The Last Link in the Chain

Sixty-nine people died on the Madrid to Seville line on Wednesday morning. Within hours, the government had found its culprit. I’m not convinced it found the right one, or at least not the whole of it.

News reaches the cave the way weather does, in gusts. A phone buzzes on the table, somebody reads a headline aloud over the coffee, and before long the whole of Wednesday morning had rearranged itself around a stretch of track in Castilla-La Mancha that most of us have hurtled past without a second thought. Two high-speed trains, one Renfe AVE and one Iryo, both heading south towards Seville, both on the same rails near a small Toledo town called Urda. At 8:53 the first ran into the back of the second. By the time the dust and the rolling news had settled into something like a shape, the count stood at sixty-eight dead and more than a hundred injured. Another body was found overnight, and by Thursday the toll had risen to sixty-nine, with around fifty people still in hospital.

I’ve lived in this country long enough to have a soft spot for its trains. They are, or were, one of the things Spain did properly while the rest of us were still apologising for leaves on the line. So this one landed hard, partly because it’s the second high-speed disaster here in under a year, and partly because of how quickly the story arrived pre-packaged. A computer failed, a man in a control room made a bad call, and the minister had a word for it before lunch. Neat. Tidy. Suspiciously so.

I spent seven-odd years in the RAF Police and a good while after that in senior security management, and if those decades taught me anything, it’s that the first explanation offered after a catastrophe is usually the one that costs the institution least. Sometimes it’s also true. But it’s rarely the whole truth, and it’s almost never the useful part.

First, let’s get the facts straight

Before I start throwing stones, I owe you a correction, because the version doing the rounds in the first twenty-four hours (and yes, the version I was repeating myself) was wrong in two ways that matter. The first was that three safety systems were down. They weren’t. One system failed: the LZB, the German-designed train protection that has watched over this line since it opened in the 1990s. What took it down was a communications fault between three computers on the network, and that’s where the number three crept in. Lose those three machines talking to each other and you lose LZB cover over a 63-kilometre stretch of track. That’s bad, but it’s one failure, not three.

The second error was the picture of two trains barrelling along at speed towards each other’s business. Only one of them was moving. When LZB dropped out, the system did precisely what it was designed to do and stopped every train on the affected stretch, six of them in all. The Iryo, carrying 147 passengers including a baby, sat stationary near the entrance to Urda. The AVE, with 397 people on board, was roughly 25 kilometres behind it. One train was standing still. The other was told it could go.

That distinction is the whole story, really. The machine failed safe. Everything that happened after 8:30 was a matter of human decisions, procedures and communication, and that’s exactly where the investigation is now looking.

Twenty-three minutes

Thanks to the Ministry of Transport’s own reconstruction and the control room recordings published by El País, we can lay out the sequence with uncomfortable precision. Read it slowly. It’s worse that way.

Time	What happened
8:30	A communications fault knocks out LZB over 63 km of the Madrid to Seville line. Trains on the stretch stop automatically.
8:36	The Adif control centre at Atocha authorises AVE 2080 to resume under lineside signalling, with “normal running”. The driver asks for confirmation. The controller confirms.
8:41	The Iryo driver reports she is stopped at the entrance to Urda with a loss of transmission. She too is authorised to resume.
8:48	She calls Atocha again: she cannot reset LZB and is still stationary. According to the published recordings, nobody tells the AVE to stop.
8:53	The AVE runs into the back of the stationary Iryo at kilometre point 118, roughly 25 km after being told to proceed.

Seventeen minutes passed between the AVE being sent on its way and the impact. In that window, the control centre was told, twice, that there was a stopped train on the line ahead. The investigation’s central question writes itself: why was the AVE not slowed down or stopped once Atocha knew the Iryo was going nowhere?

The recordings published since make it harder still to sit with, because they don’t sound like one person making one inexplicable decision. They capture the control room’s own uncertainty, with discussion over whether the Iryo was actually moving at all, and whether a second AVE was in the Urda area. According to Euronews’ account of the audio, the AVE was released without anyone checking that the Iryo had pulled far enough ahead. And when the Iryo driver called at 8:41 to say she was halted before the entry signal at Urda, the reply from Atocha amounted to: get going as soon as you can, and call us if there are any problems. By then the AVE was already rolling towards her. Twelve minutes later, it arrived.

Two words and a question

When the clever system fails, the railway falls back on older ones, and on rules written precisely for that moment. There were two ways the controller could have let the AVE continue. One is marcha a la vista, running on sight, which obliges the driver to go slowly enough to stop short of anything in front of him, with a ceiling of 40 km/h in these circumstances. Think of it as feeling your way along a dark corridor with your hand out. The other is marcha normal, normal running, which is exactly what it sounds like. The AVE was running normally. One engineering body has suggested it may have been doing around 200 km/h when it hit the Iryo, though that figure will only be settled by the black boxes.

