The following is hypothetical, since we do not have a proper safety report yet.
It sounds like the issue happened, because there was an error in the line-based train control system (LZB), which led to falling back to the point-based train control system (ASFA). However since there are more virtual blocks in LZB, than physical blocks in ASFA, this means that suddenly more than one train is in one block, which violates the most basic assumption of train control. That requires the trains to not rely on the train control at all, even if it says that the block is clear, but instead are operated manually.
I do not know what the proper procedures for that are in Spain, but in e.g. Germany that seems to require driving by sight. However that is also only after a number of accidents due this situation. So the following seem to be similar accidents from Germany:
- On April 9, 2002, a near-collision occurred near Fallersleben. After a computer at the LZB control center in Fallersleben crashed, two trains on each of the two main tracks came to a stop. When the computer was restarted, the rear train in each pair was signaled a speed of 160 km/h, while the front train in each pair was signaled 0 km/h. One of the two train operators following saw the train stopped in front of him; the other, as a precaution, contacted the operations center, which warned him not to proceed.
From reading only the linked BBC article, I would come to a totally different conclusion. That would sound like more of a dispatcher ordering a manual operation of a train, without having assessed the situation correctly. While yes, this happens (https://en.wikipedia.org/wiki/Bad_Aibling_rail_accident), this happens on minor single-track lines where the dispatcher starts playing games on his smartphone full-time due to being bored, not on a major high-speed line. Also the issue with LZB doesn't fit into the picture that the BBC paints, neither do the many people involved, so I will prefer the theory mentioned above. Also that seems like a "reasonable" "sufficiently not-obvious" error to make, given the line and attention.
My question is, why is driving by sight with speed limited (40 kmh afaik) not something that is enforced by the train itself when there is no connection to the other controls systems. How is that not a hard limit instead of something the train operator needs to remember?
Just inferring from GP, it sounds like the line was in an illegal/invalid state. Couple others are pointing out that the newer LZB system have much smaller block sizes than ASFA system it fell back to. Which means there were likely multiple trains under different LZB blocks occupying same ASFA blocks. That is a crash state, and train safety systems aren't designed to offer safe and normal operation of two already-crashed-on-paper trains.
What they needed to do was to move ALL trains around until the initial state is in a valid configuration under the ASFA system. Probably like moving one train at a time at <40kph so that there is minimum one ASFA block, which might be tens of miles or however long they are, between every single trains on the line. Then the whole operation could be switched to ASFA system at full speed at much reduced capacity. It also means the train more or less wouldn't be moving for the rest of the day. Not only passengers would be angry but there will inevitably few that needs to be hospitalized for things like mild dehydration and sometimes small injuries if they needed to be evacuated.
What likely happened was that they didn't think about any of that at all, and just hot rebooted into the ASFA system without deconflicting anything. The ASFA system signaled ok to proceed to all trains sharing the same ASFA blocks to their next vacant blocks, not knowing that some of blocks were occupied by multiple trains before humans put it online, which would be an out-of-question horrifying hypothetical to the ASFA computers. And when the system ordered a train in the block to stop because a block in front was occupied, there were in fact two trains in that block, one still driving towards the one in front at 160kph, far away from the stop signal, and two collided.
> Probably like moving one train at a time at <40kph so that there is minimum one ASFA block
If you tell the drivers to move by sight (also <40km/h), you can tell them to all move at the same time, because "by sight" means that the drivers themself can observe objects in their track. They essentially start to move like cars on the road, which they normally don't. Normally a driver does not have an obligation to verify that it is safe to drive somewhere, but then they do. It does not mean that the trains actually move at 40km/h, they can move at 1km/h if that what is required in order to move the train by sight. 40km/h is just the maximum after which it is deemed unsafe to move a train by sight even in the best sight conditions.
> Not only passengers would be angry [...]
I doubt that was even a consideration, that would mean that they would have been aware they ordered a collision, but rather:
> What likely happened was that they didn't think about any of that at all [...]
Note, that in a similar fashion as I stated in another comment (https://news.ycombinator.com/item?id=50299422), if you compare the speeds using friction, 40km/h on a train is equivalent to 300-400 km/h with a car on the road.
The thing that is enforced by the train when LZB goes down, is that the train stops. This seems to have worked correctly. Bringing a train from a stop to movement again is a potentially unsafe situation, and the situation is that the automatic system can't get movement authorities, so no safe system is going to do that automatically.
b) In a point based train control system, communication only happens at specific points. That's why it is called this way. On it's own it is safe, because in order to do anything non safe, like passing a red signal, you need to pass such a point. In order to violate a speed limit, you would need to pass the start of the speed limit, which also is such a point.
If you operate a line based control system, you are constantly making collisions from the view of the point based control system. The moment the line based system breaks down, the point based control system takes over and the only safe choice to do in the case of a collision is to immediately stop all trains. That's exactly what it did.
ATCs will have outages or drops all the time. you don't want a train to suddenly lurch down to 40 kph because of a blip. cellular coverage in Europe is pretty good but not perfect -- and it's an even bigger problem in N America.
likewise you're not going to be using Automatic Train Control in yards, sidings, or terminals, and you may need to get up to speed sometimes to move across a big yard.
manual mode lets the conductors and traffic controllers make those calls.
and it's "not something they need to remember" -- it's 40 kph or whatever the track is authorized for under ATC.
Train control in Europe doesn't really use wireless communication. Emergency calls do happen over radio, and a movement authority could be transmitted, but the continuing enforcing does not. Also I am not aware of there being ATC in general railway in Europe.
But if you replace ATC with train control in general, then yes, I agree.
In spain the procedure calls for driving by sight. There was a third train coming that stopped because the driver ignored the command to drive at normal speed and drove by sight.
The real issue is that the LZB fails often enough (installed back in 1992 and due for a phased out in favor of a newer system last year with the contract awarded and no work yet started) that the only safety assurance is the person at the command center issuing command flawlessly, which is not sustainable as it can be seen.
Iryo CEO said a few weeks back on a congress hearing that every time the LZB goes out, their trains are completely stopped. This must have slipped the central command resposible's mind as it was ordered to everyone to just restart the march, but the Iryo just couldn't.
The most that is supposed to happen when LZB goes down, is that the capacity of the line is reduced and there are delays. LZB is not the only train control system.
> ordered to everyone to just restart the march, but the Iryo just couldn't.
Railway protocols operate under the assumption that any train can stop at any time immediately (not even with a braking distance) without the dispatcher noticing. You need to have the information of complete departure of the previous train before allowing the next train to move. If the first train would be able to start, it would still be pure luck if there wouldn't have been a collision.
So to explain the used terms more: Most train control systems operate under the assumption of a fixed block. The whole network is separated into blocks, there can always be only one train in a block. Each block is protected by a signal, there must always be a red signal separating one train from the next, and there are sensors that detect when a train drives in a block, when it drives out of a block and how many carriages (train integrity is important too).
For point based train control systems, operation of a train is only enforced at every signal (and on the way in approach at specific points), this means e.g. that a train does not run over a red signal, does not drive faster than the maximum speed, and has acknowledged speed limits.
For line based train control systems, that supervising happens continuously over the whole track.
Since the physical signals and sensors are expensive in installation and maintenance and railway capacity depends on the number of blocks on a track, line based train control systems support virtual blocks. This means that the signals and sensors are not physically there, but simulated by computers (on the train and signalbox). From the view of the point based train control that means multiple trains are in a single block, because it does not know about the virtual subblocks. When a train is running that only supports point based train control it can only use whole blocks, so the capacity is simply reduced, but it is still safe, because every physical block is also known in the line based control system.
When the line based train control system stops being in use, the fundamental constraint of the point based train control system is being violated: there are multiple trains that are in a single block, and hence not actually protected by a red signal in between. This means that you must ignore the signals until every train has crossed at least one physical signal.
(This is speculation:) It seems that that the operators assumed that there is still a safety system in place, that they can rely on. Hence they did no tell the trains to use manual operation, (which might also require driving by sight [max. 40km/h], but not necessarily, I don't know the proper procedure in Spain), but told them to fall back to the normal safety system. It's reported that some train drivers and dispatchers questioned that, but that can also be an translation error and instead them repeating what was said, as is proper safety procedure. But the point based train control system will show a green signal, even if there is actually a train in front, because it is in the same block as you, but the signal shows whether you are allowed to drive in the next block, not into the current, as you are already in the current block. This seemed to be what happened here, the second train saw the green signal thought they are back in the automatic safety system and accelerated to 200km/h, not knowing that there is still a train in front. The first train should have also started driving, but did not, due to an error in the train. In normal situations this should never cause an accident, but in this case the accident would not have occurred if that wouldn't have taken place, but that would have been simply by luck.
You can see the green signal in some of the pictures, which to me looks really weird (kinda like a both dead and alive corps), because I would expect to put all signals to red in the case of an accident. I would expect to do that, while you are calling the emergency number, but I do not know if that is the procedure in Spain. You also see in the pictures that the whole cluster traveled about a train length and that the last carriages of the first and the first of the second train are merged into one. This indicates a surprisingly high speed for the crash, above 100km/h. That fits the explanation of the second train not being able to see the first until directly up to a few 100 meters before.
There were actually more trains in that block, so it's pure luck, that there were "only" two trains involved in this accident. Also some claimed, that there was a curve directly before, so the second train couldn't see the first until directly up to the accident. This would not have prevented the accident, it would have just reduced the involved crash speed and hence reduced the number of dead people.
It's quite ironic, that the accident would have likely not happened in case of no safety system being present.
---
Actual classical collisions of two trains like in this case are quite rare, because that's like the first purpose of every train control system, which exist since the 1870s. The accident from January this year in Spain was also a collision, but because a train derailed, while another train passed it. This can't really be prevented by a current train control system, other then not allowing the derailment to happen in the first place. Derailment in carriages is actually not rare at all, but daily, it's like going slightly on the shoulders of the street with your car, but train derailments are.
The accident from Meerbusch-Osterath from 2017 is similar in that is was also a collision. The cause itself is not really similar. The normal train control also failed, so the trains need to be operated manually. For that it was still relied on the automatic train detection and labeling system, but that had a bug (and some operator error due to a bug, this is simplified) and showed the number of the second train, where the block of the first train was. So they allowed the second train to advance. They did have contact with the first train, because they noticed something was wrong, but that driver didn't properly speak German and also failed to look out of the window directly where a hectometer sign was, so he couldn't tell the dispatchers were he actually was. The dispatcher forgot to tell the driver of the second train to use drive by sight (40km/h), so he accelerated to full speed (120km/h). The accident only caused 40 injured people and no deaths, because the second driver saw the first train. The accident happened at night, in the dark and at a speed of 85km/h. Train dispatchers are supposed to keep track of the trains and the actions they do too, but since the automatic train detection and labeling works most of the time, it becomes easy to rely on it.
The accident from Fallersleben from 2002 is similar, because the original failure of LZB and fallback to PZB is the same. Hence there was also more than one train in one block. The signalbox software told the second train to advance to full speed and the first to stop. This would have caused a crash, but the train driver of the second train noticed, that couldn't be and notified the dispatcher who then told them to not proceed, hence the accident didn't happen. This caused it to become mandatory to let the first train to drive again operate on sight [40 km/h].
> the signal shows whether you are allowed to drive in the next block, not into the current, as you are already in the current block. This seemed to be what happened here, the second train saw the green signal thought they are back in the automatic safety system and accelerated to 200km/h, not knowing that there is still a train in front.
Don't think the second train saw a green signal. They were in the middle of the block, while the first train was waiting just before the exit of the block (with a green signal ahead).
What I'm gathering from other sources is that the Spanish system allows the controller to override the point-based rules and provide manual clearance (because the blocks are long and it takes forever to reach the next signal by sight). It's a failure of the system imo. Ideally, the system, under no conditions whatsoever, should have even allowed such a practice to be allowed.
> Don't think the second train saw a green signal. They were in the middle of the block, while the first train was waiting just before the exit of the block (with a green signal ahead).
If the first train was really just before the exit of a block, then it's pretty safe to assume that the second train saw the corresponding distant signal.
> the Spanish system allows the controller to override the point-based rules
Every system allows that, it is required in order to be able to operate a railway network.
> What I'm gathering from other sources is that the Spanish system allows the controller to override the point-based rules and provide manual clearance
What actual happened is my speculation, the explanation how LZB works is not. It can be the case, that they messed up while issuing manual movement authorities, but if they did not notice that they need to switch to manual operation, they will have caused a crash.
During normal operations you can act on the distant signal, because you know you're the only one in the block. But when falling back from linear to point signalling, you cannot make that assumption anymore. You need to get back to a state where you are certain you're the only one in the block, and the only way to do that is to reach the next main signal by sight after which you know you're clear for the that block.
Sure, another way to be certain is for the controller to manually verify that the block is clear and verbally communicate to the driver to override the protocol. But that is putting a lot of burden on human judgement, and even without this incident, anyone would agree is not the best idea.
I don't think this should be required for "normal" operations of the network. Sure, human override should always be there for when an exceptional situation occurs. But you should take extra precaution when that happens because you're already on your final safety net and relying on the judgement of a single human at that time, and that's okay because it's an exceptional situation that doesn't happen often and when it does you can afford to spend an hour or two to take that extra precaution.
The problem happens when the system fails so often that human override becomes the new normal, and because you're doing it every day you now cannot afford to spend the extra hour and tend to skip the extra precaution because you're doing it everyday and start to feel you know what you're doing.
> You need to get back to a state where you are certain you're the only one in the block, and the only way to do that is to reach the next main signal by sight after which you know you're clear for the that block.
Yes, that is manual operation.
> Sure, another way to be certain is for the controller to manually verify that the block is clear and verbally communicate to the driver to override the protocol.
That's not another way, that's the exact situation you just described. To "manually verify that the block is clear" is drive by sight. The only alternative would be to walk along the whole track.
The problem is (AFAIK), that they didn't do that.
> I don't think this should be required for "normal" operations of the network. Sure, human override should always be there for when an exceptional situation occurs. But you should take extra precaution when that happens because you're already on your final safety net and relying on the judgement of a single human at that time, and that's okay because it's an exceptional situation that doesn't happen often and when it does you can afford to spend an hour or two to take that extra precaution.
All of that is the case, but you underestimate how often exceptional is in a whole train network. One per million means it occurs daily.
> and when it does you can afford to spend an hour or two to take that extra precaution.
You have a lot of time, but that means you operate on the order of minutes, not seconds. Needing hours is not emergency operation, that means we cease doing operations. You can of course take several hours to bring the network back to full operation, but you need hundred to thousand operations for that, so a single operation still doesn't have hours time.
> To "manually verify that the block is clear" is drive by sight. The only alternative would be to walk along the whole track.
But aren't there additional systems that can detect that a block is obstructed (e.g. also by left behind carriages that got disconnected) like the electrical track circuit (Gleisstromkreis)?
Or wouldn't that have helped because we're back again to the issue that with the downgrade from LZB to PZB we lost the virtual blocks, and both trains are now occupying the same, longer, non-virtual block?
Which would mean that this block would have been indicated to the controllers as not clear - but that is exactly what they would expect to see, because they're currently deciding what instructions to give to the AVE, which they know is stopped in that block. But they have no indication that there is a second train (Iryo) in front, occupying the same block.
Hence, I assume, the protocol to resume operations with drive by sight after a LZB failure (which seems to have been ignored in this case). But why not also have the protocol demand that operations are resumed front-to-back in that situation? I suspect that "front-to-back" is not nearly as unambiguous a concept in reality as it may seem in my layman's head.
> But aren't there additional systems that can detect that a block is obstructed (e.g. also by left behind carriages that got disconnected) like the electrical track circuit (Gleisstromkreis)?
That's not an additional system, that is the PZB (or here ASFA).
> Or wouldn't that have helped because we're back again to the issue that with the downgrade from LZB to PZB we lost the virtual blocks, and both trains are now occupying the same, longer, non-virtual block?
Yes.
> But they have no indication that there is a second train (Iryo) in front, occupying the same block.
We don't know what they missed, and speculating on that is quite pointless, if we want to have that discussion, we need to wait for the post mortem, this is what such a report exists for. We only know THAT they missed something. That they missed that the first train was in that block too, is one option. It could also be, that it was not clear which signals are virtual or that there was a communication mismatch between different dispatchers or that there was a bug in the automatic train identification system or that an automatic system did call for that procedure. All of these already do occur in railway accidents, they are not really speculative. The last one is what happened in 2002 in the exact same situation: the computer automatically ordered the second to full speed and the first to stop. There could also be some other issue, that I can't think of right now. Most likely it's more than one error, because people still do pay attention.
> Hence, I assume, the protocol to resume operations with drive by sight after a LZB failure (which seems to have been ignored in this case)
I don't actually know what the protocol in Spain is. In Germany it is like that now, but only due to the 2002 near-accident. Before that it was ambiguous. If you are a dispatcher you don't only get taught a bunch of rules. You get taught the primary constraints and then you are able to construct the rules from first principles. However under pressure it's likely to forget something vital, so there are still rules that you are supposed to follow. But no ruleset will be ever complete, that's why you don't only follow rules.
> But why not also have the protocol demand that operations are resumed front-to-back in that situation?
That wouldn't solve anything. Drive by sight is safe in that situation, driving faster is not. If you start front-to-back you can still have collisions, but you just waste time. There is also not necessarily no physical block between trains, so it could be safer to start a later train. Also are you sure you are able to correctly assess the positions and order of the train? You are supposed to, but I mean that obviously failed here. Just drive by sight.
Yeah, that's what I meant was a failure in the system. Ideally, manual operation or drive-by-sight should be the default mode. Only the appropriate signal state should be allowed to override this and clear the train for higher speed, otherwise the system must enforce manual operation (hardware enforced speed limits etc). There should simply be no procedure for a human to be able to just override this.
> The accident from January this year in Spain was also a collision, but because a train derailed, while another train passed it. This can't really be prevented by a current train control system, other then not allowing the derailment to happen in the first place.
Or by putting all the signals to red after the derailment of the first train so as to stop all the circulation on the line, which seems not to be the common practice in Spain unfortunately.
The first train going from A to B derailed, and the second train going from B to A crashed into the derailed cars 9 (20 on other sources) seconds later. Even if the second train was put in full brake in the exact same second the derailment happened, it couldn't have avoided the crash.
Surely a better fallback is possible. Like if a train is known to be in a PZB with other trains ahead of it, then when LZB goes down it has to slow down/wait/follow some different protocol until PZB rules can be enforced again.
I'm not sure, I can follow you. The trains were in LZB mode, because you need that in order to operate a high-speed train. You can't see the signals required for PZB at high-speeds.
> then when LZB goes down it has to slow down/wait/follow some different protocol
The trains did stop when the LZB reported an error, like they should.
> follow some different protocol
That is manual operation, which I suspect they failed to do.
My reading of the above was that at the time of LZB going down, PZB could not be enforced immediately, because its assumptions were violated (multiple trains in the same zone). Hence the trains are stopped.
The question is then what does manual operation entail? Do they just continue operations, driving slowly and communicating through other channels while allowing PZB rules to continue to be violated, or do they have a protocol to re-establish PZB as quickly and safely as possible? Asking as a layman.
The level of human negligence here is astounding. The system did exactly what it was supposed to (lock the train down if the track can't be confirmed clear), and then a human controller ordered the crew to override the system, and ordered them to proceed at an unsafe speed towards a similarly disabled train?
Usually when you look deeper at failures like this, it’s because there’s a morass of bad incentives from the surrounding human system that enforces this kind of behavior.
Here is a plausible alternative explanation:
They’ve probably seen false warnings over and over and overridden them enough times that they lost sense of the risk. They need to keep trains on schedule, using a buggy system, with a manager looking over their shoulder. They override the warnings over and over, nothing goes wrong, and they forget that it may actually be right. Look at the Challenger explosion, Chernobyl, or any other failure like this, and there’s usually a bureaucratic process that has run amok, and the individual is just following perverse incentives that have been socially normalized over time.
So I’ll wait until I have more information before I proclaim this as human negligence and the system doing exactly what it’s supposed to do. We don’t know how often it was doing the wrong thing and confusing the fuck out of the human.
"They need to keep trains on schedule, using a buggy system, with a manager looking over their shoulder."
Also lots of potentially angry passengers who want to get to their destination in time.
Will miss important appointments, or even the last train connection for the day and be stranded if the train drivers decide to wait a little bit longer to be on the save side.
Yes indeed. But stressed passengers tend to not think about that, so the pressure they put on the traindriver is real.
(have you ever been in a train on hold, unclear information about delay and seen the looks and talks of passengers towards the train driver walking outside who announced before he also does not know when the ride can go on? Like he is personally responsible for the delay and incompetent or straight evil)
Like, frankly, any passengers that are aggressive towards the train crew might as well be told to walk back to the nearest bus stop. Like seriously, in this case especially (a high speed train) the utmost focus should be given to safety, so anyone going against that (like putting pressure on the train crew) should be ignored if not fined/booted of the train.
Also in this case - why the hell they just did not wait for the primary safety system to go back online before doing anything ? Is it so faulty that they get used to it being broken or what ?
And baring that, how is the train even able to go full speed without the primary safety system being operational ? It really should be hardwired to cap the speed at 40 km/h or even less (including zero) unless the safety system is confirmed online and operational.
IIRC the japanese Shinkansen trains use a system called ATC (https://en.wikipedia.org/wiki/Automatic_train_control#Japan) since 1964 (!) which automatically starts breaking if a train goes faster than the maximum allowed speed in a track circuit. So presumably if connecting with the track circuit is lost the maximum speed defaults to 0 & all trains stop until proper protection is restored.
I recently saw a doc on the 2013 Spanish crash and it was full of absurd system problems. The govt pinned it on the driver as best they could but it's clear that it was entirely preventable.
> human negligence and the system doing exactly what it’s supposed to do
Negligence is not limited to the single human who issued the order. it's pretty unlikely that their order could have caused this without a significant amount of other negligence that eroded the safeguards. Nevertheless, the negligence is human, not machine in nature.
Trains in spain have been running at reduced speed, delayed or even cancelled for a while due to aging infrastructure, which might've actually caused another deadly accident back in winter, so this behavior does not surprise me.
Normalization of deviance [0], wherein a clearly unsafe practice becomes considered normal if it does not immediately cause a catastrophe: "a long incubation period [before a final disaster] with early warning signs that were either misinterpreted, ignored or missed completely
That sounds like a reasonable statement, but actually you do need to place punctuality or costs over safety at some point. If you want to chase absolute safety, you can dump infinite money in it or just not operate a train network. There must be such a thing as a socially accepted safety level, otherwise you simply don't do that thing. That's not limited to railways, but to everything you do. In the end humans are still mortal fallible beings.
I don't mean to absolve people for negligence, but when margins are very small and paychecks may have become a necessity to survive on this planet, sometimes within the complex process the collective behaviour gets pretty weird.
There are not that many people who (care to) see the big picture(s) and the consequences their semi-small actions may have in the long run.
(Un)Fortunately, finding someone who is "at fault" generally helps neither in investigating root causes nor in preventing similar problems in the future.
Usually it's detrimental, hence (criminal) investigations of personal liability in such cases are often only allowed after systemic investigation has concluded.
In court, you are allowed to withhold information that makes you look bad, which is simply lethally unhelpful when we want safer trains.
Whose negligence, though? "The system" isn't just the LZB equipment - the train dispatcher is just another cog inside the same system, and should be expected to occasionally fail just like every mechanical part.
This isn't a game of Hot Potato where the last person touching it goes to jail for gross negligence. You have to look at it through a Swiss Cheese model: every individual safety layer can and will have holes, but a disaster can only occur when all of those holes align.
Why did the LZB system fail? Why did the train dispatcher use the wrong backup procedure? Why did a backup procedure with zero safety checks even exist? Why did the train operator accept this backup procedure? Why did the train allow high-speed driving under those unsafe conditions?
It does indeed seem like the train dispatcher made a big mistake, but that was far from the only thing that went wrong, and it would be myopic to use him as the scapegoat for a far larger systemic issue.
There is a reason these people are paid good money for "responsible positions", they should be "responsible"... It shouldn't even matter why or who fucked up, you take the minister of transport, who's part of two major fuck ups by now, you fire him, make him ineligible to any kind of responsible position, and put him in house arrest for a year or two. That's like the whole fucking principle behind responsible positions. It seems like today it just means you have to go public every now and then to say "I claim full responsibility for the events" and just moves on as if you didn't kill 50+ people
Overriding safety systems is itself a safety capability. But this wasn't a failure of the safety systems. It wasn't even a failure of the train drivers who had been over using safety system overrides. It was a management failure for not noticing that over use of overrides.
Also the train driver could have pushed back, in the radio recording with the dispatcher, he tells the driver to "proceed normally", the driver asks "proceed normally?" and the dispatcher confirms it. Here's were I would expect that better training or more availability of information to the driver would've made him push back on that decision.
I read that one of the other train did push back and told the dispatcher that they were supposed to proceed "at sight". Sad that this was not enough to rectify
why does the dispatcher even hold the right to override the automatic system by themselves? this should involve multiple people, at least a signoff by a superior.
Dispatcher, conductor at that time could not have know that dispatcher ordered manual bypass ignorig the rest of the guardrails of a traffic resume procedure
Not OP but I'm imagining we'd ask the question why the "dispatcher ordered manual bypass ignoring the rest of the guardrails". They're saying it's all slices of cheese in a system that failed here.
Trains take a long time to stop even at moderate commuter train speeds because they are so heavy, let alone high speeds of 300km/h+.
At least one of the failures here is that the dispatcher authorized such a high speed, in other systems I am familiar with, generally the procedure with a signal fault is to crawl at a speed such that the train can stop in line of sight distances.
In fact, that is the Spanish protocol, which for some reason was bypassed by dispatch even after the train driver had questioned it:
> Under normal protocols, the driver would be expected to continue moving at a maximum of 40km/h according to their line of sight, and not at normal speed on a track designed for speeds of up to 200km/h.
> Under normal protocols, the driver would be expected to continue moving at a maximum of 40km/h according to their line of sight, and not at normal speed on a track designed for speeds of up to 200km/h.
I think this has been misreported and it's even worse, EU register of infrastructure says that maximum permitted speed for this section is 270km/h and the sections before it are even higher.
If a stretch of road continues to have frequent crashes even though a sign is present, it is worth examining why that sign alone is not solving the issue.
Air travel is as safe as it is because we don't stop the investigation at "pilot error" but instead ask why the pilot made the mistake, and why a single mistake was able to lead to loss of life.
Yeah. This single accident was more deadly than all commercial air traffic in the EU in the past 10 years together, while 50 deaths per day is the average for car crashes in the EU. Wild orders of magnitude difference in safety.
Rough estimate: by car, you can travel from Lisbon to Talinn (4000km) 100,000 times before expecting to die; by train, almost 4 million times, by plane 400 million times.
And if you're the median person (not the average person), you can probably 3x those numbers, because such a large number of casualties in traffic are risk-seeking individuals (e.g. a drunk driver is included in "average person" but not in "median person")
Maybe, but the median person shares the road with those risk-seeking individuals. Drunk driving accidents often kill people other than the drunk driver.
> If a stretch of road continues to have frequent crashes even though a sign is present, it is worth examining why that sign alone is not solving the issue.
I don't think trains are the same as cars. Trains are supposed to run at high speeds under normal circumstances and the system is supposed to keep everyone safe. It clearly said they wouldn't be able to drive over 40 km/h if they had to operate by line of sight.
Cars otoh don't have someone overseeing everything and directing traffic. They have to operate by sight.
I don't mean to pick, but it seems like you have near zero knowledge of how train systems work.
You are 100% dependent on your safety and monitoring systems because almost every problem that could come up is beyond the horizon of your human senses. Stopping distances are in thousands of feet to miles depending on the train size and weight. Add any curves and that's far beyond your visibility.
Then you add in management complaining that you're too slow and you need to do things faster and cheaper or you'll lose your job. Things turn from solution culture to blame culture.
Then you add in false errors and warnings in a system that teach you to ignore them and an upper management that doesn't fix them.
Then you have the day like hundreds of others where warnings are going off, management is yelling, but this time there is a stopped train around the corner and everyone dies.
I wish this were true, but there is basically no consequences for drivers in the situation you described. The most egregious example I can think of near me was in 2022 when a kid was crossing a flashing crosswalk with his bike near Tacoma, and truck had stopped to let him cross. A woman ignored the crosswalk signal and used the adjacent lane to drive past the stopped truck and hit the kid, killing him. The woman was never criminally charged. She didn't even experience any consequences for her driver's license.
I think this is something about the incentive structure of the US legal system.
Here in Australia, a member of my family was involved in a fatal accident with a pedestrian, around 20 years ago. They put him on trial even though the case was weak, and then the prosecutor moved for dismissal part way through the trial. But, what people told us, is prosecutors are encouraged to take weak cases to trial because dropping the case part way through the trial is more politically palatable than refusing to bring it to court to begin with.
> Someone was driving the train who couldn't estimate the stopping distance relative to speed.
The stopping distance for a train this size and this fast is around 2km. Good luck estimating that by sight. There is a reason the normal protocol has a 40km/h max speed for traveling according to line of sight, which the driver was told wasn't needed.
Indeed, car crashes tend to just blame one (or more) of the drivers. Nobody excuses a foolish driver with systemic excuses.
On a surely unrelated note, car travel is by a substantial margin the most dangerous mode of transport most of us ever use, and the most dangerous activity most of us routinely engage in.
I would argue that we should look at systems-level explanations. The human factor is so glaring we can get caught up in it. There are what, 50?, high speed trains in movement in Spain at the same time. Even GPS + Starlink + 1 monitor (is that 50k€?) could have prevented this. But it happened, and the question is what is going on with train security in Spain in general for people to (be able to) make such decisions.
After learning about a sufficient number of such "accidents" I'm now convinced the cause is never "operator error", it's always a system error. It's the humans that design (or oversee their design and implementation of) those systems that are at fault.
"The cause", singular, shows you're not getting the the swiss cheese model still. Trying to find a singular cause is a big mistake which prevents other causes from being addressed.
Every hole in the cheese slices, including operator error, is important. And operator error is an important kind of error in particular, not because we need to prosecute somebody but because many forms of operator error can be mitigated using better system design, but you won't figure that out if you blind yourself to operator errors.
The current control system dates from the early 90s. They started rolling a modern system with more redundancies and automatic blocking in 2022 but it's still not fully deployed.
PZB is from 1934. Arguably always prioritizing deploying the most modern system on the highest profile lines, is what prevents us from properly rolling out the basic safety systems everywhere.
PZB is only used up to 160 kph, and relies on wayside signals being read by operators. That's not possible on a high speed line. A more sophisticated signal system is simply necessary here.
I was only talking about the general problem domain, not about this specific location. The current safety system is also not was has caused this, likely. Or rather it has caused this by it's availability, not by it's safety.
Trains are still not able to assess properly where they are, even using satellites and inside train sensors. Of course there is research on that, but it's still an unsolved problem. (Current alternative is to put markers in the track, but that's also expensive at scale.)
> Trains are still not able to assess properly where they are, even using satellites and inside train sensors. Of course there is research on that, but it's still an unsolved problem
Throwing up our hands about how hard a problem this is seems like a ridiculous position to stake. If we can design self-driving cars, that operate safely in far less controlled environments, we can figure out the linear offset of a large vehicle traveling along a physical rail running along a fixed pre-determined path.
> If we can design self-driving cars, that operate safely in far less controlled environments
Self-driving cars aren't supposed to drive quicker than they can look ahead, which makes the problem way easier because you don't have to figure out how to detect obstacles ahead of time and can simply rely on vehicle-local information to stop if necessary. And because cars can brake way more rapidly than trains, it means you can still drive reasonably quickly even within that limitation.
Plus in an emergency, cars have steering as an additional degree of freedom to attempt getting out of any nasty situation that may have developed.
(And of course the socially expected safety standards for cars are quite a bit lower than for public transport…)
Trains on the other hand have braking distances on the order of a kilometre or so, and high-speed trains at full speed several kilometres, so trying to get by on local data only is hopeless and the usual strategy is instead having central signalling system that can accurately track trains and coordinate their movements.
I said nothing about "throwing up out hands", this is a current research topic. But you can hardly blame the workers for not using a system, the researchers haven't invented yet.
> If we can design self-driving cars
We can not design self-driving cars to the safety standard that is required for railways. They are way less safe than the current half-manual system for railways. What you suggest is using less automatic safety systems than what we currently do.
