operating on a railway track, it is rolling stock.

Example

Operator A shunts carriages and locomotives in a siding for the purpose of maintenance of that rolling stock.

Operator A is a rolling stock operator, and would need to apply for accreditation or seek an exemption if it is operating within a private siding, as that is defined in the RSA.

4.1.3 Combined application

Regs 7 A rolling stock operator who is also the rail infrastructure manager may make one application for accreditation.

24 ACCREDITATION GUIDE | Public Transport Safety Victoria 5 Transitional provisions

5.1 Approach to transition period

The provisions of the RSA took effect on 1 August 2006. However, the new provisions for accreditation of rail operators will be phased in over a two year period for commercial operators and a three year period for tourist and heritage operators. The new accreditation provisions will take effect on 1 August 2008 and 1 August 2009, respectively. This means that existing accredited rail operators will remain accredited while they work towards accreditation under the new scheme.

PTSV is adopting a consultative and cooperative approach to the transitional period to ensure that rail operators seeking accreditation are provided with the necessary support and assistance to satisfy the requirements of the new scheme.

PTSV therefore encourages rail operators seeking accreditation to take a proactive approach to the transition period. Regular consultation with PTSV and early identification of issues will ensure that transition to accreditation under the new scheme is smooth and efficient.

In this section, “old scheme” refers to accreditation granted under Division 3 of Part VI of the TA and “new scheme” refers to accreditation granted under Division 2 of Part 5 of the RSA.

5.2 Existing accredited rail operators seeking accreditation

Accredited commercial rail operators will effectively remain accredited under the old scheme until 1 August 2008, unless voluntarily accredited under the new scheme earlier.

Accredited tourist and heritage rail operators will effectively remain accredited under the old scheme until 1 August 2009, unless voluntarily accredited under the new scheme earlier.

Under the old scheme of accreditation, all rail operators are accredited under Division 3 of Part VI of the TA. Under the new scheme of accreditation, all rail operators will be accredited under Division 2 of Part 5 the RSA.

All rail operators who are accredited under the old scheme will be deemed to RSA 172 have transitional accreditation under the new scheme. The RSA refers to this RSA 173 type of accreditation as a “transitional accreditation”.

Public Transport Safety Victoria | ACCREDITATION GUIDE 25 It is essential that all existing rail operators secure accreditation under the new scheme before their transitional accreditation expires to ensure that they can continue to operate after the relevant transition period expires.

RSA Existing accredited rail operators are subject to the conditions and restrictions 172(2), that they were subject to under the old scheme, provided that those conditions 172(4) are not inconsistent with the new scheme. However, it should be noted that an existing accredited rail operator must comply with the following obligations:

• If the rail operator is accredited in another state or territory, the rail operator must advise the Safety Director in writing immediately if its accreditation in the other state or territory is cancelled, suspended, varied, withdrawn or revoked.

• Rail operators must take reasonable steps to ensure that a safety worker carrying out work for that operator does not have more than the prescribed concentration of alcohol in his or her blood or breath, and is not impaired by a drug.

It is also important for rail operators to comply with those provisions of the RSA on commencement (1 August 2006) and 1 November 2006, and not at the end of the transition period. These are provisions which do not relate to accreditation, for example, safety duties.

A summary of these provisions is set out in Appendix D.

Provisions relating to fatigue management and interface co-ordination plans are effective from November 2006. PTSV will expect rail operators to be able to demonstrate that if they are not compliant, they have made substantial progress towards compliance.

PTSV will be adopting the staged process to ensure a smooth transition from accreditation under the old scheme to accreditation under the new scheme. The following is an overview of these stages.

26 ACCREDITATION GUIDE | Public Transport Safety Victoria Stage 1: Accredited operators undertake and provide a gap analysis between their current SMS, risk management processes and consultation procedures and the requirements of the legislation.

Stage 2: Operators prepare a risk management plan.

Stage 3: Operators submit an RSA implementation proposal, including SMS and risk register summaries.

Stage 4: Assessment by PTSV of whether the ARO fulfils criteria for accreditation under the legislation, and if so, issuing of new notices of accreditation.

Operators should note that PTSV is currently preparing materials outlining the above steps in more detail.

5.3 Operators seeking accreditation before 1 August 2006

The RSA refers to accreditations approved after 1 August 2006, but which RSA 173 were applied for before that date as “post new scheme accreditations”. Such accreditations are treated in the same way as transitional accreditations.

5.4 New operators seeking accreditation

Any new rail operator seeking accreditation from 1 August 2006 will need to apply for accreditation under the new scheme.

Part 6 of the Accreditation Guide sets out the process for applying for accreditation if you are a new applicant after 1 August 2006.

Public Transport Safety Victoria | ACCREDITATION GUIDE 27 6 Applying for Accreditation

6.1 Application process

RSA 38(1) A rail infrastructure manager can apply to the Safety Director for accreditation for the rail infrastructure operations the rail infrastructure manager intends to carry out.

RSA 38(2) A rolling stock operator can apply to the Safety Director for accreditation for the rolling stock operations the rolling stock operator intends to carry out.

This process applies to rail operators who are applying for accreditation in Victoria and are not accredited in another State or Territory (7 - Operations in Another State or Territory).

6.2 Application

RSA 38 An application for accreditation must be made on the approved form. A copy of Regs 6(1) the prescribed form is set out at Appendix A. Regs 6(2) The form must provide:

• a detailed description of the nature, character and scope of the proposed operations

• details of the applicant’s key personnel who are responsible for the safety of the operations, and their experience in rail operations

• details of the resources and systems relied on, and

• evidence of compliance with the risk management requirements set out in the RSA.

In addition, the applicant will need to attach documentary evidence of:

• competence and capacity to carry out the particular rail operations safely, including details of key safety personnel (for mutual recognition applicants, supply information concerning Victorian personnel)

• consultation regarding the preparation of an SMS with rail workers, employees who are health and safety representatives and any persons with whom you have entered into an Interface Coordination Plan

28 ACCREDITATION GUIDE | Public Transport Safety Victoria • SMS compliance with section 25 of the RSA and that it includes a register of ICPs

• capacity to meet potential accident liabilities

• information identifying risks that could require safety interfaces, and

• details of rights of access (rolling stock operators only).

6.2.1 Nature, character and scope of proposed operations

The description of the nature, character and scope of the proposed operations must provide detailed information about the type, extent, scale and key features of proposed operations.

This information should include details (as relevant) of: Regs 6(1)(a) Regs • the geographical area of the proposed operations 6(2)(a)

• the types of rail infrastructure and rolling stock that will be operated, (for example, description of safeworking rules, safeworking systems, signalling systems, communications systems, traction infrastructure, tunnels, level crossings, traction type, wagon type, train monitoring systems), and

• the nature of rail operations conducted (for example, freight or passenger services, dangerous goods, maintenance work, organisational structure and ownership, details of rail safety work contracted out or conducted in-house, operational parameters).

6.3 Supporting documentation

An application for accreditation must be accompanied by supporting documentation.

The required supporting documentation includes evidence that:

• demonstrates competence and capacity to carry out rail operations safely

• the rail operator has undertaken consultation

• the rail operator’s SMS complies with the RSA

• the rail operator has the capacity to meet potential accident liabilities

• details safety interfaces

Public Transport Safety Victoria | ACCREDITATION GUIDE 29 • details rights of access

• is of any other kind required by the Safety Director.

6.3.1 Documentary evidence of competence and capacity

The applicant needs to address two key criteria to satisfy this requirement.

Regs First, the applicant should provide details of the knowledge, skills and 6(1)(c) experience required by those persons who will be responsible for the Regs development, management and maintenance of the SMS to ensure that they 6(2)(c) perform their allocated tasks and discharge their allocated responsibilities effectively.

This should include information such as:

• organisational charts

• job descriptions, or other evidence of the roles in the organisation for ensuring training and maintenance of competence

• processes to ensure key personnel maintain the required knowledge, skills and experience

• evidence of the ability of senior management to make safety decisions, for example, relevant qualifications of key personnel or relevant previous experience of key personnel

• procedures for monitoring competency against required standards

• arrangements for ensuring staff comply with their training

• processes for ensuring safety critical tasks that require competence workers are identified.

Secondly, the applicant should provide details about the resources and systems that it will rely on to carry out its business safely, including for example, information about:

• human resources

• legal resources

• financial resources (including relevant financial statements)

• assets

• IT systems

30 ACCREDITATION GUIDE | Public Transport Safety Victoria • maintenance systems.

To satisfy this requirement, the applicant should provide a statement of how resourcing will occur, taking into account the proposed scope of the operations or assets.

6.3.2 Documentary evidence of consultation

The applicant must show that it has complied with the obligation to consult before establishing its SMS.

Before establishing an SMS, a rail operator must identify key stakeholders, and Regs consult with: 6(1)(d) Regs 6(2)(d) • persons who work on or at railway premises or with rolling stock, and RSA 26 any registered employee organisation representing them

• every person employed by the rail operator who is a health and safety representative

• any person with whom they have an interface coordination plan with, and

• any other person identified as a key stakeholder.

Documentary evidence of consultation could include:

• minutes of high level meetings undertaken for the purpose of consultation;

• minutes of risk workshops carried out with relevant parties;

• correspondence with relevant parties.

Note that the issues raised through the consultation process need to be addressed subsequently in practice. For example, the issues raised in the consultation plan will be considered by the Safety Director in carrying out the annual safety audit (10.3 - Audits).

6.3.3 Documentary evidence of the existence of and compliance with SMS

All rail operators must have in place an SMS at all times. There are significant penalties for rail operators who do not comply.

The applicant must provide evidence that its SMS complies with the RSA and RSA 27 the Regulations. The focus of this requirement is on showing that the SMS is Regs 6(1)(e) tailored to and suitable for the applicant’s proposed operations. Regs 6(2)(e)

Public Transport Safety Victoria | ACCREDITATION GUIDE 31 In order to satisfy this requirement, the applicant should provide:

• written policies

• register of procedures

• evidence demonstrating how the SMS picks up key performance indicators

• evidence demonstrating how the SMS is integrated into the business

• evidence demonstrating how the SMS is to be maintained

• evidence demonstrating how the SMS is linked to the Risk Register.

Further detail about the content of the SMS will be provided during the transition period.

6.3.4 Evidence of capacity to meet potential accident liabilities

The applicant must provide documentary evidence that it can meet reasonable potential accident liabilities arising from its rail operations.

Regs The document can show that the applicant has the financial capacity to meet 6(1)(f) reasonable potential accident liabilities arising from its operations.

Regs Alternatively, the document can show that the applicant has public risk 6(2)(f) insurance arrangements in place to meet reasonable potential accident liabilities arising from its operations.

6.3.5 Documentary evidence of safety interfaces

The applicant must provide information identifying potential risks to the safety of rail operations that may require the development of an interface coordination plan.

Regs An interface coordination plan is a plan developed by a rail operator that 6(1)(g) identifies and specifies the potential risks to the safety of rail operations carried Regs out by that rail operator at a place that may be caused or contributed to by: 6(2)(g)

RSA 3 • the activities or rail operations of another rail operator or activities of another person at that place, or

• the ownership, occupation or management of that place by another rail operator or another person.

In addition, the interface coordination plan must:

32 ACCREDITATION GUIDE | Public Transport Safety Victoria • identify and assess the potential risks to safety

• describe the measures to control those risks to safety and the person responsible for implementing and monitoring the performance of each of the control measures

• describe how the risks to safety will be managed under the interface coordination plan

• include arrangements for the provision of information by the rail operator to another person about the risks to safety

• include arrangements for the exchange of information between the rail operator and any person affected by the plan relating to matters that may affect the effectiveness of the plan, including but not limited to a change in the ownership of the rail operations concerned

• specify intervals for the review of the plan that do not exceed 5 years.

In order to satisfy this requirement, the applicant should provide a register of all relevant safety interfaces, including details of third parties, a summary of risks arising out of each interface, and a summary of controls in place to manage risks.

Where there is an interface between two or more rail operators, the ICP must be developed between rail operators. If one operator does not co-operate in the development or agreement of an ICP, the Safety Director may consider taking action against that operator for failing to comply with this requirement.

Where there is an interface between a rail operator and a person who is not a rail operator, the Safety Director has no power to require the non-operator to co- operate in the development and implementation of an ICP. However, the Safety Director would expect the rail operator to use its best endeavours to enter into such an ICP. The Safety Director would expect to see evidence that the rail operator has considered how best to manage any risks to safety which might arise as the result of a third party refusing or unable to enter into an ICP with the rail operator.

6.3.6 Documentary evidence of rights of access

This requirement only applies to rolling stock operators.

A rolling stock operator must provide evidence of any agreement with the rail Regs infrastructure manager who controls the rail infrastructure on which the rolling 6(2)(h) stock operator wishes to operate particular rolling stock. This will generally be in the form of an access agreement, but may also take the form of a lease or licence.

Public Transport Safety Victoria | ACCREDITATION GUIDE 33 6.3.7 Any other information required by the Safety Director

The Safety Director can require an applicant to supply further information, or to verify (by statutory declaration) information supplied for the purposes of the application.

RSA 38(4) Additional information required by the Safety Director will be determined on a case by case basis. For example, additional information could be requested about the applicant’s corporate structure or ownership, financial matters, or leasing arrangements. Normally, an applicant would be contacted directly by a member of PTSV if further information is required.

Sometimes the additional information requested might require the Safety Director or PTSV staff to attend the premises of the applicant.

6.4 Compliance with risk management requirements

The applicant must provide information in writing that they have taken all reasonable steps to comply with risk management requirements.

RSA 49(2) There are three key areas of risk management that must be addressed in the application:

• identification of incidents and hazards, and risk assessment

• measures to control likelihood, magnitude and severity of consequences of incidents, and

• emergency planning.

6.4.1 Identification of incidents and hazards, and risk assessment

A rail infrastructure manager must identify all incidents which could occur while carrying out rail infrastructure operations, and identify all hazards that could cause, or contribute to causing, those incidents. A rolling stock operator must identify all incidents which could occur while carrying out rolling stock operations and identify all hazards that could cause, or contribute to causing, those incidents.

RSA 50(1) A rail operator must document all aspects of any identification required, including RSA 50(2) the methods and criteria used for identifying incidents and hazards. A detailed description of requirements for the risk assessment is published in the SFARP guideline, which is Appendix G to this Guide. However, applicants should note the key requirements of the risk assessment, which are detailed below.

34 ACCREDITATION GUIDE | Public Transport Safety Victoria A rail operator must conduct a comprehensive and systematic assessment in RSA 50(3) relation to all possible incidents and all hazards that have been identified.

This assessment must involve an examination and analysis of the identified RSA 50(4) hazards and incidents that provide a detailed understanding of all aspects of RSA 50(5) risks to safety, including:

• the nature of each hazard and incident

• the likelihood of each hazard causing an incident

• in the event of an incident occurring, its magnitude and the severity of its consequences

• the range of control measures considered.

In conducting the assessment, a rail operator must consider hazards cumulatively as well as individually and use assessment methodologies appropriate to the hazards being considered.

A rail operator must document all aspects of the assessment. The RSA 50(6) documentation must include a risk register and: RSA 50(7)

• describe the methodology used in the examination and analysis

• directly address the four aspects of risks to safety listed above

• in relation to the nature and likelihood of each hazard, provide judgments and reasons for those judgments, and

• in relation to the range of control measures considered, provide statements as to their viability and effectiveness, and reasons for selecting certain control measures and rejecting others.

6.4.2 Measures to control consequences of incidents

A rail operator must adopt measures that eliminate (or, where elimination is not RSA 51 practicable, that reduce so far as is reasonably practicable):

• the likelihood of an incident occurring, or

• in the event of an incident occurring, the magnitude of the incident and the severity of its consequences.

There is further discussion on this in the SFARP guideline in Appendix G.

The measures adopted must include the adoption of an emergency plan (6.4.3 - Emergency planning).

Public Transport Safety Victoria | ACCREDITATION GUIDE 35 6.4.3 Emergency planning

All rail operators must prepare an emergency plan.

RSA 52(3) A rail infrastructure manager must prepare an emergency plan for the rail infrastructure it controls, and the rail infrastructure operations it carries out.

A rolling stock operator must prepare an emergency plan for the rolling stock operations it carries out.

RSA 52 The emergency plan must address:

RSA 52(1) • the consequences of a major incident occurring RSA 52(2) • methods to prevent an emergency from escalating RSA 52(4)(a) Regs 10 • initial response procedures for dealing with an emergency and the provision of rescue services

• recovery procedures for the restoration of rail operations and for the assistance of persons affected by the occurrence of an emergency

• the allocation of roles and responsibilities to persons employed by the rail operator relating to emergency management, including arrangements for communication and cooperation between organisations in the event of an emergency

• processes for the training of personnel who will be responsible for implementing the emergency plan and arrangements to maintain the competence of those persons in emergency management

• call-out procedures

• the allocation of personnel for the on-site management of the emergency

• procedures for liaison with relevant emergency services, including information about the circumstances in which the emergency services should be immediately contacted

• procedures to ensure that emergency services are provided with all the information that is reasonably required to enable them to respond effectively to an emergency

• the intervals within which the plan must be reviewed (not exceeding 3 years).

The emergency plan must be prepared in conjunction with the emergency

36 ACCREDITATION GUIDE | Public Transport Safety Victoria services that are identified as the emergency services best able to deal with emergencies caused by the major incidents and hazards identified (6.4.1 - Incidents, hazards and risk assessment) as part of the accredited rail operator’s risk assessment.

In preparing the emergency plan, the rail operator must also consult with: RSA 52(4) • the appropriate government agencies

• other rail operators who may be affected by the implementation of the plan

• rail safety workers, rail contractors and employees of the operator who may be required to implement the emergency plan

• any relevant local Council of the municipal district within which the rail operator carries out rail operations.

For example, if a site specific hazard involves dangerous goods, the ictorianV WorkCover Authority must be consulted on the preparation of that part of the emergency plan relating to the hazard.

Once the emergency plan is complete, the rail operator must keep a copy of it in an accessible location for use in the event of an emergency. Copies must be provided to the emergency services and any other relevant persons. The emergency plan must be kept and maintained by the rail operator and must be tested. For further details of how to maintain an emergency plan, see (10.2.5 - Emergency Plan Implementation).

Reg 11 6.5 Signing

The application for accreditation must be signed and declared by each signatory to be true and correct.

An application must be signed in accordance with the rules set out below. In addition, each signatory must declare that he or she is not a person who is disqualified under the Corporations Act 2001 from managing corporations. RSA 38(5)

A person will be disqualified from managing corporations if the person:

• is convicted of a relevant offence - “relevant offences” are set out in s 206B of the Corporations Act (Appendix H) and include, for example, offences concerning the management of a company

• is an undischarged bankrupt

Public Transport Safety Victoria | ACCREDITATION GUIDE 37 • is disqualified by a Court, or

• is disqualified by ASIC.

Special requirements for signature apply to a body corporate that is applying for accreditation. A body corporate is any body that has been incorporated and includes a private company, a public company, an incorporated association and a body deemed by statute to be a body corporate. The requirements for signature are as follows:

If the applicant is a company registered under the Corporations Act 2001, then the application must be signed in accordance with s 127 of that Act. This means it must be signed by:

RSA • two directors of the company, or 38(6)(a)

• a director and a company secretary of the company, or

• where the company has a sole director who is also the company secretary, that director.

In any other case, the application must be signed by each director, or each member of the committee of management of the body corporate. For example, this will apply to incorporated associations and to bodies deemed by statute to be bodies corporate.

If the applicant is an unincorporated association or body, the application must be signed by each member of the committee of management of the association or body.If the applicant is a partnership, the application must be signed by each partner. If the applicant is an individual, the application must be signed by the individual.

6.6 Fees

RSA An application for accreditation must be accompanied by the requisite fee. 38(6)(b) Table 1 sets out the various fees payable as at 1 August 2006. An applicant (c) and for accreditation should check that these fees have not changed at the date of (d) application.

38 ACCREDITATION GUIDE | Public Transport Safety Victoria Table 1 - accreditation fees payable

Regs Sch Approx 1 Fee to accompany an application for accreditation Units amount $ Regs 50 (a) Application made by a tourist and heritage operator 100 1075 Regs 51 (b) Application by any other rail operator 500 5375 Reg 52 Fee for issue of a temporary accreditation Reg 53 50 537.50 (payable for each week or part of a week) Fee for exemption from accreditation for a private siding rail operation 50 537.50 Fees to be paid after accreditation granted (a) In the case of a rail infrastructure manager:

- A pro rata fee of 2 fee units for each kilometre of railway track (variable) to be managed by the rail infrastructure manager in Victoria for the coming year. (b) In the case of a rolling stop operator:

- 1.9 fee units for each 1,000 kilometres, or part thereof, anticipated to be travelled by each freight train to be operated by the rolling stock operator in Victoria for the coming year; and (variable)

- 1 fee unit for each 1,000 kilometres, or part thereof, anticipated to be travelled by each passenger train or tramway car (including a light rail vehicle) to be operated by the rolling stock operator in Victoria for the coming year. (c) In the case of an accredited tourist and heritage operator 100 1075 Annual accreditation fee Regs 54 (a) An accredited rail infrastructure manager:

- An amount of 2 fee units for each kilometre of railway track (variable) managed by that person in Victoria based on the previous year. (b) An accredited rolling stock operator:

- 1.9 fee units for each 1,000 kilometres, or part thereof, travelled by each freight train operated by operator in Victoria during the previous financial year, and (variable)

- 1 fee unit for each 1,000 kilometres, or part thereof, travelled by each passenger train or tramway car (including a light rail) to be operated by the person in Victoria for the coming year. (c) An accredited tourist and heritage rail operator 100 1075 (d) In the case of a person acquiring an existing business to manage rail infrastructure or operate rolling stock, a pro rata fee calculated in accordance (variable) with the fees specified in items (a) and (b) above with reference to operations that formed part of the previous business in the previous year ending 31 August.

