Urda: 29 km with no signals and a blank form

Urda: 29 km of track protected by a single phone phrase

How can two trains collide on a high-estimulante ilegal line with in-cab signalling? The short answer: because the system meant to prevent it had been failing for months, and when it went down, it left 29 kilometres of track turned into a single block section. The long answer fits into a form from the railway operating rules with a blank field. That field was filled in with "normal running". And that's where it all began.

The technical analysis of what peine at Urda, reconstructed from signal positions read on kilometre posts and from the functional design of the renewal project published by Adif, points to a chain of design and protocol failures that led to a human error. The conclusion is unavoidable: the responsibility is political and managerial, not that of the worker who took the call.

What a block section is and why it matters so much at Urda

In railways, a block section is the stretch of line on which only one train may be present. In lateral signalling block, signals capable of ordering a stop delimit it. In LZB, the continuous in-cab signalling, block sections are virtual and much shorter: the system talks to the train through a cable laid along the track, granting it movement authorities.

The problem arises when the LZB fails. In Los Yébenes there is not a single colour light signal or a single set of points. Only LZB screens at kilometre posts 103.7 and 105.9. With no physical signals and no track equipment, the 29 kilometres between Los Yébenes and Urda become, in practical terms, a single block section. Two trains in that stretch are no longer separated by technology but by the memory of whoever is looking at a screen.

The detail is not trivial: the line's dependency list describes Los Yébenes as a banalised post at pk 104.823, which in theory implies points to move from one track to another. It has none. It is a technical building with a radio tower next to it. A design error nobody corrected because, while the LZB worked, it went unnoticed.

The 08:36 order: a form with a blank

At 08:30 the Iryo loses LZB transmission at 40 km/h after passing the CDI at 113+200 and stops at the entrance signal to Urda. It does exactly what that signal orders. A minute later, the AVE comes to a halt 1.3 km before the restriction at pk 92.95, at LZB screen 176. At 08:32, Atocha reports that the control centre has gone down.

The order arrives at 08:36: "switch off and switch back on. Resume with normal running", under the lateral signalling block. This is not an improvised phrase. It is telefonema 5ET3.3 of the operating rules, which includes a blank for the operating conditions. The controller wrote "normal running". The form for an occupied section, 5ET3.2, has "Proceed at Sight" printed on it. With the Iryo ahead, the AVE's case was that of an occupied section.

There lies the crux. A form that leaves blank the only thing that matters turns a safety decision into a matter of personal judgement at half past eight in the morning, with the control centre down and the phone ringing off the hook.

Why wasn't ASFA enough to stop the AVE?

For a train running under lateral block, two signals remained within the block section: the distant signal and the entrance to Urda. The distant signal is at pk 115.35, 3.65 km before the entrance signal. With the entrance closed, it displayed a stop announcement to any train equipped with ASFA. A train under lateral block had plenty of distance to stop.

The key lies in whether the AVE was running with LZB restored. If it regained transmission at the CDI where the Iryo lost it, the fixed signals have no validity and ASFA is suppressed. That is the hypothesis that best fits the train exceeding 200 km/h. If it did not regain LZB, ASFA should have slowed it to 60 km/h seven seconds after passing the distant signal, almost three kilometres before the Iryo.

There is a third possibility nobody rules out: that the screen at the traffic control post was not correctly reflecting the state of the interlocking. The LZB failures originate in the trackside equipment, and the control centre was riddled with interfaces in the middle of a migration.

The media sewer narrative and the worker on duty

Within just a few hours, audios that should have been under lock and key in the judge's hands were leaked, professionals at the bottom of the ladder were blamed, and the version of individual human error was built. The pattern is familiar: the worker on duty carrying the can for what is a management decision.

The available data do not support that version. They support the opposite. According to the forum's analysis, since 2010 not a penny has gone into maintenance while spending on new construction continued. The maintenance budget was cut while building infrastructure that could not be maintained. The LZB on the trackside equipment dates from the 1970s; the on-board equipment varies by train version, theoretically compatible with one another and in practice not. A maintenance contract renegotiated the day before. An interlocking that does not control what it should.

The head of the organisation herself has declared that "the Government cannot talk about human error after what it has done to maintenance and safety". When someone who spent fifteen years inside says it, the official version loses all footing.

What can be demanded from now on

Railways were built on one idea: when in doubt, the system leaves the train stopped. At Urda, the system left 29 kilometres protected by a single sentence. A fallback designed for 1992 traffic, a control centre in the middle of a migration, an LZB that failed often and came back on its own.

The question is no longer who made the call. It is why the design allowed a single phone call to replace the signalling. And why, fifteen years after the failures were documented, it still allowed it.