Why is it that these fatal train accidents have happened multiple times in Spain, but never in Japan, even though Japan has been doing it high speed rail longer, and at 10x the passenger volume than Spain? Do they have some alien safety technology unavailable to Spain?
The were several other train accidents, where it was found out, that the drivers have made races, who can stay above the speed limit longer. But I think that was already in the 90s. There is/was definitely something at fault with the safety culture.
But there was a recent incident in Germany as well (https://en.wikipedia.org/wiki/Burgrain_train_derailment), which is somewhat similar to the earlier accident in Spain this year. Targeting high value projects, while not paying for proper maintenance is not something that only happens in a single country.
There were two fatal train accidents in the UK this year, one of them being a rear-end collision, despite no one even citing them in this thread, and definitely not claiming the UK having low safety culture. Sadly the Spanish "black legend" is still very much in force, portraying Spain as some lower place than it actually is.
Yes, you can say that high-speed rail crashes are not limited to one country (though Spain has had multiple this year alone), but you can't say that it has ever happened in Japan. So for you to argue up and down this thread that everyone calling out issues with Spanish high speed rail safety is wrong, as if it is some sort of intractable problem, is bananas.
I have not stated anything that is specific to Spain in this thread? I do think there is something wrong with the safety culture in Spain, I mean obviously, there was an accident.
> but you can't say that it has ever happened in Japan.
Ok, so railway safety for me doesn't stop at the end of high-speed lines. But, maybe Japan does indeed clear the measure you suggested, so congratulations to Japan, I guess?
> I said nothing about "throwing up out hands", this is a current research topic. But you can hardly blame the workers for not using a system, the researchers haven't invented yet.
This you? Who's fault is it then? You said the tech doesn't exist (lets take that at face-value for the sake of your argument), so then if not tech, then what? You're just left with people. So are you saying it is their fault or not? Or is it just nobody's?
Yes. General safety culture. However asking who is at fault instead of asking how to prevent it from occurring again, is also an indication of a lack of safety culture.
indeed. Japan is a compliance and shame based society. that alone is the foundation of a very strong safety culture, something that southern europe is famous for lacking.
might be a mixed bag but when safety of vehicles is involved, the japanese and germans are very good. Observe cars driving almost anywhere in southern europe and you will instantly spot the difference.
I am from Germany, and we did have the exact same failure case I expect happened here in 2002. In my opinion thinking you are good at safety is how being bad at safety starts.
The train to control center calls leaked, and they not sound like aircontrol talk we have heard latelly, more like "meh, paperwork". People! You are handling multi-ton things capable of going faster than 300 Km/h.
Has there ever been a case where two self driving cars collide with each other? I hate to be part of the peanut gallery, but as a totally naive person when it comes to railway safety research it really does seem amazing train collisions can’t be easily prevented with gps, lasers, sonar or various other trivial ways. Even the crash in question seems like it might have been easily prevented by having a second human in the loop. Maybe I and others just suspect the difficulty isn’t so much technological as it is financial.
As far as I am aware, there has been no non-supervised train in a general train network. (They exist in closed systems.) However whether the train is self-driving is really not the issue here. In current railway safety systems (even from the 80s) a crash is about the same probability as random bitflips. However reality is too messy, so that the availability is not satisfactory enough to not use a human fallback, and then you are back to the assisted human error rate.
Current operation of a train is basically self-driving and supervising driver. So if you suggest "just use self-driving", you make the system less safe, not more, because it means just getting rid of the human supervisor. This is not currently done, because it would be too insecure. It might be done in the future, but rather because less safety is going to be accepted in favor for getting rid of the costly human.
A self-driving train will happily cause a crash, if the target is "drive with high-speed in that segment currently occupied by another train". The issue is that that becomes a target, not that there is a human in the loop.
Self driving cars colliding had already happened at least once.
GPS can't work for trains, they go inside tunnels and between walls. Track circuits and train sized NFC-like tags reporting linear locations, mentioned as not scaling in GP, is the standard solution. It kinda scales fine.
> Has there ever been a case where two self driving cars collide with each other?
I don't think that's relevant to trains. Cars can avoid a collision much more easily than trains can. Cars can swerve, and if they are at a distance at which line of sight tells them they will hit an obstacle, they are moving slow enough to stop before hitting that obstacle. Trains have to stay on tracks, and they need up to 4 kilometers to stop moving.
The constraints are very different, so the solutions and tradeoffs will be different too.
> We can not design self-driving cars to the safety standard that is required for railways.
That is completely false. PTC does that, and we've had it for several decades. There are several self-driving cars operating in the world right now. I have never heard of a PTC system causing accidents; those occur in places where the system isn't required (like entering Grand Central).
You keep pretending that avoiding train collisions is too magical to achieve with current tech, but train traffic is easy to limit (but slightly harder to optimize), and systems exist to do that, because rail is unique amongst all forms of travel: if you drop speed to zero for any trains at risk of collision, they are safe. Planes will plummet; most cars are human-operated and you can get rear-ended, etc.
> That is completely false. PTC does that, and we've had it for several decades.
I think you are misunderstanding the sentence you quoted.
It says something about the safety of self-driving cars. That is they don’t meet the standards required for railways. In other words the expected safety for a self-driving CAR is lower than the expected safety of a RAILWAY. (Caps for emphasis, sorry about the shouting.)
Your comment reads as if the quote claims that we cannot make “self-driving trains”. It does not say that.
> You keep pretending that avoiding train collisions is too magical to achieve with current tech
I don’t think that they do that. Definietly not in the comment you responded to.
> That is completely false. PTC does that, and we've had it for several decades.
And they somehow work with radar, lidar and GPS from inside the train? No they work with classical block based systems and on signalboxes. So all the safety systems are outside of a train.
> You keep pretending that avoiding train collisions is too magical to achieve with current tech
Huh?? Railway interlocking exists for more than a century. It's very safe and I didn't wrote anything contradicting that.
Yeah and that's fucking ridiculous and a damning indictment of the glaring incompetence of train companies.
If I can have reasonably accurate gps readings of my phone while I'm on the train, there is zero reason for train companies to not have systems that are at least as accurate.
The thing is that trains move way faster compared to friction (which is needed for breaking and manoveering) than cars. The equivalent is if you would be driving 900-1200 km/h with your car[1]. Good luck being able to break in time on that speed and estimating your position with GPS.
Also the hard part is knowing the position of the others and their trajectory, which changes in between moving towards them and is done by a third party. The normal passing distance is smaller than the width of your vehicle and you can only change your own direction every few kilometers. That means that the others trajectory towards you can only become known after you are already past your last opportunity to change your trajectory and even within your breaking distance. Good luck!
[1] Friction for cars on the road is 0.010-0.015, for trains 0.001-0.002; train speed 120 km/h * 7.5 = 900 km/h equivalent for car; that's not even a high-speed train.
Part of the problem is multiple tracks. Those tracks may be only 10 feet (3 m) apart. (I don't know if high-speed rail lines in Spain are that close, and I don't know if the line where the accident occurred was double track.)
"Reasonably accurate GPS" trying to determine which track you're on at 150 mph is not as simple as you make it sound. Yeah, it can determine how far along the track you are. But when you get two trains moving toward each other, each at 150 MPH, do you really trust that GPS to tell you that they're on different tracks?
Trains can't change lanes without warning like a Nissan Altima on the Dan Ryan Expressway. The only way a train can move from one track to an adjacent track -- or get on the first track in the first place -- is if switches are set to allow the train onto that track. And on any modern high-speed line, those switches are centrally controlled by dispatch.
Keeping track of which parallel track a train was on automatically was a solved problem a hundred years ago, using relays and lights and hard-wired logic. Adding computers and GPS greatly increases the precision with which dispatch knows position and speed along the track, but knowing which track has not changed in the last century.
Yes, but as long as the central signalling system is working, it already knows where the train is, with no need to involve GPS. (And where modern signalling and train protection systems need increased precision as compared to the granularity of track circuits/axle counter sections, the solution usually involves a combination of on-train odometry plus track balises at occasional intervals in order to reset any inaccuracies that might have accumulated.)
What we're talking about here is some sort of TCAS-equivalent for the case where the central signalling is down – while it's easy to accurately localise trains with the aid of a central signalling system that authoritatively knows about the infrastructure layout, it's quite more difficult when you're trying to do the same thing in a decentralised, train-local fashion.
And as of now, I suppose that RCAS (or RCAS-like systems) is best suited for (especially minor) single track branch lines that don't currently have a full-scale signalling system already up-and-running, but instead still rely on "Timetable & Train Order" and similar systems.
Single track means that at least outside of stations, collisions can be reliably identified without much danger of false positives (and for station areas you can just institute a blanket speed limit to compensate for the gap in RCAS coverage, which might not even be any lower than the speed limit required for traversing diverging/spring-operated/hand-operated points there anyway), and no already existing full-scale signalling system means that RCAS actually provides a significant safety benefit and is therefore likely worthwhile from a cost-benefit-analysis point of view, too, if you're actually regularly operating multiple trains simultaneously on that kind of infrastructure.
Whereas on multi-track mainline railways avoiding false positives is much harder and normally you should already have proper signalling and train protection systems in place anyway, so the additional safety benefits of RCAS would be much more marginal.
I agree that the problem here has no easy, general and automatic gps-based solution but I think it's helpful to keep the actual likely situations in mind.
Usually we have the most trains/densest timetables close to major transport hubs where speeds are low anyway and driving 'on sight' is a good compromise of safety and keeping things working.
Where speed really matters - outside of major hubs, straight ruralish routes - we simply don't usually have great density of trains AND tracks. At least from my travels in western Europe I don't think I've ever seen more than two tracks in the same direction on high-speed-segments.
So if we keep that in mind and don't expect a general and automatic solution, a simple, gps-based fallback-system that requires all trains that are within a radius of X of each other (either in time or space) MUST coordinate, else they both shutdown/move on sight, could work reasonably well. In reality and for the involved parties (the trains that are close to each other), it's a very human-scale problem.
It's very easy since there is limited ability for trains to change tracks, so the location history of the train is a strong indicator of which track it is on. Even Google Maps can tell you which lane you are in since god knows when, and cars can freely change lanes. And that's just consumer software. For something commercial like a train they could trivially solve this problem with something more robust. But I'm not familiar with the Spanish system; how much of the engineering did they do?
There are switches that move trains between tracks. Now you need every switch to report, keep a history of that. Many trains also separate and combine. Trains sometimes go backwards to be switched.
It's not impossible. But handwaving GPS placement of trains at the correct location, direction, and track deserves more than a handwave as trivial.
All of those failure modes can be accommodated. I fail to see anything here a competent engineer couldn't address. I speculate it's not a technical problem, but an operational and cultural one. This is not rocket science.
> Presumably switches already report their position to somewhere.
Yeah and this somewhere already knows whether a crash is going to happen. In which case your solution brings no benefit. You can't rely on the correctness of a system, which you want to make an alternative to, to help in the case the original system fails.
This discussion focuses on a non-problem (granted partly due to an imprecise comment of mine). The system knows where all the trains are and also that a crash will happen, if the decision is made, that then indeed was made.
What is needed is that the system needs to convince the operator there is still a problem, after it proved itself unreliable. My suggestion would be a log of the constraints the prover encountered while determining whether there is a conflict. This certainly already exists somewhere in the background, but I am not aware whether that is currently shown to operators in deployed systems. It does exist somewhat in the research systems we use in university.
When I wrote that comment I would have answered, that you already need to distrust a system, that of course still have the authority to sound like it would be right. Also from other accident reports, my understanding is that relying on yet another system causes people to make even more errors, while when they start to manually assess the situation from first principles, they are able to grasp the fundamental error, because they are questioning every assumption, as they are reconstructing a world model different from the automatic system. But the latter takes more time and effort, so people tend to do the former.
The thing is that in modern automated dispatching you only have the same world model as the automatic system, so when there is an error you have the same world model as the system, but that just detected, that that does not equal the actual state of the world. And often the error is in fact a false positive.
Yes, it can tell you. How perfectly, though? Perfectly enough to bet 60 lives on?
When Google Maps gets wrong what lane I'm in, nobody dies. It can be right 99% of the time, that's good enough. It's not good enough for a train system, though - at least, I suspect it's not. I'd want a lot more than "it works in my car" before I trusted it.
Can we just have it as an additional data point, on top of what we should already know from where the train should be from switching history? If we get 99% accuracy, is that enough to check with an operator “specify which track you are in, left or right” when the measured value is different than the expected?
In addition to that being unpractical, the train doesn't even know the state of switches, i.e. not whether it is on the same track as some other position. It's just that this is undecidable for a single train. (This is what my first comment was about, it's simply not known how to solve it on the level of a single train, likely because it is impossible.) However the answer for what to do if a train can't trust the network, is don't move. Or move by sight, which is limited to 40km/h for good reason.
On the other hand this is a complete non-issue and solved for more than a century on the network level. So there is zero need to invent satellite or vision based train detection at worst even using statistical systems, when you can use deterministic systems, for example using the fact that a train is out of metal, so it's detectable by the train closing a electric circuit between the rails. Or using the sensors that are installed at every signal, switch or other positions for precisely this question.
Google maps gives me the directions for the express lanes when I'm in the normal lanes and vice versa like 50% of the time, and that's an order of magnitude greater error in distance than the distance between adjacent train tracks. And several orders of magnitude greater failure rate than is acceptable for a safety system.
It can be on the other track right now, but change to your track in the future. Or in other words, the topology of the network changes in operation. Whether the track you are on and the track another train is on, is the same or not is not decidable without knowing the current network state.
Tunnels are controlled by a single block - only one train can ever be allowed access at once, period. Until the "current" occupant train is verifiably out of the tunnel, that block is forbidden to all.
Forests are irrelevant; rail right-of-way contains no trees, and is wide enough to assure clear "view" of satellites.
There are actually different definitions for what a block is. It can be both a section where you can decide for trains to enter or where you can change their sequence (Zugfolgeabschnitt vs. Zugmeldeabschnitt, don't know the English terms) Also it can be a physical implementation of any constraint between components of different stations.
But yes there does not need to be a limitation on there only being a single train in a tunnel.
> a damning indictment of the glaring incompetence of train companies.
No, what I describe has nothing to do with the companies, that's the research state. It's just an indictment of you making bold statement about a subject, you don't now enough about.
> I can have reasonably accurate gps readings of my phone
Would you dare to cross on a rope over a deep valley, blind using only GPS readings of your phone? Because that's kind what you are suggesting, expect you also move a few hundred other people.
> Would you dare to cross on a rope over a deep valley, blind using only GPS readings of your phone?
Hang on, this is nothing at all like that - trains run on fixed tracks. The only bit of data we are interested in for collision avoidance is the linear offset along the track. Even the shittiest GPS fix of all-time would give a good-enough intersection with a fixed path to avoid crashing into a second stationary train in the open country-side (do you see any satellite line-of-sight blockers in the crash footage?)
> The only bit of data we are interested in for collision avoidance is the linear offset along the track.
So that is naive, but assuming that would be all that you need, with GPS you would also need the positions of all other trains. But why would you transmit all this information to every train, instead of just computing the collisions in a central node? (That's what is done now.) A better fit for what you suggest would be radar, and this does exist. [1] But that's where your original assumption is naive. You regularly pass other trains within <2m at high speeds, so linear offset is not all you need.
> But why would you transmit all this information to every train, instead of just computing the collisions in a central node?
Because central nodes can fail (as they did here, both human and machine), and providing this redundant data allows both the computer and the human-in-the-loop on the fast-moving chunk of steel to independently validate the decisions coming from the central node.
> You regularly pass other trains within <2m at high speeds, so linear offset is not all you need.
In this collision, both trains were on the same track. So while we obviously care about adjacency issues in the general case, this specific failure mode can be detected purely via a linear offset.
You can and do have redundancy in the central node already. Also that's not what failed here.
> In this collision, both trains were on the same track.
Yeah, but how do you distinguish that? So when I understand you correctly, what you want is: Find another moving chunk of metal in the radius of 2km, which moves toward you, but not in a direct or ballistic trajectory, but in a arbitrary complicated trajectory, but which can lookup in a database. Also you are operating in the real world, so there are potentially houses, trees and mountains in between. I guess that would be possible, but it would be really expensive. Your best bet would be to adapt a missile detection and targeting system from the military. A system which does exist and is somewhat similar is RCAS (https://www.dlr.de/en/kn/research-transfer/projects/next-gen...).
I feel like you are intentionally trying to turn this into a spherical cow situation by insisting on solutions that work in an information vacuum. All of this sort of problem in the real world is solved by sensor fusion from multiple data sources.
Trains are captive to a particular track - they can only change tracks at specific pre-determined junctions. With a pretty minimal sensor feed from each junction we can statically determine which track segment a given train is on. With GPS we can shrink that segment length down to a few kilometres. By sharing data persistently every single train can validate that central command-and-control is not about to run it into another train from behind...
There cases which are genuinely challenging engineering problems (i.e. derailments that impinge on adjacent tracks), but this trivial case of bumper cars is not one of them.
How do you distinguish that the <2km away detected moving train runs on your track on not on the one directly besides you?
> Trains are captive to a particular track - they can only change tracks at specific pre-determined junctions.
Yeah, but you do not know which one it runs on. Your entire point is that you do not trust the information the infrastructure knows. If you do allow to use information from the infrastructure, then why not use the sensors that already exist along the whole train network? It's also very unlikely that there is something electrically connecting the two rails of a track, that you would like to run over. So why wouldn't you trust that information, but some vague GPS signal?
> we can statically determine
But the current state of the art is, that you deterministically and provable know where a train is. Why would you use a more expensive, less safe system? The current focus to reduce errors in computing train conflicts is to prevent random bit flips due to radiation at the same time in three different computers running different software.
> I feel like you are intentionally trying to turn this into a spherical cow situation
The situation where you proposal makes sense, but the current system does not, is a spherical cow situation, that's my point.
> that you deterministically and provable know where a train is
You are the one who framed this conversation as it not being solved how to deterministically know where a train is. Everyone else in here has been kindly suggest that if perfect information is unobtainable, then we should work with what we have
Oh, I see how you could think that, without context. That's in fact not what I wanted to say. I meant that pretty literally. The infrastructure of course knows where the train is.
> Trains are still not able to assess properly where they are, even using satellites and inside train sensors. Of course there is research on that, but it's still an unsolved problem.
*Trains* on there own! This IS a hard problem, how to do that with any other infrastructure. It IS current research and not yet solved. That is for example relevant, if you want to be able to run trains at full speed <1m tolerance, so that you can have more than one train stopping at a station <60s. All while still not paying for infrastructure and maintaining backward compatibility with a century old trains. (I mean in the future you could use the same to also couple trains at full speed, but that's still sci-fi.)
> That is for example relevant, if you want to be able to run trains at full speed <1m tolerance, so that you can have more than one train stopping at a station <60s.
...is that something you'd ever want? In general, it is, but the way it's handled is by having those trains stop on separate tracks.
Running multiple trains through the same station track in under 60 seconds means that all passengers must embark and disembark in under 30 seconds. That's very tight. I would venture to say it's too tight and meeting this goal would make the trains worse.
(And if passengers aren't getting on or off the train, then the train isn't stopping at a station.)
In a society where building more rail is not welcomed, trying to get more out of the existing tracks becomes critical. In a metro, time for embark and disembark of 30s is not unreasonable. https://de.wikipedia.org/wiki/Fahrgastwechselzeit#cite_ref-d...
Redundancy in a central node is an oxymoron. Safety critical systems need to work 100% of the time if any single node fails, and stop safely if there are multiple failures and it can't work properly. Doesn't matter if each individual node is 100% reliable by itself because connections fail too.
You can still have redundancy in the computation, that isn't prevented by being in the same location.
> Safety critical systems need to work 100% of the time
Railway safety must be safe 100% of the time, but not available 100% of the time. Also the point of a signal box is to make decisions about the order of train assignment to track. You absolutely do not want multiple points of truths for that.
The way I think of it, divide the tracks into segments. Before you put a train on a segment, you must ask a question - is there a train on it. There are only two answers possible, No, and something else. If it is something else, stop. Don't let the train on that segment.
There are optimizations possible like make segments smaller etc but the original algorithm is trivial. If we can't figure things out, we make segments longer and we slow down the trains until we can. I am positive for a sufficiently large track segment and a sufficiently slow train, we can always answer the question with a no.
Actually in this case it seemed that the opposite was the case, there was another fallback system, but you needed to disregard it, and operate manually, but the operators likely didn't notice that. https://news.ycombinator.com/item?id=50298796
My reading indicates, that "Even X could have prevented this." means that X is able to solve the issue on it's own. Otherwise X would in fact not prevent it.
- I don't think X would actually work, without actually eventually recreating part of the current railway control system, and the current rail control system alone already works better.
- I don't think another less reliable more costly safety system helps, when the current one already stated that there is a problem, and it was ignored.
>My reading indicates, that "Even X could have prevented this." means that X is able to solve the issue on it's own. Otherwise X would in fact not prevent it.
X on its own would have solved this particular crash, yes.
X + existing setup would solve this crash + all the other crashed the existing setup solves.
Yes they are, those balises on tracks are the standard technique for both metro and mainline signaling systems at this point. Those balises, often combined with radio communication, are how fully autonomous trains have been operating for decades. (It's possible to use things other than balises, like track radio loops as in LZB or more recently beacons or LIDAR, but balises are standard and pretty affordable).
Yeah, that works and has been for a while. I was talking about non-track based safety systems. You can have balises in specific locations, but you can't have them every few centimeters on your whole network.
Because balises cost money, are payed for by infrastructure companies. Their position needs to be decided a priori, so you can't have the whole resolution on the whole network in order to get as close to the physical limits between trains as possible. Also it would be nice to be able to implement automatic shunting without additional infrastructure costs.
There are now hybrid systems for ETCS L2 that allow virtual blocks as short as 1 meter long. Balis + odometer is quite robust (and indeed how most CBTC systems with moving block tech function).
I guess I'm confused by why non track -based solutions are necessary? ETCS L2 would gracefully handle a system restart and automatically force a 40kph speed limit until a train traversed the unknown track proving no occupancy, and allowing proceeding trains to go faster. This all works on a track-based system.
Not sure what you're arguing, the line affected by this tragedy was migrating to ETCS L2. Its installation costs are getting lower too, I don't think there's an actual problem here.
I wasn't talking about a specific line at all. Research doesn't need a clear problem to try to find better solutions. Also Deutsche Bahn does think there is enough of a "problem", because they do support that research.
> Trains are still not able to assess properly where they are [...]
Isn't the ability to do so the basis of operation for e.g. the German LZB train protection system, which has been around since the 1960s?
If you mean that train protection systems don't (exclusively) rely on self-reported positions, your statement makes a bit more sense, but even that is changing with e.g. newer ETCS levels which do rely on self-positioning more and more.
I should have written that comment quite differently, it took a while for me to understand how it is read.
I did not say "train systems are ...", I said "trains are ...". This is referring to e.g. that odometry based on wheels results in a drift. GNSS is to imprecise and unreliable. I'm aware that you simply use balises, that's what I meant with "markers in the track". However that's based on the infrastructure again, so it's again not trains on their own.
It was simply supposed to be an example how GPS sounds like it should easily solve a problem, but does not without additional measures, that then do not need GPS anymore.
Would you mind sharing some more of the why it is still an open problem? (I know I know little about this subject.) I understand satellite positioning isn't definitive and did not suggest it should be the /primary/ risk mitigating factor. But even as a tertiary or lower risk mitigating factor, this would have been a worthwhile investment. (Sorry for the bleak introduction of economics.)
And some problems are just _open_ to outside looks. My assistant tells me that the room for error in trains on one dimension ('left - right') is mere 10s of centimeters. I understand that problem. But what track you are on, isn't that obvious to the human in the cabin? (Again, simplifying, not flaming. Production ready safety is _hard_.) So could a vision based solution help count tracks from left to right? (Assistant: "US PTC, on about 54,000 route-miles, uses GPS for the lead locomotive plus crew-entered track information and switch position".) So you use the dimension that matters most in crashes (forwards / backwards) from satellite, augmented with vision or human based left-right positioning. Some trains already have sensors to sense things like leaves on the track to adjust speeding and braking... So the sensor based approach is already there.
Perhaps I am read as suggesting that the problem is easy, and that is not my intention. But for cars this was solved decades ago for routing and years ago for self-driving. I use that daily. Flying is organised with a very clear 6 sigma approach. Crashes are nearly always situations where events / risks stack. Trains (in Spain)...?
Tl;dr - Safety is a function of (human; process; technology) and there is clearly something lacking for trains, when compared to other types of transport.
So that's a lot of questions, that I all can't answer in full.
> Would you mind sharing some more of the why it is still an open problem?
Because for train sensors, there is a small drift which accumulates too much, hence it is synchronized by magnetic position markers in the tracks.
> I understand satellite positioning isn't definitive
Yes, and the point is it might be some solution if we would have the safety systems from 1860. But we do not and hence it needs to be more accurate than the current system, and it is not and in addition also more expensive (and subject to remote influence and reliance on potentially adversary nation states).
> Sorry for the bleak introduction of economics
No, economics is basically the primary constraint for safety. We could pay million people to make sure a single person does not stumble if we want total safety, but that's completely pointless, and also these million people would starve, because no one is producing food anymore.
> But even as a tertiary or lower risk mitigating factor
But for that it's too expensive and still unreliable. There is RCAS[1], which I already linked elsewhere in the thread. That's basically cutting edge and too expensive to introduce everywhere. Also previous safety systems are already not rolled out enough, which is causing these accidents, so rolling out yet another expensive system is not going to improve much.
> But what track you are on, isn't that obvious to the human in the cabin?
Yes, but if it is already known, why use GPS to calculate the same information with more error?
> So could a vision based solution help count tracks from left to right?
If the train driver or dispatcher makes use of vision to assess the train position, the error will be higher than the current sensor/electric-resistance based system.
According to Wikipedia, ASFA being introduced in 1975 is rolled out in the entire Spain network. ETCS which is the European standardization seems to be rolled out on all high-speed lines or currently being rolled out.
> So you use the dimension that matters most in crashes (forwards / backwards) from satellite, augmented with vision or human based left-right positioning.
Duh, that just sounds like trains would be operating blindly in space currently and need to assess their approximate position.
> Perhaps I am read as suggesting that the problem is easy, and that is not my intention.
No, the issue is that you are suggesting far more complicated solutions to already solved problems, with simpler systems in operation for decades. The current system is that nobody in the train even has a say on where the train goes, so the problem you are trying to prevent doesn't even exist. This IS why it's way more safer than a car. There are movement authorities, that define from where you are allowed (and have to) drive with your train. The problem is not, that the train driver isn't able to know where he is and hence drives wrong or too far (that would be prevented by the on-board safety system), but that the movement authority itself is faulty.
On an up-to-date signaling box (withing the past 6 decades), even the train dispatcher is no say in safety questions. You could put a monkey in charge of it. There would be chaos, but they would not cause a crash. The current job of a dispatcher in normal operation is to assign resources to prevent deadlocks and to implement vaguely defined priorities. (Basically the equivalent of the public thinking a programmer is a code monkey, while the actual point is clarifying stakeholder interests.)
The actual issue here is, that while these safety system have a very small false positive rate, they do have a too large false negative rate for there to be an acceptable availability. Hence in the latter case, the human needs to take over and then you are back to a much higher false positive rate. The issue would be alleviated by relaxing the constraints on cost per availability. Either by allowing for less availability or by reintroducing more humans, so that the system situation can be assessed by humans directly.
These accidents are caused as follows: the automatic system fails, because the internal state of the system does not match the actual state of the world. Hence the human needs to take over. But the human also needs to rely on some system to know the world state. Which systems can he trust, given that the whole situation is that the systems report that he can't trust them? So he needs to make some decision and in most cases, that decision is still correct. But there is still an error rate to that, and then something like what we are discussing happens.
> But for cars this was solved decades ago for routing and years ago for self-driving.
This is absolutely not solved for the cars, and to the sense that it is, it was solved and rolled out from the 1870s onward for railways using mechanical computing systems, the switch to using electricity happened in the 1910s.
> Flying is organised with a very clear 6 sigma approach.
You are correct, that aircraft safety systems need to be designed to a higher reliability than railways, because on a rail you can always stop in case of an error, while in the air such a choice doesn't lead to a safe state. But if you compare these safety systems, basically aircraft is operated like railways used to be operated in the 1920s. (My peers actually had a task to compare them and find ideas from one that can be applied to the other. While there is a lot of automation to be taken from rail that can be applied to the aerial industry, there is not really much that can be applied the other way.) It is also operated with the amount of personal than 1920s railways. That's because there is a lot of money in aircraft, while railways are mass-transit and need to be cheap. If you would operate today's railway with the amount of human oversight than in the past, it would be a lot safer than aircraft.
> there is clearly something lacking for trains, when compared to other types of transport.
What are you talking about? Railways are so much safer than cars. https://news.ycombinator.com/item?id=50288518 Yes, there are less accidents in planes than in trains, but this is due to what I already explained.
No, it does not do, what I described. I was talking about solely determining it inside the train. At least Wikipedia indicates it is similar to LZB or ETCS. I am not familiar with PTC itself.
That's a research topic, because the infrastructure companies would like to not pay as much for maintenance and still have a high sequence of trains. Also with track based train control systems you can only have very high resolution in specific places, where you place your track-side infrastructure, but it would be nice to have that resolution anywhere you like.
PTC is a performance standard, not a concrete system. Some PTC systems do seem to use GPS for train positioning, which does seem surprising from a European train protection system perspective which all seem to completely avoid reliance on GNSS so far.
I guess a much less dense and largely overground network, mainly used by fairly slow moving freight trains as opposed to highspeed passenger connections, changes requirements somewhat.
I mean they are systems that rely on GNSS in Europe, but no safety systems, that would be simply to unreliable. For example I believe the railway announcements in Germany to depend on GNSS. They are also unreliable.
They have a failsafe to use (visual) block backup signaling on that line and used it incorrectly. 200km/h is right at the border where you don’t need in cabin signaling.
oh man, the override thing is super dangerous. I use FSD in Tesla a lot and there is a lot of times I "override" with the gas pedal because I think it phantom breaks or being slow and there were at least 2 cases where there was legitimate reason to stop (person crossing in my blind spot).
This really reminds you of the Chernobyl station computer printing all the warnings and recommendations to shut the reactor down when they started playing around with it ... and Comrade Dyatlov overriding it.
Sorry, but ordering trains to drive manually after the system locks itself down, is the proper procedure. Of course you are still supposed to only send trains to free sections, but the error is in that step, not that they ordered a train to drive on it's own.
Also the fallback procedure is also aided by automatic systems and a sizable number of accidents in the past were caused by that information being faulty.
It is the proper procedure, and it does come (in a lot of countries, AFAIK) with a lot of guardrails:
There will be a so-called "train order" allowing passage of a specific section ignoring the safety system warnings, which has strict validity limits both in time and in the area where it applies, usually denoted by specific hectometric mileposts
When cab signaling is involved (LZB is one of these) and it malfunctions, the entire system normally changes to "driving on sight only" - which indeed limits the train to 40, 30, 20, sometimes - 15 km/h (see https://fr.wikipedia.org/wiki/Marche_%C3%A0_vue) or the line gets switched to lineside signaling - if it is available.
I don't know how you could violate all of those rules - both from the driver's side and from the traffic control side - but it sounds absolutely horrible. Like an override of at least 2 (if not 3) very explicit safety margins.
(The following is speculation:) The issue is that there was still a fallback system operating (ASFA), so they likely assumed that there is still a safety system running, while actually it needed to be ignored, because due to virtual blocks of LZB there is then more than one train in a ASFA block. This means that the next signal shows you "clear", so you accelerate thinking you are back into normal operation, but there is actually a train in front of you, just not in the next block, but in your very own block, which is a situation that is not supposed to happen. So the issue is kind of different train control systems interacting disagreeing with each other. Ironically it would have been actual if there would not have been another safety system, because then they would have known, that they need to operate manually right away.
So they have lineside signaling as backup but it does not have blocks? That looks like misengineering, wow. Some reports said that the renfe train rolled for 25km - if this is what their fallback is like - it is absolutely inexcusable. Oh my...
No, the line based control system is the normally used one, because it is required for high-speed. But both systems are safe on their own. I explained it in more detail here: https://news.ycombinator.com/item?id=50298796
> Some reports said that the renfe train rolled for 25km - if this is what their fallback is like - it is absolutely inexcusable. Oh my...