Public Transport Safety Victoria | ACCREDITATION GUIDE 39 6.7 Assessing accreditation

6.7.1 Criteria on which accreditation will be assessed

RSA 39 Criteria for all applications RSA 40 Applications for accreditation will be assessed by the Safety Director. The Safety Director must accredit a rail operator if the Safety Director is satisfied that the rail operator has:

• the competence and capacity to carry out those operations safely (6.2.1 - Nature, Character and Scope)

• taken all reasonable steps to comply with risk management requirements for accreditation

• demonstrated to the Safety Director that the rail operator’s SMS complies with the requirements for an SMS (6.3.3 - SMS compliance)

• demonstrated to the Safety Director that the rail operator has complied with the requirement to consult regarding the SMS (6.3.2 - Consultation)

• the financial capacity, or public risk insurance arrangements, to meet reasonable potential accident liabilities arising from the relevant operations (6.3.4 - Capacity to meet accident liabilities).

RSA 40(d) Additional criteria for rolling stock operators

In addition, a rolling stock operator who is not also the rail infrastructure manager controlling the railway on which the rolling stock will be operated must have shown that it has an agreement with the rail infrastructure manager who controls the relevant railway. The agreement must include appropriate arrangements for the safe operation of the rolling stock.

In practice, the Safety Director may give a temporary accreditation to a rolling stock operator for the purposes of obtaining an access agreement from a rail infrastructure manager. In this case, the requirement to obtain an access agreement will form part of the conditions of accreditation, and will normally stipulate a particular time frame.

RSA 42 If a rolling stock operator has made a reasonable attempt to obtain the agreement of the relevant rail infrastructure manager, but the rail infrastructure manager unreasonably delays negotiation or unreasonably refuses to enter into an agreement, then the Safety Director can issue both parties with a written notice.

Whether the rail infrastructure manager “unreasonably” delays negotiation or refuses to enter into an agreement will depend on the facts in each case. The

40 ACCREDITATION GUIDE | Public Transport Safety Victoria Safety Director will look at the conduct of both parties to determine whether the conduct of each has been reasonable or unreasonable. Both parties will be given an opportunity to comment before the Safety Director decides to give any direction.

If no agreement has been entered into by a date specified under the notice, then the Safety Director can determine arrangements to enable the safe operation of rolling stock, and direct the parties to give effect to the arrangements. Failure to comply with the direction is an offence.

Some examples of situations might include the following:

• A rail infrastructure manager fails to attend meetings arranged with the rolling stock operator to negotiate an access agreement

• The reason for delay or refusal is that the rail infrastructure manager wants to thwart the commercial interests of the rolling stock operator.

6.7.2 Time frame in which Safety Director must make a decision RSA 44

In general, the Safety Director must decide whether to accredit an applicant within 6 months of receiving an application.

The Safety Director can extend this period if necessary. If the Safety Director decides to extend the period, the applicant must be notified of that decision.

6.7.3 Notification and reasons if accreditation refused RSA 45

If the Safety Director refuses to accredit an applicant, the Safety Director must:

• notify the accredited rail operator in writing

• inform the accredited rail operator of its right to seek review of the decision, and

• give reasons for the refusal.

A rail operator can seek review of the Safety Director’s decision by an application to the VCAT. Application forms and further details about the process for review can be found on VCAT’s website: www.vcat.vic.gov.au. VCAT can be contacted on (03) 9628 9755.

6.7.4 Notice of accreditation

If accreditation is granted, the Safety Director will issue a Notice of Accreditation. The Notice will set out what the accredited rail operator is permitted to do. In particular, the Notice will reflect details of the scope and nature of the rail

Public Transport Safety Victoria | ACCREDITATION GUIDE 41 operator’s operations in sufficient detail to clearly articulate the limits of the accredited rail operator’s competence and capacity.

The Notice may also set out conditions or restrictions on the accreditation. Generally these conditions will be specific to the particular accredited rail operator. Further information about conditions of accreditation is set out in chapter 8 of this Accreditation Guide.

42 ACCREDITATION GUIDE | Public Transport Safety Victoria 7 Operations in another State or Territory

7.1 Process for mutual accreditation

A rail operator who is accredited in another State or Territory to carry out similar operations in that State or Territory can apply to have its accreditation recognised in Victoria.

Accreditation in Victoria for a rail operator who is already accredited in another State or Territory of the Commonwealth requires the rail operator to contact the interstate regulator in the first instance. The interstate regulator will work with PTSV to facilitate the application on the rail operator’s behalf.

7.1.1 Obtain key documents from interstate regulator

PTSV will ask the regulator to provide:

• a copy of the instrument of accreditation

• a statement of accredited activities

• the most recent audit report, and

• details of the rail operator’s SMS.

Once these documents have been obtained, PTSV will communicate with the rail operator directly.

7.1.2 Further requirements

The rail operator seeking recognition of its accreditation in Victoria must then RSA 39(b) satisfy the Safety Director that it has:

• taken all reasonable steps to comply with the rail safety duties (3.1 - Safety Duties)

• demonstrated to the Safety Director that the rail operator’s SMS complies with the requirements for an SMS (6.3.3 - SMS compliance)

• demonstrated to the Safety Director that the rail operator has complied with the requirement to consult regarding the SMS (6.3.2 - Consultation)

Public Transport Safety Victoria | ACCREDITATION GUIDE 43 • the financial capacity, or public risk insurance arrangements, to meet reasonable potential accident liabilities arising from the relevant operations (6.3.4 - Capacity to meet accident liabilities).

RSA 40(d) Additional criteria for rolling stock operators

In addition, a rolling stock operator who is not also the rail infrastructure manager controlling the railway on which the rolling stock will be operated must have shown that it has an agreement with the rail infrastructure manager who controls the relevant railway. The agreement must include appropriate arrangements for the safe operation of the rolling stock.

7.1.3 Time frame in which Safety Director must make decision

RSA 44 In general, the Safety Director must decide whether to accredit an applicant within 6 months of receiving an application.

The Safety Director can extend this period if necessary. If the Safety Director decides to extend the period, the applicant must be notified of that decision.

7.1.4 Notification and reasons if accreditation refused

RSA 45 If the Safety Director refuses to accredit an applicant, the Safety Director must:

• notify the accredited rail operator in writing

• inform the accredited rail operator of its right to seek review of the decision, and

• give reasons for the refusal.

A rail operator can seek review of the Safety Director’s decision by an application to the VCAT. Application forms and further details about the process for review can be found on VCAT’s website: www.vcat.vic.gov.au. VCAT can be contacted on (03) 9628 9755.

7.2 Changes to interstate accreditation

RSA 46(4) There is a condition on the accreditation of a rail operator who is accredited in another State or Territory that the rail operator must advise the Safety Director in writing immediately if the accreditation in the other State or Territory expires, is cancelled, suspended, varied, surrendered, withdrawn or revoked.

44 ACCREDITATION GUIDE | Public Transport Safety Victoria 8 Conditions of accreditation

8.1 Conditions applying to all rail operators under the legislation

RSA 46 A condition of accreditation is a limitation placed on accreditation. There are conditions of accreditation that all rail operators must comply with. These are set out in the legislation. Conditions may also be imposed by the Safety Director. Conditions are in addition to the other duties and obligations placed upon rail operators by the legislation.

8.1.1 Conditions for all rail operators

Change of information Regs 8

It is a condition of accreditation that an accredited rail operator must, within 7 days, notify the Safety Director in writing of any change to information:

• relating to the operator’s application for accreditation, and

• that was included in the application form submitted by the operator for that accreditation.

Example

If the registered business name or trading name of the accredited rail operator changes, the Safety Director must be informed of the change within 7 days. If the name of the directors of the accredited rail operator change, the Safety Director must be informed of the change within 7 days.

Interface coordination plan

It is a condition of accreditation that a rail operator must develop and implement Regs 17 an interface coordination plan in relation to any potential risks to the safety of Regs 18 rail operations.

An interface coordination plan is a plan developed by a rail operator that identifies and specifies the potential risks to the safety of rail operations carried out by that rail operator at a place that may be caused or contributed to by:

Public Transport Safety Victoria | ACCREDITATION GUIDE 45 • the activities or rail operations of another rail operator or activities of another person at that place, or

• the ownership, occupation or management of that place by another rail operator or person.

In addition, the interface coordination plan must:

• identify and assess the potential risks to safety

• describe the measures to control those risks to safety and the person responsible for implementing and monitoring the performance of each of the control measures

• describe how the risks to safety will be managed under the interface coordination plan

• include arrangements for the provision of information by the rail operator to another person about the risks to safety

• include arrangements for the exchange of information between the rail operator and any person affected by the plan relating to matters that may affect the effectiveness of the plan, including but not limited to a change in the ownership of the rail operations concerned

• specify intervals for the review of the plan that do not exceed 5 years.

Regs Reporting 46(4) It is a condition of accreditation that a rail operator gives the Safety Director a monthly report dealing with:

• the total number of employees in that month

• the total number of passenger journeys travelled in that month

• the total number of track kilometres

• the total number of passenger train kilometres

• the total number of freight train kilometres.

The report must be given to the Safety Director within 10 days after the end of the previous calendar month. The current pro forma report form is being reviewed and will be made available to industry shortly.

Regs It is a condition of accreditation that an accredited rail operator gives the Safety 49(4) Director an annual report dealing with:

46 ACCREDITATION GUIDE | Public Transport Safety Victoria • the extent to which the rail operator satisfies the key performance targets as specified in its SMS for the year

• the incidence of notifiable accidents or incidents and analyses of safety trends

• recommendations (if any) of audits conducted in accordance with the SMS

• recommendations (if any) of the findings of inspections conducted in accordance with the SMS

• findings of inquiries and investigations into railway accidents or incidents and subsequent implementation of actions to prevent a recurrence of any such occurrence

• a summary of changes made to the SMS in the previous financial year.

A copy of the report must be provided to the Safety Director within 30 days of it being completed.

Payment of fees Regs 51 (3) If the rail operator is issued with a temporary accreditation, then it is a condition of accreditation that the rail operator pays the relevant fee for temporary accreditation within 7 days of receiving the temporary accreditation.

It is a condition of accreditation that an accredited rail infrastructure manager Regs and an accredited rolling stock operator pay the relevant fee for accreditation 53(3) within 7 days of being accredited.

It is a condition of accreditation that an accredited rail infrastructure manager Regs and an accredited rolling stock operator pay the relevant annual fees before 30 54(4) September of each year.

Safety of workers

It is a condition of accreditation that an accredited rail operator takes reasonable RSA 46(5) steps to make sure that a safety worker carrying out work for that operator does not have more than the prescribed concentration of alcohol in his or her blood or breath, and is not impaired by a drug.

8.1.2 Conditions for operators accredited outside Victoria

There is an additional condition on the accreditation of a rail operator who is RSA 46(4) accredited in another State or Territory that the rail operator must advise the Safety Director in writing immediately if the accreditation in the other State or Territory expires, is cancelled, suspended, varied, surrendered, withdrawn or

Public Transport Safety Victoria | ACCREDITATION GUIDE 47 revoked.

8.1.3 Failure to comply is an offence

RSA 48 Failure to comply with a condition of accreditation is an offence. Serious penalties apply to those who do not comply with a condition placed on accreditation.

8.2 Conditions imposed by the Safety Director

RSA 46(2)(a) The Safety Director can impose conditions on any particular accreditation. These conditions will be determined by the Safety Director on a case-by-case basis.

RSA 48 Failure to comply with a condition of accreditation is an offence. Serious penalties apply to those who do not comply with a condition placed on accreditation.

8.3 Restrictions imposed by the Safety Director

The Safety Director can limit accreditation in any way the Safety Director thinks appropriate.

RSA 46 For example, the Safety Director can restrict the scope of accreditation so that it only applies:

• to part of a railway or to a particular type of service (in the case of a rail infrastructure manager)

• to a particular type of service or rolling stock (in the case of a rolling stock operator).

RSA 46(6) If an accredited rail operator who is subject to a restriction carries out any action that is inconsistent with the restriction, then the rail operator is not accredited to carry out that action.

RSA The implication of this is that the rail operator may be committing an offence 36,37 under the RSA.

Example

The Safety Director could restrict a rail infrastructure manager to provision of freight services. This would mean that it would not be accredited to operate passenger services.

48 ACCREDITATION GUIDE | Public Transport Safety Victoria 9 Changes to Accreditation

9.1 Variation and surrender of accreditation

9.1.1 Application by rail operator to vary

RSA 53 An accredited rail operator may apply for variation or revocation of conditions and restrictions

If an accredited rail operator’s accreditation is subject to conditions or RSA 53(1) restrictions, the rail operator can apply to the Safety Director to:

• vary a condition or restriction, or

• revoke a condition or restriction.

An application must be in writing, and must set out the reasons for the requested variation or revocation. There is no prescribed form for such an application.

The Safety Director can: RSA 53(2) RSA 53(4) • grant or refuse to grant the variation, or RSA 53(5) • agree or refuse to agree to the revocation.

If the Safety Director refuses to grant a variation, or refuses to agree to a revocation, then the Safety Director must:

• notify the accredited rail operator in writing

• inform the accredited rail operator of its right to seek review of the decision, and

• give reasons for the refusal.

A rail operator can seek review of the Safety Director’s decision by an application to the VCAT. Application forms and further details about the process for review can be found on VCAT’s website: www.vcat.vic.gov.au. VCAT can be contacted on (03) 9628 9755.

Public Transport Safety Victoria | ACCREDITATION GUIDE 49 RSA 54 In some circumstances, an accredited rail operator must apply for variation of accreditation.

RSA 54(1) An accredited rail operator must apply for a variation of accreditation if the accredited rail operator intends to make a change to their operations that can reasonably be expected to:

• change the nature, character and scope of the accredited rail operations, with the result that the operations are not within the competence, capacity and systems for which the accredited rail operator is accredited; or

• require a significant variation to a risk assessment.

RSA 54(2) An accredited rail operator will only be allowed to change their operations if the variation is granted. Serious penalties apply to those who do not comply.

The triggers for an application for variation under this provision are significant changes to operations or significant changes to risk. Minor changes to operations or to risk (for example, an upgrade to level crossing protection equipment using processes already approved in a SMS) would not require an application for variation.

A change to the nature, scope and character of the accredited rail operator’s operations, as set out in the Notice of Accreditation, will trigger the requirement to seek permission for the proposed variation.

Examples of significant changes to operations would include:

• geographic change to rail operations, for example, a new line or extension to a rail corridor

• maintenance or construction activities not currently undertaken

• higher train running speeds

• new signalling or safe working system

• new communications systems

• new train stations or new types of tram stops

• new types of rolling stock, including maintenance vehicles

50 ACCREDITATION GUIDE | Public Transport Safety Victoria • changing from a freight operator to a passenger rail operator

• a change in train crew working arrangements eg. 2 person to driver only operation.

Examples of significant changes to risk would include:

• changes that affect key safety performance targets outlined in the SMS

• implementation of new or removal/relaxation of existing operational or technical standard

• the removal of existing risk controls eg the removal of existing SPAD mitigation procedures and/or equipment

• significant changes that affect the ARO’s risk register

• change in skills/qualifications required to undertake rail safety work

• significant modification to maintenance controls.

An application must be in writing on the approved form, and must set out the RSA 54(3) reasons for the requested variation or revocation. The form is included in Appendix I to this Guide.

Note that this process has been known as “material change”. However, the Safety Director intends to vary conditions of accreditation to (among other things) remove the reference to “material change”. In determining applications to vary an accreditation, the Safety Director will have regard to a new guideline “PTSV Guideline for Safe Management of Change in the Rail Industry”. This guideline is Appendix I to this Guide.

The Safety Director can: RSA 54(5) RSA 54(6) • grant or refuse to grant the variation, or

• agree or refuse to agree to the revocation.

If the Safety Director refuses to grant a variation, or refuses to agree to a revocation, then the Safety Director must:

• notify the accredited rail operator in writing

• inform the accredited rail operator of its right to seek review of the decision, and

• give reasons for the refusal.

Public Transport Safety Victoria | ACCREDITATION GUIDE 51 A rail operator can seek review of the Safety Director’s decision by an application to the VCAT. Application forms and further details about the process for review can be found on VCAT’s website: www.vcat.vic.gov.au. VCAT can be contacted on (03) 9628 9755.

9.1.2 Variation by Safety Director

RSA 55 At any time, the Safety Director can vary or revoke a condition or restriction on an accreditation, or impose a new condition or restriction.

RSA 55 If the Safety Director intends to use his or her powers to vary accreditation, the Safety Director must first:

• notify the accredited rail operator in writing of the proposed change, and

• give the accredited rail operator an opportunity to respond to the proposed change within 10 business days.

The Safety Director does not have to give the accredited rail operator an opportunity to respond if it is necessary to take immediate action in the interests of public safety.

If the Safety Director makes the proposed change, the Safety Director must:

• notify the accredited rail operator in writing

• inform the accredited rail operator of its right to seek review of the decision, and

• give reasons for the refusal.

A rail operator can seek review of the Safety Director’s decision by an application to the VCAT. Application forms and further details about the process for review can be found on VCAT’s website: www.vcat.vic.gov.au. VCAT can be contacted on (03) 9628 9755.

RSA 56 9.1.3 Surrender of accreditation

An accredited rail operator can ask the Safety Director to agree to the surrender of the accredited rail operator’s accreditation.

A request to surrender accreditation must be made in writing.

If the Safety Director refuses to agree to the surrender of the accreditation, the Safety Director must:

52 ACCREDITATION GUIDE | Public Transport Safety Victoria • notify the accredited rail operator in writing

• inform the accredited rail operator of its right to seek review of the decision, and

• give reasons for the refusal.

A rail operator can seek review of the Safety Director’s decision by an application to the VCAT. Application forms and further details about the process for review can be found on VCAT’s website: www.vcat.vic.gov.au. VCAT can be contacted on (03) 9628 9755.

Public Transport Safety Victoria | ACCREDITATION GUIDE 53 10 Ongoing Compliance

10.1 Duration of accreditation

RSA 47(1) An accreditation will remain in force until:

• it is cancelled or surrendered (10.5.4 - Cancellation; 9.1.3 - Surrender), or

• the expiry of any period specified by the Safety Director for disciplinary reasons (10.5 - Disciplinary Inquiry).

RSA 47(2) The Safety Director can give a temporary accreditation for a period of less than 12 months.

10.2 Maintaining accreditation

Once accredited, there are a number of things a rail operator must do. This chapter outlines the steps a rail operator must take to maintain its accreditation properly.

10.2.1 Record maintenance

An accredited rail operator must prepare and maintain records relating to the training of rail safety workers.

Regs 40 Training records and Sch cl.6 A rail operator must prepare and maintain records indicating:

• the training undertaken by each rail safety worker (including the date and duration of training)

• the qualifications of each rail safety worker, including:

- units of competence undertaken

- the level of qualification attained

- if and when re-training is due

- the date re-training is undertaken.

• the name of the training organisation

54 ACCREDITATION GUIDE | Public Transport Safety Victoria • the name and qualifications of the assessor

Railway Safety records

These are documents which specify an account of the day to day operations of the rail operator, and include operational records, engineering records, and rail safety worker records (such as records of training and competence and health assessment records).

10.2.2 Reporting requirements

An accredited rail operator must prepare monthly and annual reports and provide these to the Safety Director.

Monthly reports Regs 46

A rail operator must give the Safety Director a report every calendar month. The report must be in the approved form and must include the following information:

• the total number of employees in that month

• the total number of passenger journeys travelled in that month

• the total number of track kilometres

• the total number of passenger train kilometres, and

• the total number of freight train kilometres.

A copy of the report must be provided to the Safety Director within ten days after the end of the previous calendar month.

A tourist and heritage railway operator can apply to the Safety Director for an Regs 47 exemption from this requirement.

The application should be in writing. It should set out the basis for seeking the exemption. The Safety Director will make a decision, having regard to:

• the size and nature of the organisation

• the volume and frequency of rolling stock and passenger movement

• any other matter which the Safety Director considers is relevant.

The Safety Director can grant an exemption in whole or in part, subject to any terms, conditions or limitations specified in the exemption, including, for example, what frequency of reporting is required for that operator.

Public Transport Safety Victoria | ACCREDITATION GUIDE 55 Regs 49 Annual safety reports

A rail operator must annually review its activities and prepare a report for the Safety Director.

The annual review and report must include information about:

• the extent to which the rail operator satisfies the key performance targets as specified in its SMS for the year

• the incidence of notifiable accidents or incidents and analyses of safety trends

• recommendations (if any) of audits conducted in accordance with the SMS

• recommendations (if any) of the findings of inspections conducted in accordance with the SMS

• findings of inquiries and investigations into railway accidents or incidents and subsequent implementation of actions to prevent a recurrence of any such occurrence

• a summary of changes made to the SMS in the previous financial year.

Regs 49 A copy of the report must be provided to the Safety Director within 30 days of it being completed.

10.2.3 Ongoing risk management

RSA 65(1) An accredited rail operator must demonstrate to the Safety Director within the relevant period that the accredited rail operator has taken all reasonable steps to comply with the requirements relating to risk management.

RSA 50- Requirements relating to risk management include: 52 • identification of incidents and hazards, and risk assessment

• measures to control likelihood, magnitude and severity of consequences of incidents, and

• emergency planning.

A full description of these requirements is included at [6.4 - Risk Management Requirements].

56 ACCREDITATION GUIDE | Public Transport Safety Victoria An accredited rail operator must demonstrate that it has taken these steps within RSA 65(2) the relevant period.

The relevant period means:

• 5 years after the date on which the rail operator was accredited (or any other period as prescribed), and RSA 66

• subsequently, every 5 years (or other period as prescribed).

An accredited tourist and heritage railway operator can apply to the Safety Director for an exemption from the requirement to show that it has taken all reasonable steps to comply with requirements relating to risk management. RSA 28 [2.4.3 - Tourist and Heritage Operators]

10.2.4 SMS compliance

An accredited rail operator must comply with the SMS it has in place. There are serious penalties for a rail operator who does not comply with this requirement. RSA 68(1)

10.2.5 Emergency plan

An accredited rail operator who has prepared an emergency plan [6.4.3 - Emergency Planning] is under an ongoing obligation to implement that plan without delay if:

• a major incident occurs, or RSA 68(2) • an incident occurs which could reasonably be expected to lead to a major incident. Regs 11 Failure to comply with the obligation to implement an emergency plan is an offence. Serious penalties apply to those who fail to comply.

In addition, an accredited rail operator must maintain its emergency plan. This means the accredited rail operator must keep a copy of the plan in a readily accessible location for use in the event of an emergency, and edit it to ensure Regs 11 it contains up to date information (for example, contact details of relevant personnel).

