Hacker News

From reading only the linked BBC article, I would come to a totally different conclusion. That would sound like more of a dispatcher ordering a manual operation of a train, without having assessed the situation correctly. While yes, this happens (https://en.wikipedia.org/wiki/Bad_Aibling_rail_accident), this happens on minor single-track lines where the dispatcher starts playing games on his smartphone full-time due to being bored, not on a major high-speed line. Also the issue with LZB doesn't fit into the picture that the BBC paints, neither do the many people involved, so I will prefer the theory mentioned above. Also that seems like a "reasonable" "sufficiently not-obvious" error to make, given the line and attention.

So to explain the used terms more: Most train control systems operate under the assumption of a fixed block. The whole network is separated into blocks, there can always be only one train in a block. Each block is protected by a signal, there must always be a red signal separating one train from the next, and there are sensors that detect when a train drives in a block, when it drives out of a block and how many carriages (train integrity is important too).

For point based train control systems, operation of a train is only enforced at every signal (and on the way in approach at specific points), this means e.g. that a train does not run over a red signal, does not drive faster than the maximum speed, and has acknowledged speed limits.

For line based train control systems, that supervising happens continuously over the whole track.

Since the physical signals and sensors are expensive in installation and maintenance and railway capacity depends on the number of blocks on a track, line based train control systems support virtual blocks. This means that the signals and sensors are not physically there, but simulated by computers (on the train and signalbox). From the view of the point based train control that means multiple trains are in a single block, because it does not know about the virtual subblocks. When a train is running that only supports point based train control it can only use whole blocks, so the capacity is simply reduced, but it is still safe, because every physical block is also known in the line based control system.

When the line based train control system stops being in use, the fundamental constraint of the point based train control system is being violated: there are multiple trains that are in a single block, and hence not actually protected by a red signal in between. This means that you must ignore the signals until every train has crossed at least one physical signal.

(This is speculation:) It seems that that the operators assumed that there is still a safety system in place, that they can rely on. Hence they did no tell the trains to use manual operation, (which might also require driving by sight [max. 40km/h], but not necessarily, I don't know the proper procedure in Spain), but told them to fall back to the normal safety system. It's reported that some train drivers and dispatchers questioned that, but that can also be an translation error and instead them repeating what was said, as is proper safety procedure. But the point based train control system will show a green signal, even if there is actually a train in front, because it is in the same block as you, but the signal shows whether you are allowed to drive in the next block, not into the current, as you are already in the current block. This seemed to be what happened here, the second train saw the green signal thought they are back in the automatic safety system and accelerated to 200km/h, not knowing that there is still a train in front. The first train should have also started driving, but did not, due to an error in the train. In normal situations this should never cause an accident, but in this case the accident would not have occurred if that wouldn't have taken place, but that would have been simply by luck.

You can see the green signal in some of the pictures, which to me looks really weird (kinda like a both dead and alive corps), because I would expect to put all signals to red in the case of an accident. I would expect to do that, while you are calling the emergency number, but I do not know if that is the procedure in Spain. You also see in the pictures that the whole cluster traveled about a train length and that the last carriages of the first and the first of the second train are merged into one. This indicates a surprisingly high speed for the crash, above 100km/h. That fits the explanation of the second train not being able to see the first until directly up to a few 100 meters before.

There were actually more trains in that block, so it's pure luck, that there were "only" two trains involved in this accident. Also some claimed, that there was a curve directly before, so the second train couldn't see the first until directly up to the accident. This would not have prevented the accident, it would have just reduced the involved crash speed and hence reduced the number of dead people.

It's quite ironic, that the accident would have likely not happened in case of no safety system being present.

---

Actual classical collisions of two trains like in this case are quite rare, because that's like the first purpose of every train control system, which exist since the 1870s. The accident from January this year in Spain was also a collision, but because a train derailed, while another train passed it. This can't really be prevented by a current train control system, other then not allowing the derailment to happen in the first place. Derailment in carriages is actually not rare at all, but daily, it's like going slightly on the shoulders of the street with your car, but train derailments are.

