The 17-Minute Window: How a Failed Signal System and One Dispatch Call Put Two Trains on the Same Track

By 29 October, Spanish emergency authorities had confirmed at least 69 deaths in the high-speed rail collision near Toledo, south of Madrid. Fifty injured passengers remained in hospitals. Rescue teams working deeper into damaged carriages and collapsed wreckage found more bodies, and officials said the toll could rise. Four Chinese nationals were on the trains. One suffered a minor leg injury, according to the Chinese Embassy in Spain.

The collision happened on 28 October on the Madrid–Andalusia high-speed line. The rear train was a Renfe AVE service. The train ahead was an Iryo high-speed train. Preliminary investigation points to a dispatch error after the line’s main automatic protection system failed. The Spanish transport minister described the accident as a “computer communication failure plus human instruction error.” The transport ministry, the railway safety agency and judicial authorities have opened a highest-level technical and judicial investigation.

The line was already running in a degraded mode

The Madrid–Seville high-speed line uses the German LZB continuous train control system. LZB does more than show a signal to the driver. It continuously calculates the permitted speed and distance for each train. If the block ahead is occupied, the system requires the following train to slow down and, when necessary, triggers emergency braking. The system does not wait for the driver to see the train ahead.

Before the collision, LZB failed. According to Spanish government sources cited by El País, the failure stopped about eight trains in the area. Dispatchers began restoring operations. The line switched to BSL, the lateral signal blocking mode. BSL relies on trackside signals, block occupancy detection and track circuits. Under Spain’s railway operating regulations, a train authorized to run in a BSL section during this kind of failure is limited to 40 km/h and must proceed under visual driving, prepared to stop.

That limit is the fallback when continuous supervision is unavailable. The system no longer calculates a continuous braking curve. The rule replaces that calculation with low speed and a visual check. Protection then depends on the dispatch process and the driver’s execution.

The Iryo train stayed on the track

The Iryo train ahead stopped after its signalling system failed. The crew reported the stop to the dispatch control centre. Dispatchers began organizing the restart. One Iryo train did not restart successfully and remained on the track. That status, the train still occupying the section, was the information the following train’s authorization needed to block.

The AVE train behind received an instruction to continue. According to disclosed communications, the dispatcher told the AVE driver to disconnect and reconnect the LZB and to resume running under BSL protection “at normal speed.” The driver asked again to confirm: “Normal speed?” The dispatcher confirmed.

At that point, the Iryo train was still stopped at the entrance signal at Urda station. Its driver had already reported that the LZB could not be restarted. The AVE train was about 25 km behind. The authorization was issued at 8:36. The collision occurred at 8:53. During those 17 minutes, the AVE train ran through a red signal under dispatch authorization. The control centre did not issue a correction to slow or stop the train, according to the account provided by the transport minister. The minister said the control centre had enough time to detect and correct the error.

The preliminary investigation put the collision speed at more than 100 km/h. Railway engineers cited in Spanish media estimated from the damage that the impact speed may have been higher. Photographs from the scene showed carriages broken apart and wreckage down an embankment.

A red signal can be passed, but only with safeguards

Railway red signals are not the same as road traffic lights. Under special conditions, a dispatcher may authorize a train to pass a red signal. The rulebook allows this only after the necessary safety measures have been taken. The authorization itself is not automatically a violation. The danger lies in authorizing passage without confirming that the line ahead is clear.

In this case, the block ahead was not clear. The Iryo train was still there. The AVE train was released into the same block. The 40 km/h BSL limit did not enter the instruction. The instruction said “normal speed.” The driver’s question, “Normal speed?”, recorded the moment when the instruction’s deviation from the degraded-mode rule became explicit in the conversation.

Why ASFA did not stop the train

The trains still had ASFA, the Spanish automatic train warning system. ASFA uses trackside balises to transmit signal information to the train. It triggers braking when the driver fails to respond to a signal, exceeds certain speed restrictions, or passes a stop signal without authorization.

ASFA works at fixed points. It reacts to events. It does not continuously calculate the distance to the train ahead, and it does not generate a continuous braking curve. It protects against a driver passing a red signal without permission and against certain speed violations. It does not protect against a situation in which a red signal has been passed with dispatch authorization and an unseen train is still occupying the block ahead.

When LZB failed, the continuous protection layer went offline. BSL and ASFA provided a lower level of protection. The dispatch process became the layer that had to verify block occupancy before releasing the following train. The AVE train was released. The Iryo train was still in the block.

What the rulebook required

The same block should not contain two trains. When LZB is online, continuous supervision enforces that rule. When LZB is offline and BSL is running, the rule becomes a dispatch procedure. Releasing a train into a failed section requires an independent, verifiable check that the block is clear. The 40 km/h limit and visual driving are part of that fallback.

Investigators are collecting the dispatch recordings, system logs and train data recorders. They are also examining how the Iryo train’s stopped status was recorded and whether that status was available to the dispatcher who authorized the AVE movement.

The rulebook contains both the 40 km/h limit and the procedure for passing a red signal. The first is a speed constraint. The second requires confirmation that the line ahead is safe. The authorization at 8:36 placed the AVE train on the track. The Iryo train was still on it. The collision at 8:53 followed.

Spanish Prime Minister Pedro Sánchez said the investigation would go to the end. The country entered three days of mourning. Rescue work continued at the site, and hospitals treated 50 injured passengers. The 40 km/h limit and the red-signal authorization are both written in the operating regulations. The investigation will determine which confirmation was completed before the AVE train was released into the occupied block.