Urda Train Accident. Will we ask the right questions to get the second story?

On the morning of 28 October, two high-speed trains on their way from Madrid to Seville collided near the small village of Urda in Toledo province. 69 people lost their lives.

Within hours, the first story was ready. The transport minister called the crash “truly unbelievable” and said the preliminary investigation pointed to an “inexplicable” order by the rail controllers to let one train proceed while a safety failure had stopped another train further ahead. Soon after, a trade union demanded respect for the investigation and the presumption of innocence for Adif’s head of traffic. The public debate had found its shape: who commited the error (the first story), and who should pay for it?

The hunt for human error casts a long shadow in the Spanish railway system. After Santiago de Compostela in 2013, the official investigation named human error as the sole cause. Thirteen years later, we are still waiting for the story to end. In January 2026, a court in A Coruña acquitted Adif’s former head of traffic safety, and in October a judge suspended the driver’s prison sentence of two and a half years while his request for a pardon is considered. Years of searching for the guilty, and still very little shared understanding of what the railway system should learn. With this being the second fatal high-speed accident this year, it is more important than ever to look for systemic explanations (the second story) rather than settle for the easy comfort of singling out individuals.

The information available is limited. Still, already now some data points are worth exploring.

A morning that may not have been unusual

The precursor to the accident was a failure of LZB, the system that normally watches every train on the Madrid–Seville line. Under the protocol, traffic was then managed with lineside signals, and control passed to Adif’s control centre. Controllers and drivers had to exchange information and instructions by phone.

LZB (Linienzugbeeinflussung) is a German train protection system from the 1960s–70s. A cable loop is laid between the rails along the whole line, and the train communicates continuously with the trackside computers through it. It has been in operation on this high-speed line since 1992 and was originally planned to be replaced by the contemporary ERTMS (European Rail Traffic Management System) by 2024. After the accident, Spain’s Transport Minister, Óscar Puente, stated that failures in the LZB system are possible and common. So far, 170 have been reported on the Madrid–Seville line in 2026, 13 of them on the section where the accident occurred.

These numbers indicate that running trains in degraded mode, by phone and without the main safety system, was not a rare exception. After an LZB failure, trains can continue on lineside signals at up to 200 km/h. Where there is doubt about whether the track ahead is clear, the rules require on-sight running at no more than 40 km/h. Since the accident, both Iryo and Renfe have proposed making 40 km/h the limit whenever LZB fails. That they feel the need to propose it indicates that this was not how degraded situations were consistently handled before.

As the official Santiago de Compostela accident report documented, the Spanish high-speed railway system takes great pride in punctuality, where even a three-minute delay became an issue to manage. It is not hard to imagine how this may create goal conflicts and eventually foster an environment where deviations from the safety norm can become normalized. And each time it went well, it would have reinforced the impression that it could be done safely.

According to the preliminary report, the Renfe driver asked explicitly whether he should continue at normal speed and was told yes by the Atocha controller. The driver of another train warned that the order to continue at normal speed was wrong and asked to run on sight, as the protocol required.

Also at this stage, hindsight bias sneaks in when zooming in on the two colliding trains. How could the controller have missed this obvious conflict of a stationary train in front? Little do we know about what the controller’s situation looked like in this degraded mode: What information was available? How was it presented? How was workload affected? How did expectations and previous experience with degraded modes influence the controller’s understanding of the situation and eventually decision making?

These are questions the investigation hopefully will dare to ask this time.