69 dead, and Spain is asking how its railway failed twice in one year

It took 23 minutes. At about 8:30 on Wednesday morning a computer fault knocked out the LZB train protection system on a stretch of roughly 63 kilometres of the Madrid to Seville high speed line, and the trains on it stopped, the way they are supposed to stop. At 8:53 a Renfe AVE from Madrid ran into the back of an Iryo train that was still standing on the same track near Urda, in Toledo province. The Renfe service, train 2080, had left Madrid Atocha at 8:00 for Seville carrying 397 people. The Iryo ahead of it carried 147. Two of the Iryo's carriages went down an embankment, and by Thursday night the death toll had reached 69, with about 50 people still in hospital, 15 of them in critical condition. Spain has begun three days of national mourning.

What happened in between is the part investigators now have to explain, because the system did the first thing right. When the LZB protection failed, the trains halted. The failure came in what the humans did next. Transport Minister Oscar Puente has said the Adif control centre in Madrid authorised the Renfe train at about 8:36 to resume normal running, when the rule after such a failure caps trains at 40 kilometres an hour, slow enough to stop short of whatever is ahead. Instead the AVE covered about 25 kilometres at speed. The Iryo driver, still unable to move after a loss of transmission, reported her train stopped to the control centre at about 8:41 and again at about 8:48. Five minutes after that second call, the Renfe train hit hers. A preliminary estimate from the investigation authority puts the impact speed at between 160 and 200 kilometres an hour. Puente has called the authorisation inexplicable, and on the record so far it is hard to argue with him.

The unbearable context is that Spain has already had this year. On January 18, near Adamuz in Cordoba, an Iryo train derailed and collided with an oncoming Renfe service on the same Madrid to Andalusia line, and 46 people died. Urda is the country's deadliest rail crash since 2013, and it lands weeks before a snap election, with train workers already on a strike called for Thursday, planned before the crash, to demand safety improvements they say were promised after January and not delivered. Prime Minister Pedro Sanchez, speaking in Toledo, said the state was fully mobilised on three fronts: the emergency and the identification of victims, establishing the cause, and compensation for families. Among the dead, The Times reported, was Fatima Banez, a former employment minister, a name that underlines how ordinary this Wednesday morning train was: commuters, officials, families, on one of the busiest lines in the country.

Two crashes on one line in ten months do not share a cause, and the investigations should not be blurred together. Adamuz began with the track. Urda, on the early record, began with a signalling failure and then turned on a decision about how to run trains when the signalling is down. But they share a question, and it is the question the January promises were supposed to answer: what margin does the system keep for the day its protection fails? A railway that runs at full speed on a verbal clearance, past a train known to be standing ahead, has no margin at all. It has a procedure that depends on nobody in a control room making the wrong call under pressure, which is not a safety system. It is luck, formalised.

Our call is that the Urda investigation widens quickly from the controller who gave the clearance to the degraded mode rules themselves, because that is where the fixable failure sits. Expect the argument to turn on why a train could be released at normal speed at all when the protection system was down, why the Iryo's two reports of being stationary did not hard stop everything behind it, and whether the January inquiry's recommendations ever reached the control room floor. Sanchez's government will want the story to be one inexplicable decision. The timeline, 23 minutes from fault to impact with the standing train reported twice in between, points at something larger: a fallback mode that was never built to survive a single human error. Until Spain can show how its high speed lines run safely on their worst signalling day, every timetable on the Madrid to Seville line is running on the same assumption that failed twice this year.