I do not know what you mean with that, and what "rolling" would mean here.
I remember a long time ago I was stuck in a train in a field a considerable time because of a similar failure and conductor just wouldn't move unless green
I was expecting the same here, conductor is the first to die so just refuse until the idiots fix their system
A conductor always just gets a movement order. They are not able to assess whether the track is clear, that's the reason why the signalling system exists in the first place. How they get that movement order doesn't necessarily tell what the security steps were to back it.
Of course an attentive conductor can notice and mention there something being weird ("Doesn't the other train normally arrive first?"), but that's a rare lucky occasion, nothing to be relied on. And they just need to swallow the answer ("No, you go first today...") anyway.
> and conductor just wouldn't move unless green
The conductor won't ever move unless they get a movement authority, which most of the time is a green signal.
Theoretically yes, but in practice if you tell your boss to screw off multiple times a year because they don't want to spend the money to fix the base problem, you will be replaced or fired.
In some industries that is how they keep costs low while pretending they are being safe. They have alarms or procedures that say something is bad or wrong, but fixing some problems costs more money than it saves so they want them to be ignored, and managers will get angry and admonish you or eventually fire you if you keep following procedure and stopping to check problems. So eventually they build a team of people essentially trained to ignore problems. Which is why many oil pipelines still use ancient and unreliable leak detectors, they know those systems are unreliable and the operators will get alarm fatigue from the 200 false alarms, and that way they also ignore when a real problem happens, and worse case for the company they scapegoat the operator. They don't care that 2,000 gallons of oil leaked into the wilderness and poisoned the land if it would cost 2,000+ gallons of oil profit to shut down and repair the leak. They have a financial interest to not fix it.
If i understand correctly, it was green. Meaning the next block was indeed clear but the other train was stopped in the same block and there aren't supposed to be 2 trains in the same block. That's the disagreement between the new virtual system and the old system.
Why would they trust "a random blinking green light", but not a written and stamped order? Yes, they could do that (and sometimes it will actually prevent an accident), but it will be more being a snowflake, then being a decision for safety. A conductor is simply not responsible for whether it's safe to drive on a given track. Their equivalent is not a car driver.
The "random blinking green light" is generally more reliable
Being a snowflake here has 2 benefits:
1. Getting company managing tracks to fix the lights (they need to deal with angry customers and pay off damages for delays and more), so there's a direct path from unreliable lights to economic damage.
2. Avoid crashing and killing yourself and passengers on the offchance the person on the radio is a moron
> The "random blinking green light" is generally more reliable
Yes, but not because of the light itself, but due to the safety steps done before. Which should also have happened before the movement order in any other form.
As a train driver, you do not have the information required to distinguish these situations. If drivers simple refuse all movement orders, besides "green lights", running trains will become a rare occasion and the drivers will simply get fired for not doing their job. _The train driver is not the one who decides where a train goes._ For this safety-relevant decision a driver is (roughly speaking) nothing more than an innocent bystander.
You can think of a train driver more of the person who makes sure the automatic engine works correctly and also has an eye, that nothing weird happens. Most of your train driver education is knowing how the train works and how to get a broken train back working fast. In addition you also learn the safety protocols how you get the information in which state the engine should operate in. This is what train signals are, it's not really the equivalent of a green traffic light for car traffic.
In the UK at night it's walking pace. Literally. The guard gets out and walks and the train follows. (At least that was the case 25 years ago when I had a very slow train journey.)
If you're referring to "If the main signal is a (train station's) exit signal ("Ausfahrsignal"), this speed limit applies until the last set of points/switch has been passed by the complete train, after which regular speed is permitted.", I think that means "once you see a normally working signal again, if it's of a specific type (the exit signal), you still have to stay at 40 km/h until you have passed all switches.". As far as I understand the article, Zs1 is mostly intended for very local speed reductions, the kind of speed caution relevant to this discussion sounds more like the Zs7 signal.
It should not be possible for one person to make a mistake of this magnitude.
In case of a disconnected/off main safety system, the train should be limited on a hardware level to not be able to go over 40km/h.
If I read the description correctly, those hardware level systems were manually overridden, which should only be done in extremis. My guess is that this is going to turn into a normalization of deviance case, since such a cavalier attitude toward safety was unlikely to be one person's first time doing something so dangerous. There was no dilemma here and no time pressure.
Your suggestion about limiting speed after a shut down is a good one. On top of that, the rail operators should have spotted a trend of repeated safety system overrides and investigated why that was happening.
Exactly this was my first thought! I always thought highspeed trains operate under a model of clear sectors where one train is just allowed to enter when it was cleared by the previous train. From my layman point of view, those incidents point to a fundamental design flaw.
Reading the text it seems to me this is due to a very widespread issue in Spain and other southern European countries: people don’t care about the warnings because there are too many false positives.
That’s why people here, when they hear the fire alarm they just wait for it to go off: the probability that it is actually a fire is minuscule… but the alarm triggers a lot.
Not sure how to actually solve this… but I’m also not making excuses for what happened. High speed trains is not the same as a fire alarm in some office building, the people in charge should be held responsible somehow.
I'm a volunteer firefighter in rural NM. We have a commercial property close to us that repeatedly has false alarms on its fire alarm/smoke detection system, to the point where even the best of us are suffering from "the boy who cried wolf" feelings.
Because of this, I discovered that (apparently) NY Fire Department charges $5000 per false call on an alarm system directly connected to the dispatch system.
ABQ Fire charges $300/call for false alarms after the first three. It steps up to $500 after number ten. There is, of course, also the $25 annual permit fee for a reporting alarm system. Failure to comply with these fees is a misdemeanor. Just in case some local precedent will help advocate :)
Honestly it's remarkable to me to think that anyone ever gets to that $500 "excessive" tier, I've had one false alarm where the fire department attended in years of having an alarm system and I was mortified. felt like the biggest idiot in the world.
Sometimes code gets in the way. E.g. in the school I went to growing up they had to have firealarms in all kind of closets and storage rooms. We got at least once per semester a firealarm when some teacher went in to sort stuff due to the dust.
There's generally two types of smoke alarms each with pros/cons: photoelectrical which are very susceptible to dust and ionizing which generally are not:
I wouldn't think code dictated the alarm type. (I just replaced all nine sensors in my home due to age and went with all photoelectric this time and it was less than six months before I had my first false alarm. Never had any false alarms with previous ionizing type.)
"False" isn't really binary. In my condo building we used to have in-unit smoke detectors wired directly into the building alarm, which meant whenever anyone in any of 200 units burned their toast sirens were blaring. The smoke was real, it just wasn't a threat to the whole building. This would happen once a month or so, and because it's a highrise that sent the big ladder truck down our little street. The fire department got sick of this so we updated a few years ago to have heat detectors that are wired into the building-wide alarm but the smoke detectors only go off locally. False alarms have fallen to basically zero, but the downside is that for reasons not entirely clear to me the new system has to get inspected every 6 months, which includes making sure every one of 200 heat sensors is working, so we get days with 100s of very short bursts of the alarms twice a year.
In my aerospace days, our buildings had both ionization and temperature detectors, plus water flow on the sprinklers. Any detection would sound loud buzzers locally, but two sensors, or water flow, had to trigger before everything powered off.
That's common in big installations.
We once got an alarm because the heating element in a computer room air conditioner had turned on for the first time ever. It was defective and started to smoke. Smoke detection tripped, buzzers sounded, lights on a panel showed where the problem was, and alarms went off in the security control center. But this didn't trigger building evacuation or full power down. That took confirmation from a second sensor.
Someone ran into that computer room, saw smoke coming from the A/C unit, and pulled the big red power switch, installed by the safety people, on the air conditioner. Then we had time to shut down normally, the safety people came to clear the alarm, and the HVAC people came to fix the problem.
I kept the burnt heating element on my desk for a few days for people to see.
This is typical for big industrial plants. Bad stuff will happen, and you have procedures for it.
A tradie doing some welding in the kitchen I was working in some years back told me this as he disabled the smoke alarm (to prevent a false alert while he was welding): "if you set off a false alert on the fire alarm, quickly set fire to the wastepaper bin - it saves you from paying the false alert fee"
I learned this from my last landlord after I kept causing issues for the whole building by cooking bacon. The detector was installed ABOVE THE STOVE. It was cheaper for him to move the detector than to pay for the repeat call outs over a mildly smoky apartment due to my need for crispy almost burnt bacon…
I'm surprised the strata was able to offload that to you. Most building corps are in charge of maintaining the fire alarm system especially if it's a tower (rather than just a SFH community under a strata) where unit to unit spread needs to be addressed promptly.
Why? The goal is to incentivize property owners to fix broken systems not to pay for the actual cost of responding to a real call. That's covered by taxes.
> [...] not to pay for the actual cost of responding to a real call.
Not true for all places. There are places where the callee can be charged for the costs of a call and the owner of the building has to pay the firefighters (well, his mandatory government-issued insurance will pay). It's moving bills from one stack to another, but it's not free as in beer.
I'd interpret the "minus first N per year" to mean that you get a few "free" fires per year - but after that your habits filling your closets with oily rags, overloading electrical extension cords, and smoking in bed will start to cost you.
I'm sure someone somewhere will interpret it a 3 free demos of firefighters at home for their kid, with sirens and light, pretty entertaining (It's a reference to the Freakonomics study that, if you make parents pay by the minutes for being late getting their kid, they basically take the fine as a slightly expensive childcare facility).
I've deactivated my (EU equivalent of) Amber alerts the second they sent ONE irrelevant notification. It took me a few tries but fortunately they also tried their system a few times A WEEK during installation.
I prefer to risk my life every day at not knowing what the government thinks is really important for me to know.
It just means that a false positive rate is as dangerous as a false negative rate. Just issuing a warning doesn't come for free when you are designing a security system.
Any lessons in HPMOR are also going to be found in traditional works.
I was interested to find a discussion of the trolley problem in a book of out-of-copyright Norwegian-region folk tales (in English translation) that Amazon recommended.
Something similar is happening in my region after the flood that happened two years ago: The alarm was raised late; Now, even mild rain is triggering an alert.
Guess whats the consequence of that? Less and less people pay attention to the alerts.
What you mention makes me frustrated, as it also signals the infrastructure is so underdeveloped even moderate rain grinds daily life to a halt: kids don't go to school if rain is forecast. We need to elevate our professionalism in Spain and not accept African-level infrastructure in the 21st century. It's really sad within one continent we have countries producing AI and photon computing, and others can't even figure out how to put gutters and rain drains.
This is not what it is. The infrastructure isn't THAT bad.
Government officials are terrified of taking the blame for another Valencia style flooding catastrophe so any hint of rain blasts the mobile phone emergency system. Once the alert has been sent the officials can feel safe in the knowledge that they've done something.
And ES-Alert is all or nothing. All calm or end-of-the-world. There is no option to send moderate level warnings, the ones that can be disabled. It always uses level 1, even if EU-Alert also defines 2-4. Population can not act as filter like a farmer chatting with non-farmers and saying "tomorrow I have to move the cows because the warning".
To be fair, these messages we receive about impeding heavy rainfall links to the weather service which does group things into yellow/orange/red warnings, so you can see if it's actually so important or not.
But yeah, this is after the "EVERYBODY IS ABOUT THE DIE" sound alarm that triggers on everyone's phone at the same time, then you get see that they're warning about an orange weather warning, or something like that.
Is it ideal? Not really, but better than nothing. In Maresme-area we have serious flood-risk almost every time it rains, as it fucking pours when it rains, and the warnings seemingly actually save lives today.
Full alerts for everything create alarm fatigue. People will ignore them, like in the wolf tale. Maybe figure ways to disable it completly, level 1 too. Faraday cage as last resort, "let's sleep and to hell if I die".
Getting a maximum level message and then having to check another thing is not the best way to do it. The messages should be useful without further checking. In case of phone network overload, they can be the only thing the user can read.
Based in the description of levels for EU-Alert, Spain could be using it wrong. Evacuation orders are under level 2. Multiple levels are there to prepare people and give enough time in advance. It also means politicians should be less terrified to use it, as long as they use the full range avaliable. Not everyone will enable all 2-4. It will depend on how many times they are abused and how nasty the sound is for the minor levels... (checks wiki) same for 1-4 seems common... which is an oversight of the standard. EU should correct that, or all phone makers workaround it by adding a third setting for levels 2-4: on, off, on-without-scaring-user.
> Full alerts for everything create alarm fatigue.
Agree, I don't think any country has "full alerts" for "everything", Spain certainly doesn't, although currently they're over-warning for the rain rather than the opposite, as "the opposite" last time ended up in a large catastrophe. I get it.
> Based in the description of levels for EU-Alert, Spain could be using it wrong
Shouldn't you first read descriptions about how Spain is using it actually, before arriving at such conclusions? Seems you're building this point of view based on anecdotes, mine included.
In the spirit of what we're discussing here, shouldn't you actually validate and verify before you share this at large?
To your point, a contributing factor here was the front train couldn't start due to either a minor or bogus "security" alarm. Whatever alarm that was, it wasn't worth triggering such a tragic accident.
To be fair the Spanish word for security is the same as the Spanish word for safety: seguridad. It could as easily be a ‘safety’ alarm and a mistranslation.
I do not Spanish to assert whether it is true, but it is often said about German and there it is not true. I think the issue, that it is often mixed in daily speech, but that's true for English as well.
The fix is to do things right every time, and if we're losing money to false alarms, spend more money to make sure the false alarms stop happening. Make it a new persons problem rather than just making someone "used to it" and start ignoring it.
>The company itself is incentivized to ignore the warnings to keep things on track.
If ignoring an alarm and keeping it on track "counts" as having kept things on track, there's the perverse incentive. Change incentive to mean a train kept on track after ignoring an false alarm was worse than a late train.
Now the company is as focused, or more, on fixing the bad alarms, than keeping trains on time.
Finding incorrect incentives is usually not that hard.
A really important strike that Spanish pilots should do, is striking by respecting the red lights and refusing oral overrides. Hours of delays the first day, trains at the wrong place in the evening, we'd see exactly which regions are affected, and either we agree to repair things or we just leave trains to rot at the red lights rather than risking 900 people's life again (x2 trains = 1800).
Ultimately red signals due not fall from the sky. They are controlled by the same people that issue oral or written movement authorities. So focusing on just the oral movement authorities doesn't address the real problem. In the end it is the same signal in a different medium.
> That’s why people here, when they hear the fire alarm they just wait for it to go off
This literally happened to me last night, I was having dinner at my apartment, and suddenly I start hearing a smoke alarm, but not quite inside the apartment, I just kept having dinner thinking "bah, someone probably burned a toast".
Then it wont stop, I walk to door and hear people talking, still don't bother enough, wait a few minutes, then go out and my neighbor said "there are three fire trucks down there, I think it's a real one" hahhaha
The hallway was kind of hazy and smelled like burnt food, for sure... so I just grabbed my laptop and went out hahaa.
Because they don't get held responsible enough for bypissing procedures. Some system are too complex for fully automated operarions, and the human need to play along.
Safety culture is blameless, but only if everyone plays along.
Or, how about, issue a mandatory repair order and follow-up inspection for every false positive alarm that appears to be due to equipment failure. The follow-up inspection checks that the alarm has not simply been disabled.
The escalator failure in 2018 in Rome that caused severe injuries to 24 people was found to be partially caused by safety systems being disabled and overriden because they caused too many false alarms.
In a modern passenger rail control system[0], ignoring the warnings results in automated responses like dumping all the hydraulic pressure, setting all brakes at once. This will have two effects: (1) the wheels will slide on a fixed spot, grinding a flat spot, and (2) the operator will either require central control to remotely release the emergency brake state, OR the operator will have to continue at the safest (lowest) speed.
What I'm saying is: false positives should not be ignorable, and modern systems take that choice away (at least, just before the situation becomes unavoidable in worst-case analyses).
That being said, previous fatal accidents in Spain's high-speed rail have resulted in "primitive" uncontrolled areas between controlled areas. Those SHOULD NOT exist. You are essentially saying "lives don't matter that much here " ($/life).
I think aircraft are so safe in this regard because, essentially, they are required to use a single international collision avoidance system that is well defined. And modern cars have AEB systems built by vendors aiming for commonality to meet worldwide rules.
But train traffic systems seem to be a hodgepodge of different systems, perhaps locally grown and driven by the local vagaries of politics and rulemaking.
What a surprising inversion of expectations regarding safety.
I've been in a near miss in a plane: the pilot in the other plane was clearly inexperienced, not following radio protocol, and we got within O(200m) of a head-on collision which certainly would have been fatal for everyone.
Thing is, the sky is big. You can have non-fatal near-misses that everyone learns from. In trains they literately railroad you into a head-on collision when things go wrong.
I believe that aviation is safe because of standardization, but there's also just a lot more space to almost mess up.
The newest signaling systems, ETCS and related sibling CTCS, are quite standardized and interoperable across international borders, so this is an area the EU especially has been making big strides on.
I can't imagine what every passenger who survived and the families of those who passed are going through. Such a catastrophic incident with multiple human failures is so tragic and so needless. From the controller to the driver, every single one of them should have said hey we shouldn't just ignore a signal and should investigate why it's on first. For this to be such a quick decision suggests it's not a one off. I would be extremely interested to see how many near misses or ignored signals there has been across Spain. The crash earlier this year was due to inexperienced workers and it seems as if significant training improvements and protocols are needed.
To have had this many incidents compared to other HSR networks around the world gives all the signs of a classic case of normalisation of deviance.
Sadly we'll probably watch a lot of individuals being blamed/scapegoated for systemic issues, but hopefully even Spanish politics can organise a proper investigation after this many deaths in a single year.
If as a driver you get told by the control centre to get the train moving again at maximum line speed, surely you should be able to trust that it is safe to do so?
I don't see how this would fall on the drivers at all.
My thoughts as well. It appears that such signal failures happen so often that the controllers regularly let trains run through red under verbal authorization. I don't know the exact protocols, but I would expect a driver to ask for confirmation, as happened here, and then trust the control centre. However, there is clearly a huge systemic problem, with added complexity for the controllers, and there should at least be double checks in the control centre.
The person who controls whether the light shows red or green and gives verbal authorization is the same. It's both a tool, to transmit the same information.
A person saying you have a green light when you have a red light is not the same information at all. The probability that something has gone wrong and will lead to disaster is many many times higher.
The right move here would've been to accept the suggestion to drive the train, but not accept the suggestion to drive it at normal speed. The driver should have driven at 40km/h.
It's not a suggestion, it is an order and a movement authority. That would have been nice, but the drivers are not required to make such a decision. The moment you issue a movement authority, you must assume the train operates with the max speed and distance of it immediately, and that must be safe. Train drivers do not decide for the speed and trajectory a train is going to take. They are responsible for that their train drives safely inside the movement authorities given to them, they are not able and hence not responsible to ensure the safety of the network. They are more equivalent to a car mechanic, not to a car driver.
"not high-speed" != "not line of sight" High speed is the speed when you can no longer safely drive by signals, not the speed when you are not able to safely observe the breaking distance. Trains are not supposed to operate under the latter (normally).
Trust but verify. You wouldn't drive your car into a lake just because your satnav tells you to, would you?
As we also know from the aviation industry, controllers are human and therefore will make mistakes. A controller shouldn't issue a wrong order, but a driver also shouldn't accept an order they aren't certain about, and there should be technical systems backing both sides of that up.
It doesn't "fall" on the driver, but it doesn't "fall" solely on the controller either. It's a systemic issue, and many pieces have to fail for a disaster to happen.
You can't verify, the rail has curves and other stuff that block sight.
Also stopping distance for trains is huge. This video for high speed trains says 5km (3mi) https://www.facebook.com/Renfe/videos/%EF%B8%8Fcu%C3%A1l-es-... That is probably at full speed, but IIUC the accident was at half speed so the distance should be like 1.2km (0.8mi).
The driver tried to verify by asking a confirmatory question from the controller. So clearly there are in fact ways to verify, even if we can not achieve 100% certainty.
The driver also could have refused the order to drive at normal speed, and instead follow the protocol which caps speed to 40km/h in situations like these.
> The driver tried to verify by asking a confirmatory question from the controller. So clearly there are in fact ways to verify, even if we can not achieve 100% certainty.
Checking the same source is not a verification. (It verifies the order, not the ground reality.)
> The driver also could have refused the order to drive at normal speed, and instead follow the protocol which caps speed to 40km/h in situations like these.
I agree. It depends on the culture. I think airplane pilots have full authority to stick to the oficial procedure and are fully supported after that. I'm not sure what happens is a train driver there refuses an instruction.
The aviation industry operates like the railway industry ~1920 (somewhat by necessity).
> You wouldn't drive your car into a lake just because your satnav tells you to, would you?
You are assuming a train driver is equivalent to a car driver. He's not, the analog would be more a repairmen that you always take with you on journeys.
> From the controller to the driver, every single one of them should have said hey we shouldn't just ignore a signal
A train driver has zero insight in what is going on and where other trains are. They do need to trust the orders they get, if you want to question every order you will never start to drive.
No, he would get fired, because that's not his job. It would be like the machine engineer on a race track refusing to fix the ignition, because somewhere on the track he doesn't see, the asphalt might be broken.
The equivalent is a tower telling a pilot they should land and the runway is clear, except it isn't. And there also being fog, so you can't see it before it is too late. And you can magically not veer of. Planes can go around in three dimensions and try to rise again, a train basically moves in one direction, if they see the problem, it is way to late.
There is no point in the train driver making a decision about where the train goes, because he has no information for that decision. Hence it is also not his job. Like, yeah if he has reasonable reasons to think there is something wrong, nobody is going to fire him, but what is the policy that allows him to do so, while not just randomly deciding to not drive today? There is no difference for him, until he is about to die.
Pilots have the final say to refuse or stop a flight for any safety reason of their judgement... even if others tell them it is safe. And they are protected not by policy, but by law in doing so in the US and most countries.
But they also have the means to do so. If a train driver has a reasonable doubt about safety, nobody is going to punish them. But there is simply no way the doubts are reasonable, so it becomes just randomly doing otherwise, at which point the question is asked whether you are fit for the job.
I fail to see how following normal safety protocol of proceeding at 40km/h would have been indefensible or unreasonable? They are the rules of operation for this scenario and exist for the exact reason we are reading this story. I can’t think of anything more defensible than “I am not going to break safety rules”
Never would a pilot be reprimanded for refusing an ATC order to move their plane in a way that violates established protocols
I don't know, because there is no actual proper safety report yet. That certainly sounds reasonable, but obviously the dispatchers though otherwise. Likely because they did not actually understood that there was a problem, but that it's just that annoying bug again.
>No, he would get fired, because that's not his job.
Then what the fuck is this country even doing with trains.
No, no no, no no no.
Interlock safety systems exist for a reason. In any safety system where the interlock is down you do not resume standard operations. Ever. Why, because there is a book with blood that is 10,000 pages deep that describe the horrific accidents that happens when you do. Might as well be an axiom at this point.
>because somewhere on the track he doesn't see, the asphalt might be broken.
Again, stay away from analogies and safety critical systems.
The person behind the break and speed control of the train is no different from the captain of the airplane or the captain of a ship. They have full authority control to stop the train and refuse to move it until they are sure of the safety conditions. Any attempt to fire them should result in an immediate stop work from every employee in the system until they are put back on the job and the safety concerns are resolved.
> Then what the fuck is this country even doing with trains.
That has nothing to do with a single country. Above 40km/h you are not allowed to drive on sight in a lot of countries. I don't know how it is in Spain, but in Germany, you are also not allowed to drive via track-side signals above 160km/h. You can simply not decide about where it is safe to go from inside the train.
> Interlock safety systems exist for a reason
Yes, and that's a job of the dispatcher, not of the driver.
> In any safety system where the interlock is down you do not resume standard operations.
That might be nice in theory, but that has not much to do with reality. There is simply always something broken. It doesn't even need to be a signal, way more often a crossing doesn't properly report that it is closed.
> The person behind the break and speed control of the train is no different from the captain of the airplane or the captain of a ship.
Nah, it's very different. For one a captain or pilot can control the direction of the ship/plane. They can also determine whether their operation range is clear. A train driver can do none of these things. What's the point of making them responsible for safety if they neither have the knowledge, nor the lever to change things? Trains are more secure, because the driver is not responsible for the infrastructural safety, not less. That includes whether the track is clear or not.
The point of this discussion is that people blame the train driver or say "use self-driving", when that is not going to solve the problem, because that's not where the error is. The error is not there, *because* for rail making errors operating the train is not going to cause an accident (most of the time), which is not the case for cars.
The driver always has the final say on whether the train is safe to move. They are not just a button and lever pusher. They have to analyse whether the decision is correct. Hence why I stated there were multiple points of failure. The controller and the driver both went with full speed despite it being completely against regulation on a red signal.
I agree. But the decision whether all switches are locked in the correct position and that the track is clear, is not one that he is supposed to make and he also doesn't have the information for it.
> The controller and the driver both went with full speed despite it being completely against regulation on a red signal.
Going full-speed in the case of a red signal is not necessarily against regulation. Also the information of "red signal" or "you can go" is both a signal from the same source. There is no information for the driver to make a different decision over the dispatcher.
I can't comment about whether the current accident was caused by going against regulation, and more important by whom and against which. We need to wait for the proper safety report, not for a BBC article. If you take the latter at face value, it would mean there are clowns operating, which I am sure, is not actually the case. The real error is always way more subtle, otherwise it would not have happened.
> The train driver's job is to say: "it's red, I'm no moving, not my problem, you make it green if you want me to go"
A written movement authority is a signal as well in railway terms. It's more like "I don't trust your second traffic light, that you placed next to the normal one, because the normal one is broken".
The even more insane thing to me is that the controller knew that there was another train in that block, knowing it was no signal failure. The driving train should’ve never been commanded to continue on full speed by the controller.
Trains shouldn’t even be manually driven in 2026. We have self driving cars now which is a way harder problem to solve. Relying on a system of signals and driver attentiveness is archaic.
> Trains shouldn’t even be manually driven in 2026
Potentially, but the point is that signallers should physically be unable to allow trains to proceed, and drivers should physically not be able to override them. British signalling from the 1800s has physical interlocks; this isn't a matter of manual versus automatic train operation. It is clearly systemic.
LZB does cab-signalling and continuously supervises speed and braking curves. Combined with AFB it can accelerate and brake automatically to LZB targets. So regular operations are already partly automated (and have been for a long time). The system already doesn't rely on perfect driver attentiveness for safety. The driver should still watch the track ahead, but trains usually can't stop within line of sight anyway, so for separation we have to rely on the signalling system.
Drivers are absolutely still needed for other parts of the operation though, like working stations, shunting, and perhaps most importantly handling irregularities.
Faults can happen and you don't want the train to be stuck out on the track for hours. Instead, it makes so much more sense to either fall back to lineside signals (often accompanied with a point-based train protection system) or driving within line of sight.
Driving a train and driving a car are two completely different challenges.
If signaling worked properly then it wouldn't matter whether the train was driven autonomously or not, the "problem" becomes trivial. Establishing and continuously verifying that signaling is working properly is the hard part.
Without signaling you're limited to crawling speed just like humans are when they don't have any signalling .
Yeah, if you completely ignore availability as a problem. The state of the art self-driving technologies we have today only work in some conditions, some of the time.
The reason vehicles are still driven manually is because humans rely on transportation every day, all of the time.
We do not have self-driving cars in all environments that clear the necessary security regulation! Also the socially accepted number of deaths due to trains is way below that for cars. The current accident is just a Tuesday for car traffic. (Spain recorded 1785 road deaths in 2024[1], that's 4.9 per day) Detecting objects (and future objects!) on a train track is still a hard problem.
The current system is basically that the train is driven both automatically and by a professional attentive driver at the same time. Changing it to just the automatic system is going to reduce safety. Also the real world is way to messy to reach acceptable availability rates with only automatic systems.
Yeah, that's a solved problem. Did you even read my whole comment? I answered why "just use the system from self-driving cars" wouldn't work and in fact would be less safe than the current system.
What's the stopping distance of a high-speed train at full speed? I don't know, but I bet it's kilometers, not meters.
Detecting an object on the tracks 2 km away (say), as opposed to beside the track at the same distance, is in fact a hard problem. The tech used in self-driving cars is not going to solve it.
I'm totally not on the spectrum so I've only watched about 80% of the Plainly Difficult channel on YouTube, but if you want a painless and entertaining, if you're into that kind of thing, way of learning about train signaling and safety, and how safety systems have evolved, I highly recommend it.
Obviously train safety systems should be formally verified and eliminate human error (only permit safe leeway to humans).
But apart from the safety mechanisms, there is also the concept of securing passengers.
What we know so far is that originally, cars weren't equipped with safety belts, until they were.
Imagine a thought experiment: the trains are equipped with safety belts, on a voluntary basis. Initially everyone scoffs at them, except for a minority. Time passes until an accident happens. Then everybody learns that the forward facing passengers that were facing forward had the lowest casualty reports, next are the people facing backwards, since a decelerating train mostly just pushes them harder into their own seats, and their safety depends on the discipline of any occupant who happens to sit on the forward facing seat. People start preferring the safest seats forward facing with belts (you only depend on your own discipline). People sitting in a forwards facing seat who refuse to put on the belt will be asked to find a different seat or put on the belt. In many places it will turn out a lot of passengers are standing upright "by necessity" even though no law of nature or authority mandates or permits railroad operators to sell more tickets than they have safe seats. But first that would require figuring out what new lucrative job prospects can be opened for insurance companies, and any population around the world may think out loud why insurance on offenses appear to be legal and often even encouraged by court systems!
It turns out its never really possible to draw an objective line between accidental and intentional offenses, so at a fundamental level we should either permit insurance that covers you when caught committing murder, grand larceny or what have you (done); OR we should ban all insurance from covering offenses (accidental and intentional). Insurance "allows the system to stably continue without shocks reverberating through the economy in the face of adverse events" is a poor justification for permitting the insurance of offenses, especially since it typically results in the wrong questions being asked, and instead of figuring out who paid the least to insurance scams, perhaps some real questions could delve up real solutions that save lives instead of defend the income streams of lawyers profiting on the misery of civilians.
This accident seems to have been caused by human error. Moreover, (from the news) the working arrangements and procedures seem to be such that in the event of a controller (or driver) making a mistake there was no automatic failsafe protection in place to stop the Renfe train.
An automatic failsafe mechanism should be installed to stop/cut the power to the moving train in situations like this, it should work irrespective of any instructions or actions by the controller or the driver.
When safety parameters deemed the Renefe train to be travelling too fast and too close to the Iryo one it should have stopped automatically. Such safety measures aren't rocket science but straightforward engineering, (interlocks, etc.). Over the years there have been too many accidents in situations such as this for such equipment not to be installed.
For a moment I visualized myself in that busy control room and easily making that mistake even though I'd made the correct decision hundreds of times previously. Not only are 69 lost lives a terrible tragedy but the life of the person who made this momentary slip has been ruined forever.
It should not have been allowed to happen. It's worth remembering that Westinghouse brake systems (which are well over a century old) automatically default to on (stop) when there's a fault, and the high speed (now decades old) Shinkansen has very sophisticated stopping mechanisms and has never had a major crash. The question is why such safety measures weren't installed here.
Fundamentally I don't know what the cause is, because there is no full safety report yet, but I doubt that it was a driver error alone, which is what automatic braking systems at signals are actually targeting.
There are situations where the dispatcher needs to instruct the driver to ignore the road signals and hence also ignore the automatic enforcement of the signals. It shouldn't happen to often, but the real world is always more messy.
Some were installed. But what wasn’t there was the old mechanical ones that cannot be overridden, like ATS that blows the air if you pass a red signal.
I still don't know why the train drivers don't have a simple data:
The distance to the train that is next in in that railway in its direction.
With this information, that accident will have never happened.
The LZB system, which broke down, had the data you describe. It knows when trains pass over fixed sensors so it computes where they are, and sends data packets to specific trains informing them their current speed limit, and the next, and how far away that is. If the driver won't slow down, the train will.
When LZB broke down, they had to switch to their other system, BSL (fixed block signalling: https://en.wikipedia.org/wiki/Automatic_block_signaling). You can then know the distance to the next block, and if it's occupied or not, but not where the train is inside the block. You can only guess.
In the next few days we'll likely find out if the control centre also fucked up the block signals...
BSL knows there two trains are in the block, two have entered and none have left. When LZB is running, it overrides BSL and allows both the trains in the block. But with LZB down and BSL taking over, it should have raised alarms everywhere that there two trains in a block.
