Comment by electroweak

Cab-signalling train protection systems like LZB (and more modern alternatives like ETCS) are generally considered to be sufficient to ensure safe separation. The interlocking only allows setting a route if all its sections are detected vacant, conflicting routes are locked out, and flanks are protected. Meanwhile, the train protection system prevents trains from exceeding their movement authority. These systems can even largely monitor themselves and are designed to be fail-safe (often by putting all signals on danger and letting the operators figure it out).

But in those cases where the system does crash and reset, how can operations be started again? That's where you need well-specified fallback procedures. One such procedure might be that, in case axle counter sections to lose their counts (because of a crash of the interlocking or the axle count evaluator), causing affected sections to show as disturbed and mandating a manual reset, each section must be swept by a train running on sight (under a caution order in LZB or OS mode in ETCS).

There's not a sensor that can detect another train with enough warning to matter. Stopping takes miles, and turning isn't an option.

This is exactly the thought I always have.

It seems impossible to imagine that there are any layers of defense in depth involved here… Because it should be so easy to avoid.

Because rail is quite non line of sight and quite infrastructure defined pathing.

The automatic coordination system hit a fail condition; they neglected the fallback protocols that had rules for spacing determined to work reliably without the computer keeping real time supervision; they crashed.

This is in the way more like the Washington D.C. helicopter plane mid-air where some normalization of deviance got people to ignore automated protection systems.

If most involved had known the fallback protocols they would have refused to move/continue while the protocols were utterly neglected. At least with a robust safety culture active, ofc.