Background
Glenbrook is a town of 5051 people (as of 2016) in southeastern Australia, located in the federal state of New South Wales 55km/34mi west of Sydney and 104km/64.5mi southeast of Bathurst (both measurements in linear distance).
Glenbrook lies on the Blue Mountains Line (BMT), a mostly electrified section of the Main Western Line mostly acting as a commuter rail corridor moving people between Sydney Central Station and several suburbs and towns as far out as Bathurst. The line uses the Main Western Line’s single to six tracks (the closer to Sydney the line gets the more tracks it has) while serving 21 stations. Most trains are regional passenger services, with the shared trackage bringing the occasional freight train and long-distance express train.
The Trains Involved
The “Indian Pacific” is a long-distance tourist train travelling across the Australian continent, heading from Sydney on the Pacific Ocean westbound to Perth on the shore of the Indian Ocean and back east. The train involved in the accident was headed eastbound and consisted of 16 four-axle passenger cars (offering both seating and sleeper-arrangements) along with a bilevel car carrier at the back of the train. The report lists a length of 426m/1398ft at “over 900 tons” in weight. The train cars were owned by the Great Southern Railway, which also provided the train staff tending to the passengers, while the locomotive and drivers were provided by National Rail Corporation Limited under a “hook and pull”-contract.
Following behind the Indian Pacific was W534, a commuter rail service from Lithgow to Sydney. The service was provided by NSW TrainLink with a V-Set, a four-car bilevel electric multiple unit. To be precise, the unit involved in the accident was DIM 8067. The type entered service in 1970, with DIM 8067 being manufactured in the third batch in 1982. The train measured 95m/312ft in length at a weight of 204 metric tons. Each V-Set can carry up to 416 passengers at speeds of up to 115kph/71mph, the number of passengers on board the train involved in the accident is unknown.
The Accident
The Indian Pacific is approaching Sydney in the early morning hours of December 2nd 1999, having departed Perth on November 29th. It’s under the command of Mister Marshall since he took over at Lithgow Station, 54km/34mi linear distance northwest of Glenbrook.
It is at this point that we should take a quick look into how the signals are designated along the line. The track for trains towards Sydney is referred to as the “up” line, while westbound trains are on the “down” line. Signals along the section between Lithgow and Sydney are numbered by their approximate distance in miles to Sydney Central Station. As an example, Signal 46.6 is 46.6mi/75km from Sydney Central Station, Signal 50 would be 50mi/80.5km from the station and so on. As such, logically, the number-names of the signals the Indian Pacific passes gradually decrease.
The Indian Pacific was scheduled to reach Sydney Central Station by 9:15am, but by the time it departed Lithgow it was travelling 6 minutes ahead of schedule. This also meant that the 11 minute gap to W534 following behind it had increased to 17 minutes. However, the Indian Pacific had to stop at Katoomba station to pick up paperwork regarding speed restrictions on the rest of the line, which involved a 25kph/15.5mph speed limit at Woodford station. The stop and low speed limit cut its so-called headway (the gap between it and the following train) down to 15 Minutes and 20 seconds by the time the Indian Pacific passed through Valley Heights station, 8.6km/5.3mi linear distance north of Glenbrook.
W534 had meanwhile departed Lithgow at 6:39am under the command of Mister Sinnett and was slowly making its way along the BMT, stopping at just about every single station. It collected a three minute delay by the time it reached Blaxland station, but generally had an uneventful journey.
When the Indian Pacific reached Signal 42.0 just ahead of Glenbrook station it showed a yellow “caution”-light, leading to Mister Marshall reducing the train’s speed from 66kph/41mph to 39kph/24mph. He later stated that he assumed he was catching up to the train in front (another slow commuter-service). Signal 46.1 greeted Mister Marshall with a red light, which he obeyed by bringing the Indian Pacific to a complete stop at 8:04:01am, shortly after passing through Glenbrook station 3 minutes ahead of schedule. Mister Marshall then climbed off the locomotive and used a phone mounted on the signal to call the signal box at Penrith, with the signaler giving him permission to pass the red signal which apparently wasn’t meant to be red. After climbing back into the cab of his locomotive Mister Marshall put the train in motion at 8:11:15am, continuing on at speeds no higher than 18kph/11mph until he reached Signal 40.8, which was also red, and stopped there at 8:19:03am. The report points out how the long time it took the Indian Pacific for the short distance is proof of Mister Marshall’s appropriate care and caution when being allowed past a red signal.