They do, in an extremely expensive system called ETCS, which everybody is aiming for but it takes a huge pile of money and years of work to ever get there. Which is why a huge portion of rail networks don't (yet) use it.
The issue is not the idea, it's that railway signalling systems have to be an interoperable, multi-vendor, tested and accredited pile of little ideas like this, that have infinite numbers of ways to go wrong and have corner cases by the metric ton. And it's not like coding a website, where you can just ignore standards and focus on your case. "Your" rails need to support other people's trains. "Your" trains need to run on other people's rails. Even in a fully closed system with your trains on your rails... who's going to be your equipment maintainer and supplier for the next 30-50 years of their operational life?
Read this article and notice how often cost and project overruns are mentioned:
> The use of ETCS is driven by deliverables, not the technology but concerns exist as to why it is costing so much. In Europe, the success of ETCS is driven by country mandate and a system authority which helps to create a stable ongoing work plan.
> There is also the question of strategic safety versus functional safety, namely fundamental versus site specific. Over-specified ETCS undermines the strategic safety and functional over scope and so drives unaffordability since the accreditation inflates the cost.
> Cost must be driven out of ETCS if it is to be the preferred system for ongoing renewals. Despite interoperability requirements, there is risk in always using the same supplier. There is no common way of delivering ETCS. Having it as an overlay system will always be expensive and not beneficial to the business case. Lessons have been learned from the application of ETCS to the Cambrian route, the Thameslink central core, and the Northern City line from Finsbury Park to Moorgate but all of these have only one type of rolling stock in day-to-day operation. Equipping a mixed traffic railway as in the ECML makes it much more difficult.
TCAS has solved this for airplanes. It wouldn't take much to modify the system for trains so that, in the least, it notifies when an unexpected train is nearby. A little more logic could allow it to verify which track each train is on.
1. Planes can determine their altitude. Trains don't know which track they're on. You'd have to re-engineer existing signalling systems designed around the inverse. Track transponders and axle counters know which trainset passed a specific piece of track, but the trains don't know which track transponders link together on the same track. They don't even know which track they'll be going down next because that's up to the signallers controlling the points, not them.
2. Planes fly in the air and can send omnidirectional radio signals with little to no interference. Trains run on the ground, often in valleys and tunnels. There is no guarantee that trains broadcasting "I am here" signals can be picked up by the next train within the stopping distance.
Many trains did broadcast "I am here" signals, but once speeds got faster, the broadcast range (about 1km) wasn't far enough for a train to stop in time before a collision, which is why trains need to communicate, using on-track wires that run the length of the track, to each other and central control. Which therefore means that the central control system needs to work, and when it doesn't, the trains have to stop.
Planes use radio signals because they don't have signalling cable following their entire route. Trains do, and it's usually much more reliable than radio.
Obviously it wouldn't be "just" GPS. In the simplest example - if I choose to add a friend to "Find my Friends" on iPhone, both our locations are visible to each other via GPS when our phones are on.
... via mobile data or WiFi, you mean. Whether it uses GPS, Galileo, track measurement points, or even "driver calls the control centre to update their position" doesn't have much to do with it. What I assume you mean is redundancy so that two or more systems can communicate train positions independently, where the more relevant problem is how to get the data across in a timely manner. The driver of the stationary train called in their position and it wasn't used: it's a communication problem, not a "where am I" problem. Idk why the focus on GPS and using GPS for communication (which GPS can't do, and newer systems only do at very low speeds for emergency communication) but finding one's position is usually not the problem
This isn't as simple as a Disney monorail. There can be many tracks, multiple routes can share some segments of track, trains can go from one track to another, tracks can be stacked on top of each other on some bridges and go inside tunnels so GPS/GNSS is insufficient, the train in front of you can stop for emergency, etc. It's like the aeronautical collision issue, but the tracks are in charge of determining and transmitting position.
General case, it's not that simple. Say there's another train a mile ahead of you...but it's on a siding. To compute the effective distance, you'll need to know the positions of the switches connecting the main line to that siding. And switch positions can change far faster than you can stop, even if the other train doesn't move.
I would actually sit in front now. Sometimes you would be able to still get vital information and being actually able to act. But the safe decision would be no to enter the train.
> But the safe decision would be no to enter the train.
You might just as well never leave your bed, that's even safer ;) Train travel is much safer than travelling on roads, and in the same ballpark as commercial flight.
Human override could have 2 keys that get turned concurrently at two locations by people who never meet each other, never talk, each has different job incentives.
This was a terrifying read because I initially read about this at the air port in Madrid after taking a Renfe train from Alicante; literally at the same time...just a different line
The main problem comes from under maintenance. I am spanish, we have known this for years.
15 or 20 years ago when I took the train it worked well.
Now there are more trains and they increased the traffic like by 70% if I am not wrong and the budget for railway infrastructure by only 17% and it seems to not scale well enough, for whatever reason I do not know all the details.
There are a lot of railway tracks that are not in good state so speed must be lowered. There are incideents and delays routinely, all the time.
This did not happen until like 10 years ago and it has gotten worse and worse since then, not only in high speed trains.
The roads is a mess also: 52% of infrastructure for roads has bad or very bad defects in it.
The thing is that we have a record in government incomings and the services, ALL of them (healthcare, roads, infrastructure...) slowly collapsing.Part of the money is not going to the right places. I think that nearly 40% of the budget goes for retired people. We have 9.5 million pensionists in Spain.
We have to change that system and rationalize government spending and welfare or eventually everything will collapse.
I’m very wary of finger-pointing like your comment that ultimately serves to advocate for cutting quality of life for citizens.
Roughly 31% of Japan’s budget goes to social security. They don’t have problems keeping their high speed trains safe.
Cutting pensions won’t make trains safe.
I will also point out that on its own without further context, a high percentage of government spending going toward something doesn’t make that spending irresponsible or misappropriated. In the United States, a very high percentage of federal taxes are spent on Medicare and Social Security. But it should come as no sirprise that a very large percentage of federal income tax revenue is directly appropriated to pay for those things.
Pension expenditure in Spain is out of proportion from any point of view, though. I'll provide links to some graphs because I think they give more information than my words could:
So yes, the reason why we are underinvesting in pretty much everything is basically pensions. GDP is up, tax collection is up, debt to GDP is sligthly decreasing... but pension expenses keep growing at a fast pace so there's less and less money for everything else. And I say this with both of my parents earning the maximum pension, so I don't have an axe to grind, but it's just reality.
It's a trend that is pretty much inevitable for a country where birth rates have been dropping starkly for decades, so that less people generating the taxable income that pays for those pensions enters the workforce, than those who leave it.
I agree it's hard or maybe even impossible to entirely fix the problem, but there are degrees. You can at least try to mitigate it. And this is not done in Spain even in the slightest.
Check the charts above, pensions have been strictly updated with inflation in the last decades, while salaries (including both public salaries, fixed by the government, and private ones) haven't.
If salaries losing purchasing power haven't caused widespread riots, surely pensions doing the same wouldn't, and the impact on the budget would be noticeable. Of course, it would cause the party in government to lose votes, which is why it's not done.
I am not suggesting cutting down pensions. My own parents are pensionists... so that you get an idea.
I am giving an objective explanation in all honesty: Spain needs a pensions reform probably at some point bc it is 40% of the expenses in the yearly budget, with a deficit and a demographic deficit. This will explode.
If it can be taken from elsewhere, better.
But you know how much are pensions in Spain and know our pension system in detail (it is literally a Poncy system...)? They are often higher than people working!
Whether we like it or not, we need to reform or collapse in the future. I wish it could be taken from elsewhere, but 40% is a lot...
There is a lot of useless expenses in public work in our "federal system" (comunidades autónomas).
I'm not sure this article really points at government debt or spending as being immediately obviously relevant to this accident. Of course, it's probably too early to say, and that again makes me question why we are talking about pensions.
I agree that good reforms that involve realistic budgets and high levels of accountability are very good things. However, I encourage a lot of caution and skepticism around ideologies that inevitably lead to cuts to benefits.
The USA's pension system replaces a lower percentage of the average wage than Spain's system, and its universal healthcare for pensioners has higher exposure to out of pocket costs. Despite this, the debt to GDP ratio in the USA is higher than Spain, and there is a grand total of one government-operated high speed rail line which is barely high speed despite being 5x more populous.
That's why I encourage caution: cutting pensions won't necessarily lead you to better outcomes, it might just leave you to cut pensions with no improvement in other areas.
I know you are not suggesting cutting pensions directly but what I'm saying is that these types of comments contribute to people "voting against their own interests" so to speak.
Japan is a terrible comparison here because their rail network is privatized. They're also paying their pensions with debt, and their economy is really stagnant and not a shining example of a country doing well with a pension burden that high.
> They don’t have problems keeping their high speed trains safe
Their trains are safe, but they also have 2X the national suicide rate as Spain, which amounts to about 17000 more deaths per year. I'd attribute a big chunk of that to their work culture treating people like machines, whereas Spain's work culture tends to lean towards treating people like humans.
That isn't an excuse for railway mishaps, of course, but I'm just trying to de-romanticize Japan as some kind of magical perfect place. It's not. They might have gotten their railways right, but they have massive safety issues around mental health.
Not saying maintenance isn't a problem, it probably is. It's a problem everywhere in Europe. Have you seen train service in England, Germany or Sweden? Absolutely terrible, compared to just two decades ago.
But under-maintenance causes trains to stand still and be late. It does not cause them to crash.
Crashes are caused by running at speeds higher than the (under-maintained) rail can support, or (against all rules and every regulation) no cap on speed when the signalling system is down.
The latter can not be solved with more money and resources. It is a culture problem. Rules can not routinely be disregarded for arbitrary reasons, especially not when they are completely in line with common sense.
The rumor is that staff is being pushed to restore service as fast as possible after a problem is "solved". EU push for green transport and privatization means lines were opened to competition, increasing the number of trains compared to some decades ago when only one operator used them with less trains than it does now. IIRC currently the lines have two operators (3 in some places?), meaning that traffic more than doubled. Those in power do not want the service to have more delays. And instead of updating and maintaining the infrastructure, Adif stresses it even more, both in the technical and personal fronts. Thus the accidents. But nobody at the top resigns, blame low level scapegoats instead.
The Iryo train was stopped and unable to restart, because it's safety system did not allow that until the signalling issue was corrected. The AVE was commanded to move again like normal (200 Km/h or more). When the Iryo reported to be stuck, all the trains in the line should have been notified to stop once more, or go at line-of-sight speeds (40 Km/h). Both options are bad for delays. Current news is that five minutes after the Iryo call, the AVE rammed its back at 160-200 Km/h.
CEO of Iryo company complained 3 weeks ago about LZB being problematic, their trains taking a long time to recover connection. Safe but old, he said. It should have been replaced by ERTMS by 2024-2026.
> When the Iryo reported to be stuck, all the trains in the line should have been notified to stop once more
That would have meant that the dispatcher would have been aware that they already ordered a collision before. If a train stops no accident will happen, unless it could have happened regardless. Yes, such a decision would have prevented the accident or lessened it's impact, but the absence of it has not caused it. The error was already done before.
What do you mean? "Everyone crash now"? Makes no sense. "Tried to solve"? There was no collision before.
The situation seems to be that they stopped the trains due to a problem somewhere. When they thought it was solved, they commanded all of them to move again. And when one reported to be unable to do so, they failed to stop those that were around it. Or that is what the leaked conversations suggest. Do not discard this was tactical leaks to blame a scapegoat. The newer system should be running.
I say around, because news mention that a third train could have crashed into the wreckage of the other two. It was moving in the other direction, towards Madrid. Luckly it stopped when the electricity failed. It would have been like the accident early this year, when a train hit other that just had a derailment.
> What do you mean? "Everyone crash now"? Makes no sense.
If you (as a dispatcher) order a train to drive into an occupied block, you ordered a collision, independently of whether you notice later and call for an emergency stop in time, or someone else notices and prevents it.
> And when one reported to be unable to do so, they failed to stop those that were around it.
That's not what was the problem, they wouldn't be required to do that. Any train is supposed to stop at any time, without you having notice of that. It's completely normal, that you do not call for other trains to stop, if one train reports that it stopped.
In order for them to think of the conclusion of "first train stops" -> "shit there is another train in that block", they need to be aware that they told another train to be in the same block, before the call. Ordering a train to drive into the same block as another train, means ordering the trains to collide. So they would have to be aware that they ordered a train to collide into the other prior to the call, in order to arrive at that conclusion.
> The newer system should be running.
A newer system would not solve anything here. This exact failure case exists in every system that has virtual blocks, which is every new system. If you are looking for scapegoats, THAT is one.
Deterioration started long before that, according to my sources it started on 2008, but yeah, last 5 years or so it has gone worse. The budget for it has been increasing year by year. It seems that the main problem is not just lack of maintenance but that there's more traffic and new construction.
Pensions is 13%PIB which is on the European median.
The problem is demographic. Also take into account that retired people have paid for their retirement.
Your rhetoric is not what I'd like to be promoted as the first answer entering. Just reading the title of the news I knew what kind of messages I'd see promoted.
It's a bit more complicated than that. It can be argued that if there is a clear link between contributions and pensions, promised pensions based on past contributions are private property, with the usual protections. I don't know the situation in Spain, but Finland at least has made that choice.
If you choose that (or if your legal system determines that), you need to be proactive with keeping the pension system in balance. While you can change what you promise in exchange for future contributions, substantial changes to what you have already promised can easily require constitutional amendments.
The argument is ultimately constitutional. If pensions based on past contribitions are private property, the government can't avoid paying them when it's no longer economically sustainable. The obligation remains even if the government is no longer capable of honoring it. Political choices and ordinary laws can't change that. The only way out is amending the constitution and socializing the private property.
Over here in Finland our road infrastructure sucks too, and pensioners take lion's share of all the resources. Yet our trains aren't crashing. There's something wrong with systems and safety culture in your railroads. Bad maintenance doesn't cause trains to crash into each other if proper procedures are followed.
Still I agree, pension systems in most EU countries are unsustainable.
Not every city needed an airport, nor every roundabout needed to be decorated with sculptures. Everything that is needed for every place, like software for health care or judiciary, should be contracted at the national level, not 17 times at the regional one.
And pretty sure that if some stopped pocketing 3% of public contracts, or whatever amount is now, competition among companies would be better and money would achieve more.
Is there an international consortium for best practices in high-speed train control? Surely there are countries that have good systems in place, or have benefited from knowledge-sharing. I have to believe these train systems were built with outside help and then organic improvement or the opposite. Spain, talk to them.
The issue (at least in Europe) is that there are too many historical train control systems. There are more than 25 different, non-interoperable train control systems currently used across the European rail network.
That's where the EU came in and developed ETCS (https://en.wikipedia.org/wiki/European_Train_Control_System) as a modern alternative. Unfortunately, the EU doesn't have the legislative power to force member states to adopt it and also not the money to bribe them. So ETCS is still competing with the legacy systems.
However, the reason for that crash apparently was the dispatcher who greenlit the cab driver to go full speed ahead after the train control system on that track had crashed even though they knew that another train was reporting that it was unable to restart and get going. Procedures in case of a train control outage are clear: all trains can only move at a max speed of 40Km/h - slow enough to drive and brake on sight.
Instead, that train crashed into the stationary one coming from 200Km/h
> the dispatcher who greenlit the cab driver to go full speed ahead after the train control system on that track had crashed even though they knew that another train was reporting that it was unable to restart and get going
Apologies in advance for what may be a pedantic and possibly dumb question, but is there a failsafe or guardrail against such forced errors?
Not if drivers switch to full manual control. For the ETCS control system:
- in normal mode (Full Supervision) the driver's actions are monitored and unsafe operations lead to an emergency brake
- but there is a fully manual mode (Staff Responsible) which does exactly that - the driver is fully responsible for what they do. If they get bad instructions from the control center, no technical barrier against crashes exist.
Older systems like LZB usually are even more permissible.
The contract to make the line ERTMS compliant was published in 2020, with 2024 as completion target. Errors meant it had to be offered again, pushing it to 2025 and then 2026. The crash could have been avoided.
There's definitely international communication, LZB is a German signaling system and the intended 40kph speed limit after system restart is common across Europe.
Off topic I know but, the BBC has adopted this clickbaity title pattern of “what we know so far about x” for the last year or so and it really jars me. Especially when x is very serious and involves people dying. It’s like an amateur tictoc’er is in charge of headlines at the moment.
>In one recording, the controller tells the driver of the Renfe train to disconnect and reconnect the LZB mechanism that monitors train speeds, and then resume the journey at normal speed.
Wait, I thought Spain's high-speed rail network was all ETCS L1 or even L2?
They don't all use ETCS. Madrid–Seville still uses LZB and Adif awarded a contract in 2021 to upgrade it to ETCS L2, but the project is delayed/unfinished
it's a matter of budget and political will. Spain simply cannot afford all these train lines, and the system fails. But hey, we have high speed train between Villacojón del Caudillo and Cagalera de la Reina, because they happen to be aligned to the center of the country (Madrit). These railways make no economical sense, they were built for political reasons, to support a "radial" concept of the country that does not really exist yet.
Meanwhile no high speed rail between València and Barcelona, because that would somehow erode the power of the central elites.
It's incredible the minister didn't resign after the January crash and I doubt he will now either. I understand that perhaps the problem started in the control centre but surely at the end of the day the minister is responsible - they don't get paid a fortune just to pass the blame on to the workers.
"Bottom tenth: up to €12,018 a year.
Bottom quarter: up to €17,457.
Median: €24,497, or €2,041 a month divided by twelve.
Mean: €29,540, or €2,462 a month.
Top quarter: from €36,970.
Top tenth: from €52,515.
The mean for women is €26,905, for men €32,058."
I fail to see how the two accidents, which seem to have very "down to earth" explanations (maintenance failure by workers, protocol override by operators) are being assumed to be a political responsibility so quickly by some and asking for the minister resignation. Now, two in a row seem to point to systemic issues. Is this responsibility of Adif or Renfe? maybe those state companies have to be thoroughly revised. is it due to lack of funding? maybe taxes should be raised, or money diverted from somewhere else (though seeing the spanish budget, it's hard to tell where from, both teachers and doctors are currently protesting for lack of funding). Maybe it is, in the end, a political directive that should have responsibilities declared in the executive. But seeing so many interested parties jumping to that conclusion literally hours after the crash means it's not done out of any reasoning but political animosity
> are being assumed to be a political responsibility so quickly by some and asking for the minister resignation
It sucks but that's how it is over here. It's "my" party the one in power when a catastrophe like this happens? It's not the politicians, it's someone else. Is it the "other" party? Surely the politicians are ultimately responsible.
The BBC keeps repeating this inaccuracy and at this stage I wonder if it's deliberate:
> The driver replies, "At normal speed?" To which the controller says: "Yes."
That is not how the conversation went. The driver reads back the order from the controller, saying "at normal speed? Hm okay agreed / understood" then the controller starts wrapping up the conversation
ie the driver did not really question the order and it was barely a questioning tone (I write without judgement)
You only need intermediate Spanish to understand that part of the clip. The BBC has no excuse to be honest as I'm sure they have plenty of native speakers on hand
Whether it's a material difference I'm not sure, but the BBC should be more accurate
"the collision occurred after one train stopped on the line unexpectedly due to an Automatic Warning System fault causing it to brake. It was then hit from behind by the second train that had passed a red stop signal protecting the stationary train in front"
The train collided rear-end into the rear carriages of the other train and derailed, which also resulted in the three rear carriages of the first train to derail
- This was Białośliwie train collision (Poland) in June 2026
Why isn't there basically adsb data for trains?!
They can broadcast speed and position. Other trains can then see things ahead on their track. This seems like a solved problem so I must be missing something obvious.
- trains go in tunnels or tracks are between houses. When train control systems were defined in the 1990's, there was no way to make them sensitive enough to record GPS positions. Instead there is a different location system based on so-called balises with a fixed position on the tracks. Every time a train crosses one, it knows where it is.
- Planes go in 3 dimensions, trains in one. If ATC wants to ensure two planes do not collide, they will assign them different headings and/or heights. Precise position isn't that important. Trains cannot avoid each other, that's why they move in blocks.
And yes, they do signal their position back to the control center, it's just a different protocol
Modern signalling systems are basically adsb for trains. (ETCS is the modern standard in Europe, this line was using the older German LZB). Problem is that they can, and do, fail. And when that happens too frequently (as it seemingly has been in Spain due to a lack of maintenance), its easy to get sloppy on the manual handling
Safety systems don't help much when they fail themselves. E.g. usually there are automatic systems in place that prevent that two trains are on the same rail network section at the same time, but this system apparently has failed. Details are in the article.
This event was pretty chilling for me because I just took the Renfe line from Seville to Madrid a couple of weeks ago while visiting Spain. I generally like to think that I have a pretty good instinct on relative risks and make reasonable decisions based on that. This time around, between the incident earlier this year and this most recent incident, depending on how you interpret and apply the statistics (of course that's always up for healthy debate), it looks like it would have actually been safer driving between Seville and Madrid. That's a pretty low bar in terms of safety!
I set my favorite agent on the task (Opus 5.5 in the Kagi Assistant), and given the two rail crashes in Spain this year, these are the stats it came up with for "chances of dying" via various modes of transportation between Seville and Madrid:
* EU high-speed rail, long-run average: ~1 in 36 million
* This rail line, counting both 2026 crashes: ~1 in 400,000 to 1.2 million (prior to the most recent crash it was 1–3 million; now ~2.5× higher)
* Flying with a European airline: ~1 in 80 million
* Driving: ~1 in 1 million or worse
Of course this is hindsight. Heightened awareness of risks, higher propensity to overreact to anomalies or alarms, procedural changes, and so forth in the wake of this second crash might push high-speed rail in Spain to be higher than the European average in the future.
Ask it to look for high-speed train crashes globally over the past 15 years (to include the 2013 one in Spain as well) to be honest I don’t remember any HS accidents other than the three in Spain so, odds or not, I am NOT taking a high speed train in Spain ever.
> I am NOT taking a high speed train in Spain ever.
You're still much safer taking the train than a car, even in Spain, even in 2026. So good luck flying everywhere, as that seems to be the only safer transportation mode :)
And even when taking the car in Spain, you're about half as likely to be in a mortal accident compared to taking the car in the US, so depending on what you're comparing with, you might be safer in Spain regardless of what transportation method you use.
The following is hypothetical, since we do not have a proper safety report yet.
It sounds like the issue happened, because there was an error in the line-based train control system (LZB), which led to falling back to the point-based train control system (ASFA). However since there are more virtual blocks in LZB, than physical blocks in ASFA, this means that suddenly more than one train is in one block, which violates the most basic assumption of train control. That requires the trains to not rely on the train control at all, even if it says that the block is clear, but instead are operated manually.
I do not know what the proper procedures for that are in Spain, but in e.g. Germany that seems to require driving by sight. However that is also only after a number of accidents due this situation. So the following seem to be similar accidents from Germany:
- https://de.wikipedia.org/wiki/Eisenbahnunfall_von_Meerbusch-...
- On April 9, 2002, a near-collision occurred near Fallersleben. After a computer at the LZB control center in Fallersleben crashed, two trains on each of the two main tracks came to a stop. When the computer was restarted, the rear train in each pair was signaled a speed of 160 km/h, while the front train in each pair was signaled 0 km/h. One of the two train operators following saw the train stopped in front of him; the other, as a precaution, contacted the operations center, which warned him not to proceed.
From reading only the linked BBC article, I would come to a totally different conclusion. That would sound like more of a dispatcher ordering a manual operation of a train, without having assessed the situation correctly. While yes, this happens (https://en.wikipedia.org/wiki/Bad_Aibling_rail_accident), this happens on minor single-track lines where the dispatcher starts playing games on his smartphone full-time due to being bored, not on a major high-speed line. Also the issue with LZB doesn't fit into the picture that the BBC paints, neither do the many people involved, so I will prefer the theory mentioned above. Also that seems like a "reasonable" "sufficiently not-obvious" error to make, given the line and attention.
My question is, why is driving by sight with speed limited (40 kmh afaik) not something that is enforced by the train itself when there is no connection to the other controls systems. How is that not a hard limit instead of something the train operator needs to remember?
Just inferring from GP, it sounds like the line was in an illegal/invalid state. Couple others are pointing out that the newer LZB system have much smaller block sizes than ASFA system it fell back to. Which means there were likely multiple trains under different LZB blocks occupying same ASFA blocks. That is a crash state, and train safety systems aren't designed to offer safe and normal operation of two already-crashed-on-paper trains.
What they needed to do was to move ALL trains around until the initial state is in a valid configuration under the ASFA system. Probably like moving one train at a time at <40kph so that there is minimum one ASFA block, which might be tens of miles or however long they are, between every single trains on the line. Then the whole operation could be switched to ASFA system at full speed at much reduced capacity. It also means the train more or less wouldn't be moving for the rest of the day. Not only passengers would be angry but there will inevitably few that needs to be hospitalized for things like mild dehydration and sometimes small injuries if they needed to be evacuated.
What likely happened was that they didn't think about any of that at all, and just hot rebooted into the ASFA system without deconflicting anything. The ASFA system signaled ok to proceed to all trains sharing the same ASFA blocks to their next vacant blocks, not knowing that some of blocks were occupied by multiple trains before humans put it online, which would be an out-of-question horrifying hypothetical to the ASFA computers. And when the system ordered a train in the block to stop because a block in front was occupied, there were in fact two trains in that block, one still driving towards the one in front at 160kph, far away from the stop signal, and two collided.
> of two already-crashed-on-paper trains.
Exactly.
> Probably like moving one train at a time at <40kph so that there is minimum one ASFA block
If you tell the drivers to move by sight (also <40km/h), you can tell them to all move at the same time, because "by sight" means that the drivers themself can observe objects in their track. They essentially start to move like cars on the road, which they normally don't. Normally a driver does not have an obligation to verify that it is safe to drive somewhere, but then they do. It does not mean that the trains actually move at 40km/h, they can move at 1km/h if that what is required in order to move the train by sight. 40km/h is just the maximum after which it is deemed unsafe to move a train by sight even in the best sight conditions.
> Not only passengers would be angry [...]
I doubt that was even a consideration, that would mean that they would have been aware they ordered a collision, but rather:
> What likely happened was that they didn't think about any of that at all [...]
Yes.
Note, that in a similar fashion as I stated in another comment (https://news.ycombinator.com/item?id=50299422), if you compare the speeds using friction, 40km/h on a train is equivalent to 300-400 km/h with a car on the road.
The thing that is enforced by the train when LZB goes down, is that the train stops. This seems to have worked correctly. Bringing a train from a stop to movement again is a potentially unsafe situation, and the situation is that the automatic system can't get movement authorities, so no safe system is going to do that automatically.
I understand that, but why can't the train self-limit to the 40kmh that the law requires when the security systems are down.
a) It does self-limit to 0kmh.
b) In a point based train control system, communication only happens at specific points. That's why it is called this way. On it's own it is safe, because in order to do anything non safe, like passing a red signal, you need to pass such a point. In order to violate a speed limit, you would need to pass the start of the speed limit, which also is such a point.
If you operate a line based control system, you are constantly making collisions from the view of the point based control system. The moment the line based system breaks down, the point based control system takes over and the only safe choice to do in the case of a collision is to immediately stop all trains. That's exactly what it did.
ATCs will have outages or drops all the time. you don't want a train to suddenly lurch down to 40 kph because of a blip. cellular coverage in Europe is pretty good but not perfect -- and it's an even bigger problem in N America.
likewise you're not going to be using Automatic Train Control in yards, sidings, or terminals, and you may need to get up to speed sometimes to move across a big yard.
manual mode lets the conductors and traffic controllers make those calls.
and it's "not something they need to remember" -- it's 40 kph or whatever the track is authorized for under ATC.
Train control in Europe doesn't really use wireless communication. Emergency calls do happen over radio, and a movement authority could be transmitted, but the continuing enforcing does not. Also I am not aware of there being ATC in general railway in Europe.
But if you replace ATC with train control in general, then yes, I agree.
afaik, Shinkansen does strict hardware enforced 30km/hr for manual mode. It cannot be overridden.
In spain the procedure calls for driving by sight. There was a third train coming that stopped because the driver ignored the command to drive at normal speed and drove by sight.
The real issue is that the LZB fails often enough (installed back in 1992 and due for a phased out in favor of a newer system last year with the contract awarded and no work yet started) that the only safety assurance is the person at the command center issuing command flawlessly, which is not sustainable as it can be seen.
Iryo CEO said a few weeks back on a congress hearing that every time the LZB goes out, their trains are completely stopped. This must have slipped the central command resposible's mind as it was ordered to everyone to just restart the march, but the Iryo just couldn't.
The most that is supposed to happen when LZB goes down, is that the capacity of the line is reduced and there are delays. LZB is not the only train control system.
> ordered to everyone to just restart the march, but the Iryo just couldn't.
Railway protocols operate under the assumption that any train can stop at any time immediately (not even with a braking distance) without the dispatcher noticing. You need to have the information of complete departure of the previous train before allowing the next train to move. If the first train would be able to start, it would still be pure luck if there wouldn't have been a collision.
The newer system (ERTMS) is installed already and tested, currently being certified for operation. So yes, work was done on that front.
It is not more secure per se, replacement is done as part of LZB being phased out Europe-wide.
So to explain the used terms more: Most train control systems operate under the assumption of a fixed block. The whole network is separated into blocks, there can always be only one train in a block. Each block is protected by a signal, there must always be a red signal separating one train from the next, and there are sensors that detect when a train drives in a block, when it drives out of a block and how many carriages (train integrity is important too).
For point based train control systems, operation of a train is only enforced at every signal (and on the way in approach at specific points), this means e.g. that a train does not run over a red signal, does not drive faster than the maximum speed, and has acknowledged speed limits.
For line based train control systems, that supervising happens continuously over the whole track.
Since the physical signals and sensors are expensive in installation and maintenance and railway capacity depends on the number of blocks on a track, line based train control systems support virtual blocks. This means that the signals and sensors are not physically there, but simulated by computers (on the train and signalbox). From the view of the point based train control that means multiple trains are in a single block, because it does not know about the virtual subblocks. When a train is running that only supports point based train control it can only use whole blocks, so the capacity is simply reduced, but it is still safe, because every physical block is also known in the line based control system.
When the line based train control system stops being in use, the fundamental constraint of the point based train control system is being violated: there are multiple trains that are in a single block, and hence not actually protected by a red signal in between. This means that you must ignore the signals until every train has crossed at least one physical signal.
(This is speculation:) It seems that that the operators assumed that there is still a safety system in place, that they can rely on. Hence they did no tell the trains to use manual operation, (which might also require driving by sight [max. 40km/h], but not necessarily, I don't know the proper procedure in Spain), but told them to fall back to the normal safety system. It's reported that some train drivers and dispatchers questioned that, but that can also be an translation error and instead them repeating what was said, as is proper safety procedure. But the point based train control system will show a green signal, even if there is actually a train in front, because it is in the same block as you, but the signal shows whether you are allowed to drive in the next block, not into the current, as you are already in the current block. This seemed to be what happened here, the second train saw the green signal thought they are back in the automatic safety system and accelerated to 200km/h, not knowing that there is still a train in front. The first train should have also started driving, but did not, due to an error in the train. In normal situations this should never cause an accident, but in this case the accident would not have occurred if that wouldn't have taken place, but that would have been simply by luck.
You can see the green signal in some of the pictures, which to me looks really weird (kinda like a both dead and alive corps), because I would expect to put all signals to red in the case of an accident. I would expect to do that, while you are calling the emergency number, but I do not know if that is the procedure in Spain. You also see in the pictures that the whole cluster traveled about a train length and that the last carriages of the first and the first of the second train are merged into one. This indicates a surprisingly high speed for the crash, above 100km/h. That fits the explanation of the second train not being able to see the first until directly up to a few 100 meters before.
There were actually more trains in that block, so it's pure luck, that there were "only" two trains involved in this accident. Also some claimed, that there was a curve directly before, so the second train couldn't see the first until directly up to the accident. This would not have prevented the accident, it would have just reduced the involved crash speed and hence reduced the number of dead people.
It's quite ironic, that the accident would have likely not happened in case of no safety system being present.
---
Actual classical collisions of two trains like in this case are quite rare, because that's like the first purpose of every train control system, which exist since the 1870s. The accident from January this year in Spain was also a collision, but because a train derailed, while another train passed it. This can't really be prevented by a current train control system, other then not allowing the derailment to happen in the first place. Derailment in carriages is actually not rare at all, but daily, it's like going slightly on the shoulders of the street with your car, but train derailments are.
