On Wednesday 28 October 2026, at 8:53 a.m., a Renfe AVE hit a stationary Iryo train from behind at the entrance to Urda, in Toledo. At least 69 dead. The same Madrid–Seville line that in January, at Adamuz, had already taken 46. The system that was supposed to keep two trains from occupying the same piece of track — LZB, a 1992 German cable between the rails — had dropped at 8:31. It was not the first time. Spain’s transport minister, Óscar Puente, came out on Friday to say that in 2026 that system had dropped 170 times, 13 of them on that same stretch, and that this sits «within European normality». In engineering, 170 failures of a life-critical system are not normality. They are a system already screaming at you to replace it.
Ten days ago I wrote that a bank cannot have a single switch. A train, even less so. On Wednesday Spain showed that its high-speed network has the 1992 switch, a fallback that still lets you run at 200 km/h, and a man in Atocha looking for a sheet of paper. He found the sheet. He read the wrong protocol. The AVE resumed «at normal speed».
1. Urda, 8:53: the train that should not have moved
The facts, the ones already in the investigator’s note and in the minister’s own mouth, need no varnish.
At 7:54 Iryo 6076 leaves Atocha for Seville: 147 passengers and five crew, an eight-car Hitachi. Ten minutes later, Renfe’s AVE 2080, a Siemens 103, with about 380 passengers and seven crew. Same track, same direction, Madrid–Andalusia. At 8:31 the LZB at the Urda interlocking loses communication between computers. Continuous protection goes dark over 63 kilometres. The six trains on the stretch stop by themselves. That, at least, the old system did right: when in doubt, halt.
At 8:36, Adif’s control centre in Atocha authorises the AVE to disconnect and reconnect LZB and to resume «under BSL at normal speed». BSL is block working by lineside signals: the degraded mode. Normal speed, in that mode, is up to 200 km/h. The rulebook and an internal Adif instruction from January 2025 asked for something else: confirm the block is clear and, if it is not, marcha a la vista, forty an hour, ready to stop for an obstacle. The Iryo was still standing at Urda’s entry signal. The track circuit, occupied. There was a red. Even so, normal speed.
The Iryo driver calls in: the train will not let her restart LZB, she is still stopped. From Atocha: whenever you can. The AVE covers about 25 kilometres in seventeen minutes. Impact at 8:53, kilometre 118.800, track 2, Urda entry, municipality of Los Yébenes. Estimated speed 160 to 200 km/h; the black box will give the exact figure. Four tail cars of the Iryo wrecked, some down the embankment. Both AVE drivers, one of them a trainee, dead in the cab. More than five hundred people on board. At least 69 dead. Spain’s second-worst rail accident this century, after Angrois.
A rear-end collision on high-speed rail, Puente said, is «implausible». It is. That is why the systems exist. When it happens, it is not black magic. It is the layers that were meant to stop it falling in a chain, and the last layer being a man with a phone.
2. Adamuz, nine months, the same line
On 18 January, at Adamuz, Córdoba, an Iryo derailed at night on a bad weld in a new rail and a Renfe Alvia hit it on the adjacent track. 46 dead. Same Madrid–Seville line. Same LZB. Same minister. Same promise that the «integral» renewal with European recovery funds would leave the track like a piano.
That was not a rear-end. It was a rail that broke. The Civil Guard has said the aluminothermic weld was deficient, that inspectors without the required experience walked the stretch, that the measuring kits did not upload data digitally. And the worst sentence for anyone who designs systems: the night before, the track-circuit voltage dropped from 2 volts to 1.5. The alarm threshold sat at 0.78. The rail was already broken. The system filed the number as acceptable. Twenty-two hours. No scream.
Nine months later, Adamuz still has no final report. The new investigating authority already says it will not arrive before 2027. Urda lands on an open file. Two high-speed disasters on the same corridor, 115 dead between them, and the country has not even closed the first.
Two days after Adamuz, in Gelida, a retaining wall took out a Rodalies train and killed the driver. Different network, different cause. Spain’s railway year was already a casualty list before Urda. Anyone who comes out now to call these three stray fatalities should look at the calendar.
3. One hundred and seventy «normal» drops
On Friday Puente dropped the figure as if he were reading the weather.
In 2026 it has happened on 170 occasions. A number that may strike the non-specialist public, but it sits within European normality.
Thirteen of those drops, on the Urda stretch. The last one, 14 October, fifteen days earlier. Seventy-five per cent, according to the minister, is not the software: vandalism, copper theft, works, weather. Meaning: the protection system on Spain’s first high-speed line falls over when someone cuts a cable. And that, in 2026, is presented as Europe.