The accident from Meerbusch-Osterath from 2017 is similar in that is was also a collision. The cause itself is not really similar. The normal train control also failed, so the trains need to be operated manually. For that it was still relied on the automatic train detection and labeling system, but that had a bug (and some operator error due to a bug, this is simplified) and showed the number of the second train, where the block of the first train was. So they allowed the second train to advance. They did have contact with the first train, because they noticed something was wrong, but that driver didn't properly speak German and also failed to look out of the window directly where a hectometer sign was, so he couldn't tell the dispatchers were he actually was. The dispatcher forgot to tell the driver of the second train to use drive by sight (40km/h), so he accelerated to full speed (120km/h). The accident only caused 40 injured people and no deaths, because the second driver saw the first train. The accident happened at night, in the dark and at a speed of 85km/h. Train dispatchers are supposed to keep track of the trains and the actions they do too, but since the automatic train detection and labeling works most of the time, it becomes easy to rely on it.

The accident from Fallersleben from 2002 is similar, because the original failure of LZB and fallback to PZB is the same. Hence there was also more than one train in one block. The signalbox software told the second train to advance to full speed and the first to stop. This would have caused a crash, but the train driver of the second train noticed, that couldn't be and notified the dispatcher who then told them to not proceed, hence the accident didn't happen. This caused it to become mandatory to let the first train to drive again operate on sight [40 km/h].

Usually when you look deeper at failures like this, it’s because there’s a morass of bad incentives from the surrounding human system that enforces this kind of behavior.

Here is a plausible alternative explanation:

They’ve probably seen false warnings over and over and overridden them enough times that they lost sense of the risk. They need to keep trains on schedule, using a buggy system, with a manager looking over their shoulder. They override the warnings over and over, nothing goes wrong, and they forget that it may actually be right. Look at the Challenger explosion, Chernobyl, or any other failure like this, and there’s usually a bureaucratic process that has run amok, and the individual is just following perverse incentives that have been socially normalized over time.

So I’ll wait until I have more information before I proclaim this as human negligence and the system doing exactly what it’s supposed to do. We don’t know how often it was doing the wrong thing and confusing the fuck out of the human.

Whose negligence, though? "The system" isn't just the LZB equipment - the train dispatcher is just another cog inside the same system, and should be expected to occasionally fail just like every mechanical part.

This isn't a game of Hot Potato where the last person touching it goes to jail for gross negligence. You have to look at it through a Swiss Cheese model: every individual safety layer can and will have holes, but a disaster can only occur when all of those holes align.

Why did the LZB system fail? Why did the train dispatcher use the wrong backup procedure? Why did a backup procedure with zero safety checks even exist? Why did the train operator accept this backup procedure? Why did the train allow high-speed driving under those unsafe conditions?

It does indeed seem like the train dispatcher made a big mistake, but that was far from the only thing that went wrong, and it would be myopic to use him as the scapegoat for a far larger systemic issue.

I would argue that we should look at systems-level explanations. The human factor is so glaring we can get caught up in it. There are what, 50?, high speed trains in movement in Spain at the same time. Even GPS + Starlink + 1 monitor (is that 50k€?) could have prevented this. But it happened, and the question is what is going on with train security in Spain in general for people to (be able to) make such decisions.

oh man, the override thing is super dangerous. I use FSD in Tesla a lot and there is a lot of times I "override" with the gas pedal because I think it phantom breaks or being slow and there were at least 2 cases where there was legitimate reason to stop (person crossing in my blind spot).

They have a failsafe to use (visual) block backup signaling on that line and used it incorrectly. 200km/h is right at the border where you don’t need in cabin signaling.

Too bad they don't run it with AI. Then it would be nobodies fault!

Sorry, but ordering trains to drive manually after the system locks itself down, is the proper procedure. Of course you are still supposed to only send trains to free sections, but the error is in that step, not that they ordered a train to drive on it's own.

Also the fallback procedure is also aided by automatic systems and a sizable number of accidents in the past were caused by that information being faulty.

This really reminds you of the Chernobyl station computer printing all the warnings and recommendations to shut the reactor down when they started playing around with it ... and Comrade Dyatlov overriding it.

Dyatlovs seem to be born everywhere.

If I read the description correctly, those hardware level systems were manually overridden, which should only be done in extremis. My guess is that this is going to turn into a normalization of deviance case, since such a cavalier attitude toward safety was unlikely to be one person's first time doing something so dangerous. There was no dilemma here and no time pressure.