The accident from Meerbusch-Osterath from 2017 is similar in that is was also a collision. The cause itself is not really similar. The normal train control also failed, so the trains need to be operated manually. For that it was still relied on the automatic train detection and labeling system, but that had a bug (and some operator error due to a bug, this is simplified) and showed the number of the second train, where the block of the first train was. So they allowed the second train to advance. They did have contact with the first train, because they noticed something was wrong, but that driver didn't properly speak German and also failed to look out of the window directly where a hectometer sign was, so he couldn't tell the dispatchers were he actually was. The dispatcher forgot to tell the driver of the second train to use drive by sight (40km/h), so he accelerated to full speed (120km/h). The accident only caused 40 injured people and no deaths, because the second driver saw the first train. The accident happened at night, in the dark and at a speed of 85km/h. Train dispatchers are supposed to keep track of the trains and the actions they do too, but since the automatic train detection and labeling works most of the time, it becomes easy to rely on it.
The accident from Fallersleben from 2002 is similar, because the original failure of LZB and fallback to PZB is the same. Hence there was also more than one train in one block. The signalbox software told the second train to advance to full speed and the first to stop. This would have caused a crash, but the train driver of the second train noticed, that couldn't be and notified the dispatcher who then told them to not proceed, hence the accident didn't happen. This caused it to become mandatory to let the first train to drive again operate on sight [40 km/h].
> the signal shows whether you are allowed to drive in the next block, not into the current, as you are already in the current block. This seemed to be what happened here, the second train saw the green signal thought they are back in the automatic safety system and accelerated to 200km/h, not knowing that there is still a train in front.
Don't think the second train saw a green signal. They were in the middle of the block, while the first train was waiting just before the exit of the block (with a green signal ahead).
What I'm gathering from other sources is that the Spanish system allows the controller to override the point-based rules and provide manual clearance (because the blocks are long and it takes forever to reach the next signal by sight). It's a failure of the system imo. Ideally, the system, under no conditions whatsoever, should have even allowed such a practice to be allowed.
> Don't think the second train saw a green signal. They were in the middle of the block, while the first train was waiting just before the exit of the block (with a green signal ahead).
If the first train was really just before the exit of a block, then it's pretty safe to assume that the second train saw the corresponding distant signal.
> the Spanish system allows the controller to override the point-based rules
Every system allows that, it is required in order to be able to operate a railway network.
> What I'm gathering from other sources is that the Spanish system allows the controller to override the point-based rules and provide manual clearance
What actual happened is my speculation, the explanation how LZB works is not. It can be the case, that they messed up while issuing manual movement authorities, but if they did not notice that they need to switch to manual operation, they will have caused a crash.
During normal operations you can act on the distant signal, because you know you're the only one in the block. But when falling back from linear to point signalling, you cannot make that assumption anymore. You need to get back to a state where you are certain you're the only one in the block, and the only way to do that is to reach the next main signal by sight after which you know you're clear for the that block.
Sure, another way to be certain is for the controller to manually verify that the block is clear and verbally communicate to the driver to override the protocol. But that is putting a lot of burden on human judgement, and even without this incident, anyone would agree is not the best idea.
I don't think this should be required for "normal" operations of the network. Sure, human override should always be there for when an exceptional situation occurs. But you should take extra precaution when that happens because you're already on your final safety net and relying on the judgement of a single human at that time, and that's okay because it's an exceptional situation that doesn't happen often and when it does you can afford to spend an hour or two to take that extra precaution.
The problem happens when the system fails so often that human override becomes the new normal, and because you're doing it every day you now cannot afford to spend the extra hour and tend to skip the extra precaution because you're doing it everyday and start to feel you know what you're doing.
> You need to get back to a state where you are certain you're the only one in the block, and the only way to do that is to reach the next main signal by sight after which you know you're clear for the that block.
Yes, that is manual operation.
> Sure, another way to be certain is for the controller to manually verify that the block is clear and verbally communicate to the driver to override the protocol.
That's not another way, that's the exact situation you just described. To "manually verify that the block is clear" is drive by sight. The only alternative would be to walk along the whole track.
The problem is (AFAIK), that they didn't do that.
> I don't think this should be required for "normal" operations of the network. Sure, human override should always be there for when an exceptional situation occurs. But you should take extra precaution when that happens because you're already on your final safety net and relying on the judgement of a single human at that time, and that's okay because it's an exceptional situation that doesn't happen often and when it does you can afford to spend an hour or two to take that extra precaution.
All of that is the case, but you underestimate how often exceptional is in a whole train network. One per million means it occurs daily.
> and when it does you can afford to spend an hour or two to take that extra precaution.
You have a lot of time, but that means you operate on the order of minutes, not seconds. Needing hours is not emergency operation, that means we cease doing operations. You can of course take several hours to bring the network back to full operation, but you need hundred to thousand operations for that, so a single operation still doesn't have hours time.
> To "manually verify that the block is clear" is drive by sight. The only alternative would be to walk along the whole track.
But aren't there additional systems that can detect that a block is obstructed (e.g. also by left behind carriages that got disconnected) like the electrical track circuit (Gleisstromkreis)?
Or wouldn't that have helped because we're back again to the issue that with the downgrade from LZB to PZB we lost the virtual blocks, and both trains are now occupying the same, longer, non-virtual block?
Which would mean that this block would have been indicated to the controllers as not clear - but that is exactly what they would expect to see, because they're currently deciding what instructions to give to the AVE, which they know is stopped in that block. But they have no indication that there is a second train (Iryo) in front, occupying the same block.
Hence, I assume, the protocol to resume operations with drive by sight after a LZB failure (which seems to have been ignored in this case). But why not also have the protocol demand that operations are resumed front-to-back in that situation? I suspect that "front-to-back" is not nearly as unambiguous a concept in reality as it may seem in my layman's head.
> But aren't there additional systems that can detect that a block is obstructed (e.g. also by left behind carriages that got disconnected) like the electrical track circuit (Gleisstromkreis)?
That's not an additional system, that is the PZB (or here ASFA).
> Or wouldn't that have helped because we're back again to the issue that with the downgrade from LZB to PZB we lost the virtual blocks, and both trains are now occupying the same, longer, non-virtual block?
Yes.
> But they have no indication that there is a second train (Iryo) in front, occupying the same block.
We don't know what they missed, and speculating on that is quite pointless, if we want to have that discussion, we need to wait for the post mortem, this is what such a report exists for. We only know THAT they missed something. That they missed that the first train was in that block too, is one option. It could also be, that it was not clear which signals are virtual or that there was a communication mismatch between different dispatchers or that there was a bug in the automatic train identification system or that an automatic system did call for that procedure. All of these already do occur in railway accidents, they are not really speculative. The last one is what happened in 2002 in the exact same situation: the computer automatically ordered the second to full speed and the first to stop. There could also be some other issue, that I can't think of right now. Most likely it's more than one error, because people still do pay attention.
> Hence, I assume, the protocol to resume operations with drive by sight after a LZB failure (which seems to have been ignored in this case)
I don't actually know what the protocol in Spain is. In Germany it is like that now, but only due to the 2002 near-accident. Before that it was ambiguous. If you are a dispatcher you don't only get taught a bunch of rules. You get taught the primary constraints and then you are able to construct the rules from first principles. However under pressure it's likely to forget something vital, so there are still rules that you are supposed to follow. But no ruleset will be ever complete, that's why you don't only follow rules.
> But why not also have the protocol demand that operations are resumed front-to-back in that situation?
That wouldn't solve anything. Drive by sight is safe in that situation, driving faster is not. If you start front-to-back you can still have collisions, but you just waste time. There is also not necessarily no physical block between trains, so it could be safer to start a later train. Also are you sure you are able to correctly assess the positions and order of the train? You are supposed to, but I mean that obviously failed here. Just drive by sight.
Thank you for those additional clarifications!
From this article [0] (Spanish) I take it that protocol would also have been to proceed with drive by sight, at a maximum of 40 km/h.
[0] https://archive.ph/ra6Lp
Shinkansen does that afaik. 30km/hr cap during manual operation. No exceptions.
And in Europe the cap is 40km/h in most places. The issue is that they did not call for manual operation.
Yeah, that's what I meant was a failure in the system. Ideally, manual operation or drive-by-sight should be the default mode. Only the appropriate signal state should be allowed to override this and clear the train for higher speed, otherwise the system must enforce manual operation (hardware enforced speed limits etc). There should simply be no procedure for a human to be able to just override this.
> The accident from January this year in Spain was also a collision, but because a train derailed, while another train passed it. This can't really be prevented by a current train control system, other then not allowing the derailment to happen in the first place.
Or by putting all the signals to red after the derailment of the first train so as to stop all the circulation on the line, which seems not to be the common practice in Spain unfortunately.
The first train going from A to B derailed, and the second train going from B to A crashed into the derailed cars 9 (20 on other sources) seconds later. Even if the second train was put in full brake in the exact same second the derailment happened, it couldn't have avoided the crash.
https://en.wikipedia.org/wiki/2026_Adamuz_rail_disaster
Surely a better fallback is possible. Like if a train is known to be in a PZB with other trains ahead of it, then when LZB goes down it has to slow down/wait/follow some different protocol until PZB rules can be enforced again.
I'm not sure, I can follow you. The trains were in LZB mode, because you need that in order to operate a high-speed train. You can't see the signals required for PZB at high-speeds.
> then when LZB goes down it has to slow down/wait/follow some different protocol
The trains did stop when the LZB reported an error, like they should.
> follow some different protocol
That is manual operation, which I suspect they failed to do.
My reading of the above was that at the time of LZB going down, PZB could not be enforced immediately, because its assumptions were violated (multiple trains in the same zone). Hence the trains are stopped.
The question is then what does manual operation entail? Do they just continue operations, driving slowly and communicating through other channels while allowing PZB rules to continue to be violated, or do they have a protocol to re-establish PZB as quickly and safely as possible? Asking as a layman.
How long are the blocks on this point-based train control system? They were 25kms away from the other train when LZB went offline
The level of human negligence here is astounding. The system did exactly what it was supposed to (lock the train down if the track can't be confirmed clear), and then a human controller ordered the crew to override the system, and ordered them to proceed at an unsafe speed towards a similarly disabled train?
Usually when you look deeper at failures like this, it’s because there’s a morass of bad incentives from the surrounding human system that enforces this kind of behavior.
Here is a plausible alternative explanation:
They’ve probably seen false warnings over and over and overridden them enough times that they lost sense of the risk. They need to keep trains on schedule, using a buggy system, with a manager looking over their shoulder. They override the warnings over and over, nothing goes wrong, and they forget that it may actually be right. Look at the Challenger explosion, Chernobyl, or any other failure like this, and there’s usually a bureaucratic process that has run amok, and the individual is just following perverse incentives that have been socially normalized over time.
So I’ll wait until I have more information before I proclaim this as human negligence and the system doing exactly what it’s supposed to do. We don’t know how often it was doing the wrong thing and confusing the fuck out of the human.
> "the individual is just following perverse incentives that have been socially normalized over time"
Normalization of deviance,
https://hn.algolia.com/?query=normalization%20deviance&type=...
Given this keeps happening in Spain, maybe we'll need to call this "Normalization of normalization of deviance".
Humans never learn.
"They need to keep trains on schedule, using a buggy system, with a manager looking over their shoulder."
Also lots of potentially angry passengers who want to get to their destination in time. Will miss important appointments, or even the last train connection for the day and be stranded if the train drivers decide to wait a little bit longer to be on the save side.
You also miss appointments and are late if you are dead due to a train crash.
Yes indeed. But stressed passengers tend to not think about that, so the pressure they put on the traindriver is real.
(have you ever been in a train on hold, unclear information about delay and seen the looks and talks of passengers towards the train driver walking outside who announced before he also does not know when the ride can go on? Like he is personally responsible for the delay and incompetent or straight evil)
Like, frankly, any passengers that are aggressive towards the train crew might as well be told to walk back to the nearest bus stop. Like seriously, in this case especially (a high speed train) the utmost focus should be given to safety, so anyone going against that (like putting pressure on the train crew) should be ignored if not fined/booted of the train.
Also in this case - why the hell they just did not wait for the primary safety system to go back online before doing anything ? Is it so faulty that they get used to it being broken or what ?
And baring that, how is the train even able to go full speed without the primary safety system being operational ? It really should be hardwired to cap the speed at 40 km/h or even less (including zero) unless the safety system is confirmed online and operational.
IIRC the japanese Shinkansen trains use a system called ATC (https://en.wikipedia.org/wiki/Automatic_train_control#Japan) since 1964 (!) which automatically starts breaking if a train goes faster than the maximum allowed speed in a track circuit. So presumably if connecting with the track circuit is lost the maximum speed defaults to 0 & all trains stop until proper protection is restored.
Was not even talking about aggressive behavior, but complaining and annoyed looks. That is still (emotional) pressure.
I recently saw a doc on the 2013 Spanish crash and it was full of absurd system problems. The govt pinned it on the driver as best they could but it's clear that it was entirely preventable.
Jenga effectively. 3 others and Bob spent time destabilizing but Bob over here pulled the block before it collapsed. It's his fault.
> human negligence and the system doing exactly what it’s supposed to do
Negligence is not limited to the single human who issued the order. it's pretty unlikely that their order could have caused this without a significant amount of other negligence that eroded the safeguards. Nevertheless, the negligence is human, not machine in nature.
Trains in spain have been running at reduced speed, delayed or even cancelled for a while due to aging infrastructure, which might've actually caused another deadly accident back in winter, so this behavior does not surprise me.
Normalization of deviance [0], wherein a clearly unsafe practice becomes considered normal if it does not immediately cause a catastrophe: "a long incubation period [before a final disaster] with early warning signs that were either misinterpreted, ignored or missed completely
[0] https://en.wikipedia.org/wiki/Normalization_of_deviance
I did read from HN someone from Spain said that the system crashed very often that they had to rely on humans frequently.
> Show me the incentive and I’ll show you the outcome
> -Charlie Munger
It’s still gross negligence to place punctuality over safety, regardless of the reasons behind this behaviour.
That sounds like a reasonable statement, but actually you do need to place punctuality or costs over safety at some point. If you want to chase absolute safety, you can dump infinite money in it or just not operate a train network. There must be such a thing as a socially accepted safety level, otherwise you simply don't do that thing. That's not limited to railways, but to everything you do. In the end humans are still mortal fallible beings.
I don't mean to absolve people for negligence, but when margins are very small and paychecks may have become a necessity to survive on this planet, sometimes within the complex process the collective behaviour gets pretty weird.
There are not that many people who (care to) see the big picture(s) and the consequences their semi-small actions may have in the long run.
(Un)Fortunately, finding someone who is "at fault" generally helps neither in investigating root causes nor in preventing similar problems in the future.
Usually it's detrimental, hence (criminal) investigations of personal liability in such cases are often only allowed after systemic investigation has concluded.
In court, you are allowed to withhold information that makes you look bad, which is simply lethally unhelpful when we want safer trains.
[dead]
Whose negligence, though? "The system" isn't just the LZB equipment - the train dispatcher is just another cog inside the same system, and should be expected to occasionally fail just like every mechanical part.
This isn't a game of Hot Potato where the last person touching it goes to jail for gross negligence. You have to look at it through a Swiss Cheese model: every individual safety layer can and will have holes, but a disaster can only occur when all of those holes align.
Why did the LZB system fail? Why did the train dispatcher use the wrong backup procedure? Why did a backup procedure with zero safety checks even exist? Why did the train operator accept this backup procedure? Why did the train allow high-speed driving under those unsafe conditions?
It does indeed seem like the train dispatcher made a big mistake, but that was far from the only thing that went wrong, and it would be myopic to use him as the scapegoat for a far larger systemic issue.
There is a reason these people are paid good money for "responsible positions", they should be "responsible"... It shouldn't even matter why or who fucked up, you take the minister of transport, who's part of two major fuck ups by now, you fire him, make him ineligible to any kind of responsible position, and put him in house arrest for a year or two. That's like the whole fucking principle behind responsible positions. It seems like today it just means you have to go public every now and then to say "I claim full responsibility for the events" and just moves on as if you didn't kill 50+ people
Overriding safety systems is itself a safety capability. But this wasn't a failure of the safety systems. It wasn't even a failure of the train drivers who had been over using safety system overrides. It was a management failure for not noticing that over use of overrides.
Also the train driver could have pushed back, in the radio recording with the dispatcher, he tells the driver to "proceed normally", the driver asks "proceed normally?" and the dispatcher confirms it. Here's were I would expect that better training or more availability of information to the driver would've made him push back on that decision.
I read that one of the other train did push back and told the dispatcher that they were supposed to proceed "at sight". Sad that this was not enough to rectify
please do not spread false information. the driver was repeating back everything, as it's usual in these scenarios
Look, that may be true, but why would the dispatcher then say "Yes, proceed normally"?, as if he'd been asked a question?
why does the dispatcher even hold the right to override the automatic system by themselves? this should involve multiple people, at least a signoff by a superior.
The automatic system will fail at some points so manual dispatch is needed, which is how this all happened
Sounds like you have internalized https://how.complexsystems.fail/ :-)
Dispatcher, conductor at that time could not have know that dispatcher ordered manual bypass ignorig the rest of the guardrails of a traffic resume procedure
Not OP but I'm imagining we'd ask the question why the "dispatcher ordered manual bypass ignoring the rest of the guardrails". They're saying it's all slices of cheese in a system that failed here.
It seems that one of the train conductors did know that it was not the procedure and tried to warn of the problem.
Indeed the system is all of it - all gear on another level of abstraction where it as a whole is just enabling processes, not the thing running it.
If you ignore a road sign and run someone over in your car today, nobody will make systemic excuses for you.
Someone was driving the train who couldn't estimate the stopping distance relative to speed.
If a car is stalled in the middle of the road, and you hit it, that's on you. 200% if a reflective warning triangle was up 100 meters back.
Trains take a long time to stop even at moderate commuter train speeds because they are so heavy, let alone high speeds of 300km/h+.
At least one of the failures here is that the dispatcher authorized such a high speed, in other systems I am familiar with, generally the procedure with a signal fault is to crawl at a speed such that the train can stop in line of sight distances.
In fact, that is the Spanish protocol, which for some reason was bypassed by dispatch even after the train driver had questioned it:
> Under normal protocols, the driver would be expected to continue moving at a maximum of 40km/h according to their line of sight, and not at normal speed on a track designed for speeds of up to 200km/h.
> Under normal protocols, the driver would be expected to continue moving at a maximum of 40km/h according to their line of sight, and not at normal speed on a track designed for speeds of up to 200km/h.
I think this has been misreported and it's even worse, EU register of infrastructure says that maximum permitted speed for this section is 270km/h and the sections before it are even higher.
https://rinf.data.era.europa.eu/unified-search?view=map&q=JT...
> Trains take a long time to stop even at moderate commuter train speeds because they are so heavy
Mostly because metal wheels to metal rails contact offer very poor friction
If a stretch of road continues to have frequent crashes even though a sign is present, it is worth examining why that sign alone is not solving the issue.
Air travel is as safe as it is because we don't stop the investigation at "pilot error" but instead ask why the pilot made the mistake, and why a single mistake was able to lead to loss of life.
Yeah. This single accident was more deadly than all commercial air traffic in the EU in the past 10 years together, while 50 deaths per day is the average for car crashes in the EU. Wild orders of magnitude difference in safety.
Rough estimate: by car, you can travel from Lisbon to Talinn (4000km) 100,000 times before expecting to die; by train, almost 4 million times, by plane 400 million times.
And if you're the median person (not the average person), you can probably 3x those numbers, because such a large number of casualties in traffic are risk-seeking individuals (e.g. a drunk driver is included in "average person" but not in "median person")
Maybe, but the median person shares the road with those risk-seeking individuals. Drunk driving accidents often kill people other than the drunk driver.
> If a stretch of road continues to have frequent crashes even though a sign is present, it is worth examining why that sign alone is not solving the issue.
"I will not accept that it's a highly dangerous road" -- https://www.youtube.com/watch?v=7Qir4EEpawE
I don't think trains are the same as cars. Trains are supposed to run at high speeds under normal circumstances and the system is supposed to keep everyone safe. It clearly said they wouldn't be able to drive over 40 km/h if they had to operate by line of sight.
Cars otoh don't have someone overseeing everything and directing traffic. They have to operate by sight.
I don't mean to pick, but it seems like you have near zero knowledge of how train systems work.
You are 100% dependent on your safety and monitoring systems because almost every problem that could come up is beyond the horizon of your human senses. Stopping distances are in thousands of feet to miles depending on the train size and weight. Add any curves and that's far beyond your visibility.
Then you add in management complaining that you're too slow and you need to do things faster and cheaper or you'll lose your job. Things turn from solution culture to blame culture.
Then you add in false errors and warnings in a system that teach you to ignore them and an upper management that doesn't fix them.
Then you have the day like hundreds of others where warnings are going off, management is yelling, but this time there is a stopped train around the corner and everyone dies.
This is a systemic problem.
I wish this were true, but there is basically no consequences for drivers in the situation you described. The most egregious example I can think of near me was in 2022 when a kid was crossing a flashing crosswalk with his bike near Tacoma, and truck had stopped to let him cross. A woman ignored the crosswalk signal and used the adjacent lane to drive past the stopped truck and hit the kid, killing him. The woman was never criminally charged. She didn't even experience any consequences for her driver's license.
https://komonews.com/news/local/13-year-old-boy-killed-while...
I think this is something about the incentive structure of the US legal system.
Here in Australia, a member of my family was involved in a fatal accident with a pedestrian, around 20 years ago. They put him on trial even though the case was weak, and then the prosecutor moved for dismissal part way through the trial. But, what people told us, is prosecutors are encouraged to take weak cases to trial because dropping the case part way through the trial is more politically palatable than refusing to bring it to court to begin with.
Overtaking in front of a crossing is allowed in the US?
> Someone was driving the train who couldn't estimate the stopping distance relative to speed.
The stopping distance for a train this size and this fast is around 2km. Good luck estimating that by sight. There is a reason the normal protocol has a 40km/h max speed for traveling according to line of sight, which the driver was told wasn't needed.
I think it is wrong for you to make an analogy to someone driving a car.
Indeed, car crashes tend to just blame one (or more) of the drivers. Nobody excuses a foolish driver with systemic excuses.
On a surely unrelated note, car travel is by a substantial margin the most dangerous mode of transport most of us ever use, and the most dangerous activity most of us routinely engage in.
I would argue that we should look at systems-level explanations. The human factor is so glaring we can get caught up in it. There are what, 50?, high speed trains in movement in Spain at the same time. Even GPS + Starlink + 1 monitor (is that 50k€?) could have prevented this. But it happened, and the question is what is going on with train security in Spain in general for people to (be able to) make such decisions.
After learning about a sufficient number of such "accidents" I'm now convinced the cause is never "operator error", it's always a system error. It's the humans that design (or oversee their design and implementation of) those systems that are at fault.
"The cause", singular, shows you're not getting the the swiss cheese model still. Trying to find a singular cause is a big mistake which prevents other causes from being addressed.
Every hole in the cheese slices, including operator error, is important. And operator error is an important kind of error in particular, not because we need to prosecute somebody but because many forms of operator error can be mitigated using better system design, but you won't figure that out if you blind yourself to operator errors.
The current control system dates from the early 90s. They started rolling a modern system with more redundancies and automatic blocking in 2022 but it's still not fully deployed.
PZB is from 1934. Arguably always prioritizing deploying the most modern system on the highest profile lines, is what prevents us from properly rolling out the basic safety systems everywhere.
PZB is only used up to 160 kph, and relies on wayside signals being read by operators. That's not possible on a high speed line. A more sophisticated signal system is simply necessary here.
These high speed trains are pretty recent. Are we really not upgrading safety systems past the 1930's when upgrading a line from ~80kmph to ~300kmph?
I was only talking about the general problem domain, not about this specific location. The current safety system is also not was has caused this, likely. Or rather it has caused this by it's availability, not by it's safety.
According to the article, the track had LZB, though.
And according to the article the signalling system reported, that the track is blocked.
I'm pretty sure we had modern computer systems around 1990.
Trains are still not able to assess properly where they are, even using satellites and inside train sensors. Of course there is research on that, but it's still an unsolved problem. (Current alternative is to put markers in the track, but that's also expensive at scale.)
> Trains are still not able to assess properly where they are, even using satellites and inside train sensors. Of course there is research on that, but it's still an unsolved problem
Throwing up our hands about how hard a problem this is seems like a ridiculous position to stake. If we can design self-driving cars, that operate safely in far less controlled environments, we can figure out the linear offset of a large vehicle traveling along a physical rail running along a fixed pre-determined path.
> If we can design self-driving cars, that operate safely in far less controlled environments
Self-driving cars aren't supposed to drive quicker than they can look ahead, which makes the problem way easier because you don't have to figure out how to detect obstacles ahead of time and can simply rely on vehicle-local information to stop if necessary. And because cars can brake way more rapidly than trains, it means you can still drive reasonably quickly even within that limitation.
Plus in an emergency, cars have steering as an additional degree of freedom to attempt getting out of any nasty situation that may have developed.
(And of course the socially expected safety standards for cars are quite a bit lower than for public transport…)
Trains on the other hand have braking distances on the order of a kilometre or so, and high-speed trains at full speed several kilometres, so trying to get by on local data only is hopeless and the usual strategy is instead having central signalling system that can accurately track trains and coordinate their movements.
I said nothing about "throwing up out hands", this is a current research topic. But you can hardly blame the workers for not using a system, the researchers haven't invented yet.
> If we can design self-driving cars
We can not design self-driving cars to the safety standard that is required for railways. They are way less safe than the current half-manual system for railways. What you suggest is using less automatic safety systems than what we currently do.
Why is it that these fatal train accidents have happened multiple times in Spain, but never in Japan, even though Japan has been doing it high speed rail longer, and at 10x the passenger volume than Spain? Do they have some alien safety technology unavailable to Spain?
The were several other train accidents, where it was found out, that the drivers have made races, who can stay above the speed limit longer. But I think that was already in the 90s. There is/was definitely something at fault with the safety culture.
But there was a recent incident in Germany as well (https://en.wikipedia.org/wiki/Burgrain_train_derailment), which is somewhat similar to the earlier accident in Spain this year. Targeting high value projects, while not paying for proper maintenance is not something that only happens in a single country.
There were two fatal train accidents in the UK this year, one of them being a rear-end collision, despite no one even citing them in this thread, and definitely not claiming the UK having low safety culture. Sadly the Spanish "black legend" is still very much in force, portraying Spain as some lower place than it actually is.
Yes, you can say that high-speed rail crashes are not limited to one country (though Spain has had multiple this year alone), but you can't say that it has ever happened in Japan. So for you to argue up and down this thread that everyone calling out issues with Spanish high speed rail safety is wrong, as if it is some sort of intractable problem, is bananas.
I have not stated anything that is specific to Spain in this thread? I do think there is something wrong with the safety culture in Spain, I mean obviously, there was an accident.
> but you can't say that it has ever happened in Japan.
That sounds very unlikely to me, and in fact Wikipedia indicates otherwise: https://en.wikipedia.org/wiki/Shigaraki_train_disaster
That is not a high-speed rail line... so, no?
Ok, so railway safety for me doesn't stop at the end of high-speed lines. But, maybe Japan does indeed clear the measure you suggested, so congratulations to Japan, I guess?
Yup, so it seems that high-speed rail safety is not an unsolved problem. Wonder what the lessons are? Hmm...
"Sadly" anything involving safety with humans is never a solved problem, because safety culture needs continuing training and effort.
> I said nothing about "throwing up out hands", this is a current research topic. But you can hardly blame the workers for not using a system, the researchers haven't invented yet.
This you? Who's fault is it then? You said the tech doesn't exist (lets take that at face-value for the sake of your argument), so then if not tech, then what? You're just left with people. So are you saying it is their fault or not? Or is it just nobody's?
Yes. General safety culture. However asking who is at fault instead of asking how to prevent it from occurring again, is also an indication of a lack of safety culture.
In addition: https://news.ycombinator.com/item?id=50297950 https://news.ycombinator.com/item?id=50293093
You can do both
indeed. Japan is a compliance and shame based society. that alone is the foundation of a very strong safety culture, something that southern europe is famous for lacking.
> that alone is the foundation of a very strong safety culture
It's a mixed bag. That can also cause safety violations, they were suicidal incidents, because punctuality is placed over safety, in Japan. https://en.wikipedia.org/wiki/Amagasaki_derailment
might be a mixed bag but when safety of vehicles is involved, the japanese and germans are very good. Observe cars driving almost anywhere in southern europe and you will instantly spot the difference.
I am from Germany, and we did have the exact same failure case I expect happened here in 2002. In my opinion thinking you are good at safety is how being bad at safety starts.
The train to control center calls leaked, and they not sound like aircontrol talk we have heard latelly, more like "meh, paperwork". People! You are handling multi-ton things capable of going faster than 300 Km/h.
Japan railway crew have stricter procedures when they are alone: https://en.wikipedia.org/wiki/Pointing_and_calling
Has there ever been a case where two self driving cars collide with each other? I hate to be part of the peanut gallery, but as a totally naive person when it comes to railway safety research it really does seem amazing train collisions can’t be easily prevented with gps, lasers, sonar or various other trivial ways. Even the crash in question seems like it might have been easily prevented by having a second human in the loop. Maybe I and others just suspect the difficulty isn’t so much technological as it is financial.
As far as I am aware, there has been no non-supervised train in a general train network. (They exist in closed systems.) However whether the train is self-driving is really not the issue here. In current railway safety systems (even from the 80s) a crash is about the same probability as random bitflips. However reality is too messy, so that the availability is not satisfactory enough to not use a human fallback, and then you are back to the assisted human error rate.
Current operation of a train is basically self-driving and supervising driver. So if you suggest "just use self-driving", you make the system less safe, not more, because it means just getting rid of the human supervisor. This is not currently done, because it would be too insecure. It might be done in the future, but rather because less safety is going to be accepted in favor for getting rid of the costly human.
A self-driving train will happily cause a crash, if the target is "drive with high-speed in that segment currently occupied by another train". The issue is that that becomes a target, not that there is a human in the loop.
> A self-driving train will happily cause a crash, if the target is "drive with high-speed in that segment currently occupied by another train".
Sure, if you allow trains to ignore safety completely, then accidents will occur. That is a ridiculous statement.
Yes, if the dispatcher issues faulty movement authorities, it's futile to look for the error in the train. That was my point.
Self driving cars colliding had already happened at least once.
GPS can't work for trains, they go inside tunnels and between walls. Track circuits and train sized NFC-like tags reporting linear locations, mentioned as not scaling in GP, is the standard solution. It kinda scales fine.
1: https://futurism.com/advanced-transport/waymo-crashed-into-e...
> Has there ever been a case where two self driving cars collide with each other?
I don't think that's relevant to trains. Cars can avoid a collision much more easily than trains can. Cars can swerve, and if they are at a distance at which line of sight tells them they will hit an obstacle, they are moving slow enough to stop before hitting that obstacle. Trains have to stay on tracks, and they need up to 4 kilometers to stop moving.
The constraints are very different, so the solutions and tradeoffs will be different too.
> We can not design self-driving cars to the safety standard that is required for railways.
That is completely false. PTC does that, and we've had it for several decades. There are several self-driving cars operating in the world right now. I have never heard of a PTC system causing accidents; those occur in places where the system isn't required (like entering Grand Central).
You keep pretending that avoiding train collisions is too magical to achieve with current tech, but train traffic is easy to limit (but slightly harder to optimize), and systems exist to do that, because rail is unique amongst all forms of travel: if you drop speed to zero for any trains at risk of collision, they are safe. Planes will plummet; most cars are human-operated and you can get rear-ended, etc.
> That is completely false. PTC does that, and we've had it for several decades.
I think you are misunderstanding the sentence you quoted.
It says something about the safety of self-driving cars. That is they don’t meet the standards required for railways. In other words the expected safety for a self-driving CAR is lower than the expected safety of a RAILWAY. (Caps for emphasis, sorry about the shouting.)
Your comment reads as if the quote claims that we cannot make “self-driving trains”. It does not say that.
> You keep pretending that avoiding train collisions is too magical to achieve with current tech
I don’t think that they do that. Definietly not in the comment you responded to.
That's correct.