The accredited rail operator must also test the emergency plan or elements of the plan to make sure it remains effective. As far as reasonably practicable, the emergency services should participate in the tests of the plan. The plan must be tested at intervals determined in conjunction with the emergency services when preparing the emergency plan. It must also be tested within 3 months of a review of the emergency plan.

Public Transport Safety Victoria | ACCREDITATION GUIDE 57 In practice, testing of the emergency plan will require the rail operator to consider facts such as:

• the nature of the accredited rail operator’s operations

Regs 12 • the complexity of situations dealt with in the emergency plan

• the accessibility and availability of relevant emergency services personnel.

An accredited rail operator must review its emergency plan. This must be done in conjunction with the emergency services. It should take place at least every 3 years, and must also occur following the occurrence of a major incident.

Regs 41 10.2.6 Accidents and incidents

An accredited rail operator must investigate and report on railway accidents and incidents. It must notify certain people of a “major incident”.

“Railway accident or incident”

“Railway accident or incident” is defined in the Regulations and covers the following situations:

• an accident or incident on railway premises that results in the death of a person or that results in injury to a person resulting in that person requiring immediate medical treatment by a registered medical practitioner

• a running line derailment of any unit of rolling stock

• a collision between any rolling stock (other than a tram or light rail vehicle) and any person.

• a collision between any tram or light rail vehicle and any person, other vehicle, infrastructure, obstruction or object which resulted in significant property damage

Regs • an implosion, explosion, fire or other occurrence which resulted in 42(1) significant property damage, or

• a notifiable accident or incident.

Regs 44 A notifiable accident or incident is one that the Safety Director specifies to be a notifiable accident or incident. The Safety Director must specify the notifiable accident or incident by an instrument and a copy must be provided to the accredited rail operator.

58 ACCREDITATION GUIDE | Public Transport Safety Victoria The Regulations also define a notifiable circumstance. A notifiable circumstance means a circumstance, act or omission that resulted in (or had the potential to result in) death or serious injury to any person, or significant damage to property. It includes:

• any defect in, or failure of, any part of the rail infrastructure

• any defect in, or failure of, any rolling stock or any part of any rolling stock

• any failure or breach of any rail operations practice, procedure or rule

• any other circumstance, act or omission that the Safety Director has specified under the Regulations to be a notifiable circumstance.

The Safety Director has not specified any further circumstances, acts or RSA 67 omissions to be notifiable circumstances under the Regulations. Regs 45 Regs Sch Investigate and report railway accidents and incidents 4

An accredited rail operator must investigate any railway accident or incident that may affect accredited rail operations that the operator carries out.

The report prepared by the rail operator following the investigation must contain the information specified in Appendix F.

The accredited rail operator must provide the Safety Director with a copy of the report as soon as practicable after completing the report.

The Safety Director can ask an accredited rail operator to conduct a more detailed inquiry into an accident or incident, or provide further information, or clarify matters contained in the report. If the Safety Director asks for more information, the accredited rail operator must provide that information within 7 RSA 69(1) days of the request.

Duty to notify

As soon as an accredited rail operator becomes aware that a major incident has occurred, the accredited rail operator must immediately notify:

• the emergency services (with whom the rail operator developed its emergency plan)

• the Safety Director, and RSA 3 • the Chief Investigator.

The Chief Investigator is a new office established under the Transport

Public Transport Safety Victoria | ACCREDITATION GUIDE 59 Legislation (Safety Investigations) Act 2006. The Chief Investigator conducts investigations into major incidents to determine the causes of the incident, but not to apportion blame or take action against parties.

The contact details for the Chief Investigator are: Chief Investigator Level 10, 80 Collins Street Melbourne Vic 3000 Ph. 9095 4272

Regs 43 A major incident is defined as an incident or natural event that poses a serious and immediate risk to safety. It includes a derailment of rolling stock, a collision, a fire or an explosion.

Regs 44 An accredited rail operator must notify the Safety Director immediately after becoming aware that a railway accident or incident has occurred which may affect the accredited rail operations the operator carries out.

An accredited rail operator must notify the Safety Director in writing of a notifiable circumstance that has occurred in relation to the rail operations for which the rail operator is accredited within 72 hours of becoming aware of the notifiable circumstances.

The reporting requirements are designed to permit the Safety Director to:

• identify safety issues as quickly as possible

• analyse safety trends and issues so that the Safety Director can provide advice to the Minister

RSA 69(2) • give accurate feedback to operators - if operators have access to up-to- date data and trends, then they are in a better position to monitor their own systems.

Failure to comply with the obligation to notify is an offence. Serious penalties apply to those who fail to comply, including significant fines and imprisonment of up to 12 months for a natural person who breaches this provision.

However, the Safety Director is keen to work cooperatively with industry in this respect. The effectiveness of data obtained through reporting mechanisms relies on its accuracy and timelines. In turn, the effectiveness of safety initiatives can be undermined by inaccurate data. Individual accredited rail organisations should not hesitate to contact the Safety Director if they would like assistance in setting up or refining their data gathering and reporting mechanisms.

60 ACCREDITATION GUIDE | Public Transport Safety Victoria 10.3 Audits

10.3.1 Safety audits

RSA 29(1) The Safety Director must conduct (or order someone else to conduct) a safety audit of the accredited rail operations of an accredited rail operator at least once every 12 months.

Audits are conducted on behalf of the Safety Director by trained auditors within the Safety Director’s office. These auditors are also appointed as “transport safety officers”. The purpose of the safety audit is to review the safety management systems of rail operators to make sure they comply with the provisions of the legislation, and also to assess compliance with safety duties.

The Safety Director can conduct a safety audit more frequently than once every RSA 29(2) 12 months if the Safety Director considers it appropriate to do so.

Following a safety audit, the Safety Director (or transport safety officer) will raise any concerns they have with the accredited rail operator.

However, if the Safety Director (or transport safety officer) has concerns following a safety audit, the Safety Director (or transport safety officer) may decide to take one or more of the following steps:

• require the accredited rail operator to take corrective actions

• issue an improvement notice (10.5.1 - Improvement notice)

• issue a prohibition notice (10.5.2 - Prohibition notice)

• institute a compliance inspection (10.4.1 - Compliance inspection)

• institute a disciplinary inquiry (10.4.2 - Disciplinary inquiry)

• recommend changes to conditions of accreditation (8 - Conditions of accreditation).

The policy relating to enforcement is set out in Part 1 of the Compliance Manual for PTSV. You can contact PTSV if you would like a copy of this document.

10.3.2 Medical records audit

The Safety Director, or a transport safety officer, can conduct an audit of any RSA 30 medical records of people employed or engaged to perform rail safety work that are held by an accredited rail operator or by a rail contractor of the accredited rail operator. If the Safety Director or a transport safety officer conducts an audit

Public Transport Safety Victoria | ACCREDITATION GUIDE 61 of medical records, the accredited rail operator or rail contractor must provide access to relevant medical records.

An audit is an inspection of the medical records to find out whether the accredited rail operator or rail contractor has appropriate medical examination procedures and health monitoring systems in place. “Appropriate” systems and procedures will ensure that those employed or engaged to perform rail safety work are medically fit for the type of work they are required to perform.

An audit of medical records will normally take place at the same time as the annual safety audit.

Following a medical records audit, the Safety Director (or transport safety officer) will raise any concerns they have with the accredited rail operator.

However, if the Safety Director (or transport safety officer) has serious concerns following a medical records audit, the Safety Director (or transport safety officer) may decide to take one or more of the following steps:

• issue an informal warning

• issue an improvement notice (10.5.1 - Improvement notice)

• issue a prohibition notice (10.5.2 - Prohibition notice)

• institute a compliance inspection (10.4.1 - Compliance inspection)

• institute a disciplinary inquiry (10.4.2 - Disciplinary inquiry).

10.4 Inspections and Investigations

10.4.1 Compliance inspection

TA 228Z TA 228ZB The Safety Director can carry out a compliance inspection of the accredited TA 228T rail operator. In order to do this, transport safety officers are appointed by the Safety Director.

A compliance inspection may be initiated by the Safety Director:

• following an incident

• following a series of warnings or inadequate performance, or

• to review particular trends or concerns (for example, SPADS).

Following a compliance inspection, the Safety Director will raise any concerns

62 ACCREDITATION GUIDE | Public Transport Safety Victoria they have with the accredited rail operator.

However, if the Safety Director has concerns following a compliance inspection, the Safety Director may decide to take one or more of the following steps:

• require the accredited rail operator to take corrective action

• issue an improvement notice (10.5.1 - Improvement Notice)

• issue a prohibition notice (10.5.2 - Prohibition Notice)

• institute a compliance inspection (10.4.1 - Compliance inspection)

• institute a disciplinary inquiry (10.4.2 - Disciplinary inquiry)

• institute a prosecution

• vary the conditions of accreditation (9.1.2 - Variation by Safety Director)

• immediately suspend accreditation (10.5.3 - Suspension of accreditation).

10.4.2 Disciplinary inquiry

RSA 59(1) The Safety Director can hold a disciplinary inquiry to determine whether there is proper cause for taking disciplinary action against an accredited rail operator, or a person who was an accredited rail operator.

A disciplinary inquiry may be initiated by the Safety Director in response RSA 59(2) to repeated failure by the accredited rail operator to comply with audit requirements. It may also be initiated following an incident or accident, or some other conduct by the accredited rail operator which is of concern.

The purpose of the disciplinary inquiry is to determine whether there is “proper cause” for taking disciplinary action against an accredited rail operator.

There will be proper cause for taking disciplinary action if the accredited rail operator or formerly accredited rail operator:

• has breached the RSA or relevant parts of the TA and the relevant regulations under them

• has not complied with SMS requirements under the RSA

• does not have financial capacity or public risk insurance arrangements to meet reasonable potential accident liabilities

Public Transport Safety Victoria | ACCREDITATION GUIDE 63 • has not demonstrated that they can carry out accredited operations safely

• has obtained accreditation improperly, or

• has not paid any fee required by the Regulations.

RSA 59(3) If the Safety Director determines, following an inquiry, that there is proper cause for taking disciplinary action, then the Safety Director can do one or more of the following things:

• reprimand the accredited rail operator or formerly accredited rail operator

• in the case of an accredited rail operator

- warn them that if there are further reasons for taking disciplinary action, the accredited rail operator may be disqualified from holding an accreditation

- impose one or more new conditions or restrictions on the accreditation

- impose an expiry date on the accreditation

- suspend the accreditation for a specified period (10.5.3 - Suspension of accreditation)

- cancel the accreditation immediately or with effect from a specified date (10.5.4 - Cancellation of accreditation)

• disqualify the accredited rail operator or formerly accredited rail operator from holding accreditation (10.5.5 - Disqualification).

If the Safety Director holds an inquiry, the Safety Director:

• must act fairly and according to equity and good conscience, without regard to technicalities or legal forms - this includes ensuring that the relevant operator is made fully aware of the concerns the Safety Director has, and is given the opportunity to comment and provide input

• is not required to follow formal procedure - the Safety Director does not have to conduct any inquiry according to any set formal procedures

• is not bound by rules of evidence, but can inform himself or herself in relation to any matter that he or she thinks is relevant

• while the Safety Director has the power to summons people to provide

64 ACCREDITATION GUIDE | Public Transport Safety Victoria information or documents for the purpose of an inquiry, the Safety Director does not have to do so.

10.4.3 Investigation

TA 228Z The Safety Director can carry out an investigation of the accredited rail TA 228ZB operator. These will be conducted by transport safety officers appointed by TA 228T the Safety Director.

An investigation may be initiated by the Safety Director in response to a particular incident or accident.

Following an investigation, the Safety Director can:

• prepare an internal report or use information gathered in the investigation for data collection purposes

• inform the accredited rail operator of the concern and seek co- operation in addressing it

• issue an improvement notice (10.5.1 - Improvement notice)

• issue a prohibition notice (10.5.2 - Prohibition notice)

• initiate a prosecution

• vary the conditions of accreditation (9.1.2 - Variation by Safety Director)

• immediately suspend accreditation (10.5.3 - Suspension of accreditation).

10.5 Disciplinary action

10.5.1 Improvement notices

The Safety Director or a transport safety officer can serve an TA improvement 228ZZC notice on an accredited rail operator or other relevant person.

The Safety Director or a transport safety officer can serve an improvement notice on an accredited rail operator or a formerly accredited rail operator if the Safety Director or transport safety officer believes on reasonable grounds that the rail operator:

• is contravening a provision of a relevant transport safety law

Public Transport Safety Victoria | ACCREDITATION GUIDE 65 • has contravened a provision of a relevant transport safety law in TA 228Z circumstances that make it likely the contravention will continue or be TA 228ZB TA 228T repeated

• in the case of an accredited rail operator

- is contravening a condition or restriction of the operator’s accreditation, or

- has contravened a condition or restriction of the operator’s accreditation in circumstances that make it likely the contravention will continue or be repeated.

The improvement notice can require the rail operator to remedy the contravention (or likely contravention) within a period specified on the notice.The improvement notice must:

• state the basis for the Safety Director’s or transport officer’s belief on which the notice is based

• specify relevant provisions of transport safety law

• specify a reasonable date by which the contravention needs to be remedied

• include information about having the decision reviewed, and

• setting out the penalty for contravening the notice.

TA Contravention of an improvement notice is an offence. 228ZZE

Example

Following a medical records audit of an accredited rail operator, the Safety Director determines that the rail operator does not have appropriate medical examination procedures in place for ensuring that safety workers are not affected by alcohol before carrying out safety work. The Safety Director issues the rail operator with an improvement notice, requiring it to implement appropriate procedures. It gives the accredited rail operator a timeframe in which to comply.

66 ACCREDITATION GUIDE | Public Transport Safety Victoria 10.5.2 Prohibition notices TA 228ZZE

The Safety Director or a transport safety officer can serve a prohibition notice on any person who has or appears to have control over an activity that involves immediate risk to a person or to rail operations.

The Safety Director or a transport safety officer can serve a prohibition notice on TA a person who has or appears to have control over: 228ZZJ

• an activity at railway premises that involves immediate risk to the safety of a person, or

• an activity on or near rail infrastructure or rolling stock that involves immediate risk to the safety of rail operations.

A prohibition notice prohibits the carrying on of the activity, or limits the way the activity is carried on until the Safety Director or a transport safety officer has certified in writing that the circumstances giving rise to the risk have been remedied.

Contravention of a prohibition notice is an offence. TA 228ZZJ

Example

An accredited rail operator uses drivers employed by a particular contractor. The drivers, however, are not properly trained or assessed. The Safety Director or transport safety officer might issue a prohibition notice requiring the rail operator not to use drivers from the contractor until their competency can be established.

10.5.3 Suspension of accreditation

RSA 58 The Safety Director can immediately suspend an accreditation if it is necessary to do so in the interests of public safety or to protect the safety of rail workers.

The Safety Director can also suspend an accreditation if, following an RSA inquiry, the Safety Director is satisfied that proper cause for taking disciplinary 59(3)(iv) action exists.

Suspension can be for a specified period, until a specified event, or until a RSA 58 further determination is made by the Safety Director. RSA 59

An accredited rail operator whose accreditation has been suspended without

Public Transport Safety Victoria | ACCREDITATION GUIDE 67 an inquiry can require the Safety Director to hold an inquiry (10.4.2 - Disciplinary inquiry).

10.5.4 Cancellation of accreditation

RSA The Safety Director can an accreditation if, following an inquiry, the 59(3)(v) cancel Safety Director is satisfied that proper cause for taking disciplinary action exists.

Cancellation can take effect immediately or can take effect from a specified later date.

10.5.5 Disqualification of rail operator

RSA 59(c) The Safety Director can disqualify an accredited rail operator or a formerly accredited rail operator if, following an inquiry, the Safety Director is satisfied that proper cause for taking disciplinary action exists.

Disqualification can be until a specified event, or until a further determination is made by the Safety Director.

68 ACCREDITATION GUIDE | Public Transport Safety Victoria Public Transport Safety Victoria | ACCREDITATION GUIDE 69 70 ACCREDITATION GUIDE | Public Transport Safety Victoria Public Transport Safety Victoria

Accreditation Guideline

Appendix A

Application form for accreditation under the Rail Safety Act 2006

September 2006

This form is to be completed by rail operators seeking accreditation in Victoria. Before completing this form, you should read the Accreditation Guide.

For more information contact Public Transport Safety Victoria (PTSV). Telephone: (03) 9655 8949 Facsimile: (03) 9655 8929 Email: [email protected]

APPLICANT DETAILS 1 Person or company seeking accreditation Name of applicant: Registered office address: Postcode: Postal address: Postcode: ACN/ABN:

Telephone: Facsimile Email: Website: 2 Details of person(s) responsible for the application Name: Name: Position: Position: Telephone: Telephone: Facsimile: Facsimile: Email: Email: Key contract person Key contract person Name: Name: Position: Position: Telephone: Telephone: Facsimile: Facsimile: Email: Email: After hours contact: After hours contact: TYPE OF ACCREDITATION SOUGHT Rail infrastructure manager Rolling stock operator Is the rail operator currently accredited in another State or Territory? No Yes Office use only Mutual Recognition (see section 7.1 of the Accreditation Guide) Has an instrument of accreditation been provided? No Yes Has a statement of accredited activities been provided? No Yes Has a copy of the most recent audit been provided? No Yes Have details of the SMS been provided? No Yes ACCREDITATION REQUIREMENTS 3 Description of nature, character and scope of the proposed operations This description must provide detailed information about the type, extent, scale and key features of proposed operations. It should include details of the geographical area of the proposed operations, the types of rail infrastructure and rolling stock that will be operated and the nature of rail operations conducted. Attach documentary evidence as necessary (refer to the Accreditation Guide and the Management Of Change Guideline for further guidance).

1

4 Key personnel responsible for safety ( mutual recognition applicants – please identify key Victorian personnel ) You must provide details of the key personnel who are responsible for the safety of the operations, in particular the development, management and maintenance of the SMS, and their experience, knowledge and skills in rail operations. Attach documentary evidence (such as organisational charts, job descriptions, details of training programs and professional development) as necessary.

Any changes to the key personnel responsible for safety must be notified to the Safety Director. Name Position Experience

2

5 Resources and Systems ( does not apply for mutual recognition ) Provide details about the resources and systems you will rely on to carry out your business safely , including information about human resources, legal resources and financial resources (including copies of relevant financial statements). Attach documentary evidence as necessary.

6 Compliance with risk management Your application must demonstrate that you have complied with the risk management requirements. You must attach documents that demonstrate your:

1 Identification of incidents and hazards, and risk assessment;

2 Measures to control likelihood, magnitude and severity of incidents; and

3 Emergency planning.

4 Copy of risk register, which references related aspects of the SMS.

3

7 Supporting documentary evidence The following documents must be attached to your application:

1 Evidence of competence and capacity to carry out rail operations safely, including details of key safety personnel (for mutual recognition applicants, supply information concerning Victorian personnel );

2 Evidence of consultation regarding the preparation of an SMS with rail workers, employees who are health and safety representatives and any persons with whom you have entered into an Interface Coordination Plan;

3 Demonstration that SMS complies with section 25 of the Act and includes a register of ICPs (see the Accreditation Guide);

4 Evidence of capacity to meet potential accident liabilities;

5 Information identifying risks that could require safety interfaces; and

6 Details of rights of access (rolling stock operators only).

8 Fee You must attach the appropriate fee.

4

SIGNATURE AND DECLARATION Signature If the applicant is a company within the meaning of the Corporations Act 2001 , then the application must be signed in accordance with s 127 of that Act. This means it must be signed by: • two directors of the company; or • a director and a company secretary of the company; or • where the company has a sole director who is also the company secretary, that director. If the applicant is any other incorporated body (such as an incorporated association or a bodies deemed by statute to be a body corporate), the application must be signed by each director, or each member of the committee of management of the body corporate.

If the applicant is an unincorporated association or body , the application must be signed by each member of the committee of management of the association or body.

If the applicant is a partnership , the application must be signed by each partner.

If the applicant is an individual , the application must be signed by the individual.

Declaration Read the following declaration carefully before signing this document. This is a personal declaration and undertaking by each signatory to this application. Where the applicant is a company, by making this declaration the nominated directors and managers of the company are assuming the company’s compliance with this declaration and undertaking. Declaring falsely may result in accreditation being suspended or cancelled.

In accordance with s 38(5), s 38(6) and s 38(7) of the Rail Safety Act 2006 (Vic), I declare that: • This is an application for accreditation; and • All information provided in relation to this application is true and correct; and • I am not a person who, under Part 2D.6 of the Corporations Act, is disqualified from managing corporations.

1. 2. Name

Position(s)

Signature

Date

3. 4. Name

Position(s)

Signature

Date

If you have more than four signatories, please attach an additional sheet including the extra signatories.

Note that if any of the information included on this application form or in the attached documentation changes, you are obliged to inform the Safety Director.

5

Please return this form to:

Manager, Accreditation Public Transport Safety Victoria GPO Box 2797Y Melbourne Vic 3001 Phone (03) 9655 8949 Fax (03) 9655 8929

Office use only Comments

Recommended for Accreditation? No Yes Nominating Manager Name:

Signature:

Date:

6

CHECKLIST FOR ACCREDITATION

1 Application form

Detailed description of the nature, character and scope of operations

Details of key safety personnel

Resources and systems

2 Compliance with risk management

Identification of incidents and hazards, and risk assessment, including a risk register

Measures to control likelihood, magnitude and severity of incidents

Emergency planning

3 Supporting documentary evidence

Evidence of competence and capacity to carry out operations safely, including details of key safety personal and resources and systems

Evidence of consultation regarding the preparation of an SMS with rail workers, employees who are health and safety representatives and any persons with whom you have entered into an Interface Coordination Plan

Demonstration that SMS complies, including register of ICPs

Evidence of capacity to meet potential accident liabilities

Information identifying risks that could require safety interfaces

Details of rights of access (rolling stock operators only)

4 Signature

Signature of appropriate persons

Declaration that persons signing not disqualified

5 Fee

Appropriate fee

7 Public Transport Safety Victoria

Accreditation Guideline

Appendix B

Application for exemption from accreditation (private sidings) under the Rail Safety Act 2006

September 2006

For more information contact Public Transport Safety Victoria (PTSV). Telephone: (03) 9655 8949 Facsimile: (03) 9655 8929 Email: [email protected]

APPLICANT DETAILS 1 Person or company seeking private siding exemption Name of applicant: Registered office address: Postcode: Postal address: Postcode: ACN/ABN:

Telephone: Facsimile: Email: Website: 2 Details of person(s) responsible for the application Name: Name: Position: Position: Telephone: Telephone: Facsimile: Facsimile: Email: Email: EXEMPTION REQUIREMENTS 3 Description of private siding Please list the rail infrastructure and/or associated rolling stock operations for which you are seeking exemption. Ensure that you include details of: • the scale and complexity of the private siding, including a diagram; and • the extent of the railway track layout an other infrastructure of the private siding; and • the risks associated with the operation and use of the private siding; and • details of how the rail infrastructure and/or rolling stock is to be maintained. Attach documentary evidence as necessary.