Here’s the detail that I can’t shake. The driver asked for the order to be confirmed. According to the recordings, he’d been told to reset his LZB by switching it off and on again, then carry on under the backup system at normal speed, and his question back was about as simple as a question gets: normal running? He’d just watched his train’s primary protection drop out, he was being told to crack on at line speed, and something in him paused long enough to say, in effect, are you sure? The controller ratified it. That moment, a professional instinct raising its hand and being waved down, is the bit every safety system in the world is supposed to catch, and here it did the opposite. The question was asked, and the answer was wrong.

Transport minister Óscar Puente called the decision “inexplicable” and said the train should never have been allowed to move while a stop signal was still active on that line, and that if it had to move at all, it should have done so at reduced speed. He was equally clear that the train drivers bear no blame. On the narrow question of that one instruction, I suspect he’s right. It’s the narrowness that bothers me.

The convenient villain

Within a day, the Guardia Civil had questioned the operator who was controlling traffic that morning, and the phrase “human error” was everywhere. Government sources were briefing that a mistake by an Adif operator, responding to a fault in the main signalling, was the likely cause. Somewhere in Spain tonight there is a person who has gone from anonymous shift worker to the most hated name in the country, and who will carry those seventeen minutes for the rest of their life. If they got it wrong, they got it catastrophically wrong, and I’m not here to pretend otherwise.

But I’ve sat on both sides of the blame table. After the RAF, as an operations manager in civilian security, I earned the nickname Mr Memo for issuing open memos that staff had to sign to acknowledge. I did it because I believed in clear instructions. What I learned, watching directors later wave those signed sheets around as evidence, is that paperwork has a second life. It tells you who was told. It tells you nothing about whether the system they were working inside made the right action easy and the wrong one hard. And when something goes badly wrong, organisations reach for the signature, because a signature has a name on it and a system doesn’t.

That’s the trick with “human error”. It’s always technically true, because humans are in every loop we build. It’s also the place where an inquiry can choose to stop digging. As the railway accident investigator Janos Rozsa put it to CNN, accidents rarely have a single cause, and investigators need to understand the conditions people were working in and how the whole system was meant to keep trains apart. Call it the last link in the chain. Snap it and the chain breaks, certainly. But you still have to ask why every other link was rusted through.

The rust on the other links

Start with the hardware. The LZB on this line has been running since the line opened in the 1990s, and it’s been earmarked for replacement by the newer European ERTMS system for some time. Earmarked is a lovely word. It means everybody agrees a thing should happen and nobody has yet paid for it to happen. So on Wednesday morning, the protection on one of Spain’s flagship routes was a thirty-year-old system whose survival depended on three computers continuing to chat, and when they stopped, the safety of six trains fell back onto procedures, radios and a person.

Then there’s the design of the fallback itself. If a single instruction from a single controller can release a high-speed train at line speed into a section where another train is sitting dead on the rails, with no technical interlock to say hang on, then the system has quietly been built on the assumption that the controller will never be tired, rushed, confused or wrong. That’s not a safety system. That’s a hope with a uniform on. And the 8:48 call is the bit that should keep Adif’s board awake. The control room was told, in plain terms, that the train ahead was stuck. Whatever happened to that information between the headset and the AVE, it never arrived. That’s a communication and workload question as much as an individual one: who else was on shift, how many trains were they juggling, what did their screens show them with LZB down?

None of this arrives out of a clear blue sky, either. Spain’s rail accident investigation commission flagged the non-functioning of LZB and ASFA Digital as a contributing factor in an incident at Madrid Atocha back in 2011. This is the third deadly rail incident in Spain this year. In January, a derailment and collision near Adamuz in Córdoba killed 46 people, and two days later a commuter train derailed near Gelida in Catalonia on a day of heavy rain, killing its driver. Before Adamuz, the train drivers’ union SEMAF had written to Adif in August 2025 warning of heavy wear on high-speed track. CNN noted that, until this year, EU figures showed Spain’s rail safety record was better than many of its neighbours’. That makes the run of failures more alarming, not less. Good systems don’t usually decay all at once. They decay quietly, and then all at once.

And here’s the detail that should make the word “inexplicable” stick in a minister’s throat. In a 2024 report, Spain’s own rail accident investigation commission, the CIAF, examined an incident at Cuenca-Fernando Zóbel on 25 June that year, when an AVE ran past a signal ordering it to stop and a traffic controller then authorised it to carry on. Neither of them spotted the overrun; it was the train’s own ERTMS protection that braked it automatically. The commission’s conclusion was blunt. When permission to proceed rests on human verification alone, that barrier is “susceptible to failure” because it depends entirely on the human factor, and it needs technical measures behind it, including ERTMS Level 2. The CIAF had already documented a recurrence of similar overruns. In other words, the same weakness that ran through Wednesday morning had been written down, by the state, two years earlier.