[dead]
> That is completely false. PTC does that, and we've had it for several decades.
And they somehow work with radar, lidar and GPS from inside the train? No they work with classical block based systems and on signalboxes. So all the safety systems are outside of a train.
> You keep pretending that avoiding train collisions is too magical to achieve with current tech
Huh?? Railway interlocking exists for more than a century. It's very safe and I didn't wrote anything contradicting that.
Yeah and that's fucking ridiculous and a damning indictment of the glaring incompetence of train companies.
If I can have reasonably accurate gps readings of my phone while I'm on the train, there is zero reason for train companies to not have systems that are at least as accurate.
Does your phone's GPS work in a tunnel? What happens if GPS ever gets jammed (or worse, spoofed)?
Aviation also doesn't exclusively rely on GNSS positioning, so why should train protection, given that it's also extremely safety critical?
> Does your phone's GPS work in a tunnel?
My car's GPS does, using dead reckoning.
Trains can also use dead reckoning.
/me checks notes, I've heard that they move on inflexible things called "rails" that almost never change the location.
The thing is that trains move way faster compared to friction (which is needed for breaking and manoveering) than cars. The equivalent is if you would be driving 900-1200 km/h with your car[1]. Good luck being able to break in time on that speed and estimating your position with GPS.
Also the hard part is knowing the position of the others and their trajectory, which changes in between moving towards them and is done by a third party. The normal passing distance is smaller than the width of your vehicle and you can only change your own direction every few kilometers. That means that the others trajectory towards you can only become known after you are already past your last opportunity to change your trajectory and even within your breaking distance. Good luck!
[1] Friction for cars on the road is 0.010-0.015, for trains 0.001-0.002; train speed 120 km/h * 7.5 = 900 km/h equivalent for car; that's not even a high-speed train.
Uhh.... What? The wheel diameters for cars and trains are similar. The amount of slippage also seems to be the same.
You also can get periodic absolute fixes to correct for the accumulated drift.
Part of the problem is multiple tracks. Those tracks may be only 10 feet (3 m) apart. (I don't know if high-speed rail lines in Spain are that close, and I don't know if the line where the accident occurred was double track.)
"Reasonably accurate GPS" trying to determine which track you're on at 150 mph is not as simple as you make it sound. Yeah, it can determine how far along the track you are. But when you get two trains moving toward each other, each at 150 MPH, do you really trust that GPS to tell you that they're on different tracks?
Trains can't change lanes without warning like a Nissan Altima on the Dan Ryan Expressway. The only way a train can move from one track to an adjacent track -- or get on the first track in the first place -- is if switches are set to allow the train onto that track. And on any modern high-speed line, those switches are centrally controlled by dispatch.
Keeping track of which parallel track a train was on automatically was a solved problem a hundred years ago, using relays and lights and hard-wired logic. Adding computers and GPS greatly increases the precision with which dispatch knows position and speed along the track, but knowing which track has not changed in the last century.
Yes, but as long as the central signalling system is working, it already knows where the train is, with no need to involve GPS. (And where modern signalling and train protection systems need increased precision as compared to the granularity of track circuits/axle counter sections, the solution usually involves a combination of on-train odometry plus track balises at occasional intervals in order to reset any inaccuracies that might have accumulated.)
What we're talking about here is some sort of TCAS-equivalent for the case where the central signalling is down – while it's easy to accurately localise trains with the aid of a central signalling system that authoritatively knows about the infrastructure layout, it's quite more difficult when you're trying to do the same thing in a decentralised, train-local fashion.
Yep, that's what I was trying to convey as well. There also seems to be RCAS, but it sounds like a newly invented system. https://www.dlr.de/en/kn/research-transfer/projects/next-gen...
And as of now, I suppose that RCAS (or RCAS-like systems) is best suited for (especially minor) single track branch lines that don't currently have a full-scale signalling system already up-and-running, but instead still rely on "Timetable & Train Order" and similar systems.
Single track means that at least outside of stations, collisions can be reliably identified without much danger of false positives (and for station areas you can just institute a blanket speed limit to compensate for the gap in RCAS coverage, which might not even be any lower than the speed limit required for traversing diverging/spring-operated/hand-operated points there anyway), and no already existing full-scale signalling system means that RCAS actually provides a significant safety benefit and is therefore likely worthwhile from a cost-benefit-analysis point of view, too, if you're actually regularly operating multiple trains simultaneously on that kind of infrastructure.
Whereas on multi-track mainline railways avoiding false positives is much harder and normally you should already have proper signalling and train protection systems in place anyway, so the additional safety benefits of RCAS would be much more marginal.
[dead]
>Trains can't change lanes without warning
Oh, they can, but it's usually a very traumatic event.
Basically what was the case with the previous accident in Spain.
I agree that the problem here has no easy, general and automatic gps-based solution but I think it's helpful to keep the actual likely situations in mind. Usually we have the most trains/densest timetables close to major transport hubs where speeds are low anyway and driving 'on sight' is a good compromise of safety and keeping things working. Where speed really matters - outside of major hubs, straight ruralish routes - we simply don't usually have great density of trains AND tracks. At least from my travels in western Europe I don't think I've ever seen more than two tracks in the same direction on high-speed-segments. So if we keep that in mind and don't expect a general and automatic solution, a simple, gps-based fallback-system that requires all trains that are within a radius of X of each other (either in time or space) MUST coordinate, else they both shutdown/move on sight, could work reasonably well. In reality and for the involved parties (the trains that are close to each other), it's a very human-scale problem.
It's very easy since there is limited ability for trains to change tracks, so the location history of the train is a strong indicator of which track it is on. Even Google Maps can tell you which lane you are in since god knows when, and cars can freely change lanes. And that's just consumer software. For something commercial like a train they could trivially solve this problem with something more robust. But I'm not familiar with the Spanish system; how much of the engineering did they do?
There are switches that move trains between tracks. Now you need every switch to report, keep a history of that. Many trains also separate and combine. Trains sometimes go backwards to be switched.
It's not impossible. But handwaving GPS placement of trains at the correct location, direction, and track deserves more than a handwave as trivial.
All of those failure modes can be accommodated. I fail to see anything here a competent engineer couldn't address. I speculate it's not a technical problem, but an operational and cultural one. This is not rocket science.
But it must be also cheaper and more reliable than the current system, otherwise nobody is going to implement it.
Two rtk receivers with LTE including a little battery backup would cost what, $2,000 per car tops?
Presumably switches already report their position to somewhere.
It's absolutely unacceptable for this problem exist in today's world.
> Presumably switches already report their position to somewhere.
Yeah and this somewhere already knows whether a crash is going to happen. In which case your solution brings no benefit. You can't rely on the correctness of a system, which you want to make an alternative to, to help in the case the original system fails.
This discussion focuses on a non-problem (granted partly due to an imprecise comment of mine). The system knows where all the trains are and also that a crash will happen, if the decision is made, that then indeed was made.
What is needed is that the system needs to convince the operator there is still a problem, after it proved itself unreliable. My suggestion would be a log of the constraints the prover encountered while determining whether there is a conflict. This certainly already exists somewhere in the background, but I am not aware whether that is currently shown to operators in deployed systems. It does exist somewhat in the research systems we use in university.
Multiple independent systems. Easy to ignore a single system, but two or more ? Would have to have a death wish
When I wrote that comment I would have answered, that you already need to distrust a system, that of course still have the authority to sound like it would be right. Also from other accident reports, my understanding is that relying on yet another system causes people to make even more errors, while when they start to manually assess the situation from first principles, they are able to grasp the fundamental error, because they are questioning every assumption, as they are reconstructing a world model different from the automatic system. But the latter takes more time and effort, so people tend to do the former.
The thing is that in modern automated dispatching you only have the same world model as the automatic system, so when there is an error you have the same world model as the system, but that just detected, that that does not equal the actual state of the world. And often the error is in fact a false positive.
But now, I actually think that this accident was caused by several systems being in effect: https://news.ycombinator.com/item?id=50298796
Yes, it can tell you. How perfectly, though? Perfectly enough to bet 60 lives on?
When Google Maps gets wrong what lane I'm in, nobody dies. It can be right 99% of the time, that's good enough. It's not good enough for a train system, though - at least, I suspect it's not. I'd want a lot more than "it works in my car" before I trusted it.
Can we just have it as an additional data point, on top of what we should already know from where the train should be from switching history? If we get 99% accuracy, is that enough to check with an operator “specify which track you are in, left or right” when the measured value is different than the expected?
In addition to that being unpractical, the train doesn't even know the state of switches, i.e. not whether it is on the same track as some other position. It's just that this is undecidable for a single train. (This is what my first comment was about, it's simply not known how to solve it on the level of a single train, likely because it is impossible.) However the answer for what to do if a train can't trust the network, is don't move. Or move by sight, which is limited to 40km/h for good reason.
On the other hand this is a complete non-issue and solved for more than a century on the network level. So there is zero need to invent satellite or vision based train detection at worst even using statistical systems, when you can use deterministic systems, for example using the fact that a train is out of metal, so it's detectable by the train closing a electric circuit between the rails. Or using the sensors that are installed at every signal, switch or other positions for precisely this question.
HN does railway safety... The Dunning-Kruger level in this thread is ridiculous.
As a passenger, I'm very glad software engineers haven't (fully) taken over aviation and railway safety yet.
Google maps gives me the directions for the express lanes when I'm in the normal lanes and vice versa like 50% of the time, and that's an order of magnitude greater error in distance than the distance between adjacent train tracks. And several orders of magnitude greater failure rate than is acceptable for a safety system.
RTK is more than capable of figuring out what track you are on
It can be on the other track right now, but change to your track in the future. Or in other words, the topology of the network changes in operation. Whether the track you are on and the track another train is on, is the same or not is not decidable without knowing the current network state.
Would that work in tunnels and forests too?
Tunnels are controlled by a single block - only one train can ever be allowed access at once, period. Until the "current" occupant train is verifiably out of the tunnel, that block is forbidden to all.
Forests are irrelevant; rail right-of-way contains no trees, and is wide enough to assure clear "view" of satellites.
You are just answering how the current system actually works. This discussion was about how a hypothetical system works based on GPS or radar alone.
> Tunnels are controlled by a single block - only one train can ever be allowed access at once, period.
Absolute nonsense. Do you have any idea how long some tunnels are?
There are actually different definitions for what a block is. It can be both a section where you can decide for trains to enter or where you can change their sequence (Zugfolgeabschnitt vs. Zugmeldeabschnitt, don't know the English terms) Also it can be a physical implementation of any constraint between components of different stations.
But yes there does not need to be a limitation on there only being a single train in a tunnel.
> a damning indictment of the glaring incompetence of train companies.
No, what I describe has nothing to do with the companies, that's the research state. It's just an indictment of you making bold statement about a subject, you don't now enough about.
> I can have reasonably accurate gps readings of my phone
Would you dare to cross on a rope over a deep valley, blind using only GPS readings of your phone? Because that's kind what you are suggesting, expect you also move a few hundred other people.
> Would you dare to cross on a rope over a deep valley, blind using only GPS readings of your phone?
Hang on, this is nothing at all like that - trains run on fixed tracks. The only bit of data we are interested in for collision avoidance is the linear offset along the track. Even the shittiest GPS fix of all-time would give a good-enough intersection with a fixed path to avoid crashing into a second stationary train in the open country-side (do you see any satellite line-of-sight blockers in the crash footage?)
> The only bit of data we are interested in for collision avoidance is the linear offset along the track.
So that is naive, but assuming that would be all that you need, with GPS you would also need the positions of all other trains. But why would you transmit all this information to every train, instead of just computing the collisions in a central node? (That's what is done now.) A better fit for what you suggest would be radar, and this does exist. [1] But that's where your original assumption is naive. You regularly pass other trains within <2m at high speeds, so linear offset is not all you need.
> But why would you transmit all this information to every train, instead of just computing the collisions in a central node?
Because central nodes can fail (as they did here, both human and machine), and providing this redundant data allows both the computer and the human-in-the-loop on the fast-moving chunk of steel to independently validate the decisions coming from the central node.
> You regularly pass other trains within <2m at high speeds, so linear offset is not all you need.
In this collision, both trains were on the same track. So while we obviously care about adjacency issues in the general case, this specific failure mode can be detected purely via a linear offset.
You can and do have redundancy in the central node already. Also that's not what failed here.
> In this collision, both trains were on the same track.
Yeah, but how do you distinguish that? So when I understand you correctly, what you want is: Find another moving chunk of metal in the radius of 2km, which moves toward you, but not in a direct or ballistic trajectory, but in a arbitrary complicated trajectory, but which can lookup in a database. Also you are operating in the real world, so there are potentially houses, trees and mountains in between. I guess that would be possible, but it would be really expensive. Your best bet would be to adapt a missile detection and targeting system from the military. A system which does exist and is somewhat similar is RCAS (https://www.dlr.de/en/kn/research-transfer/projects/next-gen...).
> Yeah, but how do you distinguish that?
By enumerating the tracks?
I feel like you are intentionally trying to turn this into a spherical cow situation by insisting on solutions that work in an information vacuum. All of this sort of problem in the real world is solved by sensor fusion from multiple data sources.
Trains are captive to a particular track - they can only change tracks at specific pre-determined junctions. With a pretty minimal sensor feed from each junction we can statically determine which track segment a given train is on. With GPS we can shrink that segment length down to a few kilometres. By sharing data persistently every single train can validate that central command-and-control is not about to run it into another train from behind...
There cases which are genuinely challenging engineering problems (i.e. derailments that impinge on adjacent tracks), but this trivial case of bumper cars is not one of them.
>> Yeah, but how do you distinguish that?
> By enumerating the tracks?
How do you distinguish that the <2km away detected moving train runs on your track on not on the one directly besides you?
> Trains are captive to a particular track - they can only change tracks at specific pre-determined junctions.
Yeah, but you do not know which one it runs on. Your entire point is that you do not trust the information the infrastructure knows. If you do allow to use information from the infrastructure, then why not use the sensors that already exist along the whole train network? It's also very unlikely that there is something electrically connecting the two rails of a track, that you would like to run over. So why wouldn't you trust that information, but some vague GPS signal?
> we can statically determine
But the current state of the art is, that you deterministically and provable know where a train is. Why would you use a more expensive, less safe system? The current focus to reduce errors in computing train conflicts is to prevent random bit flips due to radiation at the same time in three different computers running different software.
> I feel like you are intentionally trying to turn this into a spherical cow situation
The situation where you proposal makes sense, but the current system does not, is a spherical cow situation, that's my point.
> that you deterministically and provable know where a train is
You are the one who framed this conversation as it not being solved how to deterministically know where a train is. Everyone else in here has been kindly suggest that if perfect information is unobtainable, then we should work with what we have
Oh, I see how you could think that, without context. That's in fact not what I wanted to say. I meant that pretty literally. The infrastructure of course knows where the train is.
> Trains are still not able to assess properly where they are, even using satellites and inside train sensors. Of course there is research on that, but it's still an unsolved problem.
*Trains* on there own! This IS a hard problem, how to do that with any other infrastructure. It IS current research and not yet solved. That is for example relevant, if you want to be able to run trains at full speed <1m tolerance, so that you can have more than one train stopping at a station <60s. All while still not paying for infrastructure and maintaining backward compatibility with a century old trains. (I mean in the future you could use the same to also couple trains at full speed, but that's still sci-fi.)
> That is for example relevant, if you want to be able to run trains at full speed <1m tolerance, so that you can have more than one train stopping at a station <60s.
...is that something you'd ever want? In general, it is, but the way it's handled is by having those trains stop on separate tracks.
Running multiple trains through the same station track in under 60 seconds means that all passengers must embark and disembark in under 30 seconds. That's very tight. I would venture to say it's too tight and meeting this goal would make the trains worse.
(And if passengers aren't getting on or off the train, then the train isn't stopping at a station.)
In a society where building more rail is not welcomed, trying to get more out of the existing tracks becomes critical. In a metro, time for embark and disembark of 30s is not unreasonable. https://de.wikipedia.org/wiki/Fahrgastwechselzeit#cite_ref-d...
Redundancy in a central node is an oxymoron. Safety critical systems need to work 100% of the time if any single node fails, and stop safely if there are multiple failures and it can't work properly. Doesn't matter if each individual node is 100% reliable by itself because connections fail too.
You can still have redundancy in the computation, that isn't prevented by being in the same location.
> Safety critical systems need to work 100% of the time
Railway safety must be safe 100% of the time, but not available 100% of the time. Also the point of a signal box is to make decisions about the order of train assignment to track. You absolutely do not want multiple points of truths for that.
The way I think of it, divide the tracks into segments. Before you put a train on a segment, you must ask a question - is there a train on it. There are only two answers possible, No, and something else. If it is something else, stop. Don't let the train on that segment.
There are optimizations possible like make segments smaller etc but the original algorithm is trivial. If we can't figure things out, we make segments longer and we slow down the trains until we can. I am positive for a sufficiently large track segment and a sufficiently slow train, we can always answer the question with a no.
You've "invented" interlocking railway semaphores, after which the computer science concept was named.
https://en.wikipedia.org/wiki/Railway_semaphore_signal
https://en.wikipedia.org/wiki/Interlocking
Congratulation you are reinventing 1890 state of the art.
The problem is when the modern computer-dependent system replaces the ancient one, and so then the computer is down there is nothing at all.
Actually in this case it seemed that the opposite was the case, there was another fallback system, but you needed to disregard it, and operate manually, but the operators likely didn't notice that. https://news.ycombinator.com/item?id=50298796
Which is why you generally don't do that.
who said anything about only using gps? I'm saying in addition to their current system!
The exact comment I answered to. https://news.ycombinator.com/item?id=50287160
i don't see where it says they should use gps alone. In fact it even mentions starlink in addition to gps.
>Even GPS + Starlink + 1 monitor (is that 50k€?) could have prevented this.
My reading on that sentence was that even a simple setup would have been sufficient to prevent this. Not that it should be the only thing.
My reading indicates, that "Even X could have prevented this." means that X is able to solve the issue on it's own. Otherwise X would in fact not prevent it.
- I don't think X would actually work, without actually eventually recreating part of the current railway control system, and the current rail control system alone already works better.
- I don't think another less reliable more costly safety system helps, when the current one already stated that there is a problem, and it was ignored.
>My reading indicates, that "Even X could have prevented this." means that X is able to solve the issue on it's own. Otherwise X would in fact not prevent it.
X on its own would have solved this particular crash, yes.
X + existing setup would solve this crash + all the other crashed the existing setup solves.
Yes they are, those balises on tracks are the standard technique for both metro and mainline signaling systems at this point. Those balises, often combined with radio communication, are how fully autonomous trains have been operating for decades. (It's possible to use things other than balises, like track radio loops as in LZB or more recently beacons or LIDAR, but balises are standard and pretty affordable).
Yeah, that works and has been for a while. I was talking about non-track based safety systems. You can have balises in specific locations, but you can't have them every few centimeters on your whole network.
Why would you need that many? Trains can keep pretty reasonable track of the distance between two balises using odometers.
There are also other solutions, e.g. LZB uses a phase change of the signal every 100 meters as an additional precision signal.
Because balises cost money, are payed for by infrastructure companies. Their position needs to be decided a priori, so you can't have the whole resolution on the whole network in order to get as close to the physical limits between trains as possible. Also it would be nice to be able to implement automatic shunting without additional infrastructure costs.
There are now hybrid systems for ETCS L2 that allow virtual blocks as short as 1 meter long. Balis + odometer is quite robust (and indeed how most CBTC systems with moving block tech function).
I guess I'm confused by why non track -based solutions are necessary? ETCS L2 would gracefully handle a system restart and automatically force a 40kph speed limit until a train traversed the unknown track proving no occupancy, and allowing proceeding trains to go faster. This all works on a track-based system.
Because railway infrastucture companies would like to not pay for them, not build more tracks and still get more capacity due to "digitization".
Not sure what you're arguing, the line affected by this tragedy was migrating to ETCS L2. Its installation costs are getting lower too, I don't think there's an actual problem here.
I wasn't talking about a specific line at all. Research doesn't need a clear problem to try to find better solutions. Also Deutsche Bahn does think there is enough of a "problem", because they do support that research.
> Trains are still not able to assess properly where they are [...]
Isn't the ability to do so the basis of operation for e.g. the German LZB train protection system, which has been around since the 1960s?
If you mean that train protection systems don't (exclusively) rely on self-reported positions, your statement makes a bit more sense, but even that is changing with e.g. newer ETCS levels which do rely on self-positioning more and more.
I should have written that comment quite differently, it took a while for me to understand how it is read.
I did not say "train systems are ...", I said "trains are ...". This is referring to e.g. that odometry based on wheels results in a drift. GNSS is to imprecise and unreliable. I'm aware that you simply use balises, that's what I meant with "markers in the track". However that's based on the infrastructure again, so it's again not trains on their own.
https://news.ycombinator.com/item?id=50293093
It was simply supposed to be an example how GPS sounds like it should easily solve a problem, but does not without additional measures, that then do not need GPS anymore.
Would you mind sharing some more of the why it is still an open problem? (I know I know little about this subject.) I understand satellite positioning isn't definitive and did not suggest it should be the /primary/ risk mitigating factor. But even as a tertiary or lower risk mitigating factor, this would have been a worthwhile investment. (Sorry for the bleak introduction of economics.)
And some problems are just _open_ to outside looks. My assistant tells me that the room for error in trains on one dimension ('left - right') is mere 10s of centimeters. I understand that problem. But what track you are on, isn't that obvious to the human in the cabin? (Again, simplifying, not flaming. Production ready safety is _hard_.) So could a vision based solution help count tracks from left to right? (Assistant: "US PTC, on about 54,000 route-miles, uses GPS for the lead locomotive plus crew-entered track information and switch position".) So you use the dimension that matters most in crashes (forwards / backwards) from satellite, augmented with vision or human based left-right positioning. Some trains already have sensors to sense things like leaves on the track to adjust speeding and braking... So the sensor based approach is already there.
Perhaps I am read as suggesting that the problem is easy, and that is not my intention. But for cars this was solved decades ago for routing and years ago for self-driving. I use that daily. Flying is organised with a very clear 6 sigma approach. Crashes are nearly always situations where events / risks stack. Trains (in Spain)...?
Tl;dr - Safety is a function of (human; process; technology) and there is clearly something lacking for trains, when compared to other types of transport.
So that's a lot of questions, that I all can't answer in full.
> Would you mind sharing some more of the why it is still an open problem?
Because for train sensors, there is a small drift which accumulates too much, hence it is synchronized by magnetic position markers in the tracks.
> I understand satellite positioning isn't definitive
Yes, and the point is it might be some solution if we would have the safety systems from 1860. But we do not and hence it needs to be more accurate than the current system, and it is not and in addition also more expensive (and subject to remote influence and reliance on potentially adversary nation states).
> Sorry for the bleak introduction of economics
No, economics is basically the primary constraint for safety. We could pay million people to make sure a single person does not stumble if we want total safety, but that's completely pointless, and also these million people would starve, because no one is producing food anymore.
> But even as a tertiary or lower risk mitigating factor
But for that it's too expensive and still unreliable. There is RCAS[1], which I already linked elsewhere in the thread. That's basically cutting edge and too expensive to introduce everywhere. Also previous safety systems are already not rolled out enough, which is causing these accidents, so rolling out yet another expensive system is not going to improve much.
> But what track you are on, isn't that obvious to the human in the cabin?
Yes, but if it is already known, why use GPS to calculate the same information with more error?
> So could a vision based solution help count tracks from left to right?
If the train driver or dispatcher makes use of vision to assess the train position, the error will be higher than the current sensor/electric-resistance based system.
> Assistant: "US PTC [...]
BTW, that seems to be a verbatim quote from https://www.railwayage.com/cs/the-way-forward/
> US PTC
According to Wikipedia, ASFA being introduced in 1975 is rolled out in the entire Spain network. ETCS which is the European standardization seems to be rolled out on all high-speed lines or currently being rolled out.
> So you use the dimension that matters most in crashes (forwards / backwards) from satellite, augmented with vision or human based left-right positioning.
Duh, that just sounds like trains would be operating blindly in space currently and need to assess their approximate position.
> Perhaps I am read as suggesting that the problem is easy, and that is not my intention.
No, the issue is that you are suggesting far more complicated solutions to already solved problems, with simpler systems in operation for decades. The current system is that nobody in the train even has a say on where the train goes, so the problem you are trying to prevent doesn't even exist. This IS why it's way more safer than a car. There are movement authorities, that define from where you are allowed (and have to) drive with your train. The problem is not, that the train driver isn't able to know where he is and hence drives wrong or too far (that would be prevented by the on-board safety system), but that the movement authority itself is faulty.
On an up-to-date signaling box (withing the past 6 decades), even the train dispatcher is no say in safety questions. You could put a monkey in charge of it. There would be chaos, but they would not cause a crash. The current job of a dispatcher in normal operation is to assign resources to prevent deadlocks and to implement vaguely defined priorities. (Basically the equivalent of the public thinking a programmer is a code monkey, while the actual point is clarifying stakeholder interests.)
The actual issue here is, that while these safety system have a very small false positive rate, they do have a too large false negative rate for there to be an acceptable availability. Hence in the latter case, the human needs to take over and then you are back to a much higher false positive rate. The issue would be alleviated by relaxing the constraints on cost per availability. Either by allowing for less availability or by reintroducing more humans, so that the system situation can be assessed by humans directly.
These accidents are caused as follows: the automatic system fails, because the internal state of the system does not match the actual state of the world. Hence the human needs to take over. But the human also needs to rely on some system to know the world state. Which systems can he trust, given that the whole situation is that the systems report that he can't trust them? So he needs to make some decision and in most cases, that decision is still correct. But there is still an error rate to that, and then something like what we are discussing happens.
> But for cars this was solved decades ago for routing and years ago for self-driving.
This is absolutely not solved for the cars, and to the sense that it is, it was solved and rolled out from the 1870s onward for railways using mechanical computing systems, the switch to using electricity happened in the 1910s.
> Flying is organised with a very clear 6 sigma approach.
You are correct, that aircraft safety systems need to be designed to a higher reliability than railways, because on a rail you can always stop in case of an error, while in the air such a choice doesn't lead to a safe state. But if you compare these safety systems, basically aircraft is operated like railways used to be operated in the 1920s. (My peers actually had a task to compare them and find ideas from one that can be applied to the other. While there is a lot of automation to be taken from rail that can be applied to the aerial industry, there is not really much that can be applied the other way.) It is also operated with the amount of personal than 1920s railways. That's because there is a lot of money in aircraft, while railways are mass-transit and need to be cheap. If you would operate today's railway with the amount of human oversight than in the past, it would be a lot safer than aircraft.
> there is clearly something lacking for trains, when compared to other types of transport.
What are you talking about? Railways are so much safer than cars. https://news.ycombinator.com/item?id=50288518 Yes, there are less accidents in planes than in trains, but this is due to what I already explained.
Thank you for your time and knowledge.
GPS-based PTC absolutely does what you describe. It has long been solved.
No, it does not do, what I described. I was talking about solely determining it inside the train. At least Wikipedia indicates it is similar to LZB or ETCS. I am not familiar with PTC itself.
That's a research topic, because the infrastructure companies would like to not pay as much for maintenance and still have a high sequence of trains. Also with track based train control systems you can only have very high resolution in specific places, where you place your track-side infrastructure, but it would be nice to have that resolution anywhere you like.
PTC is a performance standard, not a concrete system. Some PTC systems do seem to use GPS for train positioning, which does seem surprising from a European train protection system perspective which all seem to completely avoid reliance on GNSS so far.
I guess a much less dense and largely overground network, mainly used by fairly slow moving freight trains as opposed to highspeed passenger connections, changes requirements somewhat.
Thanks.
I mean they are systems that rely on GNSS in Europe, but no safety systems, that would be simply to unreliable. For example I believe the railway announcements in Germany to depend on GNSS. They are also unreliable.
They have a failsafe to use (visual) block backup signaling on that line and used it incorrectly. 200km/h is right at the border where you don’t need in cabin signaling.
oh man, the override thing is super dangerous. I use FSD in Tesla a lot and there is a lot of times I "override" with the gas pedal because I think it phantom breaks or being slow and there were at least 2 cases where there was legitimate reason to stop (person crossing in my blind spot).
Too bad they don't run it with AI. Then it would be nobodies fault!
This really reminds you of the Chernobyl station computer printing all the warnings and recommendations to shut the reactor down when they started playing around with it ... and Comrade Dyatlov overriding it.
Dyatlovs seem to be born everywhere.
Sorry, but ordering trains to drive manually after the system locks itself down, is the proper procedure. Of course you are still supposed to only send trains to free sections, but the error is in that step, not that they ordered a train to drive on it's own.
Also the fallback procedure is also aided by automatic systems and a sizable number of accidents in the past were caused by that information being faulty.
It is the proper procedure, and it does come (in a lot of countries, AFAIK) with a lot of guardrails:
There will be a so-called "train order" allowing passage of a specific section ignoring the safety system warnings, which has strict validity limits both in time and in the area where it applies, usually denoted by specific hectometric mileposts
When cab signaling is involved (LZB is one of these) and it malfunctions, the entire system normally changes to "driving on sight only" - which indeed limits the train to 40, 30, 20, sometimes - 15 km/h (see https://fr.wikipedia.org/wiki/Marche_%C3%A0_vue) or the line gets switched to lineside signaling - if it is available.
I don't know how you could violate all of those rules - both from the driver's side and from the traffic control side - but it sounds absolutely horrible. Like an override of at least 2 (if not 3) very explicit safety margins.
(The following is speculation:) The issue is that there was still a fallback system operating (ASFA), so they likely assumed that there is still a safety system running, while actually it needed to be ignored, because due to virtual blocks of LZB there is then more than one train in a ASFA block. This means that the next signal shows you "clear", so you accelerate thinking you are back into normal operation, but there is actually a train in front of you, just not in the next block, but in your very own block, which is a situation that is not supposed to happen. So the issue is kind of different train control systems interacting disagreeing with each other. Ironically it would have been actual if there would not have been another safety system, because then they would have known, that they need to operate manually right away.
So they have lineside signaling as backup but it does not have blocks? That looks like misengineering, wow. Some reports said that the renfe train rolled for 25km - if this is what their fallback is like - it is absolutely inexcusable. Oh my...
No, the line based control system is the normally used one, because it is required for high-speed. But both systems are safe on their own. I explained it in more detail here: https://news.ycombinator.com/item?id=50298796
> Some reports said that the renfe train rolled for 25km - if this is what their fallback is like - it is absolutely inexcusable. Oh my...
I do not know what you mean with that, and what "rolling" would mean here.
There are audio recording from this incident where you can hear the "train orders" being given and acknowledged.
They were the wrong orders apparently.
Why is that?
I remember a long time ago I was stuck in a train in a field a considerable time because of a similar failure and conductor just wouldn't move unless green
I was expecting the same here, conductor is the first to die so just refuse until the idiots fix their system
> Why is that?
What exactly?
A conductor always just gets a movement order. They are not able to assess whether the track is clear, that's the reason why the signalling system exists in the first place. How they get that movement order doesn't necessarily tell what the security steps were to back it.
Of course an attentive conductor can notice and mention there something being weird ("Doesn't the other train normally arrive first?"), but that's a rare lucky occasion, nothing to be relied on. And they just need to swallow the answer ("No, you go first today...") anyway.
> and conductor just wouldn't move unless green
The conductor won't ever move unless they get a movement authority, which most of the time is a green signal.
so in this case, couldnt conductor just say - make it green, not my problem, staying still until then
Theoretically yes, but in practice if you tell your boss to screw off multiple times a year because they don't want to spend the money to fix the base problem, you will be replaced or fired.
In some industries that is how they keep costs low while pretending they are being safe. They have alarms or procedures that say something is bad or wrong, but fixing some problems costs more money than it saves so they want them to be ignored, and managers will get angry and admonish you or eventually fire you if you keep following procedure and stopping to check problems. So eventually they build a team of people essentially trained to ignore problems. Which is why many oil pipelines still use ancient and unreliable leak detectors, they know those systems are unreliable and the operators will get alarm fatigue from the 200 false alarms, and that way they also ignore when a real problem happens, and worse case for the company they scapegoat the operator. They don't care that 2,000 gallons of oil leaked into the wilderness and poisoned the land if it would cost 2,000+ gallons of oil profit to shut down and repair the leak. They have a financial interest to not fix it.