1

4 Supporting documentary evidence Your application must be accompanied by the following documentary evidence:

1 Interface Coordination Plan(s) (see Part IV of the Regulations for the required content of an Interface Coordination Plan).

2 Evidence of consultation regarding the preparation of an SMS (see Schedule 3 of the Rail Safety Regulations 2006) with rail workers, employees who are health and safety representatives and any persons with whom you have entered into an Interface Coordination Plan.

3 Evidence of the procedures in place to ensure the health and fitness of the rail safety worker.

4 Evidence of the procedures to be taken to ensure that rail safety workers who will carry out work for you do not have more than the prescribed concentration of alcohol in their blood and are not impaired by a drug.

5 Risk register (see Schedule 3).

5 Fee Your application must be accompanied by the appropriate fee. $537.50

2

DECLARATION Signature If the applicant is a company within the meaning of the Corporations Act 2001 , then the application must be signed in accordance with s 127 of that Act. This means it must be signed by: • two directors of the company; or • a director and a company secretary of the company; or • where the company has a sole director who is also the company secretary, that director. If the applicant is any other incorporated body (such as an incorporated association or a bodies deemed by statute to be a body corporate), the application must be signed by each director, or each member of the committee of management of the body corporate.

If the applicant is an unincorporated association or body , the application must be signed by each member of the committee of management of the association or body.

If the applicant is a partnership , the application must be signed by each partner.

If the applicant is an individual , the application must be signed by the individual.

Declaration Read the following declaration carefully before signing this document. This is a personal declaration and undertaking by each signatory to this application. Where the applicant is a company, by making this declaration the nominated directors and managers of the company are assuming the company’s compliance with this declaration and undertaking. Declaring falsely may result in accreditation being suspended or cancelled.

I declare that: • This is an application for a private siding exemption; and • All information provided in relation to this application is true and correct; and • I am not a person who, under Part 2D.6 of the Corporations Act, is disqualified from managing corporations.

1. 2. Name

Position(s)

Signature

Date

3. 4. Name

Position(s)

Signature

Date

If you have more than four signatories, please attach an additional sheet including the extra signatories.

Note that if any of the information included on this application form or in the attached documentation changes, you are obliged to inform the Safety Director.

3

Please return this form to:

Manager, Accreditation Public Transport Safety Victoria GPO Box 2797Y Melbourne Vic 3001 Phone (03) 9655 8949 Fax (03) 9655 8929

Office use only Comments

Recommended for exemption? No Yes Nominating Manager Name:

Signature:

Date:

4

CHECKLIST FOR PRIVATE SIDING EXEMPTION

1 Application form

Description of railway infrastructure and/or rolling stock

2 Supporting documentary evidence

Interface Coordination Plan(s) (see Part IV of the Regulations for the required content of an Interface Coordination Plan)

Evidence of consultation regarding the preparation of an SMS with rail workers, employees who are health and safety representatives and persons with whom you have entered into an Interface Coordination Plan

Evidence that you have taken reasonable steps to ensure that rail safety workers who will carry out work for you do not have more than the prescribed concentration of alcohol in their blood and are not impaired by a drug

Evidence of the procedures in place to ensure the health and fitness of the rail safety worker

Risk register

Details of the private siding

4 Signature

Signature of appropriate persons

Declaration that persons signing not disqualified

5 Fee

Appropriate fee $537.50

5 Public Transport Safety Victoria

Accreditation Guideline

Appendix C

Application for exemption from ongoing risk management requirements under the Rail Safety Act 2006

September 2006

For more information contact Public Transport Safety Victoria (PTSV). Telephone: (03) 9655 8949 Facsimile: (03) 9655 8929 Email: [email protected]

APPLICANT DETAILS 1 Person or company tourist and heritage operator exemption Name of applicant: Registered office address: Postcode: Postal address: Postcode: ACN/ABN:

Telephone: Facsimile: Email: Website: 2 Details of person(s) responsible for the application Name: Name: Position: Position: Telephone: Telephone: Facsimile: Facsimile: Email: Email: 3 Evidence of tourist and heritage operator status Office use only Is the operator declared to be an accredited tourist and heritage operator in the Government Gazette? No Yes EXEMPTION REQUIREMENTS 4 Description of operations Describe your operations, including details of • the scale and complexity of the rail operations, including: o estimated passenger journeys, train kilometres operated and expected number of operating days per year; o type of motive power, type of construction of passenger carriages, and expected carriage passenger loadings; o maximum speed of operation; o where more than one train or vehicle will be operational at any one time, an outline of how the infrastructure is controlled/arranged to minimise the possibility of a collision occurring; o the principle structures present; o a description of level crossings, including types of road crossed, types of protection, the associated traffic volumes and train speed of approach; • the extent of the railway track layout and other rail infrastructure used for the carrying out by the accredited tourist and heritage railway operator of accredited rail operations; and • the risks to safety associated with the carrying out of accredited rail operations, including: o a copy of the risk register.

1

5 Summary of justification for exemption An application must include a summary justification for exemption, explaining why you consider the application justified.

2

6 Summary of consultation Please provide evidence that you have consulted with parties or stakeholders who could reasonably be expected to be affected by the exemption (for example, other railways with running rights on the trackage of the applicant railway, municipalities, road authorities, private road owners). Include summaries of their responses. Attach documentary evidence of consultation.

7 Details of prosecution or enforcement orders Please provide details of any prosecutions or enforcement orders that have been made by other regulators or local authorities in relation to your operations. If you are aware of any current or pending litigation against you then this should be declared. Attach documentary evidence as necessary.

3

DECLARATION Signature If the applicant is a company within the meaning of the Corporations Act 2001 , then the application must be signed in accordance with s 127 of that Act. This means it must be signed by: • two directors of the company; or • a director and a company secretary of the company; or • where the company has a sole director who is also the company secretary, that director. If the applicant is any other incorporated body (such as an incorporated association or a bodies deemed by statute to be a body corporate), the application must be signed by each director, or each member of the committee of management of the body corporate.

If the applicant is an unincorporated association or body , the application must be signed by each member of the committee of management of the association or body.

If the applicant is a partnership , the application must be signed by each partner.

If the applicant is an individual , the application must be signed by the individual.

Declaration Read the following declaration carefully before signing this document. This is a personal declaration and undertaking by each signatory to this application. Where the applicant is a company, by making this declaration the nominated directors and managers of the company are assuming the company’s compliance with this declaration and undertaking. Declaring falsely may result in accreditation being suspended or cancelled.

I declare that: • This is an application for a tourist and heritage operator exemption; and • All information provided in relation to this application is true and correct; and • I am not a person who, under Part 2D.6 of the Corporations Act, is disqualified from managing corporations.

1. 2. Name

Position(s)

Signature

Date

3. 4. Name

Position(s)

Signature

Date

If you have more than four signatories, please attach an additional sheet including the extra signatories.

Note that if any of the information included on this application form or in the attached documentation changes, you are obliged to inform the Safety Director.

4

Please return this form to:

Manager, Accreditation Public Transport Safety Victoria GPO Box 2797Y Melbourne Vic 3001 Phone (03) 9655 8949 Fax (03) 9655 8929

Office use only Comments

Recommended for Accreditation? No Yes Nominating Manager Name:

Signature:

Date:

5

CHECKLIST FOR TOURIST AND HERITAGE EXEMPTION

1 Application form

Description of operations

Summary of consultation

Details of prosecution or enforcement orders

Summary of justification for exemption

2 Supporting documentary evidence

Evidence of consultation with parties who could reasonably be expected to be affected by the exemption;

Evidence of any prosecution or enforcement orders made in relation to your operations, or any current or pending litigation.

3 Signature

Signature of appropriate persons

Declaration that persons signing not disqualified

6 Public Transport Safety Victoria

Accreditation Guideline

Appendix D

Start dates for legislative provisions

September 2006

For more information contact Public Transport Safety Victoria (PTSV). Telephone: (03) 9655 8949 Facsimile: (03) 9655 8929 Email: [email protected]

Subject matter Provision Date Comment provision takes effect Establishment of the s. 9K Transport 1 August All current delegations and Safety Director Act 1983 2006 powers cease, except in certain limited situations. The Safety Director can now exercise his/her own power, as opposed to being a delegate of the Secretary. Jurisdiction of Safety Sch 2 1 August Public Transport Competition Director re bus Transport 2006 Act 1995 has been amended accreditation Legislation to replace references to (Further “Secretary” with “Safety Amendment) Director”. Act 2006 Application for s. 38 RSA 1 August All new applicants for accreditation – RSO or 2006 accreditation must comply RIM with the new scheme. Accreditation of providers s. 119 RSA 1 August A person who falls within the ceases 2006 definition of “rolling stock operator” or “rail infrastructure manager” must be accredited. The fact that the person performs work under a contract with another accredited rail operator is not sufficient of itself to remove the requirement for accreditation. Each case will be considered individually. Existing accreditations of s. 172 RSA, 1 August Effect - commercial AROs RSO and RIM continue Division 3 of 2006 with transitional accreditation as “transitional Part 6 of the have until 1 August 2008 to accreditations” and Transport Act. become compliant with new Transport Act provisions accreditation scheme, and apply. tourist & heritage have until 1 August 2009. In the meantime, AS 4292 is the relevant standard for SMSs. NB tourist and heritage operators must be gazetted by the Minister as such. Existing statutory and s.172(2), (3) 1 August Current “conditions” will be other conditions and and (4) RSA 2006 varied by the Safety Director restrictions on in order to provide for greater accreditation apply, legal clarity, and also to except those inconsistent reference the new guideline with the RSA. relating to variations to accreditation. Current “special conditions” will be retained. Note that certain new provisions now apply as conditions of accreditation, and some conditions set out in the Transport (Rail Safety) Regulations 1998 are preserved. A summary of these is attached in the schedule.

The Safety Director can s.174 1 August See above. vary conditions of 2006 Also note that the Safety accreditation under RSA Director will consider imposing additional conditions on individual operators if the operator does not develop and implement an adequate transition plan. The plan ought to include a gap analysis between the operator’s current SMS and what is required under the RSA, an outline of a compliant SMS, and a draft risk register. The reason for this is to promote compliance prior to the end of the transition period. Existing application for s. 170 RSA 1 August Effect - commercial AROs accreditation as RSO or 2006 with post new scheme RIM to be assessed accreditation have until 1 under Transport Act August 2008 to become accreditation provisions compliant with new regime, and referred to as “post and tourist & heritage have new scheme until 1 August 2009. accreditation” once NB tourist and heritage approved operators must be gazetted by the Minister as such. Application for variation of s.54, s.178 1 August Current Transport Act accreditation RSA 2006 provisions apply for commercial AROs with transitional accreditation or post new scheme accreditation – 1 August 2008, and tourist & heritage – 1 August 2009 NB current conditions of accreditation will be varied to reference new MOC guideline (see above). Requirements for an SMS See div 4 of 1 August Commercial AROs with part 3 RSA, 2006 transitional accreditation or s.178 post new scheme accreditation – 1 August 2008, and tourist & heritage – 1 August 2009. AS 4292 is the relevant standard for SMSs. Risk management Div 3 of part 5 1 August Commercial AROs with provisions and ongoing RSA, s.38, 2006 transitional accreditation or review of risk ss.170, 172 post new scheme management system RSA, s.65, accreditation – 1 August s.179 RSA 2008, and tourist & heritage – 1 August 2009

Reporting requirements – Reg 45 1 November Application needs to be Investigation reports, Investigation 2006 made in writing for an Monthly reports, report exemption from reporting Exemptions from Reg 46 requirements, and is only reporting requirements Monthly reports available for tourist & Reg 47 heritage operators. Exemptions from reporting requirements Reporting requirements – Regs 41-44 1 August notifiable accidents and 2006 incidents, notifiable circumstances Duty to preserve incident Reg 48 1 November site 2006 Annual reviews and Reg 49 1 November reports 2006 Ensure workers are fit to Reg 35 1 August carry out rail safety work 2006 Health assessments Reg 37 1 August 2006 Fatigue management Regs 36 1 November Note start date for all AROs. requirements 2006 Competence of rail safety Reg 38 1 August workers 2006 Assessment of rail worker Reg 39 1 November Note start date for all AROs competence 2006 Records of competence Reg 40 1 August and training 2006 Interface co-ordination Part 4 of Regs 1 November PTSV will expect transitional plans (form part of the 2006 and post new scheme conditions of accredited operators to be accreditation) applying these provisions by the start date. Appointment of TSOs for s. 228T TA, Div 1 August All current authorities cease, compliance purposes, 4B of Part 10 2006 except Authorised Officers s including new powers TA for drug and alcohol testing Appointment of TSOs for s.228T TA(as 1 August New TSOs for drug and drug and alcohol amended – 2006 alcohol must receive purposes s.61 amending appointment setting out Act) restrictions and conditions, and an ID card Improvement and Subdivisions 9 1 August These can be issued by a prohibition notices and 10 of Div 2006 TSO or the Safety Director. 4B of Part 10 of They are reviewable by the TA Safety Director (if issued by a TSO) or the VCAT (if issued by the Safety Director or reviewed by the Safety Director). Safety duties Divisions 2 and 1 August These apply to RSOs, RIMs, 3 of Part 3 RSA 2006 (whether these are accredited or not), and also include contractors and rail safety workers. All relevant entities should note that these duties cannot be abrogated by way of contract. Internal review of s.129B TA 1 August Transitional and post new decisions s.171 RSA 2006 scheme accredited operators s. 88 RSA, can still seek review from s.228ZZR TA VCAT under s.129B TA. However, a decision made by a TSO is to be reviewed by the Safety Director or a delegate of the Safety Director if an application for internal review is made.

SCHEDULE

Prescribed conditions of accreditation

Rail Safety Act 2006 (Vic)

Section Condition 46(4) An accredited rail operator who is accredited in another state or territory must immediately advise the Safety Director in writing if his, her or its other accreditation expires or is cancelled, suspended, etc. 46(5) An accredited rail operator must take reasonable steps to ensure that a rail safety worker who carries out rail safety work for that operator does not have more than the prescribed concentration of alcohol in his or her blood or breath and is not impaired by a drug.

Rail Safety Regulations 2006 (Vic)

Regulation Condition 8 An accredited rail operator must notify the Safety Director in writing of changes to information relating to various details, including those relating to the operator’s application for accreditation. 17 A rail operator must develop and implement an interface co-ordination plan in relation to any potential risks to the safety of the rail operations. 46 A rail operator must give the Safety Director a monthly report detailing the number of rail safety workers in that month, the number of passenger journeys in that month, and the number of track, passenger train and freight train kilometres. 49 An accredited rail operator must perform an annual review of its operations and prepare a report detailing the findings of that review. The review and report must include, amongst other things, information about the operator’s compliance with its Safety Management System and information about accidents, incidents and safety trends. 51 Where a temporary accreditation is issued by the Safety Director under s 47(2) of the Rail Safety Act 2006 (Vic), a recipient of the temporary accreditation must pay the fee charged by the Safety Director within 7 days of receiving a temporary accreditation. 52 Where a rail infrastructure manager or rolling stock operator who uses private siding applies for an exemption from the requirement to be accredited under s 63 of the Rail Safety Act 2006 (Vic), the applicant must pay the specified fee. An applicant under s 63 of the Rail Safety Act 2006 (Vic) may apply to the Safety Director for an exemption from the requirement to pay the fee. Payment of the fee is a condition of accreditation unless the Safety Director grants an exemption from the requirement to pay the fee. 53 An accredited rail infrastructure manager and an accredited rolling stock operator must pay the specified fee within 7 days after being accredited. An accredited tourist and heritage operator may apply to the Safety Director for an exemption from the requirement to pay the fee. Payment of the fee is a condition of accreditation unless the Safety Director grants an exemption from the requirement to pay the fee. 54 An accredited rail infrastructure manager and an accredited rolling stock operator must pay the specified annual fees. An accredited tourist and heritage operator may apply to the Safety Director for an exemption from the requirement to pay the fees. Payment of the fees is a condition of accreditation unless the Safety Director grants an exemption from the requirement to pay the fees.

Transport (Rail Safety) Regulations 1998

Regulation Condition 6(a) The accredited person must ensure all accredited activities are subjected to inspections within 12 months of becoming accredited, and then at intervals not exceeding 12 months. 6(c) The accredited person must retain records necessary to clearly demonstrate compliance with conditions of accreditation, and must make the records available and, if asked, provide a copy of those records.

Public Transport Safety Victoria

Accreditation Guideline

Appendix E

Content of safety management systems (SMS) for non-accredited rail operations

September 2006

For more information contact Public Transport Safety Victoria (PTSV). Telephone: (03) 9655 8949 Facsimile: (03) 9655 8929 Email: [email protected]

Appendix E - Content of safety management systems (SMS) for non-accredited rail operations

Matters and information to be contained in a SMS of a non-accredited rail operator

1. Interface co-ordination a) Processes for the identification of potential risks to the safety of rail operations carried out by that rail operator for the purposes of developing an interface co-ordination plan. b) Copies of all interface co-ordination plans developed by the rail operator.

2. Risk management a) So far as is reasonably practicable, processes for the identification of incidents and hazards and the assessment of all possible incidents and hazards identified. b) A description of the control measures adopted by the rail operator. c) A risk register that includes— i) a comprehensive listing of hazards ii) risks associated with each hazard; iii) the control measures applicable to each hazard; iv) nomination of the person responsible for each control measure; v) key engineering, operational and maintenance standards applicable to each control measure; and vi) any relevant cross-referencing to other related aspects of the SMS or regulations. d) Processes to ensure, so far as is reasonably practicable, that rail safety work is prioritized so that those hazards representing the greatest risk are given priority.

3. Infrastructure maintenance Details about how rail infrastructure within the private siding is to be maintained by the rail operator.

Public Transport Safety Victoria | ACCREDITATION GUIDE E-

Public Transport Safety Victoria

Accreditation Guideline

Appendix F

Investigation reports

September 2006

For more information contact Public Transport Safety Victoria (PTSV). Telephone: (03) 9655 8949 Facsimile: (03) 9655 8929 Email: [email protected] Appendix F - Investigation reports

F- ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix F - Investigation reports

Matters to be included in investigation reports having regard to the severity of the accident or incident.

Accident or incident severity level Required information 1. An accident or incident that results Detailed report of a systemic nature. in major consequences, for example, fatalities, serious personal injuries or The report must include— extensive property damage • a description of the occurrence

• the consequences that resulted

• the contributing factors established by the investigation, and

• the safety actions arising from it.

2. An accident or incident involving A brief report including analysis of the only minor injuries but with appreciable incident and, where appropriate, those property damage. Includes an matters listed for a severity level 1 accident or incident that had the accident or incident. potential to be more serious, possibly involving death 3. An incident of minor consequence An initial occurrence report prepared with either no injury or damage or only and retained for trend analysis, and superficial injury or damage where it where possible, a brief report including is unlikely that a more serious incident analysis of the incident may have occurred

Public Transport Safety Victoria | ACCREDITATION GUIDE F-

Public Transport Safety Victoria

Accreditation Guideline

Appendix G

Risk management and ‘so far as is reasonably practicable’ (SFARP)

September 2006

For more information contact Public Transport Safety Victoria (PTSV).

Telephone: (03) 9655 8949 Facsimile: (03) 9655 8929 Email: [email protected]

Appendix G - Risk management and ‘so far as is reasonably practicable’

The Rail Safety Act – Risk Guidance

Rail Operators must include as part of their application for accreditation evidence that they have complied with the Risk Management requirements stated in Division 3 of the Rail Safety Act 2006. The Act requires evidence for the identification of hazards, risk assessment, and for elimination or reduction of incidents ‘so far as is reasonably practicable’. While the following document provides advice on what the Regulator would expect to see in an application, it is not the intention of this guide to provide the basis for a person or group without prior knowledge or experience to carry out hazard identification or risk assessment. It provides a basis for an understanding of how compliance with the various elements of the legislation should be demonstrated. However, examples of techniques and assessments are provided in the appendices.

Identification of incidents and hazards, and risk assessment

Hazard Identification

Clauses 50 (1) and 50 (2) of the Rail Safety Act require that rail operators must identify all (credible) incidents which could occur and all hazards that could cause or contribute to those incidents.

Hazards contributing in a major way to the overall risk of the operation, including those which refer to catastrophic or fatal consequences must be recorded, together with associated hazards or precursors. Regulations require the accredited rail operator’s Safety Management System (SMS) to have processes to ensure, so far as is reasonably practicable, that rail safety work is prioritised so that those hazards representing the greatest risk are given priority. In the accreditation process the Regulator will emphasise examination of major incidents and significant risks. These would include hazards capable of producing catastrophic consequences, such as train to train collisions, derailments, level crossing incidents, and collisions with terminal infrastructure.

The rail operator should give consideration to special hazards such as tunnels, bridges, below ground stations which are appropriate to the rail operator. Hazards associated with specific locations or geographic areas should be considered. Documentation should demonstrate that the rail operator is aware of such locations, together with any interface issues. As well as hazards during normal operations, the rail operator should consider hazards during abnormal/emergency operations, maintenance, planned changes (either permanent or temporary), activities of third parties (e.g. trespass and vandalism), and other non-routine activities. The populations affected by the hazardous events should also be identified, including any group who are especially at risk, such as contractors or other rail operators.

The hazard and risk identification should cover the relevant key elements in the checklist shown in Appendix 1. A systematic approach should be evident to

Public Transport Safety Victoria | ACCREDITATION GUIDE G- Appendix G - Risk management and ‘so far as is reasonably practicable’

ensure that all parts of the organisation’s activities have been covered, including where there are interfaces with other parties or infrastructure. The process used should also be capable of identifying where a combination or sequence of events could lead to a major accident. While historical information from the rail operator or similar organisations may be a good starting point in identifying incidents and hazards, organisations should be able to show that they have used, and will continue to use relevant information from analysis of failures, investigations, audits and inspections, overseas experience, and group exercises. A brief summary of hazard identification techniques is given in Attachment 2 for information.

