Railway tragedies in the Spanish High-Speed system overlap and exceed the Ministry of Transport's capacity to justify them as "strange" accidents, as was the case of Adamuz nine months ago or, on the same track, "implausible," like the one in Urda this Wednesday.
Railway safety is based precisely on the predictability of its systems and the layered protocols that range from the tracks to the engineer and onboard personnel, including the train itself. Yesterday, starting at 8:30 AM on the corridor connecting Madrid and Seville, several layers of security failed in a system that has operated for over three decades without recording the accidents that have occurred in the last nine months, resulting in over 100 deaths, four of whom were engineers.
The Iryo 6076 departed from Atocha towards Seville with 147 passengers at 7:54 AM and 42 minutes later reported that the LZB signaling system that locates it on the track had failed. "At 8:38, our train, which had already detected the problem and started operating in ASFA, stopped in front of a blank signal," the Italian company sources indicated yesterday.
The system failure forced the engineers to communicate with the Adif Regulation and Control Center (CRC) and stop at least six trains in circulation over an area of 623 kilometers. In the case of the Iryo, it stopped in Urda (Toledo), at kilometer point 117.800, next to signal 238 at the exit of a curve in clear terrain and with visibility conditions. The LZB system, which calculates the train's position in real-time, the maximum allowed speed, and the distance to the next milestone, is the one installed on a track that was "completely renewed," as indicated last January by Minister Óscar Puente after the Adamuz accident, who acknowledged yesterday that it is an "old" system. It should have already been replaced by the ERTMS because the renewal was tendered in 2021 and this work was awarded, but it has not been executed.
The system's failure was extraordinary in its magnitude. "Failures in LZB transmission often occur at a specific point, and when trains pass that point, the failure happens, you notify, and they give you the corresponding call. In this case, all the trains in the segment got stuck. A breakdown over such an extensive stretch affecting so many trains is not normal," explains an engineer.
The first failure in the signaling system is a safety failure, apart from its magnitude, relatively frequent, and the engineers and operators at the Adif control center have protocols to address such incidents. That protocol involves checking if the system starts working again to instruct the engineers of the trains that they can resume movement and under what conditions to operate on a "degraded" point or segment, which sometimes requires limiting speed to 40 kilometers per hour to drive "by sight."
The CRC is the second layer of security that comes into play when the signaling system fails. But it is at this point in the communications between the Atocha control center operators and the stopped engineers that the system fails again, as revealed by the audio of the conversations between engineers and controllers known late in the afternoon. At 8:36, the controllers order the Renfe AVE, a Siemens series 103 that is stopped 25 kilometers behind the Iryo, to resume movement "normally," meaning at the speed it is usually allowed to travel on the track.
Meanwhile, the engineer of the accident Iryo train warned the control center that she was resetting the signaling system and was not yet ready to resume movement. In the audio of the conversations, accessed by EL MUNDO, the driver addresses the controller as follows:
-"The train is not allowing me to restart the LZB system, that's why I am still stopped at the entry signal."
-"When you can and if you have problems, call us," they respond from the Atocha control center.
-"Okay, perfect, I'll let you know." "Really, dude, really," is heard on the other side of the conversation. "The 76," he adds referring to the Iryo that was struck at full speed by the AVE, "is having problems with the equipment."
The control center gave the green light to the other train to resume movement at normal speed while the Iryo was still at least unable to resolve its issue of restarting the system and did so without setting the 40 kilometers per hour limitation established in cases where the automatic signaling system is not functioning.
Initially, the control center forced it to stop until receiving authorization. The conversation occurred at 8:41 AM, and it remains to be seen what other exchanges took place in the following minutes. At 8:48, the train lost contact with its operations center in Madrid.
The Italian operator indicates that at no time was it ordered to resume movement and that, in any case, any safety decision should prioritize the fact that their train could not move.
It is during those minutes that the Renfe AVE has already started moving normally following the instruction given from the center in Madrid while the Iryo remains stopped on the track at less than 30 kilometers when the third security system failure occurs, ultimately triggering the tragedy. In the leaked CRC audios from yesterday, it is not indicated whether the conversation between the Iryo engineer stopped in Urda and the controller in Madrid continued beyond the initial alerts from the driver about her train's situation and that it was impossible to move it.
The fact is that no one seemed to realize that a train was barreling down the track at 120 kilometers per hour towards another one just minutes away. In that countdown of between 12 and 17 minutes during which the AVE was heading like a missile towards the Iryo Hitachi, the CRC did not seem to intervene, nor did the engineer receive any information about the catastrophe heading her way. Passengers aboard the Renfe train reported that they had not noticed any braking before the collision, and the Iryo engineer, who was trying to reset her train, stated that the first news of the AVE was the impact she felt on the train she was driving. The CRC had not warned her, and when minutes later the Civil Guard identified her and informally inquired about what had happened, her response was, "The system has failed, the system has failed!"
The investigation that has already begun to clarify the causes of the accident is primarily focused on how these three layers of security collapsed in the High-Speed system and what responsibilities may exist in each of them: an extraordinary failure in magnitude of the LZB signaling system that should have been replaced on a "totally renewed" track; confusing communications between the infrastructure manager, Adif, and the drivers of the two trains involved in the fatal accident regarding the resumption of movement and the conditions for rejoining normal circulation. And finally, the countdown to the tragedy that was not avoided of one train traveling against another for over 10 minutes without either the control center operators or the engineers having the slightest information about the catastrophe that was about to unfold.