Your suggestion about limiting speed after a shut down is a good one. On top of that, the rail operators should have spotted a trend of repeated safety system overrides and investigated why that was happening.

Exactly this was my first thought! I always thought highspeed trains operate under a model of clear sectors where one train is just allowed to enter when it was cleared by the previous train. From my layman point of view, those incidents point to a fundamental design flaw.

> It should not be possible for one person to make a mistake of this magnitude

Exactly. Which means a whole bunch of other people allowed for this situation to occur. So it isn't one person responsible for this mistake.

I'm a volunteer firefighter in rural NM. We have a commercial property close to us that repeatedly has false alarms on its fire alarm/smoke detection system, to the point where even the best of us are suffering from "the boy who cried wolf" feelings.

Because of this, I discovered that (apparently) NY Fire Department charges $5000 per false call on an alarm system directly connected to the dispatch system.

Somethng to think about.

https://en.wikipedia.org/wiki/Alarm_fatigue

> Healthcare: The constant sounds of alarms and noises from blood pressure machines, ventilators and heart monitors

> Amber Alerts: sent to cell phones as far away as [...] 15 hour drive

> "known to the state of California to cause cancer"

etc

https://www.youtube.com/user/USCSB

See also a million USCSB industrial disaster postmortems

It just means that a false positive rate is as dangerous as a false negative rate. Just issuing a warning doesn't come for free when you are designing a security system.

Something similar is happening in my region after the flood that happened two years ago: The alarm was raised late; Now, even mild rain is triggering an alert.

Guess whats the consequence of that? Less and less people pay attention to the alerts.

Agreed

https://en.wikipedia.org/wiki/Alarm_fatigue

To your point, a contributing factor here was the front train couldn't start due to either a minor or bogus "security" alarm. Whatever alarm that was, it wasn't worth triggering such a tragic accident.

The fix is to do things right every time, and if we're losing money to false alarms, spend more money to make sure the false alarms stop happening. Make it a new persons problem rather than just making someone "used to it" and start ignoring it.

> Not sure how to actually solve this…

fix the alarms? I only had one false fire alarm in my life. and thankfully zero real ones. it's possible.

do fire drills? if alarms get ignored, and you can't reduce the false-positive rate, then introduce fake alarms and monitor the response?

> That’s why people here, when they hear the fire alarm they just wait for it to go off

This literally happened to me last night, I was having dinner at my apartment, and suddenly I start hearing a smoke alarm, but not quite inside the apartment, I just kept having dinner thinking "bah, someone probably burned a toast".

Then it wont stop, I walk to door and hear people talking, still don't bother enough, wait a few minutes, then go out and my neighbor said "there are three fire trucks down there, I think it's a real one" hahhaha

The hallway was kind of hazy and smelled like burnt food, for sure... so I just grabbed my laptop and went out hahaa.

Because they don't get held responsible enough for bypissing procedures. Some system are too complex for fully automated operarions, and the human need to play along.

Safety culture is blameless, but only if everyone plays along.

Issue and enforce fines for every false positive alarm, and problem will solve itself.

The escalator failure in 2018 in Rome that caused severe injuries to 24 people was found to be partially caused by safety systems being disabled and overriden because they caused too many false alarms.

https://en.wikipedia.org/wiki/2018_Rome_escalator_accident

In a modern passenger rail control system[0], ignoring the warnings results in automated responses like dumping all the hydraulic pressure, setting all brakes at once. This will have two effects: (1) the wheels will slide on a fixed spot, grinding a flat spot, and (2) the operator will either require central control to remotely release the emergency brake state, OR the operator will have to continue at the safest (lowest) speed.

What I'm saying is: false positives should not be ignorable, and modern systems take that choice away (at least, just before the situation becomes unavoidable in worst-case analyses).

That being said, previous fatal accidents in Spain's high-speed rail have resulted in "primitive" uncontrolled areas between controlled areas. Those SHOULD NOT exist. You are essentially saying "lives don't matter that much here " ($/life).

[0] I work in rail safety.

[flagged]

The newest signaling systems, ETCS and related sibling CTCS, are quite standardized and interoperable across international borders, so this is an area the EU especially has been making big strides on.

tren

Fundamentally I don't know what the cause is, because there is no full safety report yet, but I doubt that it was a driver error alone, which is what automatic braking systems at signals are actually targeting.