The quality of both the identification and analysis of hazards and risks is dependent upon a comprehensive understanding of what makes the system work in terms of the human factors, equipment, infrastructure and relationships between them. As well as the rail operator having access to engineering technical expertise and procedures for identifying ways in which equipment could fail and result in an incident, human factors expertise should be identified. Examples of the application of human factors into rail safety can be found in Appendix B of AS 4292.1 (2006). Where a rail operator intends to sub-contract design and delivery, it would be expected that the sub-contractor would be required to procure or supply engineering and human factors design expertise. However, the rail operator must have sufficient capability to assess the quality of the engineering or human factors that is being delivered, and to determine how it could contribute to an incident associated with their accredited activities.

What the regulator will expect to see: • a documented hazard identification process • evidence of individuals trained in hazard identification, or access to trained personnel • a list of hazards covering both normal operations and emergency conditions • a list that doesn’t just consider historical data • consideration human factors elements • reference to interfaces • identification of failures for the same reason (common cause failures), or where risks are shared between organisations.

In summary, the identification methods should be appropriate to the magnitude of the hazards involved and specifically tailored to address technical, operational and organisational issues. The hazard identification strategy described in the rail operator’s Safety Management System should be able to provide a comprehensive list of risks in normal operations, together with risks associated with interfaces and emergency conditions. Hazard identification should be complimentary to other safety studies and integral to the management of change

 AS 4292.1-2006 Railway safety management - General requirements

G- ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

process. A systematic process should be used to identify where a combination or sequence of events could lead to a major accident.

Hazard and Risk Assessment

Clause 50 (4 and 5) of the Rail Safety Act details the requirements for the assessment of risks and hazards. This includes the rail operator having a detailed understanding of likelihood and consequences of each hazard and incident.

The purpose of risk assessment is to provide the necessary information to make decisions regarding the acceptability of the risk and the cost effective commitment of resources to accident prevention and reduction. A rail operator’s risk assessment process should be able to reduce uncertainty by providing a framework for the incorporation of all available information regarding the costs and risks of various alternatives. Risk assessment can also be used to determine if a proposed activity is acceptable in those situations where it is impractical to eliminate particular hazards.

In meeting this requirement, judgement is required on selecting the appropriate methodology and depth of analysis, taking into account the nature and scale of the hazards and risks. The rail operator should have processes in place to ensure local task risk assessment procedures link into the overall risk assessment process. The level of detail of the assessment must be sufficient to give confidence that all significant contributors to risk have been evaluated and that the controls/mitigation necessary to combat the risks have been identified and are in place or are to be put in place in the SMS. Whatever the method chosen, it should reflect specific operational issues and not just generic railway operations.

The methodologies of identifying and assigning values to the levels of likelihood and consequences should be described in the risk management procedures of the rail operators SMS. The procedures should also describe what controls are taken into account in assigning likelihood and consequence measures. In assigning levels of likelihood and consequences, documentation should record any assumptions made and recognise uncertainty in assumptions made.

The purpose of assigning levels of likelihood and consequence is to help determine whether the risk is serious enough to require additional control measures, where the risk reduction is balanced against the costs of additional control measures. In such assessment there are two dimensions of consequences that must be considered:

• direct physical losses, involving assets and people

• indirect costs (lost time, administrative, legal, and replacement of services).

Public Transport Safety Victoria | ACCREDITATION GUIDE G- Appendix G - Risk management and ‘so far as is reasonably practicable’

Both dimensions must be considered if the risk assessment is to be complete and consequences are to be treated equally on a systematic basis. The simplest way to treat the various types of consequences is to assign units to each of the identified consequences. Monetary units (dollars) have the distinct advantage of permitting a direct comparison of the dollar cost of risk reduction against the expected loss.

Once an analysis of risk has been made, decisions can be made regarding the need for risk treatment. Termed ‘risk evaluation’ this involves comparing the level of risk found during the analysis process with established risk criteria. The simplest form of risk criteria divides risks up between those that are intolerable, those that need treatment, and those that can be accepted without additional risk controls. Risk tolerability criteria should be established by the rail operator. An intolerable level of risk must take account of stakeholder views, including those of relevant regulators. Such decision criteria should be based on the level of risk, but may also be based on specified consequences, the likelihood of specified events or outcomes, cumulative effect of multiple events, or the range of uncertainty for risk levels at some specified level of confidence. Further guidance on risk criteria is provided in Attachment 3.

Assessment should not be a one-off activity, but should be part of the process of continuous improvement. It is therefore important that the rail operator is able to demonstrate that assessments are reviewed and updated at appropriate intervals or when there is any reason to suspect they may no longer be valid, for example, following an accident, incident or near-miss, as significant new information becomes available, or when there have been significant changes to working procedures. Reviews of risk analyses and assessments should form part of standard management practice. The time between such reviews should relate to the extent and nature of the risks involved, and the degree of change likely in the work activity. The proposed time between reviews should be stated by the rail operator in the Safety Management System. As well as reviewing the assessments, auditing and verification of key risk controls identified during risk assessment is a critical activity to ensure that the rail operators are controlling their risks.

Where the Act requires a detailed understanding of the magnitude of an incident (50 (5) (c) (i)), this relates to a qualitative appreciation of the importance of the event, as perceived by society in general, rather than simply the consequences of an incident.

G- ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

What the regulator will expect to see: • documented procedures for risk analysis and assessment, including recognition of different techniques • documentation of assumptions used in analysis • stated methodologies for assigning levels of likelihood and consequence to risk • identified incidents have risk levels set against them • a process for continual improvement of risk analyses • there is a recognition of uncertainty in risk analysis • stated risk tolerability criteria

Consider Hazards Cumulatively

Clause 50 (6) (a) requires that in conducting an assessment, the rail operator must consider hazards cumulatively as well as individually. Where a major hazard involves a number of hazards or a chain of events, the rail operator needs to understand the likelihood of each hazard or event in the chain occurring and the likelihood of them escalating to a major incident.

Many major incidents in the past have been caused by the realisation of a number of hazards concurrently. For example, a station fire may arise from an escalator fault, but probably only if the fire suppression systems do not work, or cleaning is inadequate. Clearly this cumulative consideration is necessary in order to understand the full range of incidents, their contributing factors, and the controls. In relation to this, the rail operator must give consideration to the possibility of common mode failure mechanisms which can cause several hazards or failures to occur simultaneously, significantly increasing the chances of an incident.

For any incident there may be several independent hazards or combinations of hazards, each of which could lead to that incident. Similarly, there will be several control measures which may be particularly critical because they may impact on one or more of those hazards. The ‘Comprehensive and Systematic Assessment’ referred to in Division 3 of the Rail Safety Act should give an understanding of the total likelihood of each incident and the relative importance of each separate hazard and control measure. This is needed in order to provide measures of the most important causes and controls.

Some control measures may often only be recognised as critical or justified because of their cumulative impacts on several hazards. In cases where a large number of different hazards and potential incidents exist, the cumulative risk may be significant even if the risk associated with each potential incident is low. Cumulative consideration of hazards enables the operator to assess the overall

Public Transport Safety Victoria | ACCREDITATION GUIDE G- Appendix G - Risk management and ‘so far as is reasonably practicable’

picture of rail operator risk, and to understand how different causes and events can combine to lead to an incident. It also enables the key contributors and controls for the risk to be identified and evaluated in more detail if required.

Appropriate techniques: Qualitative, Semi-Quantitative or Quantitative

Clause 50 (6) (b) requires the rail operator to use assessment methodologies (whether quantitative or qualitative) appropriate to the hazard being considered. Methods of assessment must reflect the complexity of the system. Examples of where and how the different methods may be appropriate are given below.

Assessment methodologies:

Qualitative

Where risks are well understood and cannot credibly result in catastrophic consequences a qualitative approach may be appropriate. Qualitative analysis should be informed by the best possible use of information, including quantitative data, where available. It should be recognised that a limitation of qualitative assessments is that there is little indication on an absolute scale of how serious the risk might be, particularly for comparison with other risk sources.

Semi-Quantitative

A semi-quantitative analysis could be used where the nature of the risk and causation are well understood, for example station fires, incidents around the train-platform interface. If using a semi-quantitative analysis approach, it is important that the results are not interpreted as providing a finer level of detail than is actually contained in the initial descriptive rankings.

A semi-quantitative analysis may take the form of a risk matrix that mathematically manipulates the valuation of consequence and likelihood. Typical risk matrices for rail operators range in size from 3 x 3 to 6 x 6. Examples of risk matrices and consequence and likelihood scales may be found in AS/NZS 43602. Risk increases diagonally across the matrix, and bands of broad risk levels can be established on the matrix to show areas where risk is intolerable, and where risk is tolerable subject to all practicable measures being taken and subject to continuous improvement. Rail operators should note however, that while the risk matrix approach may be useful in ranking risks and supporting a demonstration of adequacy, it is unlikely to be sufficient as the only assessment tool used by rail operators. For example, additional analysis of the effects of alternate control measures is likely to be needed as a risk matrix is often too coarse a tool to distinguish between options. It may also be difficult to fully address the requirement for cumulative consideration of hazards using risk matrices alone.

 AS/NZS 4360:2004 Risk management.

G- ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

Quantitative

A quantitative analysis would expect to be seen for incidents that could credibly have catastrophic consequences, or for which the causation of the consequences is not obvious or well understood. As a minimum, for accredited rail operators (other than tourist and heritage operators where the exposure to the risk is likely to be significantly lower) the Regulator will expect to see quantitative analysis for derailments, train to train collisions, level crossing accidents, and collisions with terminal infrastructure. Note that research is available from PTSV for use as a basis for QRA’s for collisions and derailments.

One of the main benefits of adopting a quantitative approach is that it provides a framework within which all risks can be evaluated on a common (quantified) basis, thereby allowing the significance of individual hazards to be assessed in the context of the system as a whole. A quantitative approach can also be used to evaluate the benefit of measures intended to improve safety, so that expenditure can be prioritised on the basis of cost effectiveness, while also enabling rail operators to demonstrate that risks are reduced to levels which are reasonably practicable.

Other important concepts to be considered within and after the assessment stage:

• Ensure that the sensitivity of results to changes in assumptions is discussed and quantified where possible. Where assumptions are based on data from other railways, the documentation should contain an explanation of why it is believed the data is applicable. Where risk control measures have been identified, their effect upon the results of assessments should be shown.

• It is essential that action is taken as a result of the findings of assessments and that controls are implemented and their effectiveness reviewed.

Documentation

Clause 50 (3) of the Rail Safety Act requires that rail operators must document all aspects of identification, including the methods used for identifying the incidents and hazards. Documentation is again referred to in Clause 50 (7) which requires the rail operator to document all aspects of the assessment.

Identification and assessment should use consistent and documented data. All steps in the process should be traceable and the information gathered and used should be documented to permit review of the work and to ensure reproducibility, to help understand the assumptions made, and to help validate results. Documentation regarding risk control implementation should identify responsibilities, schedules, expected outcomes, performance measures. Reference should be made to the processes for monitoring and review of risk control effectiveness in the rail operator’s Safety Management System.  Estimation of the Risk of Catastrophic Rail Accidents in Victoria (2006).

Public Transport Safety Victoria | ACCREDITATION GUIDE G- Appendix G - Risk management and ‘so far as is reasonably practicable’

The large amount of information on identified hazards and risks, and their associated likelihood and consequences, must be integrated into a reviewable format that reflects the goals of the Rail Safety Act. Indicative examples of risk registers and risk treatment plans can be found in HB 436:20044. Such summary formats are likely to reference more detailed work and should be modified according to the assessment methodology used.

Rail Safety Regulations – Risk Matters to be included in a Safety Management System

Documentation of Risk Control Measures

Schedule 2, Section 16.2 requires a description of risk control measures adopted by the rail operator. This is more than listing the controls for the current environment at the time of accreditation. Processes to consider possible new controls and continually reduce risk should form part of a rail operator’s SMS.

The description of risk control measures and their implementation should identify responsibilities, schedules, expected outcomes and performance measures. Reference should also be made to the processes for monitoring and review of risk controls. These elements are likely to be audited by the Regulator to verify that the identified risks of incidents are being controlled as described within the risk assessments.

In some cases, compliance with a recognised standard or Code of Practice will constitute a suitable control measure. However, the rail operator must demonstrate how the standard is linked to the risk and whether it deals with all aspects of that risk or only part of it. Where a standard or Code of Practice is detailed and prescriptive, further explanation of how it is to be applied should not be necessary. Where a standard or Code of Practice allows different ways of achieving compliance the rail operator should say which control measures are used.

Risk Register

Schedule 2, Section 16.3 requires the establishment of a risk register, including processes for the periodic updating of the register.

Examples of risk registers can be found in HB 436:2004 Risk Management Guidelines Companion to AS/NZS 4360:2004, as well as in many proprietary risk management software products. Whatever style of register is used, the information that it contains should include as a minimum the area, activity function, or scope that the register relates to, such as: • information showing when the register was last amended or reviewed • a brief description of each incident, including a summary of the main hazards • other organisations responsible where the risk is not under direct control

 HB 436:2004 Risk Management Guidelines, companion to AS/NZS 4360:2004

G-10 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

• existing control measures applicable to each hazard • control measures proposed for future implementation together with a plan for implementation. • estimated levels of consequences, likelihood and risk with existing controls and with proposed additional controls implemented • references to supporting data and risk assessments undertaken • references to SFARP assessments and additional controls considered. • risk controls that have been considered, but rejected • cross-references to the SMS • standards applicable to the risk controls, including key engineering, operational and maintenance standards applicable to each control measure • nomination of person responsible for each risk control.

The register should identify, prioritise and give reference to the management measures to control or mitigate significant risks. This should include risk to employees, passengers, public, contractors and any other operators who may be affected. Risks that arise at interfaces or are under the direct control of other parties should be included in the register. Where it is necessary for monitoring to extend beyond rail operator’s immediate activities to achieve effective risk management, there is obviously a requirement for co-operation. The key aspect of the risk register is the demonstration of the linking of control measures to the associated risk.

In reviewing the risk register a rail operator should ensure that:

• significant hazards are identified and there are no obvious omissions when compared with industry norms • the risk assessments reflect the real situation • the consequences and probabilities quoted, and the overall findings, make sense when benchmarked with industry performance and accident history • immediate and underlying causes of recent incidents in the rail operators own and others’ operations are addressed • the register recognises the catastrophic risks associated with the rail operator’s accredited activities, especially those associated with single failures • for each significant incident, the documentation sets out the control measures which prevent it from being realised • references between each risk assessment and the SMS are specific, so that the link is clear • where it is reasonable, risks have been avoided or eliminated at source • the effectiveness and reliability of the control measures have been periodically assessed, particularly with respect to human reliability where operator intervention is a critical control measure.

Public Transport Safety Victoria | ACCREDITATION GUIDE G-11 Appendix G - Risk management and ‘so far as is reasonably practicable’

It is important that the rail operator understands that the risk register is a live document that will require regular updating. The rail operator’s SMS should include details of the arrangements to review risk assessments and control measures in the light of new information, new technology, incidents, on-going deterioration, remedial works, or other changes that may affect risks. The need to keep a risk register updated introduces a necessary interface with asset management systems in order to ensure that works undertaken and changes in asset condition are reflected in the register. Such a link should be evident in the rail operator’s SMS.

Prioritising Safety Work

Schedule 2, Section 16.4 requires the rail operator’s SMS to contain processes to ensure, so far as is reasonably practicable, that rail safety work is prioritised so that those hazards representing the greatest risk are given priority.

In general, the greater the initial level of risk, the greater the degree of thoroughness required to demonstrate that risks have been reduced so far as is reasonably practicable. It would be very difficult to provide a quantitative demonstration for all the hazardous events and precursors identified.The essence of the legislative requirements is not associated with providing a detailed quantitative assessment for every hazard, but a demonstration which provides confidence that risk is being managed by the rail operator in a comprehensive, structured and auditable way.

However, the control of hazards with associated catastrophic consequences, such as train to train collisions, train collisions with terminal infrastructure, and derailment should be demonstrated quantitatively.

SFARP Guidance

Introduction

Section 19(1) of the Rail Safety Act (“the Act”) places a duty on persons under the Act to:

• eliminate risks to safety so far as is reasonably practicable; and

• if it is not reasonably practicable to eliminate risks to safety, to reduce those risks so far as is reasonably practicable.

The Act states that regard must be had to the following five matters in determining what is (or was at a particular time) reasonably practicable in relation to ensuring safety: • the likelihood of the hazard or risk concerned eventuating • the degree of harm that would result if the hazard or risk eventuated • what the person concerned knows, or ought reasonably to know, about

G-12 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

the hazard or risk and any ways of eliminating or reducing the hazard or risk • the availability and suitability of ways to eliminate or reduce the hazard or risk • the cost of eliminating or reducing the hazard or risk.

This requirement is consistent with existing occupational health and safety legislation. Essentially, the duty holder is expected to balance the risk (including its severity and likelihood) with the sacrifice to avert that risk (including, for instance, cost, time and trouble/inconvenience).

Each of the five matters above must be considered when demonstrating SFARP. Risk controls cannot be rejected on the basis of cost alone.

The duty holder must demonstrate that risks have been eliminated or reduced SFARP. The method of demonstration should be appropriate to the operation, facility or activities undertaken, and supportive of decision-making on control measures. Risk assessment will be an important part of this process, by showing that the level of decision-making is appropriate for the level of risk. In most cases this will simply involve a direct judgement and professional expertise by appropriate persons to determine whether benefits to be gained from alternative or additional controls outweigh the sacrifice. In some cases more detailed analysis may be more appropriate.

The Five Matters of SFARP

The five matters relating to SFARP stated in the Rail Safety Act are described below. The first two matters relate to the conduct of an appropriate risk assessment. According to AS/NZS 4360, risk is measured by the combination of the consequences of an event and their likelihood.

The likelihood of the hazard or risk concerned eventuating

In considering how often harm may occur it is important to match the likelihood to the degree of harm being considered. For example, the likelihood of a signal being passed at danger (SPAD) is higher than the likelihood of a fatal collision or derailment resulting from a SPAD.

The degree of harm that would result if the hazard or risk eventuated

The degree of harm refers to the potential severity of injuries and the number of persons that may be injured if the hazard or risk eventuated.

The degree of harm should not be limited to the most likely outcome that could eventuate. Consideration should also be given to the worst credible outcome. For example, a fall from a ladder will most often result in a minor injury, but the potential for serious injuries, even fatalities, should be considered. In some circumstances, an outcome with a lesser degree of harm can drive the risk due to

Public Transport Safety Victoria | ACCREDITATION GUIDE G-13 Appendix G - Risk management and ‘so far as is reasonably practicable’

the likelihood of occurrence. Decisions should be based on the highest risk (i.e. the product of likelihood and degree of harm).

What the person concerned knows, or ought reasonably to know, about the hazard or risk and any ways of eliminating or reducing the hazard or risk

The duty holder must ensure it has a good understanding of the hazards or risks for which it is responsible. This will require the following:

• appropriate competency of those involved in the assessment and may include access to expert involvement.

• consultation with the various stakeholders who will help ensure a proper understanding of the hazards or risks and to ensure risk controls are reasonable, accepted, practical and effective. This is a requirement of Section 18 of the Act. Section 13 provides a listing of potential stakeholders.

• reference to established standards, where applicable. This may include legislative requirements, rules, local and international standards, codes of practice, company procedures and track access agreements. The standards used must be applicable to the risk. Established standards should be considered as a minimum requirement. Where the risk differs from well established risks, or where the risk is considered high, standards alone are likely to be considered insufficient.

• reference to good practice or good professional judgement. The following should be considered when selecting good practice:

- The practice is established in Victoria, or another State which is similar in scale and operation to the Victorian system.

- The practice is established and widely implemented in a similar industrial sector.

- The practice is enforced by legislation in more than one other country.

- If all of the following also apply: • It has demonstrably improved safety in its current application • It can be implemented without significant modification • It is relevant to the circumstances, for example similar operating conditions • Reference to incident history both locally and internationally • Reference to existing reports or studies.

G-14 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

The availability and suitability of ways to eliminate or reduce the hazard or risk

Any potential alternative or additional risk controls should be considered for their suitability to the duty holder’s specific environment and operations. The emergence of new technology or systems may also offer new ways to control the risks. If alternative or additional controls are not considered practicable then their rejection should be justified. Therefore, the risk register is expected to reference rejected controls and the reason for the rejection.

In assessing the availability and suitability of risk controls, you may consider whether they will be:

• technically and logistically suitable, for example, compatible with the existing systems or operating requirements, or available at the locations required

• environmentally suitable, for example, suited to the climatic conditions or operating environment

• effective at reducing the risk. The following points should be considered:

- level of risk reduction offered including its reliability

- performance of existing controls in reducing the likelihood or severity of particular hazards

- hierarchy of controls prescribed in Occupational Health and Safety legislation should be used when considering additional risk controls

- number of other independent risk controls providing protection

- potential for common failure modes which could render more than one risk control ineffective

- number of hazards a particular control deals with.

• significantly detrimental to other service delivery goals (e.g. journey time). As with the other matters the sacrifice must be balanced against the risk (likelihood and degree of harm).

A key aspect of the duty holder’s risk assessments is to link control measures to the hazard. Once potential incidents and associated hazards/precursors have been identified and described, the control measures for each hazard must be described, the objective being to demonstrate that each potential incident is properly controlled and all that is reasonable is being done. For lower risks this can be shown using a simple risk register format as shown in the qualitative

Public Transport Safety Victoria | ACCREDITATION GUIDE G-15 Appendix G - Risk management and ‘so far as is reasonably practicable’

risk assessment in Appendix 4. For major incidents bow tie diagrams provide a useful technique for demonstrating control measures. An example of a bow tie diagram is found in the examples in Appendix 4. What is crucial however is that the controls are explicitly linked to hazards, and that the relationship between the effectiveness of the controls and subsequent risk mitigation is understood.

