Waterfall — A Driver’s Heart Stopped, the Train Did Not, 7 Dead

Summary

On the morning of 31 January 2003, a CityRail Tangara interurban train left the rails on a tight curve in a rock cutting near Waterfall, about thirty-seven kilometres south of Sydney, killing seven people — including the driver — and injuring some forty more. The train was travelling at roughly twice the speed the curve was rated for. The reason it was travelling so fast was that the man controlling it was already dead or dying, and every system that should have stopped a train without a functioning driver had failed to do so.

The train was set G7, a four-car Tangara of the State Rail Authority's CityRail network, running the early service from Sydney's Central station south toward Port Kembla via the Illawarra line. At about 7:15 a.m., as the train ran through the descending, curving territory near Waterfall, the 53-year-old driver, Herman Zeides, suffered a sudden and fatal cardiac event. He did not brake, did not ease the power, and did not react to the approaching curve. The train accelerated to around 117 kilometres per hour and entered a curve rated for no more than 60. It derailed, the leading cars striking the rock walls of the cutting.

The reason the driver's collapse did not stop the train was a defeated safety device. The Tangara's "deadman" control was a foot pedal that the driver must hold within a defined range; releasing it or pressing it fully was meant to cut power and apply the brakes, on the assumption that an incapacitated driver's foot would slip off. Investigators found that the unconscious driver's body weight held the pedal within its active range, so the system read a live, attentive driver where there was none. The guard, the train's second safety-critical crew member, was not monitoring speed and did not intervene with the emergency brake in time; the inquiry found the vigilance and guard-alerting arrangements inadequate to catch a silently incapacitated driver.

A Special Commission of Inquiry was established under the Honourable Peter Aloysius McInerney, who had also led the inquiry into the 1999 Glenbrook accident. McInerney's final report, delivered in January 2005, located the immediate cause in the driver's incapacitation and the resulting overspeed, while finding that an underdeveloped safety culture and a reactive approach to risk had left the railway without effective defences against exactly this scenario. The finding for this file is Driver — the proximate cause was the incapacitation of the man at the controls — but the report's force lay in showing how predictable that single point of failure was, and how poorly the system had guarded against it.

Timeline

The Service, the Set, and the Curve

The Illawarra line runs south out of Sydney through the national park country toward Wollongong and Port Kembla, climbing and falling through cuttings and curves. The early interurban that became set G7 was a routine, well-worn working: a four-car Tangara, a double-deck outer-suburban design, crewed by a driver in the leading cab and a guard responsible for the doors and for the safety of the train. The Tangara was a modern set with AC traction; the subsequent engineering examination found no fault in its electrical or mechanical systems or its traction equipment that contributed to the accident. The train did exactly what it was told. The problem was what it was told.

The geography south of Waterfall is unforgiving. The line descends through a rock cutting on a curve whose maximum safe speed was 60 kilometres per hour. A train approaching it under normal control would be braking and easing back. There was nothing about the curve that was hidden or novel; it was a known, posted restriction on a route the driver had worked. Taken at the correct speed it was entirely safe. Taken at roughly twice that speed it was a derailment waiting for a train that did not slow down.

The safety of the whole arrangement rested, as on most railways, on the driver — and behind him, as a partial backstop, on two further defences: the deadman vigilance device that should stop a train without an attentive driver, and the guard, a second qualified person aboard. On 31 January 2003 the driver was removed from the equation in an instant by his own heart, and the two backstops that were supposed to cover that exact contingency both failed.

The Heart, the Pedal, and the Guard

Herman Zeides was 53 and, so far as the railway's processes had established, fit to drive. At about 7:15 a.m. he suffered a myocardial infarction and lost consciousness at the controls. From that moment the train had no functioning driver. Whether it stopped now depended entirely on the machinery and the man behind him.

The Tangara's deadman control was a foot pedal of the "active range" type: the driver had to keep it depressed within a band, neither fully released nor fully pressed, and a departure from that band — a foot lifting off as a driver slumped, for instance — was meant to cut traction power and apply the brakes. The design assumed that an incapacitated driver would release the pedal. The inquiry found that assumption false for a significant proportion of drivers: an unconscious driver's leg and body weight could hold the pedal within its active range, so that the system registered a present, alert driver. Investigators determined that a large share of the driver population had sufficient leg mass to defeat the device in just this way. Zeides's collapse held the pedal active. The train read him as in control and ran on under power toward the curve.

That left the guard. On a two-person crew the guard is the redundancy against a driver who fails — able, in principle, to apply the emergency brake. But the guard was not effectively monitoring the train's speed in the seconds that mattered and did not intervene in time; the inquiry found the guard-alerting and vigilance arrangements, and the expectation of the guard's role in watching for overspeed, inadequate to catch a driver who had silently become incapacitated. With the deadman defeated and the guard not intervening, the last two defences fell together, and the train entered the 60 km/h curve at about 117 km/h. It derailed almost at once.

The Five Factors

Aftermath

The Waterfall inquiry reshaped rail safety in New South Wales. Even before the final report, its interim findings drove a 2004 overhaul of the medical assessment of rail safety workers, introducing mandatory cardiac screening as part of certification and recertification — a direct answer to the fact that a driver's heart attack had been allowed to become a fatal single point of failure. The deadman arrangements were redesigned toward task-linked vigilance systems that demand active responses rather than mere continuous pressure, addressing the defeat-by-body-weight flaw at its root. Data loggers recording the actions of driver and guard were fitted, and the guard's safety role was strengthened with clearer monitoring expectations.

Institutionally, Waterfall — coming so soon after Glenbrook, and investigated by the same commissioner — accelerated the separation of safety regulation from the railway operator and the establishment of an independent transport-safety regulator in NSW, with ongoing public reporting on the implementation of McInerney's recommendations sustained for years afterward. For the families of the seven who died, the lasting meaning of the inquiry was its insistence that the accident was not simply an act of God in a driver's chest, but a foreseeable failure the railway had been obliged, and had failed, to guard against.

Lessons

References

• Special Commission of Inquiry into the Waterfall Rail Accident: Final Report Parliament of New South Wales (the Hon. Peter McInerney)
• Waterfall rail accident Office of the National Rail Safety Regulator (ONRSR)
• Waterfall rail accident Wikipedia (synthesis of the McInerney inquiry and contemporary reporting)