There are situations where the dispatcher needs to instruct the driver to ignore the road signals and hence also ignore the automatic enforcement of the signals. It shouldn't happen to often, but the real world is always more messy.

Some were installed. But what wasn’t there was the old mechanical ones that cannot be overridden, like ATS that blows the air if you pass a red signal.

https://en.wikipedia.org/wiki/Automatic_train_stop

Any failsafe that can be bypassed manually is just a deferral to humans and eventually will result in disaster.

Signalling systems are never simple.

The LZB system, which broke down, had the data you describe. It knows when trains pass over fixed sensors so it computes where they are, and sends data packets to specific trains informing them their current speed limit, and the next, and how far away that is. If the driver won't slow down, the train will.

When LZB broke down, they had to switch to their other system, BSL (fixed block signalling: https://en.wikipedia.org/wiki/Automatic_block_signaling). You can then know the distance to the next block, and if it's occupied or not, but not where the train is inside the block. You can only guess.

In the next few days we'll likely find out if the control centre also fucked up the block signals...

This isn't as simple as a Disney monorail. There can be many tracks, multiple routes can share some segments of track, trains can go from one track to another, tracks can be stacked on top of each other on some bridges and go inside tunnels so GPS/GNSS is insufficient, the train in front of you can stop for emergency, etc. It's like the aeronautical collision issue, but the tracks are in charge of determining and transmitting position.

General case, it's not that simple. Say there's another train a mile ahead of you...but it's on a siding. To compute the effective distance, you'll need to know the positions of the switches connecting the main line to that siding. And switch positions can change far faster than you can stop, even if the other train doesn't move.

There's like 100s location data on each train, do they not just have a map of where all nearby trains are.

If it was so easy then this never would have happened.

I’m very wary of finger-pointing like your comment that ultimately serves to advocate for cutting quality of life for citizens.

Roughly 31% of Japan’s budget goes to social security. They don’t have problems keeping their high speed trains safe.

Cutting pensions won’t make trains safe.

I will also point out that on its own without further context, a high percentage of government spending going toward something doesn’t make that spending irresponsible or misappropriated. In the United States, a very high percentage of federal taxes are spent on Medicare and Social Security. But it should come as no sirprise that a very large percentage of federal income tax revenue is directly appropriated to pay for those things.

Not saying maintenance isn't a problem, it probably is. It's a problem everywhere in Europe. Have you seen train service in England, Germany or Sweden? Absolutely terrible, compared to just two decades ago.

But under-maintenance causes trains to stand still and be late. It does not cause them to crash.

Crashes are caused by running at speeds higher than the (under-maintained) rail can support, or (against all rules and every regulation) no cap on speed when the signalling system is down.

The latter can not be solved with more money and resources. It is a culture problem. Rules can not routinely be disregarded for arbitrary reasons, especially not when they are completely in line with common sense.

Over here in Finland our road infrastructure sucks too, and pensioners take lion's share of all the resources. Yet our trains aren't crashing. There's something wrong with systems and safety culture in your railroads. Bad maintenance doesn't cause trains to crash into each other if proper procedures are followed.

Still I agree, pension systems in most EU countries are unsustainable.

Deterioration started long before that, according to my sources it started on 2008, but yeah, last 5 years or so it has gone worse. The budget for it has been increasing year by year. It seems that the main problem is not just lack of maintenance but that there's more traffic and new construction.

Pensions is 13%PIB which is on the European median.

The problem is demographic. Also take into account that retired people have paid for their retirement.

Your rhetoric is not what I'd like to be promoted as the first answer entering. Just reading the title of the news I knew what kind of messages I'd see promoted.

In Spain, half a million more people depend on money they get from the government than work in the private sector: https://theobjective.com/economia/macroeconomia/2024-09-16/a...

They've done clickbait for quite a bit longer. They love testing different headlines too. And pushing out a short article then updating it as they go

It's well beyond time to move on from holding up the BBC as the pinnacle of journalistic integrity. (I'm a Brit, not a Russian troll :)

They don't all use ETCS. Madrid–Seville still uses LZB and Adif awarded a contract in 2021 to upgrade it to ETCS L2, but the project is delayed/unfinished

Ask it to look for high-speed train crashes globally over the past 15 years (to include the 2013 one in Spain as well) to be honest I don’t remember any HS accidents other than the three in Spain so, odds or not, I am NOT taking a high speed train in Spain ever.