The Indian Pacific’s locomotive had its front end just a few feet past Signal 40.8, but due to the length of the train the rear train car, a bilevel car carrier, was well over 400m/1300ft further down the up-line, standing in a cutting between steep rock walls in a left-hand turn. Up at the locomotive Mister Willoughby, who had been driving the train prior to Mister Marshall, climbed off the locomotive to contact the signal box, but found the signal phone to be damaged, being unable to establish communications. Thus, the two men decided to continue on with extreme care, passing the red signal at 8:22:02am.
W534 had arrived at Glenbrook station at 8:20am, still 3 minutes behind schedule, and by the time it departed from its brief stop the Indian Pacific’s slow speed and unscheduled stops had cut the headway down to just over a minute. It, too, received permission to pass the red signal 41.6.
At 8:22:14 W534 came around the left-hand turn in the cutting, revealing the nearly stationary Indian Pacific’s rear car to Mister Sinnett. 4 Seconds later W534 slammed into the back of the car carrier at 37kph/33mph.
Mister Sinnett had abandoned his seat and fled into the passenger compartment moments before impact, escaping his driver’s cabs utter obliteration as the two decks of the car carrier cut through the leading car of his train like a pair of knives. The impact on the curved track lifted both the V-Set and the car carrier off the tracks, throwing them against the rock wall. 7 people were killed in the collision, with another 51 being injured.
Aftermath
The first call to emergency services was placed by Mister Marshall 22 seconds after the collision, who figured that something terrible must have happened from having been jolted forwards without warning. The first firefighters arrived at the site 17 minutes later, finding themselves atop vertical rock wall looking down at the mangled remains of the V-Set. They had headed out under the information of “possible train collision”, what they found was far worse than they had anticipated. They set up ladders and ropes to allow quicker access to the wreckage than a hike up the rail line offered. Some of the first responders later reported a “weird” atmosphere, it was a nice and sunny day, so unfitting to the tragedy that had unfolded. Allegedly, the site was completely silent as they reached it. No cries, no shouts from survivors, not even birds singing in the trees.
More and more units from increasingly far away were included in the rescue effort as the scale of the tragedy clarified itself. Responders chose not to wait for the train to be stabilized, prioritizing the rescue of survivors from the rail car which they feared could tip back or completely fall over at any point. Rescue workers worked back to front in the leading car, with difficulty accessing the forward section as the car carrier had pushed the leading wall of the train car several feet inwards as the V-Set impaled itself on the back of the Indian Pacific. The forward 6m/20ft, as it would later be determined, had been compressed into about 1m/3.2ft. Crews also had to be swapped out every hour as temperatures inside the V-Set climbed past 40°C/104°F.
It took until the afternoon for all survivors to be rescued, by which point responders had to accept that nobody in the forward passenger compartment had survived. A journalist later compared the train, now empty of survivors to a tomb. As he put it, the workers cut away the bent and torn metal bit by bit until they recovered all the dead, working with a cold professionalism, eventually making the announcement that the train was empty. And then, the journalist finishes, the birds finally began to sing again.
Investigators took over the site during the night, trying to figure out what had led to the tragedy. Passengers aboard the Indian Pacific had been informed a few minutes before the accident that a signaling defect would have them collect a slight delay, bringing the investigators on the correct path. The Indian Pacific was also fitted with a Black Box, a data logger similar to those found on modern planes. This allowed a precise reconstruction of the train’s motions, safe from unreliable memory.
The section of track where the accident occurred was under the control of an off-site signal box at Penrith, from where workers observed signal settings, adjusted them if needed and communicated with drivers. Crucially, the signal box was not equipped with train position indicators for the whole area, the signal box workers had to rely on the schedule and communication with drivers to determine positions on most of the track length. The safety risk posed by this setup was abundantly clear to the workers, who referred to the area as “no man’s land”, a “dark territory”. Back in 1990 Mister Alexander, the State Rail Authority’s so-called design manager, had been asked why signal boxes like Penrith didn’t have a train position indication system that covered the whole area. He had explained that the signals were “mostly automatic”, with the trains communicating with the signals themselves, reporting sections as “occupied” by closing an electrical circuit with their wheels. When asked about breakdowns or defects in the automation he referred to “sufficient safeworking units” to maintain operational safety, but despite referencing them several times he apparently couldn’t explain what those were. The exchange ended stuck on those undefined units being sufficient under the assumption that drivers would exhibit extreme care, and with the added information that all signal box workers were trained in operating a non-automated signaling system. The point that signal boxes for non-automated systems had more extensive equipment, namely a more extensive position indication system, was ignored.
