Why Was a Renfe Train Allowed Toward a Stopped Train?

The October 28 collision near Urda, Toledo, was not caused simply by a signalling system going dark. The failure initially stopped trains automatically. The more difficult question came afterward: why was a Renfe AVE train permitted to resume moving while an Iryo high-speed train remained stopped ahead on the same track?

The collision killed at least 69 people and injured dozens, according to the Associated Press. The available evidence remains preliminary, but investigators are examining a chain of failures involving the LZB train-control system, degraded operating procedures, communications, and a decision made inside the railway control system. AP The Guardian

Spain has proposed introducing an artificial-intelligence system that could monitor operational data and conversations between controllers and train crews. The proposed system might have detected an inconsistency. But it could not replace the certified safety protections that were supposed to prevent one train from entering an occupied section of track.

The central issue is therefore not whether AI could have “seen” the stopped Iryo train. It is whether the system would have received reliable information about the train’s position, understood that the movement instruction was unsafe, and raised an alert before the Renfe train reached it.

What happened after the LZB system failed?

The LZB system provides continuous supervision of train movements. It monitors train positions and speeds, controls access to sections of track, and can automatically brake a train when its permitted movement or speed is exceeded. RTVE

At about 8:30 a.m. on October 28, a computer or communications failure disabled LZB across roughly 63 kilometres of the Madrid-Seville high-speed line. The system’s protective response was to stop several trains automatically, including the Iryo service and a Renfe AVE service behind it. EFE EFE Verifica

That automatic stop was the first safety barrier. It worked in the limited sense that trains did not continue at high speed after the protection system failed.

The danger emerged when railway operations shifted to a degraded mode. Without LZB supervising movement continuously, controllers had to manage trains through communications, trackside signals, and fallback blocking procedures. The exact rules and decisions used during those minutes are now part of the investigation. EFE

The Iryo train remained stopped at signal E242 after a transmission problem. Preliminary reporting identifies the Renfe train as AVE service 2080, which was later allowed to resume. Investigators estimate that the collision occurred at approximately 8:53 a.m., with an early estimate placing the impact speed between 160 and 200 kilometres per hour. That speed range remains subject to verification. Railin eldiario.es

Why was the Renfe train allowed to continue?

The public explanation is still incomplete. Spain’s transport minister, Óscar Puente, described the decision to resume normal running as “inexplicable” and said the control-centre instruction was under investigation. Reports said the Renfe train was authorised to proceed even though the Iryo train remained stopped farther along the same track. Cadena SER Euronews

That description identifies the decision under scrutiny, but it does not yet establish why the controller made it. Several possibilities remain open:

• the controller may not have had a complete or accurate picture of the Iryo train’s status;
• the fallback signalling arrangement may have indicated that the route was clear even though the train remained ahead;
• communications between the control centre, trains, and signalling equipment may have been misunderstood or incomplete;
• the Renfe train may have received an instruction that did not match the restrictions governing degraded operation;
• or several of these failures may have interacted.

Some reports say the fallback rules required trains to proceed “on sight,” at roughly no more than 40 km/h, so that a driver could stop within the visible clear distance. Other reporting says the Renfe train was instead authorised to resume at normal speed. El País El País

If that account is confirmed, the critical failure was not merely the loss of LZB. It was the transition from an automatic stop to a human-controlled recovery in which the instruction to move did not preserve the protection required by the degraded-operation rules.

The investigation must establish what each person and system knew at each moment. That requires control-centre logs, train data, signal states, telephone and radio recordings, the precise operating rules in force, and the movement instructions issued to both trains. Public reporting has not yet supplied the complete evidence record.

What safeguards were supposed to prevent the collision?

Several safety barriers should have stood between a signalling failure and a high-speed rear-end collision.

Automatic train protection

LZB was the strongest protection on the affected section. It normally maintains continuous contact with trains and can enforce speed and separation automatically. Once it failed, that protection was no longer available in its normal form. RTVE

Degraded-operation rules

Fallback procedures were supposed to restrict how trains moved after the loss of cab signalling. Reporting on the Urda crash describes “march at sight” rules, meaning that the driver should proceed slowly enough to stop within the visible distance. The reported limit was approximately 40 km/h, although the investigation must establish the exact rule and whether it applied to the Renfe train at the relevant moment. El País

Such a rule changes the driver’s task. The driver is no longer relying on an automated movement authority for safe separation. The train must be operated as if an obstruction could appear within the track ahead.

Trackside signalling and block protection

The fallback system also relied on fixed signals and track occupancy arrangements. But reports say the relevant signalling apparently showed a clear route, even though the Iryo train remained stopped ahead. El País

That raises a technical question at the centre of the investigation: did the fallback signalling correctly represent the occupied section, and if it did, how was the Renfe train authorised to pass or approach it?

Dispatcher and driver communication

Once the automated system failed, human communication became more important. Controllers and drivers exchanged instructions by telephone while the line operated under degraded conditions. eldiario.es

That communication should have included the location and status of stopped trains, the restrictions on movement, and the conditions under which a train could resume. If the controller’s instruction conflicted with the actual position of the Iryo train, or with the requirement to proceed at restricted speed, the communication system became a point of failure rather than a final safeguard.