The issue (at least in Europe) is that there are too many historical train control systems. There are more than 25 different, non-interoperable train control systems currently used across the European rail network.

That's where the EU came in and developed ETCS (https://en.wikipedia.org/wiki/European_Train_Control_System) as a modern alternative. Unfortunately, the EU doesn't have the legislative power to force member states to adopt it and also not the money to bribe them. So ETCS is still competing with the legacy systems.

However, the reason for that crash apparently was the dispatcher who greenlit the cab driver to go full speed ahead after the train control system on that track had crashed even though they knew that another train was reporting that it was unable to restart and get going. Procedures in case of a train control outage are clear: all trains can only move at a max speed of 40Km/h - slow enough to drive and brake on sight.

Instead, that train crashed into the stationary one coming from 200Km/h

There's definitely international communication, LZB is a German signaling system and the intended 40kph speed limit after system restart is common across Europe.

Japan has had high-speed trains since the 1960's and have had zero passenger fatalities. They must be doing something right.

It's already resulted in five injuries: https://abc30.com/post/five-high-speed-rail-workers-injured-...

To have had this many incidents compared to other HSR networks around the world gives all the signs of a classic case of normalisation of deviance.

Sadly we'll probably watch a lot of individuals being blamed/scapegoated for systemic issues, but hopefully even Spanish politics can organise a proper investigation after this many deaths in a single year.

If as a driver you get told by the control centre to get the train moving again at maximum line speed, surely you should be able to trust that it is safe to do so?

I don't see how this would fall on the drivers at all.

> From the controller to the driver, every single one of them should have said hey we shouldn't just ignore a signal

A train driver has zero insight in what is going on and where other trains are. They do need to trust the orders they get, if you want to question every order you will never start to drive.

The even more insane thing to me is that the controller knew that there was another train in that block, knowing it was no signal failure. The driving train should’ve never been commanded to continue on full speed by the controller.

That has been true in the last century, but now the classic collisions are way rarer. See https://en.wikipedia.org/wiki/Eschede_train_disaster .

I would actually sit in front now. Sometimes you would be able to still get vital information and being actually able to act. But the safe decision would be no to enter the train.

That's where the bus hits you.

> they don't get paid a fortune

Salary for ministers is around 80k euro per year. Yes significantly more than the minimum salary but hardly a fortune.

I fail to see how the two accidents, which seem to have very "down to earth" explanations (maintenance failure by workers, protocol override by operators) are being assumed to be a political responsibility so quickly by some and asking for the minister resignation. Now, two in a row seem to point to systemic issues. Is this responsibility of Adif or Renfe? maybe those state companies have to be thoroughly revised. is it due to lack of funding? maybe taxes should be raised, or money diverted from somewhere else (though seeing the spanish budget, it's hard to tell where from, both teachers and doctors are currently protesting for lack of funding). Maybe it is, in the end, a political directive that should have responsibilities declared in the executive. But seeing so many interested parties jumping to that conclusion literally hours after the crash means it's not done out of any reasoning but political animosity

Two main reasons:

- trains go in tunnels or tracks are between houses. When train control systems were defined in the 1990's, there was no way to make them sensitive enough to record GPS positions. Instead there is a different location system based on so-called balises with a fixed position on the tracks. Every time a train crosses one, it knows where it is.

- Planes go in 3 dimensions, trains in one. If ATC wants to ensure two planes do not collide, they will assign them different headings and/or heights. Precise position isn't that important. Trains cannot avoid each other, that's why they move in blocks.

And yes, they do signal their position back to the control center, it's just a different protocol

Modern signalling systems are basically adsb for trains. (ETCS is the modern standard in Europe, this line was using the older German LZB). Problem is that they can, and do, fail. And when that happens too frequently (as it seemingly has been in Spain due to a lack of maintenance), its easy to get sloppy on the manual handling

Safety systems don't help much when they fail themselves. E.g. usually there are automatic systems in place that prevent that two trains are on the same rail network section at the same time, but this system apparently has failed. Details are in the article.