Comment by potamic
5 hours ago
> the signal shows whether you are allowed to drive in the next block, not into the current, as you are already in the current block. This seemed to be what happened here, the second train saw the green signal thought they are back in the automatic safety system and accelerated to 200km/h, not knowing that there is still a train in front.
Don't think the second train saw a green signal. They were in the middle of the block, while the first train was waiting just before the exit of the block (with a green signal ahead).
What I'm gathering from other sources is that the Spanish system allows the controller to override the point-based rules and provide manual clearance (because the blocks are long and it takes forever to reach the next signal by sight). It's a failure of the system imo. Ideally, the system, under no conditions whatsoever, should have even allowed such a practice to be allowed.
> Don't think the second train saw a green signal. They were in the middle of the block, while the first train was waiting just before the exit of the block (with a green signal ahead).
If the first train was really just before the exit of a block, then it's pretty safe to assume that the second train saw the corresponding distant signal.
> the Spanish system allows the controller to override the point-based rules
Every system allows that, it is required in order to be able to operate a railway network.
> What I'm gathering from other sources is that the Spanish system allows the controller to override the point-based rules and provide manual clearance
What actual happened is my speculation, the explanation how LZB works is not. It can be the case, that they messed up while issuing manual movement authorities, but if they did not notice that they need to switch to manual operation, they will have caused a crash.
During normal operations you can act on the distant signal, because you know you're the only one in the block. But when falling back from linear to point signalling, you cannot make that assumption anymore. You need to get back to a state where you are certain you're the only one in the block, and the only way to do that is to reach the next main signal by sight after which you know you're clear for the that block.
Sure, another way to be certain is for the controller to manually verify that the block is clear and verbally communicate to the driver to override the protocol. But that is putting a lot of burden on human judgement, and even without this incident, anyone would agree is not the best idea.
I don't think this should be required for "normal" operations of the network. Sure, human override should always be there for when an exceptional situation occurs. But you should take extra precaution when that happens because you're already on your final safety net and relying on the judgement of a single human at that time, and that's okay because it's an exceptional situation that doesn't happen often and when it does you can afford to spend an hour or two to take that extra precaution.
The problem happens when the system fails so often that human override becomes the new normal, and because you're doing it every day you now cannot afford to spend the extra hour and tend to skip the extra precaution because you're doing it everyday and start to feel you know what you're doing.