ASFA

The ASFA system provides protection based mainly on fixed signals and speed restrictions. It is not equivalent to continuous supervision of the kind provided by LZB. Reporting on the crash says ASFA did not stop the movement because the relevant fixed signalling apparently indicated a clear route. El País

This distinction matters. A system can be functioning as designed and still fail to prevent a collision if it is not designed to detect the particular danger. ASFA may react to a red signal or a speed restriction, but it does not automatically provide the same continuous movement authority and separation control as LZB or ETCS.

Where this story sits

5 related pieces

Hover a story · click to read

1. No. 87 · Nov 1, 2026The Train Stopped. Then It Was Told to Go
2. No. 84 · Oct 28, 2026Spain’s Deadly Train Collision: What Failed?
3. No. 82 · Oct 27, 2026When a Prime Minister Orders an Attack, Who Can Stop It?
4. No. 11 · Aug 26, 2026Volt Typhoon and the Weaponization of the Local Tap
5. No. 59 · Oct 3, 2026How One IP Address Change Cost HSI Months of Wiretap Downtime

Could ERTMS have prevented the crash?

ERTMS is the European railway traffic-management architecture. Its ETCS component continuously supervises a train’s permitted speed and movement authority and can apply automatic braking when a train exceeds its authorised limit. European Commission

A functioning ETCS installation could probably have reduced the risk in this scenario. If it had known that the line ahead was occupied, it could have withheld movement authority, warned the driver, imposed a lower speed, or triggered braking. The European Commission describes ETCS as a system capable of supervising movement authority and speed continuously. European Commission

But that conclusion needs a qualification. ERTMS is not an all-purpose obstacle-detection system. It depends on accurate track occupancy information, signalling data, communications, configuration, and correct operating rules. Railway engineers have also warned that ERTMS cannot guarantee prevention of every collision caused by infrastructure failures, incorrect data, or conditions outside the system’s monitored functions. Sur in English

The Madrid-Seville line was still protected by LZB in the affected section rather than the replacement ERTMS installation, according to Associated Press reporting. AP

So ERTMS might have prevented or mitigated the collision, but the available evidence does not justify saying that it certainly would have done so. The decisive question is whether the system would have received a correct and timely indication that the Iryo train occupied the route ahead.

What would Spain’s proposed AI system monitor?

Reports describe a proposed AI agent for railway control centres. It would analyse operational data and conversations between controllers and train crews, looking for ambiguous, contradictory, or unsafe instructions. Spain is also considering a digital model of the rail network that could simulate conditions, detect anomalies, and support recovery after disruptions. Business Insider España Yahoo News Malaysia

An AI monitor could potentially cross-check:

• the reported positions of trains;
• occupied track sections;
• signal states;
• the movement instruction issued to a train;
• the operating mode after an LZB failure;
• the required speed restriction;
• and the content of controller-driver communications.

The proposed concept would depend on combining those operational data sources. Hitachi Rail

In the Urda scenario, the system might have raised an alert if it detected a combination such as:

1. LZB has failed across a section.
2. The Iryo train remains stopped at E242.
3. The Renfe train is behind it on the same route.
4. A controller issues an instruction to resume normal speed.
5. The instruction conflicts with degraded-operation rules or the known occupancy state.

That is the strongest case for AI. The danger was not necessarily hidden in one isolated data point. It may have appeared as a contradiction between several pieces of information.

Could AI have detected the danger in time?

Possibly, but only under specific conditions.

The AI would have needed access to accurate, time-synchronised data about both trains, the signalling state, and the instructions being issued. It would also have needed a rule or model capable of identifying that the combination was unsafe. Finally, the alert would have had to reach a qualified human quickly enough to change the movement.

If the Iryo train’s position was correctly represented in the data, an AI system could have detected that a normal-speed movement instruction for the Renfe train was inconsistent with the occupied route. It might have flagged the instruction before the train moved, or at least before it reached a dangerous speed.

If the underlying data was wrong, delayed, incomplete, or internally inconsistent, AI would have faced the same problem as the human operators. It cannot infer a reliable train position from information that does not record it correctly. Nor should a monitoring model be allowed to override certified signalling and braking systems without a separate safety case and regulatory approval.

Spain’s railway material describes automatic train-protection systems as the equipment responsible for enforcing movement authorities. An AI tool would be supervisory, alerting human staff rather than replacing the certified signalling and braking systems. ADIF, Automatic Train Protection Systems

That makes AI a possible additional barrier, not a substitute for LZB, ETCS, block protection, or disciplined degraded-operation procedures.

What is confirmed, and what remains unresolved?

The preliminary record supports several conclusions:

• The LZB system failed on the Madrid-Seville line near Urda.
• The failure automatically stopped several trains.
• The Iryo train remained stopped ahead of the Renfe service.
• Traffic was then managed under degraded procedures.
• The Renfe train was authorised to resume movement.
• The collision followed roughly 17 minutes later.
• Investigators are examining the control-centre decision, the fallback signalling arrangement, communications, train data, and the safeguards that failed to stop the approach. Euronews EFE

The unresolved questions are more specific:

• What exactly did the control centre know about the Iryo train?
• What signal and occupancy information was displayed?
• Who authorised the Renfe train to move?
• What wording did the instruction use?
• Did the instruction permit normal speed or restricted movement?
• What did the driver understand?
• Did the fallback system incorrectly show a clear route?
• Why did no human or technical barrier stop the train before the collision?
• Would the proposed AI have received enough reliable information to detect the contradiction?