The cost of eliminating or reducing the hazard or risk

Finally, the cost of the control measures should be weighed against the potential benefits gained. In most cases this is expected to involve a direct judgement by appropriate persons to determine whether existing controls are adequate or whether additional or alternative controls are justified. In some cases a more detailed cost benefit analysis (CBA) may be required to better inform the decision. This may be required where:

• established good practice or standards do not exist.

• new or emerging good practice may be relevant.

• the combination of hazards is complex and the risk or potential risk reduction may not be immediately obvious.

A rail operator may be tempted to take into account its financial circumstances when deciding what is reasonably practicable. It should be noted however that case law establishes that “financial strength or weakness” is not relevant in determining the proper degree of care. Reasonable practicability is an objective test and the specific financial circumstances of the duty holder are not relevant.

In a quantitative analysis there will be a need to consider the avoided consequences of a risk control, generally involving two dimensions of consequences:

• direct physical losses, involving assets and people

• indirect costs (e.g. lost time, replacement of services).

Both dimensions must be considered if the assessment is to be complete and consequences are to be treated equally on a systematic basis. The simplest way to treat the various types of consequences is to assign units to each of the identified consequences. Monetary units (dollars) have the distinct advantage of permitting a direct comparison of the dollar cost of risk reduction against the expected loss.

In quantifying the costs of a risk control, the following aspects should be considered: • capital investment. • installation and commissioning.

G-16 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

• training • management and administration • operation and maintenance • decommissioning • avoided costs of accidents

Costs and cost savings should not include those which are speculative, for example: • improved reputation and the response of the market to the new control and its safety or commercial effects • reduced insurance premiums.

Tools for demonstrating SFARP

A demonstration that risks are reduced SFARP must begin with a risk assessment and include consideration of the five matters discussed above. As discussed earlier, in most cases a demonstration of SFARP will involve a direct judgement by appropriate persons. In some cases more detailed analysis may be required. Requirements for an appropriate level of risk assessment have been described in the earlier sections of this document. The duty holder’s risk register should provide the primary tool for a transparent and auditable demonstration that risks are SFARP.

This process can involve varying degrees of complexity that will depend on the nature of the hazard, the extent of the risk and the control measures to be adopted. The level of justification and analysis required to reject risk controls is represented in Figure 1. However, duty holders (and the Regulator) should not be overburdened if such thoroughness is not warranted. The greater the likelihood of occurrence or degree of harm, the greater the degree of rigour required of the arguments purporting to show that those risks have been reduced SFARP. It would likely be impractical for each duty holder to provide a quantitative demonstration for all the potential incidents and hazards/precursors identified. The essence of the Regulator’s requirements is rather that a demonstration is made which provides confidence that risk reduction is being considered in a comprehensive, structured and auditable way.

Public Transport Safety Victoria | ACCREDITATION GUIDE G-17 Appendix G - Risk management and ‘so far as is reasonably practicable’

High Should be More detailed justi- implemented. Little fication required to analysis required reject. unless rejected. Benefit (risk reduction)

More detailed Simple justification to justification required reject. to reject. Low

Low High

Sacrifice (cost, time, effort and inconvenience)

Figure 1 - Justification and analysis required to reject risk controls.

Where it is necessary to conduct a more detailed cost benefit analysis, the following options are available: • financial appraisal, assessing the monetary effects of options to the rail operator • in-depth Cost Benefit Analysis, considering all aspects in monetary terms • broad CBA, recognising only some effects can have a monetary value placed against them, with some effects ranked • goals-achievement matrix, where all relevant objectives are listed and given a relative weighting, with control options given a performance measure against each objective • cost effective analysis (or risk-tradeoff analysis or risk-benefit analysis), where the benefits of each control option are expressed in non-financial units and the analysis focuses on the relative costs of the options.

The level of detail can vary significantly depending on the complexity of the issue, the costs involved and the level of uncertainty in the analysis. If the Rail Operator is inexperienced in conducting CBA it is recommended that the advice of a professional experienced in the DOI quantitative cost benefit analysis techniques is sought before undertaking detailed quantitative CBA, and that reference is made to the Department’s Investment Appraisal Guidelines, available on request from PTSV.

The SFARP demonstration is also expected to contain the following:

• proposed controls that are not yet in place should be clearly differentiated from existing controls. The expected effect of future controls on the risk should also be shown. Proposed risk controls should be associated with a person responsible for implementing them

G-18 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

and a plan and time frame for implementation.

• potential additional or alternative risk controls that have been rejected and the justification for their rejection.

• reference to more detailed analysis, where appropriate, should be recorded to ensure the process is transparent and auditable.

In demonstrating risks are SFARP it is vital that the duty holder also:

• monitors and reviews risks and control measures to ensure they are performing as expected from the risk assessments. The Regulator will expect to see evidence that the controls included in the assessments are indeed performing as expected. A demonstration of SFARP may include information on the performance of existing controls to minimise existing risks. • communicates and consults with internal and external stakeholders on both the risks and the risk controls. The Regulator will expect to see evidence of communication and consultation.

Finally, the RSA requires a rail operator to consider hazards cumulatively as well as individually. It is important for a rail operator to review all hazards examined and demonstrate that the cumulative impact of all hazards does not make the overall risk of rail operations intolerable. This may require the implementation of additional controls initially rejected because the benefit was marginally less than resources required to implement.

Public Transport Safety Victoria | ACCREDITATION GUIDE G-19 Appendix G - Risk management and ‘so far as is reasonably practicable’

Attachment 1 Hazard Checklist

Rolling Stock Operator Checklist

The risk management strategy provided by a rolling stock operator should make reference to the following hazards and the precursors for how the risks can be realised. The list provided below is not exhaustive.

Derailment Including the precursors: • coupling failure • wheel/tyre wear beyond limits • severe braking/snatch • seized axle box bearing • buffer locking • suspension system/bogie failures • axle failure • equipment falling from train or tram • train or tram not detected by train or tram detection system resulting in points moving under train or tram • shunter errors • overspeeding • other driver/train or tram crew error, including incapacitation and failure of vigilance and deadman devices • signal passed at danger at points

Train or Tram to Train or Tram Collision Including the precursors: • brake failure • traction control failure • train or tram not detected by train or tram detection system • defective train or tram protection equipment • train or tram protection equipment not activated • driver anticipates clearance of a signal and passes signal at stop • driver fails to check signal aspect • driver fails to locate signal • driver fails to react to cautionary aspect • driver overspeeding • driver misreads previous signal • driver disregards signal due to ignorance of rules/instructions • driver disregards signal due to violation of rules • driver misjudges train or tram behaviour • driver misreads aspect of correct signal • driver misreads by viewing wrong signal • wrong information given to driver/signaller • communication error

G-20 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

• contamination of wheel / rail interface • train or tram out of gauge.

Train or Tram to Train or Tram Collision in Station (permissive working) Including the precursors: • defective brakes • defective train or tram control equipment • driver misjudges braking • driver loss of concentration • driver error while coupling/uncoupling • failure to apply brakes resulting in rollback • error using couple/uncouple button / equipment • driver error when propelling • driver inexperience / training deficiency • driver incapacitated • driver overspeeding or other incorrect application of propulsion equipment • driver does not shut down train or tram correctly • contamination of wheel / rail interface.

Train or Tram to Object Collision Including the precursors: • collision with objects fallen from train or tram • train or tram out of gauge.

Train or Tram Collision with Terminal Infrastructure Including the precursors: • defective brakes • defective train or tram control equipment • driver misjudges braking • driver loss of concentration • driver overspeeding • driver inexperience / training deficiency • driver incapacitated • driver selects reverse instead of forwards • driver error while shunting/splitting/uncoupling/set-up/shut down • contamination of wheel / rail interface.

Train or Tram to Motor Vehicle Collision at Level Crossing Including the precursors: • failure to detect train or tram approaching • SPAD at signal protecting level crossing • train or tram overspeeding

Public Transport Safety Victoria | ACCREDITATION GUIDE G-21 Appendix G - Risk management and ‘so far as is reasonably practicable’

Fire on Train or Tram Including the precursors: DMU engine fire diesel/oil leak fire DEMU engine fire hot/failed axle box mechanical equipment fire brake sparking fire due to traction power transformer fault current collection equipment fire electric equipment fire dragging brakes fire fire from Heating/ventilation fault EMU resistance bank fire EMU battery box fire control equipment fire traction motor fire switchgear fire fire on train or tram owing to arson fire from discarded cigarette fire inside buffet car unauthorised use of power sockets on train or trams combustion of freight load without external source of ignition.

Explosion on Train or Tram Including the precursors: • overpressure • incorrect storage / loss of containment of dangerous goods.

Rolling Stock Runaway Including the precursors: • inappropriate stabling • mechanical failure • external force on train or tram.

Train or Tram Congestion Casualty Including the precursors: • crushed passenger • heat exhaustion • suffocation.

G-22 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

Passenger / Worker Falls from Train or Tram Including the precursors: • failure of door locking • train or tram too long for platform • exits wrong side of train or tram • passenger/worker struck while leaning out of train or tram • passenger/worker struck by missile through window • train or tram door closes on passenger/worker • passenger/worker falls between train or tram and platform • passenger/worker injured while boarding or alighting

Rail Infrastructure Manager Checklist

The risk management strategy provided by a manager of infrastructure should make reference to the following hazards and the precursors for how the risks can be realised. The list provided below is not exhaustive.

Public Transport Safety Victoria | ACCREDITATION GUIDE G-23 Appendix G - Risk management and ‘so far as is reasonably practicable’

Derailment including the precursors: • track damage from other undetected derailment • subsidence/ landslip under track • track twist • buckled rail • rail profile out of gauge • defective points leading to derailment • gauge spread • broken rail • running into derailed maintenance vehicle or Engineers train or tram • running into debris from retaining walls • running into train or tram derailed while in depots/sidings • running into maintenance vehicles • running into objects from building site • running into items blown onto the line • running into out of gauge structures • drainage culvert/pipework collapse • rail bridge structural failure • structural damage due to earthquake • running into flooding • running into Engineers materials left foul • running into to debris from overbridges • running into debris from lineside structures/buildings • running into vehicles fallen from overbridge • running into vehicles through boundary fence • running into snow/ice • running into landslip • running into items placed on the track by vandals • rail bridge collapse • running into large animals • running into trees • running into objects fallen from train or trams • movement of points under train or tram (equipment faults) • wrongside signal failure • points in the wrong position and not detected.

Train or Tram to Train or Tram Collision including the precursors: • wrong information given to signaller • communication error • wrongside signal failure • contamination of wheel/rail interface • signal sighting inadequate.

G-24 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

Train or Tram to Train or Tram Collision in Station (permissive working) including the precursors: • contamination of wheel/rail interface.

Train or Tram to Object Collision Including the precursor: • collision with objects fallen from train or tram • collision with objects fallen from platform • collision with out of gauge structure • collision with platform collapse • collision with structure collapse • collision with objects placed on line by vandals • collision with engineers material/equipment • collision with detonators • collision with vehicles driven onto the line • collision with high ballast • collision with trees • collision with animals • collision with objects blown onto the line • collision with debris from landslips/slides.

Train or Tram Collision with Terminal Infrastructure Including the precursor: • contamination of wheel / rail interface.

Train or Tram to Motor Vehicle Collision at Level Crossing including the precursors: • road vehicle stranded on level crossing • incorrect level crossing signage/equipment • failure to detect train or tram approaching • failure of level crossing equipment • signalman/crossing keeper error • road vehicle incorrectly on crossing owing to environmental factors • vehicle abandoned on crossing.

Pedestrian Struck at Level Crossing

Public Transport Safety Victoria | ACCREDITATION GUIDE G-25 Appendix G - Risk management and ‘so far as is reasonably practicable’

Worker Struck by Train or Tram Including the precursors: • wrong side signal failure allowing train or tram into possession • mechanical failure resulting in runaway • worker struck by out of gauge item on train or tram • worker strays onto adjacent running line and struck • worker struck while patrolling • worker struck during train or tram shunting movements • worker strays from lineside onto running line • lookout struck by train or tram • worker struck failing to move out of train or tram path • trains / wagons not secured correctly • worker struck during coupling / uncoupling error • worker struck by derailed train or tram • worker struck due to failure of lookout • train or tram enters possession due to SPAD

Worker struck getting out wrong side of train or tram.

Train or Tram / Passengers/ Workers Crushed by Structural Collapse including the precursors: • collapse of bridge • collapse of tunnel • collapse of retaining wall • collapse of cutting • collapse of overhead structure.

Structural Collapse at Station Including the precursors: • stairway • platform • escalator • lift • barrier • wall.

Fire in Station

Electric Shock of Passengers / Workers / member of public

G-26 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

Attachment 2 – Basic Summary Hazard Identification Techniques

Hazard identification should be systematic and comprehensive, involve consultation with stakeholders, and entail individuals with expertise and competency in hazard identification techniques.

Hazard identification techniques are often formalized processes involving a qualified team leader and an experienced team. A central issue in all hazard identification techniques is that of completeness– assuring that the list of hazards is as exhaustive as appropriate. One way that the issue of completeness is addressed is by putting together a multi-disciplinary hazard evaluation team. The combined experience of the team is expected to provide assurance that no important hazards are overlooked. Another way of addressing the issue of completeness is to use more comprehensive techniques for those processes that are perceived to pose the highest risk—a graded approach.

A number of sources of information that are likely to be of relevance whatever approach is adopted. Relevant sources of information include:

• legislation and supporting Approved Codes of Practice which give practical guidance and include basic minimum requirements

• product information from manufacturers and suppliers

• relevant Australian and International Standards

• industry or trade association guidance

• the personal knowledge and experience of managers and employees

• incident data (including near miss data) from within the organisation, from other organisations or from central sources

• expert advice and opinion and relevant research.

Checklist Analysis

A checklist analysis is an experience-based approach in which a list of specific items is used to identify known types of hazards, potential accident situations, or design deficiencies. Checklists are often used in the evaluation of new processes to identify and eliminate hazards that have been recognized in the previous operation of similar systems.

Public Transport Safety Victoria | ACCREDITATION GUIDE G-27 Appendix G - Risk management and ‘so far as is reasonably practicable’

Checklists are developed for a specific operation, and a ChecklistAnalysis includes a tour of the environment in which the operation is to take place. Checklists should be regarded as living documents that need to be audited and updated regularly, with recent applicable operating experiences being incorporated after a formal review.

While Checklist Analysis is a structured, systematic process, it is of limited use in uncovering unique or unexpected or unlikely hazards.

What-If Analysis

The What-If Analysis hazard identification technique is a flexible, creative examination of an operation for potential hazards. Members of the hazard evaluation team are encouraged to ask ‘What-If’ questions. The What-If Analysis reviews the operation systematically from the beginning to the end (or the boundary defined by the scope of the analysis). The team leader guides the analysis in any appropriate logical way. It should be noted that this type of analysis could lead to incomplete results in the hands of an inexperienced facilitator. For simple systems or operations the analysis can be conducted by as few as one or two people.

Combined What-If/Checklist Analysis

The creative, flexible, brainstorming nature of a ‘What-If’ Analysis can be combined with the advantage with the systematic, structured approach of a Checklist Analysis in the form of a ‘What-If / Checklist’ Analysis. This method makes the most of the strengths of the two methods while compensating for the shortcomings of the individual methods. The Checklist Analysis, being an experience based technique, may miss hazards if the checklist is not complete. The What-If Analysis encourages the team to consider potential hazards that are not covered in the checklist. Conversely, the checklist portion of the analysis lends a more structured and systematic nature to the What-If Analysis.

The checklists used in the What-If / Checklist Analysis are somewhat more general than conventional checklists used in Checklist Analysis. Together with the flexible, brainstorming approach of What-If Analysis it allows What-If / Checklist Analysis much wider applications than a Checklist Analysis.

HAZOP Analysis

Hazard and Operability (HAZOP) analysis operates on the principle that a group of experts with different backgrounds working together on a project can interact in a creative fashion and identify more problems than when working separately and combining their results. Although HAZOP Analysis was originally developed for a new design or technology, it is applicable to almost all phases of rail operations. The HAZOP study focuses on specific operating steps called “study nodes.” The

G-28 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

hazard evaluation team examines each study node for potentially hazardous deviations with the help of a set of established guide words: “No,” “Less,” “More,” “Part Of,” “As Well As,” “Reverse,” and “Other Than.” The guide words are systematically applied to the process parameters at each study node to ensure that all relevant deviations of the process parameters and their consequences have been evaluated. The process also requires appropriately trained personnel.

Failure Modes and Effects Analysis (FMEA)

Failure Modes and Effects Analysis (FMEA) uses a similar ‘what if’ approach to a HAZOP but is used in the identification of the effects of failures modes of system components. FMEA is used to identify single failure modes that can contribute to an accident. However, it is not as effective in identifying combinations of failures that may lead to an incident, or incorporating human factors.

In FMEA, the cause of equipment failure is not specifically considered, rather the methodology assumes that a failure occurs and then evaluates the consequences to verify if the failure can be tolerated by the system.

Fault Tree Analysis

A fault tree depicts the way in which a particular system failure might occur. The failure mode, for example a tram fire, forms the top event of the tree. orkingW downwards through the branches, using logic gates, the analysis reveals the combination of events which themselves cause the top event to occur. Thus the components of a fire would be an ignition source and a fuel source.The source of ignition could be heat tram the brakes or a spark from an electrical source. The fuel source could be from a loss of containment of lubricant from the tram or other motor vehicle, or from other flammable material. The tree stops when no further analysis is practicable or necessary.

Such analysis provides an understanding of how an incident could occur and what effect design modifications may have. The preparation of fault tree for identified failure modes or deviations ensures that the possibilities of failure have been thought through and designed out as far as is reasonable and practicable.

Prob = TRAM FIRE 0.0406

IGNITION SOURCE AND FUEL SOURCE

0.28 0.145

0.2 OR 0.1 0.05 OR 0.1

Vehicle carrying flammable Heat from Spark from Loss of material tram motor electrical containment other than or brake source of lubricant fuel

Public Transport Safety Victoria | ACCREDITATION GUIDE G-29 Appendix G - Risk management and ‘so far as is reasonably practicable’

Attachment 3 – Risk criteria: general principles

The establishment of appropriate risk criteria is a critical component of a risk management process. The criteria define whether the risk associated with the operation can be considered acceptable, or whether there is justification for implementing further safety measures. Examples of risk criteria published by regulators may be found in the U.K. Health and Safety Executive document’ Reducing Risk, Protecting people’, and the New South Wales Department of Urban Affairs and Planning Document ‘Risk Criteria for land use safety planning’. The general principle is that there is a level above which risk is intolerable; then a region where risk is tolerable providing it can be demonstrated that it has been reduced to a level ‘so far as is Reasonably Practicable’ (SFARP). If the risk level is intolerable, it must be reduced, or the activity must cease. For risks below the intolerable level, cost (resource expenditure) can be taken into account when determining how far to go in the pursuit of safety. A quantified risk assessment can be used to measure the incremental risk reduction associated with incremental safety improvements. The results can then be used in a cost- benefit analysis to determine what risk reduction measures might reasonably be implemented.

In determining an acceptable level of risk, a good measure of what society finds acceptable is to look at the actual rate of fatalities. For example, it might be decided that a passenger journeys by train should at least as safe as journeys by motor vehicle. With reference to motor vehicle journeys, of the estimated 200,000 million km travelled in Australia in 2004, about 25% took place in Victoria (ABS survey of motor vehicle use, 2004). Of these, about 20% involved freight vehicles, the rest being for private use. For approximately 340 Victorian road fatalities, this equates to a fatality every 120 million motor vehicle km. This figure is considered to be unacceptable, and Government initiatives such as Arrive Alive have been introduced. For comparison, there are between 30 and 40 million passenger train km in Victoria each year. If the same societal values were held for rail safety as for roads safety, this would equate to a passenger train fatality every three years being considered unacceptable.

Alternatively, it might be decided that the level of risk experienced today should be at least as safe as that experienced over the last 30 years for the particular Victorian rail sector in question. These remarks, in effect, define the level above which risk is intolerable, at least in relation to individual risk. Detailed accident data for rail operations in Victoria, covering region passenger, freight tram and tourist Metropolitan Railways, are available from the Regulator.

Societal Risk

Societal risk is a measure of the aggregate risk associated with a system. It accounts for the likely impact of all accidental events, not just on a particular type of individual, as in the case of individual risk, but on all individuals who may

 Reducing Risk, Protecting People, Health and Safety Executive, U.K. (2004)  Risk Criteria for land use safety planning, New South Wales Department of Urban Affairs and Planning Document (1992)

G-30 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

be exposed to the risk, whether they are passengers, or operating staff, and it reflects the number of people exposed.

To calculate societal risk, estimates have to be made, for each identified accidental event and its possible outcomes, of the frequency of the event per year, f, and the associated number of fatalities, N. The resulting data takes the form of a set of f-N pairs. Alternatively one may consider the cumulative frequency, F, of all event outcomes that lead to N or more fatalities. These data are usually plotted as a continuous curve against logarithmic axes for both F and N, which makes for ready comparison against criteria for intolerable risk, itself represented as F-N curves. The f-N curve for Victoria for between 1902 and 2002 is shown below.

The Regulator would not generally expect rail operators to provide a quantitative assessment of societal risk. However, societal risk should be considered qualitatively for those events with the potential to result in multiple fatalities. Quantitative assessment of societal risk may be required however where a significant hazard is novel, for example a new high speed rail link.

Figure 1 - Observed societal risk (Victorian Rail Network 1902 to 2002)

Train collisions, derailments, civil and rolling stock failures Likelihood of N or more fatalities per year

Number of fatalites, N

Public Transport Safety Victoria | ACCREDITATION GUIDE G-31 Appendix G - Risk management and ‘so far as is reasonably practicable’

Attachment 4 - SFARP examples

SFARP demonstration Example 1: Incapacitated Train Driver

This is an example of a SFARP demonstration using a quantitative risk analysis (QRA) and cost benefit analysis (CBA). It examines the risk of an incapacitated train driver and the practicability of the proposed task linked vigilance control (TLVC). The reasons for using this approach to determine SFARP are:

• deficiencies identified with existing controls in recent incidents • risk reduction of potential controls was not immediately obvious • significant cost to implement potential controls • emerging good practice and new technology

Preliminary Risk Assessment

Preliminary hazard analysis is conducted to define the potential incident and review the controls (existing and potential). The results are summarised in the following table and the bow tie diagram attached at the end of this appendix (Figure 4-1).

