RAMSRail.com

Three safety nets, one gap: what the Urda crash says about fallback protection on Spain’s high-speed lines

Posted by:

Sergio

|

On:

|

, , , , , , , , , ,

The collision between an AVE and an Iryo train near Urda (Toledo) was not a failure of one system. It was a failure of how the line moves from its strongest protection to its weakest ones.

The Madrid–Seville high-speed line is protected by three layers, each one the safety net for the one above it:

  1. LZB: continuous automatic train protection. It supervises speed and distance at all times and stops the train if anything is wrong.
  2. ASFA + BSL: intermittent protection at the signals (ASFA) plus lineside block signalling (BSL). It is the fallback when LZB is not available.
  3. Driver and signaller: written procedures and verbal orders, with no automatic protection behind them.

My argument is simple. Every time the top layer fails, the load moves down to layers that are weaker by design. That is acceptable only under two conditions. First, these degraded situations must be rare: a fallback used once a year is a very different risk from one used every week. Second, each handover between layers must have been properly risk-assessed. On Spanish lines, the evidence so far suggests the second condition has not been met, and nobody has yet published the figures for the first.

Note on sources: the facts below come from the driver–controller audio and the reporting published in the Spanish press. The investigation by the CIAF (Spain’s rail accident investigation body) is ongoing. Where I interpret, I say so.

Layer 1, LZB: it failed safe, but how often does it fail?

LZB behaved as designed. According to the published accounts, several computers in the ground system went down and the section lost LZB transmission. The trains on board reacted by stopping. That is the safe state.

The problem came next. To get the AVE moving, the controller told the driver to disconnect and reconnect LZB. In practice, this protocol means LZB stops protecting the train until it passes a zone change point (punto de cambio de zona): a fixed location on the track where LZB accepts trains into supervision. A train reconnected in the middle of a section is not supervised by LZB straight away, even if the ground system is working, until it reaches the next one. Here the ground system was not transmitting at all. Between the restart and that point, the train was protected only by ASFA, which is why it did not stop again.

The question for LZB is therefore not whether it is safe when it works. It is how often it stops working, compared with what it was specified to achieve. Each failure pushes trains onto weaker safety nets. Investigators should look at:

  • The failure record of the LZB ground equipment on this line, against the reliability and availability targets it was procured and approved for.
  • Whether the trend has been getting worse as the equipment ages.
  • Whether those failures were tracked as a safety issue, not just as a punctuality issue.

A system that fails safe but fails often is not as safe as it looks. Its reliability is part of the safety case of everything below it.

Layer 2, ASFA + BSL: a sound system used in the wrong role

ASFA comes from Spain’s conventional, lower-speed lines, and it has a good reliability record there. The issue is not the system itself. The issue is that on high-speed lines it is used as a backup, and the risks of switching to it are not properly analysed.

Those switches happen in two ways:

  • Planned transitions, where the line itself changes from one protection system to another.
  • Forced transitions, where the main system fails and trains fall back to ASFA + BSL.

In both cases, EU law requires a structured risk assessment of the change: today the Common Safety Method for risk assessment, Regulation (EU) 402/2013. In my view, neither kind of transition has been assessed to that standard.

Angrois, 2013: a disabled system and an unassessed transition

In the Santiago de Compostela derailment of July 2013, which killed 80 people, the Alvia was running with ASFA as its only protection. ERTMS had been taken out of the picture in two ways:

  • On the train. The onboard ERTMS of the Class 730 had been switched off since June 2012 because of recurring technical faults (memory overload and failures to read balises on the Ourense–Santiago section) that caused unplanned stops. Adif authorised the disconnection at Renfe’s request, initially for one month. It stayed off until the accident.
  • On the track. The project had been modified so that the section including the A Grandeira curve was protected by ASFA instead of ERTMS.

ASFA could not enforce the large speed reduction required from high-speed running to the curve’s limit at the entrance to the conventional section. At the trial in 2022, Christopher Carr, former head of safety at the European Union Agency for Railways, testified that the derailment risk of the curve “was not perceived and was not mitigated”, and that the investigation never analysed why the driver had been left as the only protection. (At the time the framework was Regulation 352/2009, which 402/2013 later replaced.)

The parallel with Urda is direct. In both cases the main train protection system was out of action for technical reasons, trains fell back to ASFA, and the risk of that fallback had not been properly assessed.

Urda, this week: a forced transition

The same gap appears in a different form. LZB divides the line into short virtual blocks. On high-speed lines such as this one, the BSL fallback works with much longer block sections. When trains fall back from LZB to BSL, two trains that were safely separated in different LZB blocks can end up inside the same BSL block. From what has been published, that appears to be what happened here, although it is not confirmed. In the leaked part of the conversation, the AVE driver is told to resume “under BSL, with normal running”, with no authorisation to pass any signal. That points to both trains already being inside the same BSL block: had there been a signal at stop between them, ASFA would have stopped the AVE on entering the occupied block. The published audio was edited, so the investigation will have to confirm it.

Adif’s own instruction COI 01/25 (February 2025), as reported in the press, says that after an LZB failure trains may only resume under BSL, and only if the BSL block ahead is clear of trains. That rule exists because the risk is known. But it leaves the check to the signaller, by procedure, at the most stressful moment of the shift. A risk assessment of this transition should have asked whether a human check is an adequate barrier there. That is a deficiency of the risk analysis, not just of the person in the control room.

Layer 3, driver and signaller: the last barrier, under the most pressure

The published audio shows the controller reading the order from a procedure sheet. He reads the code “desconexión LZB 4”, hesitates, and authorises the driver with “normal running” instead of “line-of-sight running”. The same wording was apparently given to both trains.

It would be easy to stop at human error. I think that would be the wrong conclusion. The order did not switch ASFA off: ASFA stayed active. The problem is that ASFA + BSL, by design, cannot protect against a situation where the fallback starts with two trains inside the same BSL block. With trains in adjacent blocks, the signal at the entrance to the occupied block shows stop and ASFA protects. With both trains inside one block, there is no signal between them. In that scenario, the only barrier left is the procedure: the signaller checking that the block is clear and giving the right order. So the design itself puts the whole weight on people, at a moment of disruption and pressure.

The human layer is the weakest of the three by nature. It should be designed as the last resort, not as the main defence during a degraded situation that can be foreseen.

What investigators should examine

The questions I would expect the CIAF and the court to look at:

  1. LZB reliability. How often the ground system fails, against its targets, and whether those failures were treated as safety events. And its age: LZB has protected this line since it opened in 1992. Has the equipment reached or passed its design life? A replacement plan exists: ERTMS Level 2, tendered in 2020 with an initial execution period of 52 months, and the main signalling contract awarded in 2021. But at the time of the Urda crash it was still not the line’s main system. Investigators should ask how that delay extended the reliance on ageing LZB equipment, and whether the extra risk was assessed.
  2. The risk assessment of the fallback. Whether the move from LZB to ASFA + BSL, including the difference in block lengths, was ever assessed under Regulation 402/2013.
  3. The procedure and the “block clear” check. Did the coded order on the controller’s sheet itself say “normal running”? If so, the error is in Adif’s procedure documentation, not only in the operator. Were the control room’s sheets revised when COI 01/25 came into force in February 2025? And how was the signaller expected to confirm that the BSL block ahead was free: from the CTC occupancy display, by contacting the train ahead, or otherwise?

Sources

Posted by

Sergio

in