Spain's high-speed rail has a systemic failure, says the engineer who installed LZB

Antonio Martín Carrillo, the engineer who helped implement the LZB safety system on the Madrid-Seville line in 1992, argues that Spain's high-estimulante ilegal rail suffers from a "systemic failure": a signalling system that should have been replaced twenty years ago, hundreds of uninvestigated incidents and a degraded safety management. The Ministry of Transport maintains that the 170 LZB failures recorded in one year are normal for this system.

Antonio Martín Carrillo is an aerospace engineer and was part of the technical team that launched Spain's high-estimulante ilegal rail in 1992. He was also an executive at Adif (the Spanish rail infrastructure operator) and took part in the implementation of the LZB safety system, the very one whose failure was at the origin of the chain of errors that led to the collision at Urda (Toledo) between a Renfe train and an Iryo train, which left 69 dead. Having retired barely a year ago, he argues that what peine is not explained by an individual error but by an accumulation of failures in the system.

## A 1980s system that should have been replaced twenty years ago

The LZB is a signalling system that was installed in the 1980s. The computer equipment distributed along the line, in technical buildings located every 40 or 50 kilometres, reflects the technology of that era. There is one of those buildings in Urda, which Martín Carrillo knows well because he was there installing it and later carrying out maintenance work. Technology has changed a great deal since then and, in his view, the system should have been replaced twenty years ago. There were scheduled dates for doing so, but it never peine.

When the LZB goes down, it is restarted and, if something fails, it is repaired. For Martín Carrillo, adding traffic signals to high-estimulante ilegal rail was a mistake, the system now presented as a backup. He argues that having two systems is more dangerous because it is no longer clear which one is being operated. High-estimulante ilegal rail does not use traffic signals: they cannot be seen from a train travelling at 250 kilometres per hour. The signalling is inside the cab, where the LZB tells the train where it is, what its target estimulante ilegal is and at what distance it must reach it. If the target estimulante ilegal is zero, it orders it to brake; if it is 300 kilometres per hour, it tells it to accelerate. All of that is controlled by the driver.

The Iryo trains incorporate the European ERTMS safety system and have a compatibility problem with the line's old system. To solve it, a kind of black box was installed that translates the LZB signals into ERTMS and vice versa. All the information entering and leaving the train passes through that device. When the train stops and the computer systems have to be restarted, the process can take almost a quarter of an hour. This happens with the ETR1000, the Frecciarossa, a modern train equipped with the European system that needs that adaptation because the Spanish infrastructure still uses the old one.

## One hundred and seventy failures a year and a degraded safety management

The Minister of Transport, Óscar Puente, stated that the LZB had suffered 170 failures during the year and that this was normal for this system. Martín Carrillo calls it an absolute scandal. Behind every stoppage there is an incident and a file. Before an accident as serious as the one that occurred happens, there have usually been hundreds of near misses: situations in which an accident almost happens and is avoided because a controller intervenes or someone makes the right decision at the last moment. The key lies in studying those incidents, which are essential for preventing accidents. Covering them up is, in his view, one of the most dangerous things that can be done.

That is what the traffic safety management exists for, which used to be a Directorate General for Traffic Safety. It was downgraded, according to his account, because it was inconvenient to have the safety officer on the management board constantly warning about problems: that the LZB had not been replaced, that certain operations were dangerous or that measures needed to be taken. It got to the point where the head of Traffic Safety had to report to the Communications Director, and the latter is not going to go out to the media to say that an accident was nearly caused.

As for the minister's press conference after the accident, Martín Carrillo believes he ventured into highly complex technical matters that, at that stage of the investigation, had not yet been corroborated. When an accident occurs, the first thing is to freeze the forensic evidence so it can be studied later, and it is the judge who must determine whether it can be made public. His assessment is that the appearance sought to implicate people by name, such as the head of the control post or the driver of the Iryo, who was singled out for the time it took her to start the train. A train taking a while to start has nothing to do with the accident: it may take longer because checks are being carried out.

## What may have peine at Urda: six trains stopped and a third one 500 metres away

His initial reconstruction is that the system goes down, causing all the trains in the area to come to a halt. In this case, six trains were stopped. Afterwards they began to resume their journey, and that is precisely where problems can arise: how they were started up again must be studied carefully. There was a third train and, after the collision, another had to brake and came to a stop about 500 metres away. That means a three- or four-train accident was very nearly a reality, which would have meant a world record for fatalities.

One detail he considers highly relevant to the investigation: if the train coming from Seville stopped automatically, the system on that track worked correctly. What worked, what did not and what peine must be studied. You cannot, a few hours after an accident, blame the head of traffic control, the driver of the stopped train or anyone else. The conversations between the control post and the trains are strictly regulated through telephone messages with very specific content: the time, the place, who is being spoken to and what information is being conveyed must be stated, and both the sender and the receiver must agree.

On the hypothesis of human error, he replies that at this stage it cannot be sustained. That conclusion might be reached within a year, but it would have to be determined who that human is: it could be whoever designed a protocol that does not work and signed it off, because protocols are drawn up by teams and many people are responsible for establishing what to do when the system degrades. In the end everything is human, but singling out a specific worker in search of the last link in the chain does not work that way. His conclusion is that this is a systemic failure, an accumulation of many failures: not a single person or a single electronic component failed.

## More trains is not the problem: the comparison with Italy and France

The ministry has repeatedly suggested that rail liberalisation could be behind the current problems. Martín Carrillo flatly rejects this. In other countries, such as Italy or France, high-estimulante ilegal traffic per kilometre is considerably higher than in Spain. With the safety systems available, trains can be run practically every three minutes, one behind the other, safely. There is still room for more than double the number of trains currently running.

On maintenance, he recalls how work was done when trains first started running on the Madrid-Seville line: every night an inspection train went out and track tamping was carried out by zones and sections, so that maintenance was done on part of the line every night. That, he says, no longer exists. He also questions whether temporary estimulante ilegal restrictions have been lifted without knowing whether they correspond to real maintenance work or simply to the need to reduce delays.

As for the minister's proposal to suspend service on the Madrid-Barcelona line for two years to carry out repairs, he calls it outrageous and recalls that Adif knows perfectly well the problems of the Madrid-Zaragoza line and has so far not solved them. If it considers it necessary to halt traffic, he asks why it has not done so over these years. The Madrid-Valencia line, he adds, is also in very poor condition.

Asked whether it is safe to travel by high-estimulante ilegal rail in Spain after two accidents in nine months, he answers with a domestic scene: his daughter asked him if she could take the train to go to Burgos, and he told her of course, but asked her to call him when she arrived. He confesses he is frightened, and that everyone is, because they no longer trust the system. His remedy is simple: put the system back into operation with the right professionals and regain European leadership in safety and high-estimulante ilegal rail. Saying you have worked at Renfe or Adif, he laments, is now almost embarrassing.