If i understand correctly, it was green. Meaning the next block was indeed clear but the other train was stopped in the same block and there aren't supposed to be 2 trains in the same block. That's the disagreement between the new virtual system and the old system.
Why would they trust "a random blinking green light", but not a written and stamped order? Yes, they could do that (and sometimes it will actually prevent an accident), but it will be more being a snowflake, then being a decision for safety. A conductor is simply not responsible for whether it's safe to drive on a given track. Their equivalent is not a car driver.
The "random blinking green light" is generally more reliable
Being a snowflake here has 2 benefits:
1. Getting company managing tracks to fix the lights (they need to deal with angry customers and pay off damages for delays and more), so there's a direct path from unreliable lights to economic damage.
2. Avoid crashing and killing yourself and passengers on the offchance the person on the radio is a moron
> The "random blinking green light" is generally more reliable
Yes, but not because of the light itself, but due to the safety steps done before. Which should also have happened before the movement order in any other form.
As a train driver, you do not have the information required to distinguish these situations. If drivers simple refuse all movement orders, besides "green lights", running trains will become a rare occasion and the drivers will simply get fired for not doing their job. _The train driver is not the one who decides where a train goes._ For this safety-relevant decision a driver is (roughly speaking) nothing more than an innocent bystander.
You can think of a train driver more of the person who makes sure the automatic engine works correctly and also has an eye, that nothing weird happens. Most of your train driver education is knowing how the train works and how to get a broken train back working fast. In addition you also learn the safety protocols how you get the information in which state the engine should operate in. This is what train signals are, it's not really the equivalent of a green traffic light for car traffic.
Actually in this case it looks like the error was that the light did show green, when it should be ignored: https://news.ycombinator.com/item?id=50298796
Many train systems have a trip-stop on signals that will automatically activate the trains's emergency brake if one passes a red signal.
It cannot be bypassed, if an operator must go through a red they have to manually reset the e-brake on each car once it passes the signal.
Yes, but just with max. 40km/h
So that's why my train slowed to 40kmph when the Norwegian Telecom died for a few hours 3 weeks ago.
Yes, 40km/h is for driving on sight in most Europa. I think in France it's even 30km/h.
In the UK at night it's walking pace. Literally. The guard gets out and walks and the train follows. (At least that was the case 25 years ago when I had a very slow train journey.)
Depends. For example German Zs1 (https://en.wikipedia.org/wiki/Railway_signals_in_Germany#Zs1...) would give them the full clear outside of stations.
If you're referring to "If the main signal is a (train station's) exit signal ("Ausfahrsignal"), this speed limit applies until the last set of points/switch has been passed by the complete train, after which regular speed is permitted.", I think that means "once you see a normally working signal again, if it's of a specific type (the exit signal), you still have to stay at 40 km/h until you have passed all switches.". As far as I understand the article, Zs1 is mostly intended for very local speed reductions, the kind of speed caution relevant to this discussion sounds more like the Zs7 signal.
[dead]
It should not be possible for one person to make a mistake of this magnitude. In case of a disconnected/off main safety system, the train should be limited on a hardware level to not be able to go over 40km/h.
If I read the description correctly, those hardware level systems were manually overridden, which should only be done in extremis. My guess is that this is going to turn into a normalization of deviance case, since such a cavalier attitude toward safety was unlikely to be one person's first time doing something so dangerous. There was no dilemma here and no time pressure.
Your suggestion about limiting speed after a shut down is a good one. On top of that, the rail operators should have spotted a trend of repeated safety system overrides and investigated why that was happening.
From what I read the opposite was the case. They kept relying on a fallback system, when manual operation was required: https://news.ycombinator.com/item?id=50298796
Exactly this was my first thought! I always thought highspeed trains operate under a model of clear sectors where one train is just allowed to enter when it was cleared by the previous train. From my layman point of view, those incidents point to a fundamental design flaw.
> It should not be possible for one person to make a mistake of this magnitude
Exactly. Which means a whole bunch of other people allowed for this situation to occur. So it isn't one person responsible for this mistake.
Reading the text it seems to me this is due to a very widespread issue in Spain and other southern European countries: people don’t care about the warnings because there are too many false positives.
That’s why people here, when they hear the fire alarm they just wait for it to go off: the probability that it is actually a fire is minuscule… but the alarm triggers a lot.
Not sure how to actually solve this… but I’m also not making excuses for what happened. High speed trains is not the same as a fire alarm in some office building, the people in charge should be held responsible somehow.
I'm a volunteer firefighter in rural NM. We have a commercial property close to us that repeatedly has false alarms on its fire alarm/smoke detection system, to the point where even the best of us are suffering from "the boy who cried wolf" feelings.
Because of this, I discovered that (apparently) NY Fire Department charges $5000 per false call on an alarm system directly connected to the dispatch system.
Somethng to think about.
ABQ Fire charges $300/call for false alarms after the first three. It steps up to $500 after number ten. There is, of course, also the $25 annual permit fee for a reporting alarm system. Failure to comply with these fees is a misdemeanor. Just in case some local precedent will help advocate :)
Honestly it's remarkable to me to think that anyone ever gets to that $500 "excessive" tier, I've had one false alarm where the fire department attended in years of having an alarm system and I was mortified. felt like the biggest idiot in the world.
$500 is probably cheaper than a Simplex service call.
Pretty common in lots of places - you get charged after n false-alarms and are required to fix your broken sensors or whatever is causing the issue.
Sometimes code gets in the way. E.g. in the school I went to growing up they had to have firealarms in all kind of closets and storage rooms. We got at least once per semester a firealarm when some teacher went in to sort stuff due to the dust.
There's generally two types of smoke alarms each with pros/cons: photoelectrical which are very susceptible to dust and ionizing which generally are not:
https://www.nfpa.org/news-blogs-and-articles/blogs/2023/03/0...
I wouldn't think code dictated the alarm type. (I just replaced all nine sensors in my home due to age and went with all photoelectric this time and it was less than six months before I had my first false alarm. Never had any false alarms with previous ionizing type.)
"False" isn't really binary. In my condo building we used to have in-unit smoke detectors wired directly into the building alarm, which meant whenever anyone in any of 200 units burned their toast sirens were blaring. The smoke was real, it just wasn't a threat to the whole building. This would happen once a month or so, and because it's a highrise that sent the big ladder truck down our little street. The fire department got sick of this so we updated a few years ago to have heat detectors that are wired into the building-wide alarm but the smoke detectors only go off locally. False alarms have fallen to basically zero, but the downside is that for reasons not entirely clear to me the new system has to get inspected every 6 months, which includes making sure every one of 200 heat sensors is working, so we get days with 100s of very short bursts of the alarms twice a year.
In my aerospace days, our buildings had both ionization and temperature detectors, plus water flow on the sprinklers. Any detection would sound loud buzzers locally, but two sensors, or water flow, had to trigger before everything powered off. That's common in big installations.
We once got an alarm because the heating element in a computer room air conditioner had turned on for the first time ever. It was defective and started to smoke. Smoke detection tripped, buzzers sounded, lights on a panel showed where the problem was, and alarms went off in the security control center. But this didn't trigger building evacuation or full power down. That took confirmation from a second sensor.
Someone ran into that computer room, saw smoke coming from the A/C unit, and pulled the big red power switch, installed by the safety people, on the air conditioner. Then we had time to shut down normally, the safety people came to clear the alarm, and the HVAC people came to fix the problem. I kept the burnt heating element on my desk for a few days for people to see.
This is typical for big industrial plants. Bad stuff will happen, and you have procedures for it.
A tradie doing some welding in the kitchen I was working in some years back told me this as he disabled the smoke alarm (to prevent a false alert while he was welding): "if you set off a false alert on the fire alarm, quickly set fire to the wastepaper bin - it saves you from paying the false alert fee"
I learned this from my last landlord after I kept causing issues for the whole building by cooking bacon. The detector was installed ABOVE THE STOVE. It was cheaper for him to move the detector than to pay for the repeat call outs over a mildly smoky apartment due to my need for crispy almost burnt bacon…
Consider investing in powerful window fans. If it's setting off a detector it's causing havoc in your lungs.
True, but do consider it is bacon, not exactly the healthiest of foods anyways.
Pretty sure that'll just drive people to turn it off. Or if they can't, try and set a small fire or something to get out of paying the fine
These are elegant solutions imo.
For example, my condo in Toronto charges $800 per false call.
I'm surprised the strata was able to offload that to you. Most building corps are in charge of maintaining the fire alarm system especially if it's a tower (rather than just a SFH community under a strata) where unit to unit spread needs to be addressed promptly.
It should probably be X$ per alarm regardless of it being false or not, minus first N per year.
Why? The goal is to incentivize property owners to fix broken systems not to pay for the actual cost of responding to a real call. That's covered by taxes.
Depending on who is paying and how much, someone might light a small fire to avoid the fine.
Arson when the fire department is already on the way. Great idea! Firefighters hate this one simple trick.
> [...] not to pay for the actual cost of responding to a real call.
Not true for all places. There are places where the callee can be charged for the costs of a call and the owner of the building has to pay the firefighters (well, his mandatory government-issued insurance will pay). It's moving bills from one stack to another, but it's not free as in beer.
I'd interpret the "minus first N per year" to mean that you get a few "free" fires per year - but after that your habits filling your closets with oily rags, overloading electrical extension cords, and smoking in bed will start to cost you.
Fire is one of those things that really sucks for you - but also really sucks for your neighbors.
You never want to supply any reason for someone to demur about reporting a fire.
I'm sure someone somewhere will interpret it a 3 free demos of firefighters at home for their kid, with sirens and light, pretty entertaining (It's a reference to the Freakonomics study that, if you make parents pay by the minutes for being late getting their kid, they basically take the fine as a slightly expensive childcare facility).
That will also decrease the number of true positives
https://en.wikipedia.org/wiki/Alarm_fatigue
> Healthcare: The constant sounds of alarms and noises from blood pressure machines, ventilators and heart monitors
> Amber Alerts: sent to cell phones as far away as [...] 15 hour drive
> "known to the state of California to cause cancer"
etc
https://www.youtube.com/user/USCSB
See also a million USCSB industrial disaster postmortems
I've had the thought that: "known to the state of California to cause cancer"
Should probably be: "known to the state of California to be a class N carcinogen"
I've deactivated my (EU equivalent of) Amber alerts the second they sent ONE irrelevant notification. It took me a few tries but fortunately they also tried their system a few times A WEEK during installation.
I prefer to risk my life every day at not knowing what the government thinks is really important for me to know.
It just means that a false positive rate is as dangerous as a false negative rate. Just issuing a warning doesn't come for free when you are designing a security system.
This is very well illustrated in the fable Boy who cried false positive.
that sounds like a character from Harry Potter and the Methods of Rationality.
Any lessons in HPMOR are also going to be found in traditional works.
I was interested to find a discussion of the trolley problem in a book of out-of-copyright Norwegian-region folk tales (in English translation) that Amazon recommended.
False positive? How did you know?
Something similar is happening in my region after the flood that happened two years ago: The alarm was raised late; Now, even mild rain is triggering an alert.
Guess whats the consequence of that? Less and less people pay attention to the alerts.
What you mention makes me frustrated, as it also signals the infrastructure is so underdeveloped even moderate rain grinds daily life to a halt: kids don't go to school if rain is forecast. We need to elevate our professionalism in Spain and not accept African-level infrastructure in the 21st century. It's really sad within one continent we have countries producing AI and photon computing, and others can't even figure out how to put gutters and rain drains.
This is not what it is. The infrastructure isn't THAT bad.
Government officials are terrified of taking the blame for another Valencia style flooding catastrophe so any hint of rain blasts the mobile phone emergency system. Once the alert has been sent the officials can feel safe in the knowledge that they've done something.
And ES-Alert is all or nothing. All calm or end-of-the-world. There is no option to send moderate level warnings, the ones that can be disabled. It always uses level 1, even if EU-Alert also defines 2-4. Population can not act as filter like a farmer chatting with non-farmers and saying "tomorrow I have to move the cows because the warning".
To be fair, these messages we receive about impeding heavy rainfall links to the weather service which does group things into yellow/orange/red warnings, so you can see if it's actually so important or not.
But yeah, this is after the "EVERYBODY IS ABOUT THE DIE" sound alarm that triggers on everyone's phone at the same time, then you get see that they're warning about an orange weather warning, or something like that.
Is it ideal? Not really, but better than nothing. In Maresme-area we have serious flood-risk almost every time it rains, as it fucking pours when it rains, and the warnings seemingly actually save lives today.
Full alerts for everything create alarm fatigue. People will ignore them, like in the wolf tale. Maybe figure ways to disable it completly, level 1 too. Faraday cage as last resort, "let's sleep and to hell if I die".
Getting a maximum level message and then having to check another thing is not the best way to do it. The messages should be useful without further checking. In case of phone network overload, they can be the only thing the user can read.
Based in the description of levels for EU-Alert, Spain could be using it wrong. Evacuation orders are under level 2. Multiple levels are there to prepare people and give enough time in advance. It also means politicians should be less terrified to use it, as long as they use the full range avaliable. Not everyone will enable all 2-4. It will depend on how many times they are abused and how nasty the sound is for the minor levels... (checks wiki) same for 1-4 seems common... which is an oversight of the standard. EU should correct that, or all phone makers workaround it by adding a third setting for levels 2-4: on, off, on-without-scaring-user.
https://en.wikipedia.org/wiki/EU-Alert
Spain leans too much into kakistocracy, IMO.
> Full alerts for everything create alarm fatigue.
Agree, I don't think any country has "full alerts" for "everything", Spain certainly doesn't, although currently they're over-warning for the rain rather than the opposite, as "the opposite" last time ended up in a large catastrophe. I get it.
> Based in the description of levels for EU-Alert, Spain could be using it wrong
Shouldn't you first read descriptions about how Spain is using it actually, before arriving at such conclusions? Seems you're building this point of view based on anecdotes, mine included.
In the spirit of what we're discussing here, shouldn't you actually validate and verify before you share this at large?
[dead]
In my area it is that bad, when the torrential rains come yearly, streets become rivers, with trash cans floating. Is it not like that in your place?
How can you even claim infrastructure is not bad in our country?
Agreed
https://en.wikipedia.org/wiki/Alarm_fatigue
To your point, a contributing factor here was the front train couldn't start due to either a minor or bogus "security" alarm. Whatever alarm that was, it wasn't worth triggering such a tragic accident.
To be fair the Spanish word for security is the same as the Spanish word for safety: seguridad. It could as easily be a ‘safety’ alarm and a mistranslation.
I do not Spanish to assert whether it is true, but it is often said about German and there it is not true. I think the issue, that it is often mixed in daily speech, but that's true for English as well.
I'd bet this "safety" alarm was minor or bogus, not worth risking lives over.
The fix is to do things right every time, and if we're losing money to false alarms, spend more money to make sure the false alarms stop happening. Make it a new persons problem rather than just making someone "used to it" and start ignoring it.
> Not sure how to actually solve this…
fix the alarms? I only had one false fire alarm in my life. and thankfully zero real ones. it's possible.
do fire drills? if alarms get ignored, and you can't reduce the false-positive rate, then introduce fake alarms and monitor the response?
Then what? In this case, Suspend the train engineer? The company itself is incentivized to ignore the warnings to keep things on track.
(...on track)
>The company itself is incentivized to ignore the warnings to keep things on track.
If ignoring an alarm and keeping it on track "counts" as having kept things on track, there's the perverse incentive. Change incentive to mean a train kept on track after ignoring an false alarm was worse than a late train.
Now the company is as focused, or more, on fixing the bad alarms, than keeping trains on time.
Finding incorrect incentives is usually not that hard.
A really important strike that Spanish pilots should do, is striking by respecting the red lights and refusing oral overrides. Hours of delays the first day, trains at the wrong place in the evening, we'd see exactly which regions are affected, and either we agree to repair things or we just leave trains to rot at the red lights rather than risking 900 people's life again (x2 trains = 1800).
Ultimately red signals due not fall from the sky. They are controlled by the same people that issue oral or written movement authorities. So focusing on just the oral movement authorities doesn't address the real problem. In the end it is the same signal in a different medium.
> That’s why people here, when they hear the fire alarm they just wait for it to go off
This literally happened to me last night, I was having dinner at my apartment, and suddenly I start hearing a smoke alarm, but not quite inside the apartment, I just kept having dinner thinking "bah, someone probably burned a toast".
Then it wont stop, I walk to door and hear people talking, still don't bother enough, wait a few minutes, then go out and my neighbor said "there are three fire trucks down there, I think it's a real one" hahhaha
The hallway was kind of hazy and smelled like burnt food, for sure... so I just grabbed my laptop and went out hahaa.
My apartment has both a local fire detector and a building fire alarm.
The building fire alarm is soooo loud and obnoxious, you _want_ to leave the building at speed. (Which I think is the right way to do it.)
Because they don't get held responsible enough for bypissing procedures. Some system are too complex for fully automated operarions, and the human need to play along.
Safety culture is blameless, but only if everyone plays along.
"bypissing procedures"
I know that this was likely a typo, but it is also a genuinely great word for the sort of attitude related to these situations.
Issue and enforce fines for every false positive alarm, and problem will solve itself.
Or, how about, issue a mandatory repair order and follow-up inspection for every false positive alarm that appears to be due to equipment failure. The follow-up inspection checks that the alarm has not simply been disabled.
The escalator failure in 2018 in Rome that caused severe injuries to 24 people was found to be partially caused by safety systems being disabled and overriden because they caused too many false alarms.
https://en.wikipedia.org/wiki/2018_Rome_escalator_accident
In a modern passenger rail control system[0], ignoring the warnings results in automated responses like dumping all the hydraulic pressure, setting all brakes at once. This will have two effects: (1) the wheels will slide on a fixed spot, grinding a flat spot, and (2) the operator will either require central control to remotely release the emergency brake state, OR the operator will have to continue at the safest (lowest) speed.
What I'm saying is: false positives should not be ignorable, and modern systems take that choice away (at least, just before the situation becomes unavoidable in worst-case analyses).
That being said, previous fatal accidents in Spain's high-speed rail have resulted in "primitive" uncontrolled areas between controlled areas. Those SHOULD NOT exist. You are essentially saying "lives don't matter that much here " ($/life).
[0] I work in rail safety.
[flagged]
[dead]
I think aircraft are so safe in this regard because, essentially, they are required to use a single international collision avoidance system that is well defined. And modern cars have AEB systems built by vendors aiming for commonality to meet worldwide rules.
But train traffic systems seem to be a hodgepodge of different systems, perhaps locally grown and driven by the local vagaries of politics and rulemaking.
What a surprising inversion of expectations regarding safety.
I've been in a near miss in a plane: the pilot in the other plane was clearly inexperienced, not following radio protocol, and we got within O(200m) of a head-on collision which certainly would have been fatal for everyone.
Thing is, the sky is big. You can have non-fatal near-misses that everyone learns from. In trains they literately railroad you into a head-on collision when things go wrong.
I believe that aviation is safe because of standardization, but there's also just a lot more space to almost mess up.
The newest signaling systems, ETCS and related sibling CTCS, are quite standardized and interoperable across international borders, so this is an area the EU especially has been making big strides on.
TCAS has its own flaws, especially around take-off and landing where it's completely disabled. Which is exactly where it matters most.
I can't imagine what every passenger who survived and the families of those who passed are going through. Such a catastrophic incident with multiple human failures is so tragic and so needless. From the controller to the driver, every single one of them should have said hey we shouldn't just ignore a signal and should investigate why it's on first. For this to be such a quick decision suggests it's not a one off. I would be extremely interested to see how many near misses or ignored signals there has been across Spain. The crash earlier this year was due to inexperienced workers and it seems as if significant training improvements and protocols are needed.
To have had this many incidents compared to other HSR networks around the world gives all the signs of a classic case of normalisation of deviance.
Sadly we'll probably watch a lot of individuals being blamed/scapegoated for systemic issues, but hopefully even Spanish politics can organise a proper investigation after this many deaths in a single year.
Plenty if reports of lack of maintenance, overwork in all levels, blame culture, etc.
Also systems in place not trusted by the workers, which means they're used to bypass them.
It's a systemic failure.
If as a driver you get told by the control centre to get the train moving again at maximum line speed, surely you should be able to trust that it is safe to do so?
I don't see how this would fall on the drivers at all.
My thoughts as well. It appears that such signal failures happen so often that the controllers regularly let trains run through red under verbal authorization. I don't know the exact protocols, but I would expect a driver to ask for confirmation, as happened here, and then trust the control centre. However, there is clearly a huge systemic problem, with added complexity for the controllers, and there should at least be double checks in the control centre.
The person who controls whether the light shows red or green and gives verbal authorization is the same. It's both a tool, to transmit the same information.
Same information, no.
A person saying you have a green light when you have a red light is not the same information at all. The probability that something has gone wrong and will lead to disaster is many many times higher.
That's also true, but you should also be able to trust written movement authorities, otherwise why have them in the first place?
The right move here would've been to accept the suggestion to drive the train, but not accept the suggestion to drive it at normal speed. The driver should have driven at 40km/h.
It's not a suggestion, it is an order and a movement authority. That would have been nice, but the drivers are not required to make such a decision. The moment you issue a movement authority, you must assume the train operates with the max speed and distance of it immediately, and that must be safe. Train drivers do not decide for the speed and trajectory a train is going to take. They are responsible for that their train drives safely inside the movement authorities given to them, they are not able and hence not responsible to ensure the safety of the network. They are more equivalent to a car mechanic, not to a car driver.
You know who else was "just following orders"? Nazis.
If someone gives you an order that you know has high risk of killing you and your passengers, you can just say no and not do it.
+1 high speed should only be enabled by multiple redundant safety system being operational. Otherwise, it needs to operate at line of sight speeds.
"not high-speed" != "not line of sight" High speed is the speed when you can no longer safely drive by signals, not the speed when you are not able to safely observe the breaking distance. Trains are not supposed to operate under the latter (normally).
Trust but verify. You wouldn't drive your car into a lake just because your satnav tells you to, would you?
As we also know from the aviation industry, controllers are human and therefore will make mistakes. A controller shouldn't issue a wrong order, but a driver also shouldn't accept an order they aren't certain about, and there should be technical systems backing both sides of that up.
It doesn't "fall" on the driver, but it doesn't "fall" solely on the controller either. It's a systemic issue, and many pieces have to fail for a disaster to happen.
You can't verify, the rail has curves and other stuff that block sight.
Also stopping distance for trains is huge. This video for high speed trains says 5km (3mi) https://www.facebook.com/Renfe/videos/%EF%B8%8Fcu%C3%A1l-es-... That is probably at full speed, but IIUC the accident was at half speed so the distance should be like 1.2km (0.8mi).
The driver tried to verify by asking a confirmatory question from the controller. So clearly there are in fact ways to verify, even if we can not achieve 100% certainty.
The driver also could have refused the order to drive at normal speed, and instead follow the protocol which caps speed to 40km/h in situations like these.
> The driver tried to verify by asking a confirmatory question from the controller. So clearly there are in fact ways to verify, even if we can not achieve 100% certainty.
Checking the same source is not a verification. (It verifies the order, not the ground reality.)
> The driver also could have refused the order to drive at normal speed, and instead follow the protocol which caps speed to 40km/h in situations like these.
I agree. It depends on the culture. I think airplane pilots have full authority to stick to the oficial procedure and are fully supported after that. I'm not sure what happens is a train driver there refuses an instruction.
Anyway, a few years ago we had a big airplane accident and part of the problem was that crew learned to ignore the alarms https://en.wikipedia.org/wiki/LAPA_Flight_3142
> As we also know from the aviation industry
The aviation industry operates like the railway industry ~1920 (somewhat by necessity).
> You wouldn't drive your car into a lake just because your satnav tells you to, would you?
You are assuming a train driver is equivalent to a car driver. He's not, the analog would be more a repairmen that you always take with you on journeys.
A train is not a car. They accelerate and brake very slowly, you need kilometers to brake at high speed, it is impossible to check manually.
> From the controller to the driver, every single one of them should have said hey we shouldn't just ignore a signal
A train driver has zero insight in what is going on and where other trains are. They do need to trust the orders they get, if you want to question every order you will never start to drive.
The train driver's job is to say: "it's red, I'm no moving, not my problem, you make it green if you want me to go"
That's why it's a union job
Also he's the first person to die on accident so it's that and the safety of everyone else
They do not 'need' to follow others, they just need to refuse unless all safe and green.
If they never start to drive it's the companies problem to deal with angry non-dead customers
That is not how the procedures work, so the driver would be fired as soon as they did that.
Every train network has situations where drivers are authorised to proceed against a red signal. Not usually at full speed though.
They wouldn't get fired. They are protected both in the US and Spain.
At most face unlikely discipline.
Here they would even have valid reason to refuse - order was given for full speed, regulation says low speed ready to stop.
So a "No, i'm not doing that, you're moron" would be justified.
No, he would get fired, because that's not his job. It would be like the machine engineer on a race track refusing to fix the ignition, because somewhere on the track he doesn't see, the asphalt might be broken.
Do train conductors not have the final authority in safe operation the way airline pilots do? If so that is absolutely insane.
The equivalent is a tower telling a pilot they should land and the runway is clear, except it isn't. And there also being fog, so you can't see it before it is too late. And you can magically not veer of. Planes can go around in three dimensions and try to rise again, a train basically moves in one direction, if they see the problem, it is way to late.
There is no point in the train driver making a decision about where the train goes, because he has no information for that decision. Hence it is also not his job. Like, yeah if he has reasonable reasons to think there is something wrong, nobody is going to fire him, but what is the policy that allows him to do so, while not just randomly deciding to not drive today? There is no difference for him, until he is about to die.
Pilots have the final say to refuse or stop a flight for any safety reason of their judgement... even if others tell them it is safe. And they are protected not by policy, but by law in doing so in the US and most countries.
But they also have the means to do so. If a train driver has a reasonable doubt about safety, nobody is going to punish them. But there is simply no way the doubts are reasonable, so it becomes just randomly doing otherwise, at which point the question is asked whether you are fit for the job.
I fail to see how following normal safety protocol of proceeding at 40km/h would have been indefensible or unreasonable? They are the rules of operation for this scenario and exist for the exact reason we are reading this story. I can’t think of anything more defensible than “I am not going to break safety rules”
Never would a pilot be reprimanded for refusing an ATC order to move their plane in a way that violates established protocols
I don't know, because there is no actual proper safety report yet. That certainly sounds reasonable, but obviously the dispatchers though otherwise. Likely because they did not actually understood that there was a problem, but that it's just that annoying bug again.
>No, he would get fired, because that's not his job.
Then what the fuck is this country even doing with trains.
No, no no, no no no.
Interlock safety systems exist for a reason. In any safety system where the interlock is down you do not resume standard operations. Ever. Why, because there is a book with blood that is 10,000 pages deep that describe the horrific accidents that happens when you do. Might as well be an axiom at this point.
>because somewhere on the track he doesn't see, the asphalt might be broken.
Again, stay away from analogies and safety critical systems.
The person behind the break and speed control of the train is no different from the captain of the airplane or the captain of a ship. They have full authority control to stop the train and refuse to move it until they are sure of the safety conditions. Any attempt to fire them should result in an immediate stop work from every employee in the system until they are put back on the job and the safety concerns are resolved.
> Then what the fuck is this country even doing with trains.
That has nothing to do with a single country. Above 40km/h you are not allowed to drive on sight in a lot of countries. I don't know how it is in Spain, but in Germany, you are also not allowed to drive via track-side signals above 160km/h. You can simply not decide about where it is safe to go from inside the train.
> Interlock safety systems exist for a reason
Yes, and that's a job of the dispatcher, not of the driver.
> In any safety system where the interlock is down you do not resume standard operations.
That might be nice in theory, but that has not much to do with reality. There is simply always something broken. It doesn't even need to be a signal, way more often a crossing doesn't properly report that it is closed.
> The person behind the break and speed control of the train is no different from the captain of the airplane or the captain of a ship.
Nah, it's very different. For one a captain or pilot can control the direction of the ship/plane. They can also determine whether their operation range is clear. A train driver can do none of these things. What's the point of making them responsible for safety if they neither have the knowledge, nor the lever to change things? Trains are more secure, because the driver is not responsible for the infrastructural safety, not less. That includes whether the track is clear or not.
So it’s clearly an industry wide problem then. The more I read the more thankful I am California can’t build high speed rail.
Except that car vs. rail deaths per 100 million person km is 0.7 vs. 0.035 and per 100 million person hours 25 vs. 2 (https://etsc.eu/transport-safety-performance-in-the-eu-a-sta... or https://injuryfacts.nsc.org/home-and-community/safety-topics...). It's more of an human wide problem, rather than industry wide problem. If you want to be safe, you need stay at home, but that's also not going to be actually safe.
The point of this discussion is that people blame the train driver or say "use self-driving", when that is not going to solve the problem, because that's not where the error is. The error is not there, *because* for rail making errors operating the train is not going to cause an accident (most of the time), which is not the case for cars.
The driver always has the final say on whether the train is safe to move. They are not just a button and lever pusher. They have to analyse whether the decision is correct. Hence why I stated there were multiple points of failure. The controller and the driver both went with full speed despite it being completely against regulation on a red signal.
> They are not just a button and lever pusher.
I agree. But the decision whether all switches are locked in the correct position and that the track is clear, is not one that he is supposed to make and he also doesn't have the information for it.
> The controller and the driver both went with full speed despite it being completely against regulation on a red signal.
Going full-speed in the case of a red signal is not necessarily against regulation. Also the information of "red signal" or "you can go" is both a signal from the same source. There is no information for the driver to make a different decision over the dispatcher.
I can't comment about whether the current accident was caused by going against regulation, and more important by whom and against which. We need to wait for the proper safety report, not for a BBC article. If you take the latter at face value, it would mean there are clowns operating, which I am sure, is not actually the case. The real error is always way more subtle, otherwise it would not have happened.
> The train driver's job is to say: "it's red, I'm no moving, not my problem, you make it green if you want me to go"
A written movement authority is a signal as well in railway terms. It's more like "I don't trust your second traffic light, that you placed next to the normal one, because the normal one is broken".
The even more insane thing to me is that the controller knew that there was another train in that block, knowing it was no signal failure. The driving train should’ve never been commanded to continue on full speed by the controller.
Trains shouldn’t even be manually driven in 2026. We have self driving cars now which is a way harder problem to solve. Relying on a system of signals and driver attentiveness is archaic.
> Trains shouldn’t even be manually driven in 2026
Potentially, but the point is that signallers should physically be unable to allow trains to proceed, and drivers should physically not be able to override them. British signalling from the 1800s has physical interlocks; this isn't a matter of manual versus automatic train operation. It is clearly systemic.
How do you pass a defective signal then? How do you couple a second locomotive? How do you add cars?
LZB does cab-signalling and continuously supervises speed and braking curves. Combined with AFB it can accelerate and brake automatically to LZB targets. So regular operations are already partly automated (and have been for a long time). The system already doesn't rely on perfect driver attentiveness for safety. The driver should still watch the track ahead, but trains usually can't stop within line of sight anyway, so for separation we have to rely on the signalling system.
Drivers are absolutely still needed for other parts of the operation though, like working stations, shunting, and perhaps most importantly handling irregularities. Faults can happen and you don't want the train to be stuck out on the track for hours. Instead, it makes so much more sense to either fall back to lineside signals (often accompanied with a point-based train protection system) or driving within line of sight.
Driving a train and driving a car are two completely different challenges.
If signaling worked properly then it wouldn't matter whether the train was driven autonomously or not, the "problem" becomes trivial. Establishing and continuously verifying that signaling is working properly is the hard part.
Without signaling you're limited to crawling speed just like humans are when they don't have any signalling .
Yeah, if you completely ignore availability as a problem. The state of the art self-driving technologies we have today only work in some conditions, some of the time.
The reason vehicles are still driven manually is because humans rely on transportation every day, all of the time.
We do not have self-driving cars in all environments that clear the necessary security regulation! Also the socially accepted number of deaths due to trains is way below that for cars. The current accident is just a Tuesday for car traffic. (Spain recorded 1785 road deaths in 2024[1], that's 4.9 per day) Detecting objects (and future objects!) on a train track is still a hard problem.
The current system is basically that the train is driven both automatically and by a professional attentive driver at the same time. Changing it to just the automatic system is going to reduce safety. Also the real world is way to messy to reach acceptable availability rates with only automatic systems.
[1] https://www.itf-oecd.org/sites/default/files/spain-road-safe...
> Detecting objects (and future objects!) on a train track is still a hard problem.
