MADRID, Spain – The computer failure that brought down the signalling system on the Madrid-Seville high-speed line, and which was the origin of the chain of events that led to the “human error” that allowed a Renfe AVE to keep running until it collided with the Iryo train, causing at least 68 deaths and more than a hundred injuries, originated in three computers that, like the entire signalling system, date from the early 1990s and should have been replaced at the end of last year.
Tragedy on the AVE: Two Trains Collide in Toledo on the Madrid-Seville Line
“At around 8.30am, the LZB control system at Urda station failed as a consequence of a communication failure involving three computers on the network,” Transport Minister Óscar Puente began explaining on Wednesday regarding the event that set off the chain of mechanisms for keeping traffic safe and the decisions of Adif’s control centre at Atocha that led to the fatal accident in the province of Toledo. The LZB signalling system was the first installed on the Spanish high-speed network, on the first line inaugurated in 1992 linking Madrid and Seville. As the ministry, union sources, industrial engineers and other rail sector sources assure, it is a system as safe as the newest one operating on the rest of Spain’s lines, ERTMS. That is not the case, however, with the computer system supporting it, which like the LZB itself dates from the 1990s, consisting of computers more than 35 years old that, moreover, should have been replaced along with the entire signalling system and other track elements between the end of last year and the beginning of this one, when the 52-month deadline Adif set in September 2021 to renew the Madrid-Seville line expired, through works that, as the Adamuz accident tragically recalled in January, envisaged modernising some track sections but also replacing the LZB system with ERTMS, which would also have entailed renewing the computer system and the computers supporting it.
“The control centres supporting the LZB are from the 1990s,” rail sector sources say, referring to the set of computers with which this signalling system operates, including on the section where the system failed on Wednesday at around 8.32am. When Adif awarded the line’s renewal in September 2021, it highlighted that “the main contract” covered “signalling installations, train protection systems, with the implementation of the ERTMS system along the entire line, object-fall detectors and fixed telecommunications,” with 94 million euros allocated to works that together had “an execution period of 52 months,” expiring between December 2025 and January 2026.
“It is a system that should already have been replaced,” notes the president of the General Council of Official Industrial Engineering Associations, César Franco, with him and other rail sector sources pointing out that the current signalling system on the Madrid-Seville line, LZB, is not unsafe for being older than the one that will replace it, ERTMS. In fact, union sources note that according to technicians “the LZB is the safest system” despite failures in its computer system having occurred on more occasions, as the minister himself pointed out. “It is a computer breakdown that can happen. It doesn’t happen every day, but it happens,” Puente explained on Wednesday from Adif’s traffic control centre at Atocha station, with sources at the railway section of the CCOO union noting that “it is not something unusual or everyday.” “A computer system can fail for one reason or another, or due to a power supply error, because it crashes, there are many reasons,” Franco concedes, adding that “being old does not mean things are unsafe, if they are maintained correctly,” and precisely, as the Adamuz accident in January tragically recalled and despite the increased maintenance resources committed then, Spain continues to invest far more in building new kilometres than in repairing existing ones, with Puente himself on Monday putting at 1.8 billion euros a year the amount needed to preserve rail infrastructure, describing improving it as the most urgent and pressing problem of his ministry.
The computer failure of these three computers from the early 1990s, in any case predating 1992 when the Madrid-Seville AVE was inaugurated, is at the origin of the chain of devices, auxiliary measures and decisions that ended six minutes later with the “erroneous” decision by an Adif traffic controller in Madrid to give the AVE permission to resume running, and with the “inexplicable” circumstance of allowing it to do so at “normal speed”, with the capacity to reach 200 kilometres per hour on a section where another train was still stopped, the Iryo at the entrance to Urda station, with which it collided 25 kilometres further on and 17 minutes later, causing an accident that has so far left 68 dead and 50 injured.
Neither rail experts nor unions question the account Puente gave hours later about the auxiliary safety systems activated after the LZB system failure, though they do take issue with all the blame being placed on Adif’s traffic controller. “It seems somewhat painful to us that a human error is singled out in this way,” they lament at CCOO, where they believe a system should be implemented that has “some guarantee” beyond leaving everything “to chance” of human action in the final instance, as also noted by the Railway Traffic Union. “A human failure is perfectly possible. Attributing the whole problem to one person is venturing too far,” Franco agrees. According to the sequence of events shared by unions and the ministry, the computer failure caused the LZB signalling system to go down, which as a “safety” measure halted traffic on a 63-kilometre section comprising several blocks into which the track is compartmentalised and in which, in the event of an incident, traffic is stopped, as also happens with ERTMS.
The figures still vary on whether six or eight trains were affected, but what is clear is that, in the absence of the LZB, traffic was first halted and the BSL lateral signalling block system activated, the “auxiliary”, “back-up” system to the LZB, at which point traffic switched to manual mode, to be managed by Adif control centre operators who, once they had completed the full migration to it, began communicating with each train, driver by driver, so they could set off, at least in the known case of the crashed AVE. This is where the “human error” attributed by the Transport Ministry occurred, in the sending of “phone calls”, of pre-established texts in the protocol, communicating to drivers whether they could resume running and in what mode, normal or on sight. In the case of the AVE, and in a manner Puente said on Wednesday he still cannot explain, the message that reached it was that it could resume normal running, that is, with the possibility of reaching the 200 km/h permitted on the accident section, all when there was a red light and, as Puente explained, from Adif’s control centre at Atocha the position of all trains could clearly be seen, including the Iryo still stopped at the entrance to Urda station. In contrast to the first reports in the hours after the accident pointing to a problem with the train itself, in the afternoon the Italian company reported that its driver did not set off because he was awaiting instructions from Adif’s control centre. The chain of events from the computer failure that brought down the system leads to a controller’s decision that Puente described as “erroneous” and the absence of a correction he judged “inexplicable”, pointing to a worker as ultimately responsible, a theory the Railway Traffic Union places in suspense, all the more so as it has been denouncing for months before Adif the “work overload” suffered by these workers, with the union having staged two demonstrations in recent weeks to improve their working conditions, both outside Adif’s presidency headquarters and at the Chamartín station control centre.
A Train Derails In Seville, Causing A Commuter Line To Be Closed
This union is not so sure that the ultimate error was the instruction to the AVE to continue at normal speed rather than on sight, in which the driver could not have travelled at more than 40 km/h for better visibility of the track. “We don’t know whether it was human error or a display error,” they say at the SCF, where they also question the content of the phone message the control centre sent to the AVE driver. “We are trying to cross-check information and see with the necessary detail. There are things that don’t add up for us,” they say from this union, which on Wednesday began collecting “records” from traffic controllers to determine, among other things, the circumstances in which they carry out their work, with SCF sources indicating that the Urda accident is a new occasion to press their demands over “work overload, lack of staff, the responsibility borne by the traffic collective that does not correspond to the training it receives and how we are valued within the company”, Adif.
