What we know so far about Spain train crash

From reading only the linked BBC article, I would come to a totally different conclusion. That would sound like more of a dispatcher ordering a manual operation of a train, without having assessed the situation correctly. While yes, this happens (https://en.wikipedia.org/wiki/Bad_Aibling_rail_accident), this happens on minor single-track lines where the dispatcher starts playing games on his smartphone full-time due to being bored, not on a major high-speed line. Also the issue with LZB doesn't fit into the picture that the BBC paints, neither do the many people involved, so I will prefer the theory mentioned above. Also that seems like a "reasonable" "sufficiently not-obvious" error to make, given the line and attention.

So to explain the used terms more: Most train control systems operate under the assumption of a fixed block. The whole network is separated into blocks, there can always be only one train in a block. Each block is protected by a signal, there must always be a red signal separating one train from the next, and there are sensors that detect when a train drives in a block, when it drives out of a block and how many carriages (train integrity is important too).

For point based train control systems, operation of a train is only enforced at every signal (and on the way in approach at specific points), this means e.g. that a train does not run over a red signal, does not drive faster than the maximum speed, and has acknowledged speed limits.

For line based train control systems, that supervising happens continuously over the whole track.

Since the physical signals and sensors are expensive in installation and maintenance and railway capacity depends on the number of blocks on a track, line based train control systems support virtual blocks. This means that the signals and sensors are not physically there, but simulated by computers (on the train and signalbox). From the view of the point based train control that means multiple trains are in a single block, because it does not know about the virtual subblocks. When a train is running that only supports point based train control it can only use whole blocks, so the capacity is simply reduced, but it is still safe, because every physical block is also known in the line based control system.

When the line based train control system stops being in use, the fundamental constraint of the point based train control system is being violated: there are multiple trains that are in a single block, and hence not actually protected by a red signal in between. This means that you must ignore the signals until every train has crossed at least one physical signal.

(This is speculation:) It seems that that the operators assumed that there is still a safety system in place, that they can rely on. Hence they did no tell the trains to use manual operation, (which might also require driving by sight [max. 40km/h], but not necessarily, I don't know the proper procedure in Spain), but told them to fall back to the normal safety system. It's reported that some train drivers and dispatchers questioned that, but that can also be an translation error and instead them repeating what was said, as is proper safety procedure. But the point based train control system will show a green signal, even if there is actually a train in front, because it is in the same block as you, but the signal shows whether you are allowed to drive in the next block, not into the current, as you are already in the current block. This seemed to be what happened here, the second train saw the green signal thought they are back in the automatic safety system and accelerated to 200km/h, not knowing that there is still a train in front. The first train should have also started driving, but did not, due to an error in the train. In normal situations this should never cause an accident, but in this case the accident would not have occurred if that wouldn't have taken place, but that would have been simply by luck.

You can see the green signal in some of the pictures, which to me looks really weird (kinda like a both dead and alive corps), because I would expect to put all signals to red in the case of an accident. I would expect to do that, while you are calling the emergency number, but I do not know if that is the procedure in Spain. You also see in the pictures that the whole cluster traveled about a train length and that the last carriages of the first and the first of the second train are merged into one. This indicates a surprisingly high speed for the crash, above 100km/h. That fits the explanation of the second train not being able to see the first until directly up to a few 100 meters before.

There were actually more trains in that block, so it's pure luck, that there were "only" two trains involved in this accident. Also some claimed, that there was a curve directly before, so the second train couldn't see the first until directly up to the accident. This would not have prevented the accident, it would have just reduced the involved crash speed and hence reduced the number of dead people.

It's quite ironic, that the accident would have likely not happened in case of no safety system being present.

---

Actual classical collisions of two trains like in this case are quite rare, because that's like the first purpose of every train control system, which exist since the 1870s. The accident from January this year in Spain was also a collision, but because a train derailed, while another train passed it. This can't really be prevented by a current train control system, other then not allowing the derailment to happen in the first place. Derailment in carriages is actually not rare at all, but daily, it's like going slightly on the shoulders of the street with your car, but train derailments are.

The accident from Meerbusch-Osterath from 2017 is similar in that is was also a collision. The cause itself is not really similar. The normal train control also failed, so the trains need to be operated manually. For that it was still relied on the automatic train detection and labeling system, but that had a bug (and some operator error due to a bug, this is simplified) and showed the number of the second train, where the block of the first train was. So they allowed the second train to advance. They did have contact with the first train, because they noticed something was wrong, but that driver didn't properly speak German and also failed to look out of the window directly where a hectometer sign was, so he couldn't tell the dispatchers were he actually was. The dispatcher forgot to tell the driver of the second train to use drive by sight (40km/h), so he accelerated to full speed (120km/h). The accident only caused 40 injured people and no deaths, because the second driver saw the first train. The accident happened at night, in the dark and at a speed of 85km/h. Train dispatchers are supposed to keep track of the trains and the actions they do too, but since the automatic train detection and labeling works most of the time, it becomes easy to rely on it.

The accident from Fallersleben from 2002 is similar, because the original failure of LZB and fallback to PZB is the same. Hence there was also more than one train in one block. The signalbox software told the second train to advance to full speed and the first to stop. This would have caused a crash, but the train driver of the second train noticed, that couldn't be and notified the dispatcher who then told them to not proceed, hence the accident didn't happen. This caused it to become mandatory to let the first train to drive again operate on sight [40 km/h].

Usually when you look deeper at failures like this, it’s because there’s a morass of bad incentives from the surrounding human system that enforces this kind of behavior.

Here is a plausible alternative explanation:

They’ve probably seen false warnings over and over and overridden them enough times that they lost sense of the risk. They need to keep trains on schedule, using a buggy system, with a manager looking over their shoulder. They override the warnings over and over, nothing goes wrong, and they forget that it may actually be right. Look at the Challenger explosion, Chernobyl, or any other failure like this, and there’s usually a bureaucratic process that has run amok, and the individual is just following perverse incentives that have been socially normalized over time.

So I’ll wait until I have more information before I proclaim this as human negligence and the system doing exactly what it’s supposed to do. We don’t know how often it was doing the wrong thing and confusing the fuck out of the human.

Whose negligence, though? "The system" isn't just the LZB equipment - the train dispatcher is just another cog inside the same system, and should be expected to occasionally fail just like every mechanical part.

This isn't a game of Hot Potato where the last person touching it goes to jail for gross negligence. You have to look at it through a Swiss Cheese model: every individual safety layer can and will have holes, but a disaster can only occur when all of those holes align.

Why did the LZB system fail? Why did the train dispatcher use the wrong backup procedure? Why did a backup procedure with zero safety checks even exist? Why did the train operator accept this backup procedure? Why did the train allow high-speed driving under those unsafe conditions?

It does indeed seem like the train dispatcher made a big mistake, but that was far from the only thing that went wrong, and it would be myopic to use him as the scapegoat for a far larger systemic issue.

I would argue that we should look at systems-level explanations. The human factor is so glaring we can get caught up in it. There are what, 50?, high speed trains in movement in Spain at the same time. Even GPS + Starlink + 1 monitor (is that 50k€?) could have prevented this. But it happened, and the question is what is going on with train security in Spain in general for people to (be able to) make such decisions.