Potential Incident: Incapacitated driver leading to collision or derailment. Hazards/Pre-cursors: Driver asleep/fatigue, medical incapacitation. Consequence: Potential for multiple fatalities. Likelihood: Several known incidents have occurred in Australia in the recent years (Footscray, Waterfall). Preliminary Risk Current risk assigned in the tolerable region. This indicates risk is Assessment: tolerable if risks are reduced SFARP. Controls Review: Refer to the attached bow tie diagram that provides representation of the existing controls as well as potential alternatives. Note a review of good practice around the world identified a number of potential alternative risk controls some of which are shown on the attached bowtie.

Recommendations from the Waterfall Inquiry and the ATSB indicate that the traditional controls for driver incapacitation, and in particular, deadman devices are now considered insufficient. Task linked vigilance controls are emerging as good practice and are installed in some other states. However, the level of risk reduction was not immediately clear and costs are significant. Therefore more detailed analysis was recommended.

G-32 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

Detailed Risk Analysis:

Detailed analysis included:

• Quantitative risk assessment (QRA) to determine the current level of risk and the potential for risk reduction. This involved fault tree and event tree analysis that examines the incident precursors and estimates the consequences and likelihood of an incident. To assist in quantifying the benefits of TVLC one fault tree and one event tree without TVLC and another set with TLVC installed were developed, and the risk reduction evaluated by comparing the two scenarios. Examples of one of the fault trees and one modified event tree are shown in Figure 1 and Figure 2 (attached at the end of this appendix). A QRA relies on frequency data from historical incidents and near misses to be applied and adjusted to the specific present circumstances. The QRA showed that the implementation of the TLVC system would reduce the risk of fatality due to an incapacitated driver.

• Cost benefit analysis determines the benefit in terms of a lower rate of death and injury compared with the existing situation. A formal cost benefit analysis was conducted using the Department of Infrastructure guidelines. This methodology equates the estimated risk reduction offered by an additional control measure to an annualised monetary value. This value then can be compared against the cost implementing that measure. The value is based on the principle that society is prepared to pay a certain amount to prevent a fatality. The formal cost benefit analysis provided some justification for the implementation of the TLVC system (i.e. the annualised cost of implementing the measure was less than the estimated annual risk reduction).

Conclusion

In relation to the 5 matters of SFARP:

• The likelihood of the hazard or risk concerned eventuating, and

• The degree of harm that would result if the hazard or risk eventuated

Despite the quantitative risk assessment showing the risks were relatively low, the potential catastrophic consequences warranted further consideration. This was highlighted through deficiencies in current systems in light of a number of historical incidents involving driver incapacitation.

• What the person concerned knows, or ought reasonably to know, about the hazard or risk and any ways of eliminating or reducing the hazard or risk.

Relevant stakeholders were consulted and advice was sought from experts for the more detailed analysis. A review of operations in other

Public Transport Safety Victoria | ACCREDITATION GUIDE G-33 Appendix G - Risk management and ‘so far as is reasonably practicable’

states and around the world identified additional risk controls that could be considered as emerging good practice, such as Advanced Train Protection (ATP) and Task Linked Vigilance Controls (TLVC). A review of incident history in Australia and studies showed a number of learnings and that TLVC has been used successfully to prevent or mitigate some hazards.

• The availability and suitability of ways to eliminate or reduce the hazard or risk.

Additional and alternative risk controls were reviewed for their potential for risk reduction and suitability. Some alternatives were rejected based on lack of suitability for adoption to the specific Victorian network and trains, such as ATP. TLVC was found to offer a reasonable reduction risk and be well suited and compatible to the Victorian network and in addition offers operational benefits to the driver.

• The cost of eliminating or reducing the hazard or risk

Cost benefit analysis also shows some justification for the implementation of TLVC (i.e. the annualised cost of implementing the measure is less than the estimated annual risk reduction).

Considering the 5 matters above the TLVC was deemed reasonably practicable to implement.

G-34 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

SFARP demonstration Example 2: ‘Central Station’ Upgrade

This is an example of a SFARP demonstration using various approaches including a qualitative risk assessment, FMEA and other reviews. It examines the risk process for the Central Station redevelopment. As this was such a large change, various approaches were used. However, the majority of risks were reviewed using a qualitative risk matrix approach in workshops involving various stakeholders. Key reasons for using this approach are:

• hazards and risk levels obvious for the majority of hazards

• most hazards are well covered by established standards

Preliminary Hazard Analysis

Preliminary hazard analysis was conducted to identify the incidents, hazards and review the adequacy of controls (existing and potential). The analysis included the following reviews:

• a qualitative risk assessment workshop was conducted with relevant stakeholders to identify hazards, assess risks using a qualitative risk matrix and review the adequacy of controls. The analysis considered design, construction, commissioning and operation phases of the project. Results risks were low or medium according to the organisations risk matrix. Detailed analyses were recommended for underground station fire risks due to the potential for catastrophic consequences. See example in Table 1 (at the end of this appendix).

• review of relevant Australian Standards and Building Codes to ensure compliance

• review of good practice around the world

• notification of material change was completed that included a checklist for change to risk profile.

Detailed Risk Analysis

Detailed analysis included:

• detailed cross-check of the Kings Cross Underground Station fire (UK 1987) incident investigation findings and recommendations

• FMEA of the new fire detection and response system. Results showed a reduction of the overall risk level

• egress modelling was conducted. Results showed that emergency

Public Transport Safety Victoria | ACCREDITATION GUIDE G-35 Appendix G - Risk management and ‘so far as is reasonably practicable’

egress was improved with the new design due to the increase in the number of exit points.

• Semi-quantitative risk analysis of station fire. This analysis involved an examination of the hazards or precursors that could lead to the escalation of an underground station fire. The estimates of likelihood of the fire were based on historical incident data.

Conclusion

In relation to the 5 matters of SFARP:

• the likelihood of the hazard or risk concerned eventuating, and

• the degree of harm that would result if the hazard or risk eventuated

The risks from most hazards were examined using a qualitative risk matrix approach and were deemed either low or medium. The redevelopment meant that the risk profile of the station would change during the various stages of the project. However, due to the potentially catastrophic consequences of an underground station fire a more detailed semi-quantitative analysis was used.

• what the person concerned knows, or ought reasonably to know, about the hazard or risk and any ways of eliminating or reducing the hazard or risk

Due to the range of users of the station and the interfaces between multiple organisations it was vital that a collaborative approach was used that consulted the various stakeholders. Applicable standards and codes describe appropriate means of risk control for most of the hazards identified. A review of operations around the world also established accepted good practice. The public inquiry into the Kings Cross underground fire provided information on underground fires and ways of controlling the risks presented by such fires.

• the availability and suitability of ways to eliminate or reduce the hazard or risk

Requirements of applicable legislation, standards and codes must be deemed suitable and were accepted as a minimum. Additional controls from the review of good practice and recommendations from the Kings Cross fire investigation were considered for suitability to Melbourne Central station. Potential risk reduction was assessed for potential controls. Detailed analysis showed a reduction from previous risk levels.

• the cost of eliminating or reducing the hazard or risk

G-36 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix G - Risk management and ‘so far as is reasonably practicable’

A formal detailed cost benefit analysis was not considered necessary. The requirements for risk controls were largely chosen based on the other four matters above and were accepted by management.

The majority of hazards were identified and adequacy of controls reviewed using a qualitative approach based on expert judgements and comparison to good practice and established standards. Due to the multiple organisation interfaces it was important that all organisations participated in the risk review process. Station management accepted residual risks. Therefore SFARP was achieved.

Public Transport Safety Victoria | ACCREDITATION GUIDE G-37

Figure 2 – Example fault tree for QRA (No TVLC)

Train Driver Incapacitated 6.22E-07

AND 1.87E-11 Primary PV system unsafe failure PV jammed or total failure 3.01E-05

Train Driver Incapacitated 6.22E-07

Deliberate Circumvention AND 1.08E-04 6.71E-11

Primary PV system Operational 0.99948182

Train Driver Incapacitated 6.22E-07

Primary PV system Operational AND 0.99948182 3.10839E-07

PV not released 0.5

Driver Incapacitated, PV not released, Brakes not OR applied Train Driver Incapacitated 3.11E-07 6.22E-07 incidents per Km

Deliberate Circumvention AND 1.08E-04 3.24E-14

Part of PrimarySystem Fails Safe. Other Part continues to work OK 4.82E-04

Train Driver Incapacitated 6.22E-07

2nd PV not released AND 0.5 1.50E-10

Part of PrimarySystem Fails Safe. Other Part continues to work OK 4.82E-04

Train Driver Incapacitated 6.22E-07

Deliberate Circumvention AND 1.08E-04 4.32E-16

PrimarySystem Fails Safe. Emergency VC system operates 6.43E-06

Figure 3 – Example modified Event Tree for QRA (TVLC installed)

TLVC stops train Train stops by itself Incident before before incident (uphill, not powering) TLVC stops train Consequences of Incident

0.8 No incident Yes Driver Incapacitated, PV not released, Brakes not applied 0.1 No Incident 0.2 Yes No 0.1 0.9 Yes No Hits Buffers 1 0.01 Derails 0.3 Hits vehicle at Level Crossing 2 0.01 Doesn't Derail 0.7

Hits Gang 3 0.001

Derails Hits Obstruction 3 0.3 0.001 Doesn't Derail 0.7

Train Derails on curve or turnout 4 0.1

Stops in overlap No Incident Trips at next signal Yes 0.7 0.878 Doesn't stop Hits Buffers 5 No 0.3 0.001

Hits train rear end coll'n 0.05

Hits Train head on, crossing or converging collision 0.03

Hits Obstruction 0.001

Hits Gang 0.001

Derails 0.1

No Collision /incident 0.817 0.9 No incident No Notes: 1. This probability allows for all signals may be at proceed all the way to the terminal station (buffer stops) or else the train trip may not be operational (Broadmeadows) 2. This probability allows for all signals may be at proceed (or else the train trip may not be operational) and allow passage over several level crossings (Broadmeadows) 3. Low probability of gang working on track at the same time as event. Gangs should provide own protection, but flagmen may not be able to provide adequate warning or stop train. Low probability of obstacle 4. Train accelerates or exceeds curve speed limit as per Waterfall 5. Unlikely that only the terminal station arrival signal at stop

Figure 4 – Bow-Tie diagram regarding Driver Incapacitation and TLVC (Courtesy of Moduspec Pty Ltd, RiskManager 2.2.1) Reference Description of Hazard Risk Controls Likelihood Consequence Risk Comments/Additional Controls Number B8 Tripping hazards for 1. Job Safety Analysis C 2 M No further controls identified, risk public and staff 2. Secure work areas using boardings considered acceptable therefore 3. Maintain full access during peak SFARP achieved. times 4. Notification to public of closed areas 5. Regular housekeeping inspections B9 Fire due to construction 1. Prepare an Incident Management E 4 M Refer also to detailed analysis of activity possibly System that will be managed and station fire. No further controls associated with a monitored throughout the project. identified, risk considered acceptable degraded or changed 2. Ensure that all relevant staff therefore SFARP achieved. response procedure understand the current emergency response and evacuation procedures. 3. Central Station EH&S Plan 4. Job Safety Analysis

Table 1 – Example of Qualitative Risk Analysis

Public Transport Safety Victoria

Accreditation Guideline

Appendix H

Corporations Act - disqualifications

September 2006

For more information contact Public Transport Safety Victoria (PTSV). Telephone: (03) 9655 8949 Facsimile: (03) 9655 8929 Email: [email protected]

Appendix H - Corporations Act - disqualifications

CORPORATIONS ACT 2001

- SECT 206B

Automatic disqualification

Convictions (1) A person becomes disqualified from managing corporations if the person: (a) is convicted on indictment of an offence that:

(i) concerns the making, or participation in making, of decisions that affect the whole or a substantial part of the business of the corporation; or (ii) concerns an act that has the capacity to affect significantly the corporation’s financial standing; or

(b) is convicted of an offence that:

(i) is a contravention of this Act and is punishable by imprisonment for a period greater than 12 months; or (ii) involves dishonesty and is punishable by imprisonment for at least 3 months; or

(c) is convicted of an offence against the law of a foreign country that is punishable by imprisonment for a period greater than 12 months.

The offences covered by paragraph (a) and subparagraph (b)(ii) include offences against the law of a foreign country.

(2) The period of disqualification under subsection (1) starts on the day the person is convicted and lasts for:

(a) if the person does not serve a term of imprisonment—5 years after the day on which they are convicted; or (b) if the person serves a term of imprisonment—5 years after the day on which they are released from prison.

Bankruptcy or personal insolvency agreement

(3) A person is disqualified from managing corporations if the person is an undischarged bankrupt under the law of Australia, its external territories or another country.

(4) A person is disqualified from managing corporations if:

(a) the person has executed a personal insolvency agreement under: (i) Part X of the Bankruptcy Act 1966; or (ii) a similar law of an external Territory or a foreign country; and (b) the terms of the agreement have not been fully complied with.

Public Transport Safety Victoria | ACCREDITATION GUIDE H-

Public Transport Safety Victoria

Accreditation Guideline

Appendix I

Guideline for safe management of change in the rail industry

September 2006

For more information contact Public Transport Safety Victoria (PTSV).

Telephone: (03) 9655 8949 Facsimile: (03) 9655 8929 Email: [email protected]

Appendix I - Guideline for safe management of change in the rail industry

Preface

This guideline supersedes the Victorian “Interim guidelines for changing an accredited rail safety management system”, published November 2002. The provisions contained in this guideline commenced on 1 August 2006.

This Guideline is intended to assist accredited rail operators (AROs) during the transitional phase of the implementation of the Rail Safety Act 2006. Particularly, it is intended to assist:

• existing AROs to manage change in accordance with the general conditions of accreditation, currently placed on all existing Accredited Rail Organisations, and

• new AROs to manage change in accordance with section 54 of the Rail Safety Act 2006.

Any projects currently underway where work has started on a material change may continue with the superseded guideline, but only if the written agreement of PTSV has been obtained.

Public Transport Safety Victoria | ACCREDITATION GUIDE I- Appendix I - Guideline for safe management of change in the rail industry

Introduction

Purpose

The purpose of this document is to provide clear and consistent guidance for existing AROs and new AROs on the Management of Change process during the transitional phase between the lapse of the requirements contained in the Transport Act 1983 and those prescribed in the Rail Safety Act 2006 and Rail Safety Regulations 2006.

Structure and content

Part A describes the management of change (MoC) process, types of change and the steps involved in successful MoC.

Part B provides guidance to AROs on applications for variations of accreditation and outlines when an application is required, together with examples and further information.

Part C contains protocols followed by the Safety Director and his delegates in dealings with other Rail Safety Regulators (ORSR). It provides transparency and consistency in the processing of an Application for Variation of Accreditation which may affect one or more Australian jurisdiction.

Scope and application

This guideline is intended for general application across all sectors of the rail industry - commercial, not-for profit, tourist and heritage, train and/or tram organisations within Victoria.

This guideline is not intended to provide AROs with their own specific MoC procedures. Rather, the material contained in this guideline aims to provide AROs with a better understanding of the process and risks brought about by change so they may develop their own policies and procedures for implementation.

AROs should also note that this guideline does not replace legal obligations under the Transport Act 1983 or the Rail Safety Act 2006. To the extent that there is any inconsistency with the legislation, the legislation prevails. AROs are encouraged to obtain their own legal advice on complying with their legal obligations.

I- ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix I - Guideline for safe management of change in the rail industry

Definitions

Accredited Rail Operator: means an existing ARO or a new ARO.

Application for Variation of Accreditation: an ARO’s official submission to PTSV of proposed change/s to, or the manner of carrying out, accredited rail operations (previously known to existing AROs as an application for a material change). For existing AROs, the reference to “accredited rail operations” is a reference to the nature, character and scope of the activities reflected in the ARO’s safety management system.

Change Register: a register maintained by the ARO of all changes affecting safety management.

Documents: any record of information, including:

• anything on which there is writing, or

• anything on which there are marks, figures, symbols or perforations having a meaning for persons qualified to interpret them, or

• anything from which sounds, images or writings can be reproduced with or without the aid of anything else, or a map, plan, drawing or photograph.

Environment: the combination of surrounding conditions and influences. In this document the environment will include (but is not limited to) rail safety activities regardless of whether the operations are conducted on the running line, or whether operations are conducted in metropolitan areas or in isolated areas. It also includes impacting features of the natural environment such as extreme temperatures.

Existing ARO: means a manager of rail infrastructure or an operator of rolling stock who is accredited under the Transport Act 1983 and who holds transitional accreditation or post new scheme accreditation under the Rail Safety Act 2006.

Hazard: a source of potential harm.

Interface Co-ordination Plan: has the same meaning as set out in section 3(1) of the Rail Safety Act 2006.

New ARO: means a rail infrastructure manager or rolling stock operator who applies for and is granted accreditation under the Rail Safety Act 2006, on or after 1 August 2006.

Principal Rail Safety Regulator: for a railway accredited in more than one jurisdiction, the rail safety regulator from whom initial accreditation is obtained. Normally it is the Rail Safety Regulator located where the applicant carries out

Public Transport Safety Victoria | ACCREDITATION GUIDE I- Appendix I - Guideline for safe management of change in the rail industry

their principal business activities. It may be in the jurisdiction where direct contact is most practical.

Other Rail Safety Regulator: Any Rail Safety Regulator of another jurisdiction in which accreditation is sought.

Rail Contractor: means a person who:

• whether or not under an agreement with a rail infrastructure manager or rolling stock operator designs, commissions, constructs, manufactures, supplies, installs, erects, maintains, repairs, modifies or decommissions any thing that may be used as rail infrastructure or rolling stock, or

• is engaged directly or indirectly by a rail infrastructure manager or rolling stock operator to supply rail infrastructure operations or rolling stock operations to that rail infrastructure manager or rolling stock operator, and includes a sub-contractor.

Rail Safety Regulator: the responsible person or organisation in each Australian jurisdiction which has the legal authority to accredit and audit rail organisations.

Rail Safety Work: has the same meaning as set out in section 7 of the Rail Safety Act 2006.

Rail Safety Worker: means a person who has carried out, is carrying out or is about to carry out, rail safety work and includes:

• a person who is employed or engaged by a rail operator to carry out rail safety work

• a person engaged by a person (other than by a rail operator) to carry out rail safety work

• a trainee

• a volunteer.

Risk: Risk is the product of the expected consequences and frequency of a hazardous event - R = E(C) X E(F).

Note 1: the appropriate definition for risk depends to a large extent on the scope and purpose of the analysis. The definition of risk should be compatible with the target safety measures used by the ARO. It should be expected however that all guides and standards related to rail safety use the same definition of risk. While ISO/IEC Guide 51:1999 defines risk as ‘A combination of the probability of occurrence of harm and the severity of that harm’, a definition of risk in terms of frequency may be more appropriate than one based on probability as the latter requires the consideration of time. Also, in rail, often frequency of incidents can be influenced more straightforwardly than the severity.

I- ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix I - Guideline for safe management of change in the rail industry

Risk Assessment: An overall process of risk identification, analysis and evaluation.

Risk Management Process: The systematic application of management policies, procedures and practices to the task of communicating, establishing the context, identifying, analysing, evaluating treating monitoring and reviewing risk.

Risk Register: A continually updated document that records an ARO’s risk information, including hazards, risks and controls.

Safety Director: Director, Public Transport Safety Victoria.

Safety Management System: A formal framework for integrating safety management into the organisation’s business policies, systems, standards, practices and activities. The purpose of the SMS is to ensure safe management of the rail operations that the ARO carries out. The SMS includes development, implementation, documentation, monitoring, review and improvement. The specific content of an SMS is set out in Schedule 2 of the Rail Safety Regulations 2006. Please note that the SMS requirements set out in Schedule 2 only apply to New AROs during the transition period. The Safety Director recommends that Existing AROs comply insofar as they are able.

Transition period: for commercial operators – 1 August 2006 to 31 July 2008, and for tourist and heritage operators – 1 August 2006 to 31 July 2009.

Glossary of abbreviations

ARO Accredited Rail Operator

MoC Management of Change

ORSR Other Rail Safety Regulator

PRSR Principal Rail Safety Regulator

PTSV Public Transport Safety Victoria

RSR Rail Safety Regulator

SFARP So Far As Reasonably Practicable

SMS Safety Management System

Public Transport Safety Victoria | ACCREDITATION GUIDE I- Appendix I - Guideline for safe management of change in the rail industry

Roles and responsibilities relevant to managing change

Accredited Rail Operators

The responsibilities of AROs include, amongst other things, to:

• have a Safety Management System (SMS) in place

• have and maintain a risk register

• follow the applicable MoC process in their SMS

• operate within the terms of the applicable legislation and the conditions of accreditation, and

• submit an Application for Variation of Accreditation to PTSV, as required (see Part B for further details).

An SMS is intended to ensure the safe management of rail operations, by protecting and controlling risks to the safety of the public and rail safety workers (including rail contractors) as well as preventing damage to property and the environment. A suitable and sufficient MoC process to plan, assess, implement and monitor change should be included and maintained as an integral part of the rail organisation’s SMS.

It is advisable to contact PTSV at the earliest opportunity to discuss any possible Variation of Accreditation submission. The necessary provisions for involving PTSV, including allowing time for review, acceptance, revision or rejection of Applications for Variations to Accreditation must also be included in the SMS. It is advisable for the ARO to forward an Application for Variation to PTSV no less than 30 calendar days prior to the proposed implementation date.

An ARO must not implement any change that is subject to a mandatory Application for a Variation of Accreditation under section 54 of the RSA until the Safety Director’s approval is received.

Public Transport Safety Victoria responsibilities

The primary responsibilities of PTSV in relation to MoC are:

• first, to be satisfied that the ARO has the competence and capacity to manage the risks to safety associated with the change to its accredited

I- ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix I - Guideline for safe management of change in the rail industry

rail operations, and

• secondly, to confirm that the ARO has applied an appropriate MoC process consistent with the Rail Safety Act 2006, Rail Safety Regulations 2006 and the ARO’s SMS.

PTSV is also responsible for the following MoC activities:

• monitoring compliance with the ARO’s accreditation through audit and inspection

• assessing Applications for Variation of Accreditation, and

• the timely consideration and determination of Applications for Variations of Accreditation.