Adding insult to injury was the fact that the signal box had had the system cover the entire area, but it was downscaled/largely removed in 1990 when the signaling was entirely automated, being deemed no longer necessary. Its main purpose had been the handling of a train terminating at Glenbrook station, which was phased out. The piece of it left only covered Penrith station.
Signals of the type used near the site of the accident consist of three lights in a vertical row along with a separate, off-center marker light. A “stop”-indication is shown by a red light in the vertical row and the red marker light. If any componentry in the main signal fails the marker light will illuminate, with train drivers instructed to disregard conflicting information (green/yellow light) from the main signal. As long as the marker light is illuminated you have to stop.
The signals automatically turn red when passed by a train, and remain red until the train is halfway between the second and third signal further down the line. The closest signals to the site were Signal 42.0, 41.6 and 40.8. In normal operation passing signal 42.0 would turn it red, and it would remain red until the train passed 41.6, turning yellow when the train passes the halfway point between 41.6 and 40.8. This extra distance is supposed to increase the safety in case a train runs a red signal. To achieve it, the circuits where each signal detects a train overlap, allowing a signal to still register a train that is past the following signal.
On the day of the accident Signal 40.8 had turned red for no obvious reason, stopping the Indian Pacific. After ruling out track damage as a cause for a faulty “occupied”-status investigators went about dismantling the signals near the site, examining their hardware for any defect that could explain why 40.8 had turned red. They found the cause in a power supply unit for the signaling system, where a blown fuse had cut power to the sensing circuit shared by signals 40.8 and 41.6. With 40.8 no longer able to “know” if it had a train in the section beyond it it shut down, entering failsafe-mode (“stop”-indication).
The report explains that the fuse in the power supply unit failed after a diode on a circuit board for a power-converter (240V input to 120V output) failed, placing excessive load on the fuse. This defect occurred in a sealed component of the power supply unit and was impossible to predict during the regular inspections. However, as evident in the signals turning red, the failsafe-systems worked as intended. Still, this power supply unit failing can be seen as the root cause of the accident.
The main cause of a blown fuse turning into a fatal train collision lies in the communications between signal box workers and train drivers as well as train drivers between each other, or lack thereof. The trains and infrastructure involved in the accident together contain no less than five different, partially incompatible communication systems.
- : The Metronet Radio, a two-way radio system introduced exclusively on CityRail services (such as the V-Sets) in fall 1998. The system allows train drivers to contact signal box workers by pressing a dedicated button in the driver’s cab, while communication between drivers was purposely excluded. The main purpose of introducing the system was to streamline communication with the signal boxes and prevent third parties from unauthorized messaging across the railway’s system. The system allows for communication between a driver and signal box worker, driver and dispatch center, or for a signal box or dispatch center worker to transmit an emergency message to trains in a limited radius.
- The Countrynet System, an open channel two-way radio system whose messages can be sent and received by anyone within range who tunes into the frequency. It is in use across New South Wales and available to State Rail Authority Countrylink services, National Rail Corporation Limited services and other freight operators. In contrast to Metronet it allows driver-to-driver communication. This system was fitted to the Indian Pacific’s locomotive and allowed them to contact the nearest signal box and/or other drivers.
- The 450.50 radio system, another open radio system which was used by all trains prior to the introduction of the two systems listed above. It has a limited range and is not secure against third parties, and had been discontinued as the primary communication for signal box communications. It was, however, still in use among railway workers. The system was available to the drivers of the Indian Pacific, the signal box workers at Penrith and the conductor on the V-Set. It was not available to the dispatch center.
- Mobile phones were carried by the crew of the Indian Pacific and a few passengers along with railway staff responding after the accident. The driver and conductor of the V-Set did not carry cell phones. The Indian Pacific’s locomotive was equipped with a system which could pick up GSM calls and route them via satellite in areas with no cell service.
- The signals along the line were equipped with signal telephones, landline phones which were “hardwired” to contact the signal box and were operated by cranking a handle on the base of the phone. All signal phones on one section of rail line are connected on a “party line”, so a caller would hear any transmission made between the signal box and another phone on the line.