You do not need to be a driver to hear the alarm. On 5 October, three weeks earlier, Iryo’s chief executive, Fabrizio Favara, said it in public: every time the signal drops, the train stops, reconnection takes ages, the service goes to hell. The drivers’ union has been saying for months that degraded working cannot become the normal mode. CIAF, in 2025, after an incident at Cuenca with no dead and the same taste, asked for technical measures that cut human risk. Adif wrote an instruction. On Wednesday the instruction was in a drawer and the protocol sheet on another desk.
One hundred and seventy is not a Twitter rumour. The minister said it. He called it normal. On an aircraft, 170 failures of a flight channel in a year are not filed: the fleet is grounded. In a power plant, 170 losses of a protection loop are not «stable»: they are a shutdown file. On a full train, apparently, they are the weather.
4. A 1992 cable and a contract that arrived late
LZB — Linienzugbeeinflussung, linear train control — is German technology from the sixties and seventies. Spain put it on Madrid–Seville in 1992 because that is what existed, and it was good: a cable between the rails talks constantly to the train, tells it the speed, the distance to the next target, and if the driver does not obey, it brakes on its own. While the cable talks, two trains do not stack. On Wednesday the cable stopped talking. A communications fault between three computers at the Urda interlocking. A 63-kilometre stretch, blind.
When LZB drops, ASFA Digital comes in, point balises, and the lineside signals. ASFA does not supervise continuously. It updates when you pass over it. It allows 200 km/h. If you are authorised to pass a red, it stops being a brake and becomes a witness. The investigation will say whether the AVE met any restrictive signal in those 25 kilometres or whether, as already reported, the alignment gave it none until the Iryo. I will not invent that. What is not a hypothesis is this: the fallback is not a second LZB. It is a poorer system, built for another era, asked to cover a 63-kilometre hole at firing speed.
The replacement is called ERTMS Level 2: radio, not a cable in the ballast. Adif awarded it to Thales in September 2021 for €93.8 million, a bid 28 per cent below budget, classed at the time as abnormally low. Term, 52 months. It was supposed to be ready in January 2026. After Adamuz, Puente cited it as proof the line was being modernised. On Friday he admitted a twelve-month delay. Hitachi Rail, which inherited Thales, is still in night testing. On 27 October, the day before the crash, the Cabinet injected another €11.5 million into the maintenance contract because the old LZB and the new ERTMS have to be kept alive together. The paper arrived twenty-four hours too late for the people at Urda.
Angrois, 2013, 80 dead: ERTMS on that stretch was switched off. Urda, 2026, 69 dead: ERTMS on that stretch had not arrived. Twice the modern system absent. Twice the speech that the old one is «thoroughly proven».
5. Three times, or do not call it safety
You do not need a super-engineer. You need the manual taught on day one anywhere a failure kills people. Aviation. Nuclear. Real networks, the ones I was already building in the nineties, when a BBS explained why the internet was born to route around damage. One channel. A second independent channel. A third that votes. If one lies, the other two catch it. If one goes quiet, the other two shout. A single failure is already a critical alarm, not an incident log.
That is triple modular redundancy, two-out-of-three voting, failure independence. It is not three copies of the same cable. Three copies of the same cable are a cable in costume. Independent means: different physics, different power, a different way of dying. Radio that does not drop when someone steals the copper. Satellite and odometry that do not drop when the Urda interlocking has a bad morning. Track circuits and axle counters that do not go mute because a threshold is wrong. And the train talking to the train in front: I am on track 2, kilometre 118, heading Seville, speed zero. The one behind does not need a man in Atocha to know there is an aluminium wall standing 25 kilometres ahead.
A 1990s SCADA — screens, a phone, a mnemonic on a laminated sheet, «mate, where’s the LZB 4?» — is not a 2026 safety system. It is an industrial plant room to which we have bolted 300 km/h. DaVinci, the CRC, Atocha’s H24: tools. Design is what counts. Urda’s design, on Wednesday, was this: one cable, one degraded mode, and a human looking up the protocol. The human got the number wrong. The design had already decided that a human would pick the number.
6. GPS, radio, the train that shouts, the tunnel
Now the clever one: GPS does not work in a tunnel. Correct. It does not have to. The train knows its speed. It knows how many axles have turned. It knows the last clean satellite fix. In a tunnel you navigate by inertial odometry, the way an airliner does over an ocean. On the way out, the satellite corrects. Inside, radio. GSM-R today, FRMCS tomorrow, and if needed a sideband that does not share the same cabinet as LZB. The train can broadcast the whole time: track, direction, kilometre, speed, occupancy. The one ahead broadcasts the opposite. That is not science fiction. It is the principle of ERTMS Level 3 and metro CBTC, taken to a corridor that should already have had them.
