Technology was supposed to prevent two trains from dangerously occupying the same section of railway track. But on the morning of Wednesday, 28 October, the sophisticated safety systems protecting Spain’s high-speed rail network failed to prevent a tragedy. A Renfe train collided violently with the rear of another train operated by Iryo, which was stationary on the Madrid–Seville line in the province of Toledo. The disaster left dozens dead and raised a central question for investigators: how could a train have been authorised to proceed along a track that was still occupied?
The collision occurred on one of Spain’s main railway connections, equipped with systems designed to control speeds, monitor safe distances and automatically apply the brakes in dangerous situations.
According to Portuguese public broadcaster RTP, figures released during the afternoon indicated 68 deaths and 80 injuries, with 50 people in a serious condition. Rescue operations were continuing, meaning the figures remained subject to revision.
Twenty-four minutes between the failure and the tragedy
It was 8.30 am Spanish time when a fault was detected in the signalling system associated with the Urda communications centre. The problem led to the suspension of the Linienzugbeeinflussung (LZB) system, the technology responsible for continuously monitoring train movements on the line.
Following the failure, several trains were brought to a halt, and railway operations switched to an alternative system known as Bloqueo de Señalización Lateral (BSL).
At 8.54 am, just 24 minutes after the initial incident, Renfe's AVE 2080 service struck the rear of Iryo service 6076, which remained stationary on the track.
The collision occurred at kilometre marker 118, between Los Yébenes and Urda, in the province of Toledo. The Iryo train was carrying 147 people, including a baby, according to Spanish public broadcaster RTVE. Two of the carriages involved in the accident subsequently fell down an embankment.
Adif, the organisation responsible for Spain's railway infrastructure, suspended high-speed services between Madrid and Andalusia while emergency teams attempted to recover victims from the wreckage.
An instruction that could explain the disaster
Initial information gathered by the authorities points to a possible human error during the management of the technical failure.
According to Spanish newspaper El País, government sources acknowledge that an operator at the Atocha control centre in Madrid may have mistakenly authorised the Renfe train to proceed, despite the Iryo train still occupying the track.
Renfe maintains that its train resumed its journey in accordance with the instructions it had received. This account places communications between control centres and train drivers at the heart of the investigation.
However, the possibility of human error has yet to be established as an official conclusion. Investigators will have to determine whether safety procedures were followed, what information was available and why the authorisation to proceed failed to prevent the collision.
LZB: the technology designed to keep trains under constant supervision
The Madrid–Seville line, inaugurated in 1992, was one of Spain's first major investments in high-speed rail. From the outset, operational safety was closely associated with the German Linienzugbeeinflussung (LZB) system.
This technology can continuously monitor train movements through the exchange of information between equipment installed along the track and onboard systems.
LZB provides drivers with essential information for safe operation: the maximum permitted speed, the target speed and the distance available for braking.
When it detects that a train is exceeding established limits, it can intervene automatically, applying the brakes to prevent a dangerous situation.
However, there is a fundamental limitation: LZB is not a radar system capable of independently detecting every obstacle that might appear on the track.
Its effectiveness depends on information supplied by signalling mechanisms, equipment that detects whether sections of track are occupied, and systems responsible for authorising train movements.
If this information is not correctly provided, or if the system stops functioning, continuous protection may become unavailable.
BSL: when safety becomes dependent on alternative procedures
It was precisely such a situation of degraded operation that preceded the collision in Toledo.
Following the fault detected at 8.30 am, Adif suspended LZB operation and activated the Bloqueo de Señalización Lateral (BSL) system.
Under this arrangement, train movements remain subject to safety procedures, including mechanisms for monitoring track occupancy and specific rules governing movement authorisations. However, trains no longer benefit from the same level of continuous supervision provided by LZB.
This change is particularly significant on a line where trains can travel at high speeds, requiring considerable distances to stop safely.
The LZB failure alone does not establish the cause of the accident. The crucial question is how the AVE train was authorised to proceed when another train remained stationary on its route.
ASFA: a second barrier against danger
In addition to LZB, Spain's railway network uses the Anuncio de Señales y Frenado Automático (ASFA) system, designed to transmit signalling information and intervene in certain hazardous situations.