Under guidelines for operational safety train drivers were not allowed to contact signal boxes by train radio or cellphone once past Lithgow, with the Metronet system being the intended system to be used for such communications (such as asking to pass a suspected faulty signal). Trains like the Indian Pacific, which aren’t equipped with the Metronet system, were expected to stop at the signal in question and use the signal telephone to contact the signal box. The driver would open the box, and then either turn a crank to ring a bell at the signal box or, on some units, use a simple button to power the ringing. The signal box worker, alerted by the ringing and a flashing light, would then pick up his handset and start communications. The button was originally intended to interrupt the ringing from the handle, allowing train drivers to send coded messages identifying themselves and their position.
In the morning hours of December 2nd 1999 the Indian Pacific was stopped at signal 41.6, right at the end of Glenbrook station. When the signal didn’t turn green as expected Mister Willoughby put on his high-vis jacket and climbed off the locomotive, heading to the signal phone. When he found the box chained shut and locked, the first time he encountered this in many years, he retrieved his key from the locomotive and returned to unlock the phone. Phones were meant to be locked to protect them, but as the investigation found they usually weren’t. He then opened the box, picked up the handset to ensure nobody was talking already, set it down, pushed the ring button and turned the crank to place a call. Picking up the handset again he heard a man say “Penrith here”. He had reached Mister Mulholland, the signaller at Penrith signal box. Mister Willoughby proceeded to identify himself and report the inexplicable red signal, receiving permission to pass it. Mister Mulholland further requested to be informed about the setting of the next signal down the line. A request for further information about how to proceed, which should have been answered with “with caution”, apparently went unanswered. Mister Willoughby returned to the locomotive and later stated that he instructed his coworker, Mister Marshall, that they were cleared to proceed. Mister Marshall recalled the conversation, but recalled also that Mister Willoughby had been instructed that they shall proceed with caution. By the time the Indian Pacific began its slow drive past Signal 41.6 id had been delayed there for 7 minutes and 14 seconds, and would require another 7 minutes and 45 seconds to get to Signal 40.8, being driven at a snail’s pace to ensure they could stop if an obstacle came into view.
Mister Mulholland had been able to clear the Indian Pacific past the red signal as he had been able to establish that the train ahead, which Mister Marshall suspected they might have caught up to, was well ahead of the Indian Pacific. Investigators stumbled in a later, second interview with Mister Mulholland, when he recalled having cleared the train all the way through to Emu Plains instead of just to the next signal. He was unable to recall which version was accurate, appearing confused and switching back and forth sometimes within minutes. A recorded call to the area control center right after the Indian Pacific had Mister Mulholland explain that he was expecting to hear from the Indian Pacific again at Emu Plains, expecting a report about any more faulty signals along the way. This supports the version that he cleared the train all the way to Emu Plains and didn’t expect contact prior to the train reaching that location.
W534 reached Signal 41.6 eight minutes after that call, with Mister Sinnet using the Metronet radio to contact the signal box. Due to the differences in Mister Mulholland’s and Mister Willoughby’s statements to the investigation (and the fact that signal telephone calls aren’t recorded) the exact reasoning cannot be determined, but it’s assumed that Mister Mulholland assumed that signal 40.8 had been passed by the Indian Pacific in the “clear” (green light) setting as he had heard nothing from that train’s crew. Referencing schedules and the delay he knew the train had collected at Signal 41.6 he must have assumed that the Indian Pacific was well clear of signal 40.8, leading to Mister Sinnet being allowed past Signal 41.6, which showed red. Granted, it did so in a failsafe mode, but it was also a valid red light due to the Indian Pacific up ahead.
In reality the Indian Pacific had driven up to signal 40.8 at slow speed (exhibiting great caution by the driver) and stopped there, with Mister Willoughby intending to report to the signal box that it was also showing red with a red marker light.
Upon reaching the telephone Mister Willoughby discovered that the chain and lock on the box had been broken, and upon opening the box he found that the “push to ring”-button was missing for unknown reasons. When checking for other callers the line was quiet, so he went to crank the handle several times attempting to call the signal box, but found himself unable to establish contact. Mister Willoughby would later recall several muffled voices “in the distance”, as if several people were talking near a handset placed on a table, but nobody seemed to address him or even notice the inbound call. He tried identifying himself twice, even yelling position and train into the handset, but received no reaction. With the prior visible damage to the phone, which might have stemmed from vandalism, Mister Willoughby assumed that the phone was broken and placed the handset back in the box before returning to the locomotive.