Unsurprisingly, the politics has arrived on schedule. There have been protests in Madrid calling for Puente’s resignation, the crash lands a month before the 29 November general election, and Pedro Sánchez has promised that any failures in the safety system will be met with the utmost firmness. On Thursday, rail workers went ahead with a strike they’d called before the crash, demanding the safety improvements they say were promised after Adamuz, and their leaders openly questioned the minister for laying all the blame on one controller and for leaking of the control room conversations to the media. The public-sector union CSIF went further and called for Puente to resign, accusing him of singling out the Adif controller and demanding that the investigation, and the worker’s presumption of innocence, be respected. Puente has ruled out resigning. The opposition Partido Popular has also attacked the government for pinning it on a worker. As for the Prime Minister’s promise, fine words. The test is whether “the safety system” ends up meaning one person at a desk in Atocha, or the decisions about funding, staffing and modernisation that put them there with nothing behind them.

What we don’t know yet

In fairness to everyone, including the controller, a great deal is still unknown, and I’d rather say so than pretend otherwise. The investigating court in Orgaz, Toledo, has placed the case under judicial secrecy. It has sealed off a two-kilometre zone around the crash site, barred anyone from removing wreckage without authorisation, and ordered both trains’ black boxes seized and held. Judicial police have been tasked with gathering the communications and traffic data from the Atocha control centre, and a separate technical investigation will run alongside, aimed at causes and safety recommendations rather than guilt. That job falls to the CIAF, which takes on Urda without yet having finished its report on Adamuz, nine months on.

So the honest list of open questions is long. What exactly did the controller see on screen once LZB dropped? Was normal running a permitted option under the protocol in force, or a breach of it? Who else was in the room, and what was their workload? What happened to the 8:48 call? How fast was the AVE actually going? And were there further failures in the layers of protection and supervision that should have caught all of this? Even Euronews, laying out the timeline, concluded that the cause can’t be closed and the blame can’t be pinned on a single person until the inquiries finish. That’s not lawyerly hedging. That’s the job.

The signature and the system

Here’s where I’ve landed, for now. A person in a control room very probably made a terrible call on Wednesday morning, and a driver very probably did the right thing by questioning it and was overruled. Both of those can be true at the same time as this: the railway around them was running on ageing kit, on fallback procedures that let one voice release a high-speed train into an occupied section, and on a communications chain that let a stranded driver’s warning evaporate somewhere between her radio and the train bearing down on her.

The temptation, for a government heading towards an election and an infrastructure manager with a lot to answer for, will be to let the story end with the signature. One name, one inexplicable decision, one villain. It’s satisfying. It’s quick. And it guarantees that the next time three computers stop talking to each other on some other stretch of line, the safety of a few hundred people will once again rest on whether somebody in a headset gets the next seventeen minutes exactly right.

I don’t know yet whether Spain will choose the signature or the system. I know which one is cheaper. I know which one sixty-nine families deserve. And I know, from long and occasionally bitter experience, that those are rarely the same thing.

Fact-check links and publishing notes

Sources

Euronews: the breakdown, the Atocha order and the 17 key minutes (timeline, passenger numbers, normal running vs running on sight, court measures)
NPR: Spain reckons with 2nd deadly train crash of the year (Puente’s account, 25 km gap, stop signal, drivers not to blame)
CNN: What caused the deadly train crash in Spain? (third deadly incident this year, prior EU safety record)
CNN live coverage (Janos Rozsa on multiple causes)
CNN en Español live coverage (three computers, 63 km stretch)
RTVC (engineer’s estimate of around 200 km/h, LZB due for replacement)
CIAF report on the 2011 Atocha incident (LZB and ASFA Digital not functioning as a contributing factor)
Wikipedia: 2026 Adamuz rail disaster (SEMAF warning, August 2025)
Wikipedia: 2026 Gelida train derailment

Added Thursday evening, 29 October

AP via KSAT: Spain reckons with second deadly train crash of the year (toll of 69, around 50 in hospital, election in four weeks, rail strike and union criticism)
Recordings shed light over errors before deadly Spain train crash (LZB reset instruction, “normal operations” exchange, Atocha’s reply to the Iryo driver)
El Constitucional: CIAF requests technical measures after human failures (2024 Cuenca-Fernando Zóbel report, “susceptible to failure”, ERTMS Level 2)
Castilla-La Mancha Media live (CIAF briefly reported 74 dead, then corrected to 69)
Público live (PP criticism of the government blaming a worker)

Added late Thursday, 29 October

Euronews: what the leaked control room audio reveals (Iryo not checked as clear, doubts over the Iryo’s movement and a second AVE, 8:41 reply)
Infobae: the Adif and AVE driver audio (LZB reset instruction, no recorded order to stop or slow the AVE)
The Objective live (CSIF resignation call, CIAF still to conclude Adamuz)
Newsweek (29 November election date)

Until Next Time