Those questions cannot be answered responsibly from ministerial statements and preliminary news reports alone. The formal railway investigation, event data, communications records, and judicial evidence will determine whether the collision resulted from one incorrect decision or a longer chain of incompatible system states.

The proposed AI system could have helped expose that chain. It might have noticed that a stopped train, a failed protection system, and a normal-speed authorisation did not belong together. But the lesson from Urda is not that railways need a smarter observer watching a fragile process. It is that the primary safety system must keep movement authority, track occupancy, operating rules, and braking protection consistent when a failure occurs.

AI may provide an extra warning. It cannot make an unsafe movement safe by itself.

Sources and references

• Associated Press, “High-speed train collision kills at least 68 in Spain’s 2nd deadly rail crash this year,” October 28, 2026. https://apnews.com/article/4f65471a0e36f448d7ee9efe0768cd77
• Associated Press, “Spain’s latest deadly train crash puts human error and systemic failure under scrutiny,” 2026. https://apnews.com/article/669ef8c0c12c8c9b720e721e7532ccbb
• EFE, “Spain Rail Crash Investigation Focuses on Control Center Failure,” October 31, 2026. https://efe.com/english/other-news/2026-10-31/spain-high-speed-rail-crash-control-center-failure/
• EFE Verifica, “Claves del sistema LZB: cómo funciona, qué ocurre cuando se avería y qué relación tiene con el accidente de Toledo,” 2026. https://verifica.efe.com/claves-del-sistema-lzb-como-funciona-que-ocurre-cuando-se-averia-y-que-relacion-tiene-con-el-accidente-de-toledo/
• European Commission, “FAQ on ERTMS,” Mobility and Transport. https://transport.ec.europa.eu/transport-modes/rail/ertms/faq-ertms_en
• RTVE, “La seguridad LZB, un sistema que permite alertar de que hay otros trenes en la vía,” 2026. https://www.rtve.es/play/videos/especiales-informativos/sistema-seguridad-lzb-alerta-otros-trenes-via/17287699/
• El País, “What is the LZB signaling system, one of the key factors in the fatal train accident in Spain?” October 28, 2026. https://english.elpais.com/spain/2026-10-28/what-is-the-lzb-signaling-system-one-of-the-key-factors-in-the-fatal-train-accident-in-spain.html
• El País, “Los cabos por atar del siniestro de Urda en las investigaciones judicial y técnica,” October 29, 2026. https://elpais.com/espana/2026-10-29/los-cabos-por-atar-del-siniestro-de-urda-en-las-investigaciones-judicial-y-tecnica.html
• El País, “Una cadena de fallos técnicos tumbó el sistema de seguridad ferroviaria LZB en Urda,” October 31, 2026. https://elpais.com/espana/2026-10-31/una-cadena-de-fallos-tecnicos-tumbo-el-sistema-de-seguridad-ferroviaria-lzb-en-urda.html
• Euronews, “‘Inexplicable’ order by control centre investigated after Spain train crash,” October 28, 2026. https://www.euronews.com/2026/10/28/inexplicable-order-by-control-centre-investigated-after-spain-train-crash
• Euronews, “Spain train crash: What happened in the 17 minutes before the collision?” October 29, 2026. https://www.euronews.com/2026/10/29/spain-train-crash-what-happened-in-the-17-minutes-before-the-collision
• The Guardian, “How did the Spain train crash happen and what will investigators be asking?” October 29, 2026. https://www.theguardian.com/world/2026/oct/29/how-did-the-spain-train-crash-happen-what-will-investigators-be-asking
• Business Insider España, “España creará un agente de IA para la seguridad en la alta velocidad ferroviaria tras el accidente de Toledo,” 2026. https://www.businessinsider.es/economia/espana-creara-agente-ia-para-seguridad-alta-velocidad-ferroviaria-tras-accidente-toledo_7056664_0.html
• Hitachi Rail, “Spain: A Shared Data Space for the Railway Ecosystem,” 2026. https://www.hitachirail.com/case-studies/spain-a-shared-data-space-for-the-railway-ecosystem/
• ADIF, Automatic Train Protection Systems, 2025. https://www.adif.es/documents/20124/28860899/20240531_01_NS_Adif_book%2B2025.pdf/127237b9-3391-8931-f528-0d762ff1a107?download=true&version=1.0
• eldiario.es, “El primer informe sobre el accidente de Urda estima que la colisión del AVE con el Iryo se produjo a ‘entre 160 y 200 km/h’,” 2026. https://www.eldiario.es/castilla-la-mancha/primer-informe-accidente-urda-estima-colision-del-ave-con-el-iryo-se-produjo-a-entre-160-y-200-km-h_1_13625882.amp.html