During a safety audit or at any time, PTSV may review changes that either have or have not resulted in a Variation of Accreditation, and the MoC process generally.

In approving a variation of accreditation, it is not the intention of PTSV to be a part of the day- to-day management of railways. Rather, PTSV must be satisfied that the submission has been supported by an appropriately rigorous MoC process. Part B provides further information on Variations to Accreditation.

The Safety Director may grant or refuse the Application for Variation, or approve with conditions. The Safety Director will provide a statement of reasons for any refusal of an Application for Variation of Accreditation (or opportunity to consult, if conditions are varied). Should the ARO disagree with a refusal by the Safety Director to grant a variation, the ARO has the right to seek a review by the Victorian Civil and Administrative Tribunal (VCAT) of the decision to refuse an Application for Variation of Accreditation.

Public Transport Safety Victoria | ACCREDITATION GUIDE I- Appendix I - Guideline for safe management of change in the rail industry

Part A - The Management of Change process

The purpose of the MoC process is, first and foremost, to ensure that change is introduced safely. An effective MoC process also will aid in consistent decision making and provide assurance that the ARO continues to operate in compliance with applicable laws and within the conditions of their accreditation. Regardless of the scope or complexity of the changes, it is the ARO’s responsibility to manage changes safely through a robust internal MoC process.

Successful MoC is not simply the application of a system, process or procedure in isolation. Rather it relies on the ARO fostering a safe working environment that is committed to continuous improvement for its rail safety workers, passengers and other stakeholders.

Key principles of an effective and safe MoC process

The following are recommended as prudent guiding principles for safely managing change:

• Change should be properly identified, described and documented in the context of the specific rail organisation. The identification should include all relevant types of change to be managed (ie, those which may affect the safety of rail operations). The changes should be documented in a specific change register, a risk register or other appropriate means in the SMS.

• A new risk assessment should be undertaken (by suitably knowledgeable and experienced people) to manage risk associated with the proposed change.

• The assessment should include identification of hazards and analysis of human factors issues and methods of treatment using suitable risk controls. New AROs are to ensure remaining risks are reduced so far as reasonably practicable (SFARP). Further information regarding risk and SFARP is available from PTSV.

• The information in the risk register should be updated with any changes to hazards, risks and control measures.

• People who are, or might be, affected by the change should be consulted, including relevant rail safety workers.

• Roles and responsibilities of different people affected by, or involved in the change, ought to be clearly defined.

• A check should be made to ensure that the proposed change conforms to legislation in the appropriate jurisdiction(s) or, where appropriate, is

I-10 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix I - Guideline for safe management of change in the rail industry

consistent with accepted codes or standards.

• Analysis of training needs should be undertaken as part of the MoC process, and appropriate instruction or training of personnel in the change should occur in accordance with the identified needs

• Monitoring and reviews of the effect of the change ought to be undertaken, documented and actioned, to ensure that control measures perform as intended

• Ensuring decisions are transparent and formally accepted by those responsible for decision-making within the ARO.

Types of change to be managed

AROs can be subject to changes from both internal and external sources.

Internal sources of change may include: turnover in staff; the findings or recommendations of internal auditors; the Board or Management Committee; findings from internal investigations.

External sources for change may include: Rail Safety Regulators; Office of the Chief Investigator, road authorities; other AROs; suppliers; rail contractors.

These changes may present themselves as:

• planned change, for example change brought about by business or strategic plans

• unavoidable, unplanned or unintended change, such as legislative reform, and including “creeping” or “incremental” change, where the impact at any time may seem minor, but which over a period can significantly increase risk

• a change to an interface

• a mandated Government project

• temporary change, and

• emergency or abnormal change which may be required within a short timeframe and therefore may require different controls.

The MoC process should enable the different types of change to be identified in advance and managed appropriately.

Public Transport Safety Victoria | ACCREDITATION GUIDE I-11 Appendix I - Guideline for safe management of change in the rail industry

A systems view of change

Elements within a rail organisation that may influence or be affected by change include:

• people, such as employees (managers and staff), consultants, rail contractors, customers, suppliers and other stakeholders • environment, such as the physical and social environments of the organisation and this may cover not only the internal environment but also the surrounding industry (eg, interfaces with other rail organisations) and regulatory environment in which the organisation exists • work, practices, policies and procedures, and • equipment, technology and facilities.

The change may have an impact on these elements across their lifecycle from conception and design to commissioning, operations, maintenance and decommissioning.

A change may be influenced by, or affect one or more of, the above elements and/or the interfaces between these elements. As such, it is useful to take a systems view to the management of change process to ensure that the impact on all elements and their interfaces across their lifecycle can be systematically identified, assessed and controlled.

A key aspect of the MoC process is to define which elements of the system and the lifecycle need to be considered. A starting point for the process of defining the system and the relevant elements impacted by change is the organisation’s SMS.

Managing rail contractors

An ARO is also responsible for managing its rail contractors and ensuring that rail contractors are consulted, where practicable, in respect of decisions that affect the safety of the ARO’s railway operations at appropriate points of the MoC process, and that they meet their responsibilities for managing change safely.

As the principal, the ARO remains responsible for the MoC process and the submission of Applications for Variation of Accreditation.

Steps in the internal MoC process

PTSV considers that an appropriate and robust internal MoC and safety validation process involves seven main steps. These are set out in Figure 1 (refer to attachment at the end of this appendix).

I-12 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix I - Guideline for safe management of change in the rail industry

The level of detail required at each step will depend on the level of complexity and scope of the proposed change. The involvement of PTSV during the management of change process is set out in Part B.

Step 1 - Establish the context of the change and consult with stakeholders

This step involves identifying the change and developing the necessary plans for change management in consultation with stakeholders including interfacing organisations.

A clear description of the current situation, including the problem or matter that the change is intended to address, and the change itself, is required. This should be sufficiently detailed to fully define the overall nature and scope of the change. Changes can be defined and analysed at several levels, including project, component and/or process level. More than one may be applicable.

Consultation with stakeholders is an integral part of managing change and should be included, where practicable, at regular intervals throughout the MoC process.

The objectives of consultation are to:

• obtain all information necessary for identification and assessment of the options for change, and the possible impact of each option

• ensure that all relevant personnel in the ARO, interfacing external organisations and other affected parties are aware of the proposed change, have an opportunity to comment on safety aspects and act consistently to achieve a safe outcome

• ensure different perspectives are reflected in the monitoring and review of the proposed change, and

• promote ownership among affected persons for safety and the successful implementation of the change.

Affected persons may include:

• persons who will be involved in implementing the change (technical staff and/or end user employees/rail safety workers) and/or whose work may be affected by the proposed change

• organisations with an interface with the proposed change, maintenance and construction contractors, and other third parties whose access may be affected by changes to the scope of operations

• manufacturers/suppliers

• rail unions and passenger representative bodies, and

• persons who may make a useful contribution to the change process (for example

Public Transport Safety Victoria | ACCREDITATION GUIDE I-13 Appendix I - Guideline for safe management of change in the rail industry

people with prior experience in similar changes, or who have technical expertise).

Emphasis should be placed on direct dialogue with the appropriate persons, with efforts focussed on consultation rather than a one way flow of information. AROs should produce a consultation plan for changes involving multiple stakeholders, or where a stakeholder will be significantly affected by a change. Further guidance on consultation plans can be found in Appendix 1.

Step 2 - Undertake risk assessment

This step involves undertaking a risk assessment on the proposed change. Appropriate use of risk management tools and techniques as part of the MoC process ensures that the potential impacts are understood. This requires an in depth understanding of the change proposed, its potential impacts on current activities, operational interfaces, and the accredited rail organisation’s SMS.

Risk assessment involves a comprehensive and systematic assessment of all incidents that could occur on or at rail infrastructure, or while carrying out rail infrastructure operations, and hazards that could cause, or contribute to causing, those incidents. As well as identifying ways in which equipment may fail, human error analysis should also be considered. It also involves the adoption of measures to eliminate or reduce the likelihood, magnitude and severity of incidents, so far as is reasonably practicable.

When an ARO undertakes risk assessments, the emphasis is usually on any new incidents or associated hazards that could arise from the proposed change. The assessment should also take into consideration any existing risks and common cause failures should be considered where the change is not independent of existing systems or functions.

The ARO should ensure that the new cumulative impact of all hazards does not make the overall risk of rail operations intolerable. This may require the implementation of additional controls initially rejected because the benefit was marginally less than the resources to implement them.

Step 3 - Evaluate levels of change and develop implementation plan

This step requires evaluation of the consolidated information gathered, further consultation (if practicable) with appropriate stakeholders and judgement decisions to determine options available. The change and associated activities are determined and an implementation plan developed.

The implementation plan should address a range of matters including:

• plans for introducing the change, including all necessary modifications to the SMS

I-14 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix I - Guideline for safe management of change in the rail industry

• communication, whereby important changes regarding operations, equipment and procedures are effectively communicated throughout the organisation

• requirements for instruction and training

• any additional resources required to implement the change, for example supervision or verification

• documents that need to be revised, for example, operating procedures, Risk Registers, training material, interface coordination plans, emergency plans and MoC documentation itself

• plans for monitoring and reviewing the change following implementation.

Step 4 - Document changes and obtain internal approvals

This step involves consolidating documentation on the change, including any supporting records (external reports, quotes, findings, memos). The change must be clearly documented and gain internal sign off from the appropriately authorised person/s within the rail organisation.

An independent safety validation where the proposed change relates to major projects should be undertaken by someone not affected by the change, ideally by a person in another division or unit within the same rail operator.

Step 5 - Review of SMS

This step involves the rail operator reviewing and revising where necessary its SMS, Risk Register, emergency plans and interface co-ordination plans.

Step 6 - Implementation

Once a change has received the necessary approvals (see figure 2, part B regarding PTSV approval), it may be implemented using the approved implementation plan.

It is essential that the approved implementation plan is fully carried out, including making all necessary modifications to organisational documentation, such as the SMS, risk assessments and other operational documentation.

Step 7 - Monitoring and review

The following questions should be asked at this step in the MoC process:

1. Have any new risks eventuated or pre-existing risks increased after implementation? Have any pre-existing risks been reduced or eliminated?

Public Transport Safety Victoria | ACCREDITATION GUIDE I-15 Appendix I - Guideline for safe management of change in the rail industry

2. Are additional risk controls, implemented as part of the change, appropriate?

3. Have performance targets for the change been set, and where applicable organisational key safety performance targets been reviewed?

4. Has training been provided to staff affected by the change?

5. Has a post implementation competency assessment been conducted to ensure the training provided was adequate for facilitating the change?

6. Is there a process to revise the risk assessment as new information accumulates?

Monitoring and review arrangements can be introduced immediately following the implementation of the change to ensure all risk controls, including training, have been effective, and that documentation has been updated.

I-16 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix I - Guideline for safe management of change in the rail industry

Part B - Application for variation of accreditation

An Application for Variation of Accreditation is a common regulatory submission required by each Rail Safety Regulator across Australia. In Victoria, the Safety Director or his/her delegate will assess and determine an Application for Variation of Accreditation prior to the proposed change being implemented.

Proposed changes to accredited rail operations will vary in size, complexity, duration and/or resources involved. While some applications will be more complicated than others, early consultation between the ARO and PTSV is encouraged prior to the submission of an Application for Variation of Accreditation. PTSV contact details are listed in Appendix 4.

The submission of an Application for Variation of Accreditation late in a major project introduces a risk that earlier decisions may be questioned, changes may be required to project work already completed and/or the application may be rejected, potentially leading to delays and or cancellation of the project.

To determine if the proposed change will require an Application for Variation of Accreditation refer to Figure 2 over the page.

When an Application for Variation to Accreditation is required

The information set out below provides AROs with some guidance in deciding when an Application for Variation to Accreditation should be made. However, both Existing and New AROs should obtain their own legal advice on their obligations to notify the Safety Director of proposed changes to accredited rail operations, or the manner of carrying out accredited rail operations.

It is not necessary to seek approval for trivial changes within an ARO’s business. Instead, approval ought to be obtained in the following situations.

1. When there is a change to the existing accredited rail operations with the result that the operations are not within the competence, capacity and systems for which the accredited rail operator is accredited.

A change to existing accredited rail operations can include, but is not limited to, the following: • a physical or geographic change to operations. • a change to the fundamental type and scale of operations. • significant internal change in the ARO’s structure or ownership.

Where changes such as these occur and take the ARO’s operations outside those for which it was accredited, then an application for variation of accreditation must be made.

Public Transport Safety Victoria | ACCREDITATION GUIDE I-17 Appendix I - Guideline for safe management of change in the rail industry

Figure 2: Determining if an Application for Variation of Accreditation is required

A Change is proposed to ARO’s activities

Internal MoC process commenced

Does the proposed change Does the proposed change alter the existing require a significant variation nature, character and/or OR to the existing risk register? scope of the operator?

NO YES Unsure

Submit an application for variation to accreditation Seek advice from Continue with PTSV Internal MoC Process Obtain PTSV and/or Other Rail Safety Regulator PTSV May Audit Endorsement

Implement Change According To Implementation Plan

Continue with Internal MoC process PTSV May Audit

I-18 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix I - Guideline for safe management of change in the rail industry

2. Where the change requires a significant variation to an existing risk register.

It is for the ARO to decide what is significant. In meeting this requirement, the ARO will need to decide on the appropriate methodology and depth of analysis, taking into account the nature and scale of the hazards and risk for the change. The principle consideration is whether or not the variation has genuine potential to affect the previous decision of the Safety Director to grant accreditation. It is recommended that examples of significant variations are included in the organisation’s change management procedures.

Where a number of less significant revisions have been made without seeking PTSV approval, the cumulative effect of revisions should be considered in deciding whether there is a significant variation to the original accreditation application.

Where the rail operator has used a quantitative risk assessment methodology, what the rail operator considers significant may be in terms of a defined change to the level of individual or societal risk, such as a change to the expected fatalities per million passenger journeys, per million train km, or per hour exposure.

The intention regarding application for a significant variation is to ensure that all changes are managed within the accredited change management process. For example, if a rail operator proposes to implement a change to a number of level crossings over a period of time, the rail operator would describe the implementation process and there would be no need to submit an application for each level crossing. The actual implementation at each level crossing would not be a significant variation, provided the installation was in line with the procedures and standards documented in the Safety Management System.

Examples of change that may necessitate an Application for Variation of Accreditation

The examples below are not exhaustive but are intended merely to provide additional guidance to AROs.

Any changes to the accredited rail operations may include:

• geographic change to rail operations, for example, a new rail corridor or an extension to an existing rail corridor • maintenance or construction activities not currently undertaken • higher train running speeds • new signalling or safe working system • new communications systems • new train stations or new types of tram stops • new types of rolling stock, including maintenance vehicles

Public Transport Safety Victoria | ACCREDITATION GUIDE I-19 Appendix I - Guideline for safe management of change in the rail industry

• a change from a freight operator to a passenger rail operator • a change in train crew working arrangements eg 2 person to driver only operation

Any significant variation to a risk register, such as:

• changes that affect key safety performance targets outlined in the SMS. • implementation of new or removal/relaxation of existing operational or technical standards • the removal of existing risk controls, for example, the removal of existing SPAD mitigation procedures and/or equipment • significant changes that affect the ARO’s risk register • change in skills/qualifications required to undertake rail safety work • significant modification to maintenance controls.

Further information can be obtained from the Risk Management Guideline

The Application for Variation of Accreditation structure

An Application for Variation of Accreditation must be made on the approved form. A copy of the prescribed form is set out in the Accreditation Guideline. The application should contain supporting documentation as deemed relevant.

The Application for Variation of Accreditation should convey to PTSV the adequacy of the ARO’s risk management systems in relation to the proposed change. This may be satisfied by assessing and documenting all incidents that could occur and all hazards that could cause or contribute to the incidents in order to assess the risks to the safety of persons and property, arising from the change. The application should also list the controls required to reduce those risks to a level that is reasonably practicable.

The application should also demonstrate the competency and capacity of the organisation to implement and maintain the change. Further information can be obtained from the Accreditation Guideline or by contacting PTSV.

The application should be authorised in writing by the director/manager who is accountable for the proposed change in addition to the manager responsible for the SMS. For example:

• Director/Manager Operations

• Director/Manager Rolling Stock

• Director/Manager Infrastructure • Chief Executive Officer/Managing Director for complex projects involving many interfaces.

I-20 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix I - Guideline for safe management of change in the rail industry

The Application for Variation of Accreditation must be signed off by the nominated management officer responsible for maintaining accreditation, prior to submission to PTSV.

Supporting documentation

The Application for Variation of Accreditation should be supported by appropriate documentation relating to the proposed change. Examples of suitable supporting documentation may include but are not limited to:

• an overview of the project, including its objectives. This may take the form of a project plan • executive summary of proposed change • reference to or a summary of the internal change management process being followed • all possible major incidents and all hazards that were not identified in any previous risk assessment • the nature, character and scope of the proposed change in rail operations • the implementation plan • the consultation plan • a safety validation where appropriate • project plans • commissioned reports, either from internal or external stakeholders • any other information as is considered to support the Application (for example, this may include financial analysis, comparison with other jurisdictions).

The ARO may be able to include other supporting documents specific to the nature of the change proposed.

Regulator requests

PTSV or other RSRs may require a rail operator to make a change to its accredited activities or systems by varying or imposing a condition or restriction of accreditation. In these circumstances the ARO should apply their existing MoC process documented in its SMS and follow the process as if the change/s are proposed by the ARO itself.

Accreditation in more than one jurisdiction

Public Transport Safety Victoria | ACCREDITATION GUIDE I-21 Appendix I - Guideline for safe management of change in the rail industry

Where it is evident to the ARO that an Application for Variation of Accreditation made to a particular RSR may impact on or have implications for another jurisdiction, the ARO is responsible for providing original documentation to the Principal Rail Safety Regulator (PRSR). The PRSR will provide duplicate copies of the Application for Variation of Accreditation and supporting documents to affected Other Rail Safety Regulators (ORSR). See Figure 3.

Review Part B for further information regarding Application for Variation of Accreditation senarios involving PRSRs and ORSRs.

Joint Applications for a Variation of Accreditation (more than one ARO)

Prior to submitting any joint Applications for a Variation, the AROs together should first contact PTSV to discuss the specific change proposal intention.

A joint application will normally arise as a result of a major project impacting on two or more accreditations and the co-ordinated preparation of the applications is necessary to ensure that the rail operations of the applicants are carried out safely.

Each ARO will need to evaluate the level of change to safety risk and controls with respect to existing accreditation in order to understand the involvement required by each party. The level of change to each rail organisation’s accreditation will also assist to determine:

• which ARO may be the ‘Primary’ applicant and which ARO will be the ‘Secondary’ applicant, or

• whether one or more AROs are an affected party only, or

• whether it may be more straightforward for both AROs impacted by the change to submit separate applications.

I-22 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix I - Guideline for safe management of change in the rail industry

Part C - Protocols for the Safety Director

This part outlines protocols followed by PTSV when processing Applications for Variation of Accreditation. The purpose is to provide consistency and transparency for industry, particularly where the impact of an Application for Variation of Accreditation affects existing mutual recognition arrangements in place with ORSRs.

Regulatory Process

Figure 3 (overleaf) illustrates the approach PTSV will undertake when processing an Application for Variation of Accreditation.

The following criteria will be observed by the Safety Director in the exchange of information relating to Applications for Variation of Accreditation:

Where the ARO’s Victorian rail accreditation was granted under mutual recognition provisions but the variation has no impact on rail operations in its ‘home’ jurisdiction, the Safety Director will provide the following details to the PRSR:

• name of ARO

• date application is received and/or approved

• summary of change

• date change is due

• contact officer.

Where the variation impacts on rail operations in another jurisdiction/s, a complete duplicate of the Application and any supporting documentation will be forwarded to each RSR.

Public Transport Safety Victoria | ACCREDITATION GUIDE I-23 Appendix I - Guideline for safe management of change in the rail industry

Figure 3 - Regulatory application for Variation of Accreditation process File File File t y ma RSR Audi n n e n n n ariation and Implement Change documentatio documentatio documentatio new accreditation documents issued with PRSR prior to in accordance with Approve and Issue Approve and Issue Implement change, ORSR should liais issue of amended or Approve V required accreditatio required accreditatio d Application require issues, conduct Assess meetings between Resolve outstanding appropriate parties if n d Process and f n pplication, A further Provide applicatio either RSR requested by Information if assessment o ccreditation Process liase with PRSR Review Co-ordinate detaile A specific requirements, evaluate for jurisdictio riation of No Va f r s ? r ARO Application ARO s Ye Submit variation to accreditation application to Does the forward copy of Initial Review fo operate interstate applicable ORSR/ Application for

Lodge application fo acknowledgement o

completeness and send application back to

) ) R R l a c P O R (A r to ra e p O il a R d ite d re c c A R S (P R S ip rin ) R S R (O R S R r e th O Regulatory

I-24 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix I - Guideline for safe management of change in the rail industry

Attachment 1 Model Consultation Plan

A Consultation Plan specific to the project may be developed where deemed appropriate, and implemented with sufficient lead-time to enable feedback and revision prior to its implementation. Input from other affected AROs and parties may be required to complete the plan.

Initial consultation involves providing information on the proposed change. This information should be circulated widely even if some stakeholders respond that the change has no impact on them.

Where the change involves a potential increase in risks to another party, the MoC process should cover how those risks are likely to be increased and subsequently managed.

As a result of consultation, the definition of the change, risk assessment, options and implementation plans may need to be amended.

Suggested elements of a consultation plan include but are not limited to the following:

• name of the ARO

• title of the proposed change

• brief description of the proposed change

• Gantt Chart or similar containing all elements of the plan, including milestones, timelines, and dates for achieving outcomes

• names of all affected AROs and other affected parties, including a brief description of the proposed consultation with each and their respective accountabilities

• details of the communications packages to be prepared for all affected parties

• details of all briefings, education/training of all affected personnel, including a strategy that covers personnel not available during the implementation, and

• means by which consultation responses, including risk and safety issues, will be received, addressed and fed into the project plan.

Public Transport Safety Victoria | ACCREDITATION GUIDE I-25 Appendix I - Guideline for safe management of change in the rail industry

I-26 ACCREDITATION GUIDE | Public Transport Safety Victoria Appendix I – Guideline for safe management of change in the rail industry

Figure 1 – Internal MoC process