In this case the “object” was another train. That’s not the “hard” part of the problem. This sounds like an apologist comment.
What difference does that make, genuinely?
Are there systems that can warn drivers and prevent collisions without external signaling, like ACAS?
Yeah, that's a solved problem. Did you even read my whole comment? I answered why "just use the system from self-driving cars" wouldn't work and in fact would be less safe than the current system.
What's the stopping distance of a high-speed train at full speed? I don't know, but I bet it's kilometers, not meters.
Detecting an object on the tracks 2 km away (say), as opposed to beside the track at the same distance, is in fact a hard problem. The tech used in self-driving cars is not going to solve it.
I'm totally not on the spectrum so I've only watched about 80% of the Plainly Difficult channel on YouTube, but if you want a painless and entertaining, if you're into that kind of thing, way of learning about train signaling and safety, and how safety systems have evolved, I highly recommend it.
tren
Obviously train safety systems should be formally verified and eliminate human error (only permit safe leeway to humans).
But apart from the safety mechanisms, there is also the concept of securing passengers.
What we know so far is that originally, cars weren't equipped with safety belts, until they were.
Imagine a thought experiment: the trains are equipped with safety belts, on a voluntary basis. Initially everyone scoffs at them, except for a minority. Time passes until an accident happens. Then everybody learns that the forward facing passengers that were facing forward had the lowest casualty reports, next are the people facing backwards, since a decelerating train mostly just pushes them harder into their own seats, and their safety depends on the discipline of any occupant who happens to sit on the forward facing seat. People start preferring the safest seats forward facing with belts (you only depend on your own discipline). People sitting in a forwards facing seat who refuse to put on the belt will be asked to find a different seat or put on the belt. In many places it will turn out a lot of passengers are standing upright "by necessity" even though no law of nature or authority mandates or permits railroad operators to sell more tickets than they have safe seats. But first that would require figuring out what new lucrative job prospects can be opened for insurance companies, and any population around the world may think out loud why insurance on offenses appear to be legal and often even encouraged by court systems!
It turns out its never really possible to draw an objective line between accidental and intentional offenses, so at a fundamental level we should either permit insurance that covers you when caught committing murder, grand larceny or what have you (done); OR we should ban all insurance from covering offenses (accidental and intentional). Insurance "allows the system to stably continue without shocks reverberating through the economy in the face of adverse events" is a poor justification for permitting the insurance of offenses, especially since it typically results in the wrong questions being asked, and instead of figuring out who paid the least to insurance scams, perhaps some real questions could delve up real solutions that save lives instead of defend the income streams of lawyers profiting on the misery of civilians.
Earlier thread:
What we know so far about Spain train crash - https://news.ycombinator.com/item?id=50286197 - Oct 2026 (84 comments)
This accident seems to have been caused by human error. Moreover, (from the news) the working arrangements and procedures seem to be such that in the event of a controller (or driver) making a mistake there was no automatic failsafe protection in place to stop the Renfe train.
An automatic failsafe mechanism should be installed to stop/cut the power to the moving train in situations like this, it should work irrespective of any instructions or actions by the controller or the driver.
When safety parameters deemed the Renefe train to be travelling too fast and too close to the Iryo one it should have stopped automatically. Such safety measures aren't rocket science but straightforward engineering, (interlocks, etc.). Over the years there have been too many accidents in situations such as this for such equipment not to be installed.
For a moment I visualized myself in that busy control room and easily making that mistake even though I'd made the correct decision hundreds of times previously. Not only are 69 lost lives a terrible tragedy but the life of the person who made this momentary slip has been ruined forever.
It should not have been allowed to happen. It's worth remembering that Westinghouse brake systems (which are well over a century old) automatically default to on (stop) when there's a fault, and the high speed (now decades old) Shinkansen has very sophisticated stopping mechanisms and has never had a major crash. The question is why such safety measures weren't installed here.
Fundamentally I don't know what the cause is, because there is no full safety report yet, but I doubt that it was a driver error alone, which is what automatic braking systems at signals are actually targeting.
There are situations where the dispatcher needs to instruct the driver to ignore the road signals and hence also ignore the automatic enforcement of the signals. It shouldn't happen to often, but the real world is always more messy.
Some were installed. But what wasn’t there was the old mechanical ones that cannot be overridden, like ATS that blows the air if you pass a red signal.
https://en.wikipedia.org/wiki/Automatic_train_stop
Any failsafe that can be bypassed manually is just a deferral to humans and eventually will result in disaster.
I still don't know why the train drivers don't have a simple data: The distance to the train that is next in in that railway in its direction. With this information, that accident will have never happened.
Signalling systems are never simple.
The LZB system, which broke down, had the data you describe. It knows when trains pass over fixed sensors so it computes where they are, and sends data packets to specific trains informing them their current speed limit, and the next, and how far away that is. If the driver won't slow down, the train will.
When LZB broke down, they had to switch to their other system, BSL (fixed block signalling: https://en.wikipedia.org/wiki/Automatic_block_signaling). You can then know the distance to the next block, and if it's occupied or not, but not where the train is inside the block. You can only guess.
In the next few days we'll likely find out if the control centre also fucked up the block signals...
BSL knows there two trains are in the block, two have entered and none have left. When LZB is running, it overrides BSL and allows both the trains in the block. But with LZB down and BSL taking over, it should have raised alarms everywhere that there two trains in a block.
I'm wondering why don't they use GPS as a redundant data source too.
There is a system that does exactly that, its called ETCS Level 2: https://en.wikipedia.org/wiki/European_Train_Control_System But its not so wide spread unfortunately. Also if it fails then you are back to operators taking decisions
They do, in an extremely expensive system called ETCS, which everybody is aiming for but it takes a huge pile of money and years of work to ever get there. Which is why a huge portion of rail networks don't (yet) use it.
The issue is not the idea, it's that railway signalling systems have to be an interoperable, multi-vendor, tested and accredited pile of little ideas like this, that have infinite numbers of ways to go wrong and have corner cases by the metric ton. And it's not like coding a website, where you can just ignore standards and focus on your case. "Your" rails need to support other people's trains. "Your" trains need to run on other people's rails. Even in a fully closed system with your trains on your rails... who's going to be your equipment maintainer and supplier for the next 30-50 years of their operational life?
Read this article and notice how often cost and project overruns are mentioned:
https://www.railengineer.co.uk/etcs-preparing-the-east-coast...
> The use of ETCS is driven by deliverables, not the technology but concerns exist as to why it is costing so much. In Europe, the success of ETCS is driven by country mandate and a system authority which helps to create a stable ongoing work plan.
> There is also the question of strategic safety versus functional safety, namely fundamental versus site specific. Over-specified ETCS undermines the strategic safety and functional over scope and so drives unaffordability since the accreditation inflates the cost.
> Cost must be driven out of ETCS if it is to be the preferred system for ongoing renewals. Despite interoperability requirements, there is risk in always using the same supplier. There is no common way of delivering ETCS. Having it as an overlay system will always be expensive and not beneficial to the business case. Lessons have been learned from the application of ETCS to the Cambrian route, the Thameslink central core, and the Northern City line from Finsbury Park to Moorgate but all of these have only one type of rolling stock in day-to-day operation. Equipping a mixed traffic railway as in the ECML makes it much more difficult.
Because the issue is knowing where the other trains are, not yours.
TCAS has solved this for airplanes. It wouldn't take much to modify the system for trains so that, in the least, it notifies when an unexpected train is nearby. A little more logic could allow it to verify which track each train is on.
This would fail at the first hurdle.
1. Planes can determine their altitude. Trains don't know which track they're on. You'd have to re-engineer existing signalling systems designed around the inverse. Track transponders and axle counters know which trainset passed a specific piece of track, but the trains don't know which track transponders link together on the same track. They don't even know which track they'll be going down next because that's up to the signallers controlling the points, not them.
2. Planes fly in the air and can send omnidirectional radio signals with little to no interference. Trains run on the ground, often in valleys and tunnels. There is no guarantee that trains broadcasting "I am here" signals can be picked up by the next train within the stopping distance.
Many trains did broadcast "I am here" signals, but once speeds got faster, the broadcast range (about 1km) wasn't far enough for a train to stop in time before a collision, which is why trains need to communicate, using on-track wires that run the length of the track, to each other and central control. Which therefore means that the central control system needs to work, and when it doesn't, the trains have to stop.
Planes use radio signals because they don't have signalling cable following their entire route. Trains do, and it's usually much more reliable than radio.
Obviously it wouldn't be "just" GPS. In the simplest example - if I choose to add a friend to "Find my Friends" on iPhone, both our locations are visible to each other via GPS when our phones are on.
"Just put airtags on all the trains"... obviously simplistic but I get your point.
> our locations are visible to each other via GPS
... via mobile data or WiFi, you mean. Whether it uses GPS, Galileo, track measurement points, or even "driver calls the control centre to update their position" doesn't have much to do with it. What I assume you mean is redundancy so that two or more systems can communicate train positions independently, where the more relevant problem is how to get the data across in a timely manner. The driver of the stationary train called in their position and it wasn't used: it's a communication problem, not a "where am I" problem. Idk why the focus on GPS and using GPS for communication (which GPS can't do, and newer systems only do at very low speeds for emergency communication) but finding one's position is usually not the problem
This isn't as simple as a Disney monorail. There can be many tracks, multiple routes can share some segments of track, trains can go from one track to another, tracks can be stacked on top of each other on some bridges and go inside tunnels so GPS/GNSS is insufficient, the train in front of you can stop for emergency, etc. It's like the aeronautical collision issue, but the tracks are in charge of determining and transmitting position.
General case, it's not that simple. Say there's another train a mile ahead of you...but it's on a siding. To compute the effective distance, you'll need to know the positions of the switches connecting the main line to that siding. And switch positions can change far faster than you can stop, even if the other train doesn't move.
There's like 100s location data on each train, do they not just have a map of where all nearby trains are.
If it was so easy then this never would have happened.
So based on this, the safest place to sit is presumably the middle carriage?
That has been true in the last century, but now the classic collisions are way rarer. See https://en.wikipedia.org/wiki/Eschede_train_disaster .
I would actually sit in front now. Sometimes you would be able to still get vital information and being actually able to act. But the safe decision would be no to enter the train.
> But the safe decision would be no to enter the train.
You might just as well never leave your bed, that's even safer ;) Train travel is much safer than travelling on roads, and in the same ballpark as commercial flight.
> Sometimes you would be able to still get vital information and being actually able to act.
Optimistically assuming you have a minute to react (I'm imagining closer to 10s), what could one possibly do?
Yeah, I would also guess about that time. Run away, jump out of the train, duck behind some larger wall, pray.
That's where the bus hits you.
Human override could have 2 keys that get turned concurrently at two locations by people who never meet each other, never talk, each has different job incentives.
This was a terrifying read because I initially read about this at the air port in Madrid after taking a Renfe train from Alicante; literally at the same time...just a different line
The main problem comes from under maintenance. I am spanish, we have known this for years.
15 or 20 years ago when I took the train it worked well.
Now there are more trains and they increased the traffic like by 70% if I am not wrong and the budget for railway infrastructure by only 17% and it seems to not scale well enough, for whatever reason I do not know all the details.
There are a lot of railway tracks that are not in good state so speed must be lowered. There are incideents and delays routinely, all the time.
This did not happen until like 10 years ago and it has gotten worse and worse since then, not only in high speed trains.
The roads is a mess also: 52% of infrastructure for roads has bad or very bad defects in it.
The thing is that we have a record in government incomings and the services, ALL of them (healthcare, roads, infrastructure...) slowly collapsing.Part of the money is not going to the right places. I think that nearly 40% of the budget goes for retired people. We have 9.5 million pensionists in Spain.
We have to change that system and rationalize government spending and welfare or eventually everything will collapse.
I’m very wary of finger-pointing like your comment that ultimately serves to advocate for cutting quality of life for citizens.
Roughly 31% of Japan’s budget goes to social security. They don’t have problems keeping their high speed trains safe.
Cutting pensions won’t make trains safe.
I will also point out that on its own without further context, a high percentage of government spending going toward something doesn’t make that spending irresponsible or misappropriated. In the United States, a very high percentage of federal taxes are spent on Medicare and Social Security. But it should come as no sirprise that a very large percentage of federal income tax revenue is directly appropriated to pay for those things.
Pension expenditure in Spain is out of proportion from any point of view, though. I'll provide links to some graphs because I think they give more information than my words could:
https://elequidistante.github.io/graficos-jongonzlz/pensione...
https://elequidistante.github.io/graficos-jongonzlz/pensione...
https://elequidistante.github.io/graficos-jongonzlz/pensione...
And maybe this is the most illustrative:
https://i.redd.it/uwvgxycxhjeg1.jpeg
So yes, the reason why we are underinvesting in pretty much everything is basically pensions. GDP is up, tax collection is up, debt to GDP is sligthly decreasing... but pension expenses keep growing at a fast pace so there's less and less money for everything else. And I say this with both of my parents earning the maximum pension, so I don't have an axe to grind, but it's just reality.
It's a trend that is pretty much inevitable for a country where birth rates have been dropping starkly for decades, so that less people generating the taxable income that pays for those pensions enters the workforce, than those who leave it.
At the same time, medical advances make it so that retirees live longer than before: https://relojpublico.es/poblacion/esperanza-de-vida
If someone has solutions that would not cause widespread riots, I'm sure most goverments of countries in a similar situation would be all ears.
I agree it's hard or maybe even impossible to entirely fix the problem, but there are degrees. You can at least try to mitigate it. And this is not done in Spain even in the slightest.
Check the charts above, pensions have been strictly updated with inflation in the last decades, while salaries (including both public salaries, fixed by the government, and private ones) haven't.
If salaries losing purchasing power haven't caused widespread riots, surely pensions doing the same wouldn't, and the impact on the budget would be noticeable. Of course, it would cause the party in government to lose votes, which is why it's not done.
Spain will solve the problem by buying train tickets for all the pensioners.
I am not suggesting cutting down pensions. My own parents are pensionists... so that you get an idea.
I am giving an objective explanation in all honesty: Spain needs a pensions reform probably at some point bc it is 40% of the expenses in the yearly budget, with a deficit and a demographic deficit. This will explode.
If it can be taken from elsewhere, better.
But you know how much are pensions in Spain and know our pension system in detail (it is literally a Poncy system...)? They are often higher than people working!
Whether we like it or not, we need to reform or collapse in the future. I wish it could be taken from elsewhere, but 40% is a lot...
There is a lot of useless expenses in public work in our "federal system" (comunidades autónomas).
I'm not sure this article really points at government debt or spending as being immediately obviously relevant to this accident. Of course, it's probably too early to say, and that again makes me question why we are talking about pensions.
I agree that good reforms that involve realistic budgets and high levels of accountability are very good things. However, I encourage a lot of caution and skepticism around ideologies that inevitably lead to cuts to benefits.
The USA's pension system replaces a lower percentage of the average wage than Spain's system, and its universal healthcare for pensioners has higher exposure to out of pocket costs. Despite this, the debt to GDP ratio in the USA is higher than Spain, and there is a grand total of one government-operated high speed rail line which is barely high speed despite being 5x more populous.
That's why I encourage caution: cutting pensions won't necessarily lead you to better outcomes, it might just leave you to cut pensions with no improvement in other areas.
I know you are not suggesting cutting pensions directly but what I'm saying is that these types of comments contribute to people "voting against their own interests" so to speak.
We're financing pensions with debt, that's why it's a problem.
You will notice that 31 is less than 40
Japan is a terrible comparison here because their rail network is privatized. They're also paying their pensions with debt, and their economy is really stagnant and not a shining example of a country doing well with a pension burden that high.
I don’t know why that makes them a bad comparison, anyone can follow what Japan did with its train system.
Anybody can privatize their rail system???
It’s a lot more nuanced than that. It’s about how they privatized it and how they ensured that it would be sustainable and efficient.
> They don’t have problems keeping their high speed trains safe
Their trains are safe, but they also have 2X the national suicide rate as Spain, which amounts to about 17000 more deaths per year. I'd attribute a big chunk of that to their work culture treating people like machines, whereas Spain's work culture tends to lean towards treating people like humans.
That isn't an excuse for railway mishaps, of course, but I'm just trying to de-romanticize Japan as some kind of magical perfect place. It's not. They might have gotten their railways right, but they have massive safety issues around mental health.
> Spain's work culture tends to lean towards treating people like humans
You clearly have not worked for the average Spanish employer.
Spain, the land of the Empresaurio.
Not saying maintenance isn't a problem, it probably is. It's a problem everywhere in Europe. Have you seen train service in England, Germany or Sweden? Absolutely terrible, compared to just two decades ago.
But under-maintenance causes trains to stand still and be late. It does not cause them to crash.
Crashes are caused by running at speeds higher than the (under-maintained) rail can support, or (against all rules and every regulation) no cap on speed when the signalling system is down.
The latter can not be solved with more money and resources. It is a culture problem. Rules can not routinely be disregarded for arbitrary reasons, especially not when they are completely in line with common sense.
The rumor is that staff is being pushed to restore service as fast as possible after a problem is "solved". EU push for green transport and privatization means lines were opened to competition, increasing the number of trains compared to some decades ago when only one operator used them with less trains than it does now. IIRC currently the lines have two operators (3 in some places?), meaning that traffic more than doubled. Those in power do not want the service to have more delays. And instead of updating and maintaining the infrastructure, Adif stresses it even more, both in the technical and personal fronts. Thus the accidents. But nobody at the top resigns, blame low level scapegoats instead.
The Iryo train was stopped and unable to restart, because it's safety system did not allow that until the signalling issue was corrected. The AVE was commanded to move again like normal (200 Km/h or more). When the Iryo reported to be stuck, all the trains in the line should have been notified to stop once more, or go at line-of-sight speeds (40 Km/h). Both options are bad for delays. Current news is that five minutes after the Iryo call, the AVE rammed its back at 160-200 Km/h.
CEO of Iryo company complained 3 weeks ago about LZB being problematic, their trains taking a long time to recover connection. Safe but old, he said. It should have been replaced by ERTMS by 2024-2026.
> When the Iryo reported to be stuck, all the trains in the line should have been notified to stop once more
That would have meant that the dispatcher would have been aware that they already ordered a collision before. If a train stops no accident will happen, unless it could have happened regardless. Yes, such a decision would have prevented the accident or lessened it's impact, but the absence of it has not caused it. The error was already done before.
> they already ordered a collision before
What do you mean? "Everyone crash now"? Makes no sense. "Tried to solve"? There was no collision before.
The situation seems to be that they stopped the trains due to a problem somewhere. When they thought it was solved, they commanded all of them to move again. And when one reported to be unable to do so, they failed to stop those that were around it. Or that is what the leaked conversations suggest. Do not discard this was tactical leaks to blame a scapegoat. The newer system should be running.
I say around, because news mention that a third train could have crashed into the wreckage of the other two. It was moving in the other direction, towards Madrid. Luckly it stopped when the electricity failed. It would have been like the accident early this year, when a train hit other that just had a derailment.
> What do you mean? "Everyone crash now"? Makes no sense.
If you (as a dispatcher) order a train to drive into an occupied block, you ordered a collision, independently of whether you notice later and call for an emergency stop in time, or someone else notices and prevents it.
> And when one reported to be unable to do so, they failed to stop those that were around it.
That's not what was the problem, they wouldn't be required to do that. Any train is supposed to stop at any time, without you having notice of that. It's completely normal, that you do not call for other trains to stop, if one train reports that it stopped.
In order for them to think of the conclusion of "first train stops" -> "shit there is another train in that block", they need to be aware that they told another train to be in the same block, before the call. Ordering a train to drive into the same block as another train, means ordering the trains to collide. So they would have to be aware that they ordered a train to collide into the other prior to the call, in order to arrive at that conclusion.
> The newer system should be running.
A newer system would not solve anything here. This exact failure case exists in every system that has virtual blocks, which is every new system. If you are looking for scapegoats, THAT is one.
Deterioration started long before that, according to my sources it started on 2008, but yeah, last 5 years or so it has gone worse. The budget for it has been increasing year by year. It seems that the main problem is not just lack of maintenance but that there's more traffic and new construction.
Pensions is 13%PIB which is on the European median.
The problem is demographic. Also take into account that retired people have paid for their retirement.
Your rhetoric is not what I'd like to be promoted as the first answer entering. Just reading the title of the news I knew what kind of messages I'd see promoted.
>Also take into account that retired people have paid for their retirement.
No, they have not. It's a pyramid scheme. Whatever they put into the system when they worked probably doesn't even cover 5 years of retirement.
It's a bit more complicated than that. It can be argued that if there is a clear link between contributions and pensions, promised pensions based on past contributions are private property, with the usual protections. I don't know the situation in Spain, but Finland at least has made that choice.
If you choose that (or if your legal system determines that), you need to be proactive with keeping the pension system in balance. While you can change what you promise in exchange for future contributions, substantial changes to what you have already promised can easily require constitutional amendments.
There is no system where you can get more than a share of what the economy produces currently.
Paid contributions should only ensure that you get a part of that, a bit more if you paid more, less if you paid less.
If workforce/economy halves when pensioners double, you will get 4x less than you "expect".
The argument is ultimately constitutional. If pensions based on past contribitions are private property, the government can't avoid paying them when it's no longer economically sustainable. The obligation remains even if the government is no longer capable of honoring it. Political choices and ordinary laws can't change that. The only way out is amending the constitution and socializing the private property.
Over here in Finland our road infrastructure sucks too, and pensioners take lion's share of all the resources. Yet our trains aren't crashing. There's something wrong with systems and safety culture in your railroads. Bad maintenance doesn't cause trains to crash into each other if proper procedures are followed.
Still I agree, pension systems in most EU countries are unsustainable.
Not every city needed an airport, nor every roundabout needed to be decorated with sculptures. Everything that is needed for every place, like software for health care or judiciary, should be contracted at the national level, not 17 times at the regional one.
And pretty sure that if some stopped pocketing 3% of public contracts, or whatever amount is now, competition among companies would be better and money would achieve more.
In Spain, half a million more people depend on money they get from the government than work in the private sector: https://theobjective.com/economia/macroeconomia/2024-09-16/a...
[dead]
[dead]
Is there an international consortium for best practices in high-speed train control? Surely there are countries that have good systems in place, or have benefited from knowledge-sharing. I have to believe these train systems were built with outside help and then organic improvement or the opposite. Spain, talk to them.
The issue (at least in Europe) is that there are too many historical train control systems. There are more than 25 different, non-interoperable train control systems currently used across the European rail network.
That's where the EU came in and developed ETCS (https://en.wikipedia.org/wiki/European_Train_Control_System) as a modern alternative. Unfortunately, the EU doesn't have the legislative power to force member states to adopt it and also not the money to bribe them. So ETCS is still competing with the legacy systems.
However, the reason for that crash apparently was the dispatcher who greenlit the cab driver to go full speed ahead after the train control system on that track had crashed even though they knew that another train was reporting that it was unable to restart and get going. Procedures in case of a train control outage are clear: all trains can only move at a max speed of 40Km/h - slow enough to drive and brake on sight.
Instead, that train crashed into the stationary one coming from 200Km/h
> the dispatcher who greenlit the cab driver to go full speed ahead after the train control system on that track had crashed even though they knew that another train was reporting that it was unable to restart and get going
Apologies in advance for what may be a pedantic and possibly dumb question, but is there a failsafe or guardrail against such forced errors?
Not if drivers switch to full manual control. For the ETCS control system:
- in normal mode (Full Supervision) the driver's actions are monitored and unsafe operations lead to an emergency brake
- but there is a fully manual mode (Staff Responsible) which does exactly that - the driver is fully responsible for what they do. If they get bad instructions from the control center, no technical barrier against crashes exist.
Older systems like LZB usually are even more permissible.
The contract to make the line ERTMS compliant was published in 2020, with 2024 as completion target. Errors meant it had to be offered again, pushing it to 2025 and then 2026. The crash could have been avoided.
This is just sad. Red tape killing tens of people.
There's definitely international communication, LZB is a German signaling system and the intended 40kph speed limit after system restart is common across Europe.
Japan has had high-speed trains since the 1960's and have had zero passenger fatalities. They must be doing something right.
Off topic I know but, the BBC has adopted this clickbaity title pattern of “what we know so far about x” for the last year or so and it really jars me. Especially when x is very serious and involves people dying. It’s like an amateur tictoc’er is in charge of headlines at the moment.
They've done clickbait for quite a bit longer. They love testing different headlines too. And pushing out a short article then updating it as they go
It's well beyond time to move on from holding up the BBC as the pinnacle of journalistic integrity. (I'm a Brit, not a Russian troll :)
>In one recording, the controller tells the driver of the Renfe train to disconnect and reconnect the LZB mechanism that monitors train speeds, and then resume the journey at normal speed.
Wait, I thought Spain's high-speed rail network was all ETCS L1 or even L2?
They don't all use ETCS. Madrid–Seville still uses LZB and Adif awarded a contract in 2021 to upgrade it to ETCS L2, but the project is delayed/unfinished
At least California's high-speed rail will never kill anyone.
It's already resulted in five injuries: https://abc30.com/post/five-high-speed-rail-workers-injured-...
it's a matter of budget and political will. Spain simply cannot afford all these train lines, and the system fails. But hey, we have high speed train between Villacojón del Caudillo and Cagalera de la Reina, because they happen to be aligned to the center of the country (Madrit). These railways make no economical sense, they were built for political reasons, to support a "radial" concept of the country that does not really exist yet.
Meanwhile no high speed rail between València and Barcelona, because that would somehow erode the power of the central elites.
It's incredible the minister didn't resign after the January crash and I doubt he will now either. I understand that perhaps the problem started in the control centre but surely at the end of the day the minister is responsible - they don't get paid a fortune just to pass the blame on to the workers.
> they don't get paid a fortune
Salary for ministers is around 80k euro per year. Yes significantly more than the minimum salary but hardly a fortune.
The average salary in Spain is around 30k euro, and almost nobody makes 80k there.
> The average salary in Spain is around 30k euro
I could not believe it, but it is actually true:
The average gross annual salary in Spain is €29,540, which translates to approximately €2,461 per month before taxes.
"Bottom tenth: up to €12,018 a year. Bottom quarter: up to €17,457. Median: €24,497, or €2,041 a month divided by twelve. Mean: €29,540, or €2,462 a month. Top quarter: from €36,970. Top tenth: from €52,515. The mean for women is €26,905, for men €32,058."
From https://relocoast.com/en/guides/minimum-wage-salary A quarter of the people do not go beyond 18K, another quarter is between that and 25K. Only one quarter make more than 36K.
Before taxes. And VAT is 21%, with some exceptions.
I fail to see how the two accidents, which seem to have very "down to earth" explanations (maintenance failure by workers, protocol override by operators) are being assumed to be a political responsibility so quickly by some and asking for the minister resignation. Now, two in a row seem to point to systemic issues. Is this responsibility of Adif or Renfe? maybe those state companies have to be thoroughly revised. is it due to lack of funding? maybe taxes should be raised, or money diverted from somewhere else (though seeing the spanish budget, it's hard to tell where from, both teachers and doctors are currently protesting for lack of funding). Maybe it is, in the end, a political directive that should have responsibilities declared in the executive. But seeing so many interested parties jumping to that conclusion literally hours after the crash means it's not done out of any reasoning but political animosity
> are being assumed to be a political responsibility so quickly by some and asking for the minister resignation
It sucks but that's how it is over here. It's "my" party the one in power when a catastrophe like this happens? It's not the politicians, it's someone else. Is it the "other" party? Surely the politicians are ultimately responsible.
This reflects on the news media as well.
"What Lurks Beneath" has foreseen this coming disaster in Spain
https://www.youtube.com/watch?v=voCcgeBkidE
The BBC keeps repeating this inaccuracy and at this stage I wonder if it's deliberate:
> The driver replies, "At normal speed?" To which the controller says: "Yes."
That is not how the conversation went. The driver reads back the order from the controller, saying "at normal speed? Hm okay agreed / understood" then the controller starts wrapping up the conversation
ie the driver did not really question the order and it was barely a questioning tone (I write without judgement)
You only need intermediate Spanish to understand that part of the clip. The BBC has no excuse to be honest as I'm sure they have plenty of native speakers on hand
Whether it's a material difference I'm not sure, but the BBC should be more accurate
Related:
Spain train crash
https://news.ycombinator.com/item?id=50271032
"the collision occurred after one train stopped on the line unexpectedly due to an Automatic Warning System fault causing it to brake. It was then hit from behind by the second train that had passed a red stop signal protecting the stationary train in front"
- Not Spain. This was Bedford (UK) in June 2026.
https://en.wikipedia.org/wiki/2026_Bedford_train_collision
The train collided rear-end into the rear carriages of the other train and derailed, which also resulted in the three rear carriages of the first train to derail
- This was Białośliwie train collision (Poland) in June 2026
https://en.wikipedia.org/wiki/2026_Bia%C5%82o%C5%9Bliwie_tra...
One carriage was reported to have overturned and four more were derailed. 44 of the passengers were injured
- And this was the Cleon Derailement (France) by sabotage in September 2026
https://en.wikipedia.org/wiki/Cl%C3%A9on_derailment
In this last case Police suspected sabotage after a 300 Kg piece of rail was found deliberately laid in the railway.
"A fire was detected in the rear cabin of the high-speed train. Following safety protocols, the 283 passengers on board have been evacuated"
This was an AVE passenger train in the line Madrid-Barcelona, in October 2026. Most probably another case of sabotage.
[dead]
Tell your travel agent:
"Add a global memory. Whenever I'm in Spain or planning to go there, remind me of this: <story url>, and plan to avoid it."
Why isn't there basically adsb data for trains?! They can broadcast speed and position. Other trains can then see things ahead on their track. This seems like a solved problem so I must be missing something obvious.
Two main reasons:
- trains go in tunnels or tracks are between houses. When train control systems were defined in the 1990's, there was no way to make them sensitive enough to record GPS positions. Instead there is a different location system based on so-called balises with a fixed position on the tracks. Every time a train crosses one, it knows where it is.
- Planes go in 3 dimensions, trains in one. If ATC wants to ensure two planes do not collide, they will assign them different headings and/or heights. Precise position isn't that important. Trains cannot avoid each other, that's why they move in blocks.
And yes, they do signal their position back to the control center, it's just a different protocol
Modern signalling systems are basically adsb for trains. (ETCS is the modern standard in Europe, this line was using the older German LZB). Problem is that they can, and do, fail. And when that happens too frequently (as it seemingly has been in Spain due to a lack of maintenance), its easy to get sloppy on the manual handling
Safety systems don't help much when they fail themselves. E.g. usually there are automatic systems in place that prevent that two trains are on the same rail network section at the same time, but this system apparently has failed. Details are in the article.
This event was pretty chilling for me because I just took the Renfe line from Seville to Madrid a couple of weeks ago while visiting Spain. I generally like to think that I have a pretty good instinct on relative risks and make reasonable decisions based on that. This time around, between the incident earlier this year and this most recent incident, depending on how you interpret and apply the statistics (of course that's always up for healthy debate), it looks like it would have actually been safer driving between Seville and Madrid. That's a pretty low bar in terms of safety!
I set my favorite agent on the task (Opus 5.5 in the Kagi Assistant), and given the two rail crashes in Spain this year, these are the stats it came up with for "chances of dying" via various modes of transportation between Seville and Madrid:
* EU high-speed rail, long-run average: ~1 in 36 million
* This rail line, counting both 2026 crashes: ~1 in 400,000 to 1.2 million (prior to the most recent crash it was 1–3 million; now ~2.5× higher)
* Flying with a European airline: ~1 in 80 million
* Driving: ~1 in 1 million or worse
Of course this is hindsight. Heightened awareness of risks, higher propensity to overreact to anomalies or alarms, procedural changes, and so forth in the wake of this second crash might push high-speed rail in Spain to be higher than the European average in the future.
Ask it to look for high-speed train crashes globally over the past 15 years (to include the 2013 one in Spain as well) to be honest I don’t remember any HS accidents other than the three in Spain so, odds or not, I am NOT taking a high speed train in Spain ever.
> I am NOT taking a high speed train in Spain ever.
You're still much safer taking the train than a car, even in Spain, even in 2026. So good luck flying everywhere, as that seems to be the only safer transportation mode :)
And even when taking the car in Spain, you're about half as likely to be in a mortal accident compared to taking the car in the US, so depending on what you're comparing with, you might be safer in Spain regardless of what transportation method you use.