The system operates through trackside beacons installed at specific points along the railway. When a train passes over these devices, it receives information enabling its onboard system to monitor compliance with certain restrictions.
ASFA can alert the driver, supervise specific speed conditions and automatically apply the brakes, particularly when a train improperly passes a stop signal or when certain warnings are not acknowledged.
The main difference lies in how information is transmitted: while LZB continuously monitors train movements, ASFA receives information at designated points along the infrastructure.
This characteristic means that the two systems do not provide exactly the same level of protection.
ERTMS: the European technology designed to strengthen safety
European railway modernisation has introduced another essential technology: the European Rail Traffic Management System (ERTMS).
Developed to harmonise train management and protection across different countries, ERTMS aims to overcome incompatibilities between national systems and enable more integrated railway operations.
One of its key components is the European Train Control System (ETCS), responsible for supervising movement authorisations and monitoring speed limits.
The system operates at different levels.
At Level 1, information is transmitted mainly through beacons positioned along the track. At Level 2, radio communication enables the continuous transmission of data between the infrastructure and equipment installed onboard trains.
At both levels, ETCS can supervise braking curves and intervene when defined safety limits are not respected.
On the Madrid–Seville line, LZB continues to play the principal role, although its replacement by ERTMS Level 2 is under way.
The modernisation programme, led by Adif, aims to update control mechanisms and bring Spain's railway infrastructure into closer alignment with European interoperability standards.
Why did multiple technologies fail to prevent the collision?
The answer requires an understanding that railway safety does not depend exclusively on a single piece of equipment.
Behind the operation of a high-speed train lies a complex structure of interconnected systems. Detection devices identify occupied sections of track, interlocking systems govern authorised routes, signalling equipment transmits instructions, and automatic protection systems supervise train movements.
This structure also includes control centres and the professionals responsible for operational management.
Under normal conditions, these mechanisms work together, creating multiple barriers against the risk of collision.
When one fails, alternative procedures designed to keep railway operations under control are activated.
The problem arises when a technical failure is accompanied by other circumstances that compromise the effectiveness of the remaining safety barriers.
In the Toledo accident, investigators will need to determine whether information about the Iryo train's presence on the track was correctly available, whether it was properly interpreted and whether alternative operating procedures were fully observed.
It will also be necessary to clarify the circumstances in which the AVE train received authorisation to proceed.
The existence of advanced technology does not eliminate the need for rigorous procedures, particularly when primary systems cease to function.
Previous tragedies that had already exposed weaknesses
The Toledo accident has revived memories of two of the most serious incidents in Spain's recent railway history.
In January 2026, a railway collision in Adamuz, in the province of Córdoba, killed 46 people and injured more than 100, according to figures reported by the Spanish press.
Thirteen years earlier, on 24 July 2013, another disaster had placed Spanish railway safety under intense scrutiny.
On that day, a train derailed on a curve in Angrois, near Santiago de Compostela, killing 80 people and injuring many others.
The investigation established that the train had been travelling at 179 kilometres per hour in an area where the speed limit was just 80 kilometres per hour.
Excessive speed was identified as the direct cause of the derailment, with the driver's lack of attention cited as a contributing factor.
At the time, the train was operating with the ASFA system active because compatibility problems had restricted the use of ERTMS. The accident occurred outside the section of track equipped with the latter system.
The tragedy highlighted the importance of ensuring that protection mechanisms remain effective during transitions between different technologies and operating conditions.
The investigation must explain why the safety systems failed
The Toledo accident now represents a new challenge for Spanish railway safety.
The known sequence begins with a failure in the main signalling system, continues with the activation of an alternative operating arrangement and ends with a train being authorised to proceed along a track on which another train remained stationary.
However, that chronology alone does not explain all the circumstances that led to the collision.
The authorities will have to examine control centre records, communications sent to train drivers, track occupancy information and the actual operation of the protection equipment.
Only then will it be possible to establish responsibility and identify any technical, human or procedural failures.
In the meantime, the disaster raises a fundamental question for modern railway safety: it is not enough for trains to be equipped with technologies capable of preventing accidents. It is essential to ensure that, even in the event of a technical failure, no authorisation for a train to proceed compromises the safety barriers designed to protect lives.