Lidar does not see around a curve. Nobody is asking for lidar as the only channel. Lidar is one more sensor, short range, for the last metre, for the worksite, for the obstacle the map did not have. The curve is covered by radio and the map and the other train shouting. The vibration of the train on the rail is already in the track circuit: Adamuz showed that the number arrives and is ignored. What is missing is not physics. What is missing is that when the number leaves its range, it cannot be silenced.
Artificial intelligence: not to replace the brake, to hear the pattern. One hundred and seventy drops in a year is a dataset. Thirteen on one stretch is a heat map. A dumb 2018 model will tell you which interlocking, which hour, which copper theft, which overnight ERTMS test correlates with the next hole. Favara saw it without a model, with his gut and with his delayed trains. The State had the logs. The State had 170 points. The State had Puente calling it European weather.
And yes: a single cable, in 2026, is ridiculous. Seventy-five per cent of the drops blamed on copper theft is the confession. You have put five hundred lives on a metal that sells by the kilo. Three independent channels do not all leave with one pair of cutters.
7. «I was getting mixed up»
The Atocha CRC audios are not a film. They are the design, out loud.
Mate, where’s the sheet? This mnemonic… LZB 4? Hold on a second, driver, I was getting mixed up.
The AVE driver calls in a partial-block transmission failure, 000. The 000, according to people who know the line, already said there was another train ahead. The protocol for that fault was LZB 3: proceed on sight. They applied LZB 4, the onboard-equipment disconnect, the one that lets you choose the speed. They chose normal speed. The driver repeats, just in case: «At normal speed». Fine, agreed. Seventeen minutes. An Iryo standing. An AVE at two hundred.
Blaming only the controller is the usual trick. Angrois: the driver. Urda: the man in Atocha. The man in Atocha is the last link in a chain designed so that the last link could kill. The CRC unions say they are short of hands. Too many trains for too few eyes. A 63-kilometre fault spikes the load, and the 2025 instruction asked for reinforcement. Reinforcement, a sheet, a phone. At 200 km/h the human eye is not a sensor. It is an excuse.
A life-critical system that in degraded mode depends on someone hitting a 3 or a 4 on a sheet is not degraded. It is naked. The critical alarm should have fired in the second LZB dropped: map in red, no train moves above 40 until three independent channels say the block is empty. No sheet. No «I was getting mixed up». No «whenever you can».
8. Puente, Mazón, and a head
Óscar Puente is not resigning. «Showing my face», he says. Sánchez has asked him to stay. On Friday he normalised 170 drops, defended LZB, and offered to close stretches for modernisation, now, after the dead. On 18 January there were already dead. On 5 October an operator was already warning. On 14 October the Urda stretch had already dropped again. You show your face before, or it is not a face: it is a press conference.
Carlos Mazón, after the Valencia dana, the same species. The man who should have moved the system stayed in the narrative. Two incompetents, two catastrophes, two countries inside the same one: the victims’ and the one that comes out to explain why the procedure was correct until it stopped being correct. This is not a party joke. It is a missing technical command. Spain lacks someone who knows what a SPOF is, an independent channel, a SIL-4, and who has the authority to stop a line before the funeral, not after.
Put me in as minister or as a technician. I do not want the salary. I do not want the car. I am not talking off the top of my head. I am a CCIE engineer. Thirty years building networks, industrial systems and energy plants that are not allowed a single switch. I started in 1990 with a BBS: if a node dies, the packet takes another path. That is not a Twitter riff. It is the job. Urda is the opposite: a 1992 cable, a man with a sheet, and 69 dead. I want three channels that do not die together, an alarm that cannot be filed as weather, ERTMS on that line actually switched on, and a train shouting its track and its direction until the one behind brakes on its own. If Madrid–Seville has to be cut for a month to do it, cut it. What you do not cut is the burial. Spain does not have a shortage of ultra-engineers. It has a shortage of heads that call normal what has already killed twice in a year. I can read a system that is falling over. On Friday they called it European weather.
Without redundancy there is no high-speed rail. There is a 1992 cable, a man with a sheet, and a standing Iryo that an AVE will reach. We saw it on Wednesday. Anyone who talks again about European normality can take a walk through Urda.