Several examinations and tests with the phone at Signal 40.8 as to why Mister Willoughby was unable to place a call were inconclusive. Investigators were able to place calls from the device several times without issue, and the buzzer at the signal box worked as intended also. This is in contrast to Mister Mulholland’s statement of never hearing the buzzer when Miser Willoughby attempted to call from Signal 40.8. Two most likely scenarios were constructed, but neither can be presented with 100% certainty. One scenario says that Mister Mulholland had forgotten to press a “cancel call” button after the call from Signal 41.6, leaving that phone to receive input from people at the platform which Mister Willoughby heard on his phone as the “distant voices”.
The second scenario is that the second call came in while Mister Mulholland was engaged in Mister Sinnett’s call via the Metronet system, in which case he may have pressed the button to accept the call but then left the phone on his desk while tending to Mister Sinnett’s call, only to then forgot that he had another call on hold. Alternatively, the radio conversation with Mister Sinnett may only have ended after Mister Willoughby had given up on his call and returned to the locomotive.
In his phone call to the area control center Mister Mulholland had referred to dealing with a lot of “dramas”, apparently putting him unter such a high workload that he had to ask the control center to organise an electrician to fix signal 41.6 rather than doing so himself. While no details of those “dramas” materialized having a high workload might explain why Mister Mulholland may have forgotten about the call from the Indian Pacific.
Mister Mulholland apparently also didn’t expect the Indian Pacific to proceed past Signal 41.6 at extreme caution (read: extremely slow speed), which further threw off his estimations of the train positions. If he expected the train to proceed at regular speeds it would have been well past Signal 40.8 by the time Mister Willoughby attempted to call him from there.
The data-logger from the Indian Pacific’s locomotive shows brakes releasing at 8:21:47am, ending the stop at Signal 40.8. Two seconds later the Metrolink call between W534 and the signal box concluded. After finishing the conversation with Mister Sinnett Mister Mulholland realized that the Indian Pacific, which was meant to show up at his local train station at 8:20am, had not done so. He thus used the Countrynet system to contact the crew of the Indian Pacific, and was told that they had received “a large shunt in the back” and to notify emergency services because SOMETHING had gone terribly wrong.
The report lists no less than 23 minor and major contributing factors, but points out a few major factors, most of which in the communications department.
- Had the Indian Pacific been allowed to use in-cab radio to contact the signal box it could have stopped for far less time or not at all.
- Mister Sinnett was told by Mister Browne, the train controller at the area control center, that he should “just trip past” the red signal. This, combined with similarly informal communication with Mister Mulholland during their following conversation, motivated him to proceed past the red signal at regular speed rather than slow speeds such as those exhibited by the Indian Pacific.
- Had the Indian Pacific and the V-Set used a compatible radio system the drivers could have heard each other’s conversations and/or warned each other. However, the Indian Pacific was “locked out” of the Metrolink system and the antiquated signal telephones can’t be listened in on by any train crew that isn’t also stopped and using one of the phones.
The report closes with several recommendations to improve operational safety. The recommendations include introduction of a shared radio system for all trains using the CityRail network, train position indication systems covering the entire network rather than just the stations, stricter adherence to formal communication to reduce the risk of misunderstandings and improved training to ensure that a suspected faulty signal is always passed at extreme caution. Furthermore, the report recommends evaluating removal of the antiquated signal telephones once a shared radio system is established. The judge in charge of the report would later double down on the report and publish an extension, bringing the amount of recommendations to a total of ninety-five, which has to be a record for a train crash investigation.
A memorial plaque was unveiled at Glenbrook’s city park shortly after the accident, being dedicated in memory to the victims and and appreciation for the responders. It was joined by a second plaque right below it in 2009, which lists the names and ages of the seven victims of the 1999 accident along with that of the sole victim of a nearby 1976 accident.
Despite suffering extensive damage in the collision the V-Set was repaired and returned to service, being renumbered DIM8020 to avoid reference to the tragedy which may be taken as insensitive. The train was withdrawn from service in 2005 and scrapped. The type is undergoing gradual retirement, with the last units set to be retired when the newer D-Set trains enter service in 2024. The Indian Pacific still operates in much the same way as it did on the day of the accident, but the car carrier service was cut to run between Adelaide and Perth in 2015, no longer reaching the site of the accident. On the day of the accident the car carrier’s stiff construction did cause extensive damage to the V-Set, but it also meant that there was very little damage to the rear passenger car, keeping the passengers of the Indian Pacific safe.
_______________________________________________________________
A kind reader is posting the installments on reddit for me, I cannot interact with you there but I will read the feedback and corrections. You can find the post right here.
