Who guards the fallback?At Urda, a signalling failure moved train protection from a computer to a phone call, and 22 minutes later two trains collided

ROn the morning of Wednesday 28 October 2026 a Renfe AVE travelling from Madrid to Seville struck the rear of a stationary Iryo train at the entrance to Urda station, in Toledo province. The investigating authority, AITAT, puts the collision at 08:53 and estimates the impact speed at 160 to 200 km/h, pending the onboard recorder data. The provisional death toll is 69.¹²

RAITAT's first note, issued after 24 hours, places the start of the sequence at 08:31, when a computer failure in the LZB train protection system hit three network computers and left 63 km of the line without LZB protection. Trains moved to degraded operation under lateral signalling, known as BSL, with Adif's control centre and the drivers coordinating by phone.¹²

RThe Ministry of Transport's provisional reconstruction says six trains stopped, that the control centre authorised the AVE to resume at 08:36, and that it then covered about 25 km in 17 minutes.³

RAITAT says the chain of failures, instructions and actions would have led to the collision without the necessary mitigating barriers acting. It had not yet interviewed the drivers or the control staff, and it says every hypothesis on cause remains open.¹²

AThe visible failure is a computer. The system question is what protected the trains once the computer had gone: a written procedure, instructions given by phone and lineside signals. The investigation will say which of these failed and why. KPL's interest is in how much weight they were asked to carry.

RA fallback in frequent use. The minister said the LZB had failed 170 times this year, a rate he described as within European norms.⁴

RProtection moved from the cab to the phone. Without LZB the driver loses the in-cab display of the distance to the train ahead and the automatic braking that goes with it, and the control centre guides the driver instead.²

RA speed limit carried by procedure. The minister said the procedure allowed no more than 40 km/h under restricted, sight-based running, while the AVE was told to proceed at normal speed.⁴

RA remaining layer that read the line as clear. The minister said a lineside signal turned green although the Iryo had not moved, so the ASFA system could not warn the AVE to stop.⁴

RA replacement still in transition. Adif awarded Thales a contract of €93.8 million in September 2021 to renew the line's safety installations, including LZB and ERTMS train protection, over 52 months. Procurement documents cited by Reuters, as reported, put completion in early 2026, and the route fell behind that timetable.⁴⁵

ATrain protection on a high-speed line spans assets, information, people and governance: the trackside and onboard equipment, the data each driver sees, the control-centre staff who manage traffic, the rules for degraded working, and the programme replacing the system. Three disciplines ask distinct questions of it.

AThe requirements question (systems engineering): once the automatic protection is lost, which requirement still stops a train short of the one ahead, and what evidence shows the degraded mode meets it? The time question (system dynamics): how often is the line in degraded mode, how long does each episode last, and does familiarity with the fallback wear down its discipline? The condition question (asset management): how reliable is a system nearing replacement, and how does a late replacement change exposure to its failures?

VThe European Investment Bank describes Adif's programme for the 470 km Madrid to Seville line as renewing its civil works, track, electrification, signalling and telecoms and deploying ERTMS, because its installations are approaching the end of their design life.⁶

IEach failure of the primary system moves the line into a mode that leans harder on people and procedure, so the risk carried by that mode grows with how often it is used as well as with how well it is designed.

AKPL calls this degraded-mode protection: the protection a system still provides after its automatic safeguards are lost, carried by procedure, communication and the systems that remain, which must be specified and proved for that state as rigorously as for normal operation.

ACount the degraded hours. Record how often and for how long each line or site runs without its primary protection, and report that figure to the board as an operating state.⁴

AName what still stops the train. For each degraded mode, identify the barrier that prevents a collision if one instruction is wrong, and test it.¹

APut limits into equipment where possible. Where a speed or separation limit rests on a spoken instruction, look for a way to enforce it with equipment.⁴

AClose the instruction loop. Require every authority to move in degraded mode to be checked against the position of the train ahead, by a second person or by a system.³

APrice the transition gap. While a replacement programme runs late, track the old system's failure rate against the new one's entry into service, and decide what extra protection the gap needs.⁴⁵

OUR PERSPECTIVE

A fallback used this often is part of the system.

AThe same pattern runs through air traffic control working on its fallback, power grids switched by hand and process plants with a safety system bypassed: wherever protection moves from equipment to procedure.

1. How many hours last year did each of our lines or sites run without its primary protection, and who sees that figure?
2. In each degraded mode, which barrier stops a collision if one instruction is wrong?
3. Which speed or separation limits in our fallback rules rest on a person, and which on equipment?
4. How are instructions given in degraded mode checked against the position of what lies ahead?
5. When a replacement programme slips, who decides what extra protection the old system needs meanwhile?
6. When did we last rehearse our degraded mode under realistic traffic?

AFollow-through on Nº 13: KPL searches on 3 November found no report that the line through Barking had reopened or that freight rail had returned to Tilbury, so those milestones remain open.

AKPL will return to this story when AITAT publishes its findings on the LZB failure and on the instructions given in degraded mode.