New Delhi: At least 68 people have died after a high-speed train collided with a stationary train near Urda in Spain’s Toledo province on 28 October, according to the latest reports. The crash is the country’s second major high-speed rail disaster this year, following a collision near Adamuz in January that killed 46 people.
Initial accounts from Spanish officials point to a failure involving the LZB train-control system, which reportedly brought several trains to a halt. A subsequent instruction from a control centre allowed one train to resume normal running, before it struck another train that remained stationary. Investigators are examining why that instruction was issued and whether the system’s safeguards should have prevented the collision.
The precise causes of the latest crash have not yet been established by a final investigation. But earlier railway disasters offer a way to understand the technologies involved, how failures can cascade and what can prevent a train from becoming a deadly projectile.
Spain, 2026: When a signalling failure meets a human decision
The first question in any rail collision is whether the trains were physically prevented from occupying the same stretch of track.
Railways divide routes into sections, often called blocks. A signalling system monitors whether a section is occupied and regulates which train is allowed to enter it. Under normal operation, a train should not be given permission to enter a section where another train is present.
On high-speed lines, this protection can go beyond trackside signals. An onboard computer can receive information about the permitted route, calculate how quickly the train must brake and intervene if the driver exceeds the permitted speed or movement limit.
In Spain, officials said the LZB system failed along a stretch of track, automatically stopping several trains. The transport minister subsequently said a control-centre decision allowed a train to resume normal running even though the danger had not been cleared.
This distinction matters. A technical fault that stops trains is not necessarily a catastrophic failure. In fact, an automatic stop is often the intended response to uncertainty. The risk arises if trains are allowed to resume without reliable confirmation that the track ahead is clear and the required protections are in place.
The investigation will need to establish what information controllers had, what the system displayed, what instructions were given and whether any independent protection remained active. It would be premature to attribute the crash to one component or individual before that evidence is assessed.
What could prevent a repeat?
When signalling or train-control equipment fails, the railway must switch to a clearly defined degraded operating procedure. Trains may have to remain stopped or move only under restricted conditions, such as at a reduced speed that allows the driver to stop within the visible distance. Any override should be tightly controlled, recorded and backed by checks that establish the route is safe.
Wenzhou, China, 2011: When the system gives the wrong signal
On 23 July 2011, two high-speed trains collided near Wenzhou in eastern China, killing 40 people and injuring more than 170.
The official investigation found that lightning damaged signalling equipment. A serious design defect meant the equipment could provide incorrect information about whether a section of track was occupied. The system then displayed a green signal to a following train, which ran into the train ahead.
The investigation also identified shortcomings in equipment development, technical review and the response to the failure.
The disaster illustrates a fundamental problem in railway engineering: a system must not mistake missing or corrupted information for evidence that the track is clear.
A well-designed safety system should be fail-safe. If a sensor stops reporting, communications are lost or the computer cannot establish the position of a train, the system should default to a restrictive state rather than grant permission to proceed.
That principle is particularly important because a controller may not immediately know whether a fault is harmless or whether it has compromised train detection.
What could prevent a repeat?
Redundant sensors and independent checks can help detect inconsistencies. Equipment should be tested under failure conditions, including lightning damage and communications loss. Most importantly, a signalling fault should not produce a false clear signal. The system should restrict movement until the track’s status can be verified.
Santiago de Compostela, Spain, 2013: When speed protection is missing
On 24 July 2013, a passenger train derailed near Santiago de Compostela in north-western Spain. The disaster killed 80 people.
The train was travelling at approximately 179 kmph as it entered a curve with a speed limit of 80 kmph. The investigation identified excessive speed as the immediate cause and found that the driver had been distracted by a telephone conversation shortly before the derailment. The train’s speed was not automatically brought down sufficiently before it reached the curve.
The case shows why a driver’s awareness cannot be the only safeguard against overspeeding. A train travelling at high speed has substantial momentum, and braking must begin well before a sharp curve or other hazard.
Train-protection systems calculate a braking curve — the speed at which a train must travel at successive points to stop before a signal, restriction or other limit. If the driver does not brake in time, the system can intervene automatically.
The technology is particularly important when a train moves from a high-speed section to a conventional line with a much lower speed limit. A driver may be expected to reduce speed from well above 150 kmph to a fraction of that speed over a relatively short distance.
What could prevent a repeat?
Automatic speed supervision must cover the transition to lower-speed sections, including curves, junctions and station approaches. The system should calculate whether the train can brake in time and apply the brakes if necessary. Reducing distractions in the cab also helps, but it cannot replace automatic protection.
Eschede, Germany, 1998: When a mechanical defect becomes a chain reaction
On 3 June 1998, Germany’s high-speed InterCity Express train derailed near Eschede while travelling at around 200 kmph. The crash killed 101 people, making it one of the deadliest high-speed rail disasters.
The investigation traced the accident to the failure of a wheel component. The broken component damaged parts of the train and track, contributing to the derailment. A carriage struck the supports of a road bridge, which collapsed onto the train. More carriages then crashed into the wreckage.
Unlike the Spanish collision, Eschede was not primarily a case of two trains occupying the same track. It demonstrates a different hazard: a small mechanical failure can trigger a sequence of events whose consequences are much greater than the original defect.
High-speed trains subject wheels, axles, bearings, bogies and track components to repeated loads. Even a defect that develops gradually can become dangerous if inspections fail to identify it or if maintenance intervals do not reflect the component’s actual condition.
The bridge collapse also highlights how the surrounding infrastructure influences the severity of a derailment. A train leaving the rails near a rigid obstacle, bridge support or steep embankment can suffer much greater damage than one derailing into an open area.
What could prevent a repeat?
Operators need rigorous component inspection, appropriate replacement intervals and systems that detect cracks, overheating or abnormal vibration before a component fails. Trackside monitoring equipment can identify certain defects while trains are moving. Engineers must also assess whether bridges, embankments and other structures could turn a derailment into a larger disaster.
Japan, 2005: When timetable pressure and overspeeding combine
On 25 April 2005, a commuter train derailed on the Fukuchiyama Line in western Japan, killing 107 people and injuring hundreds.
The train entered a curve too quickly. Investigations and subsequent safety reviews drew attention to excessive speed, driver performance and the operational pressures associated with punctuality.
The disaster is a reminder that railway safety is not only about the hardware installed on trains and tracks. Timetables, work culture, training, fatigue management and the consequences of delays can influence decisions made in the cab.
If a driver feels pressure to recover lost time, a speed restriction may be treated as an obstacle to punctuality rather than an absolute safety limit. Such pressures do not excuse unsafe operation, but they can reveal weaknesses in the way an organisation manages risk.
What could prevent a repeat?
Automatic speed control can prevent a train from entering a curve above its permitted speed, even if a driver fails to brake. Operators also need realistic timetables, effective fatigue management and a culture in which reporting a safety concern does not carry a penalty.
What technology is supposed to stop two trains from colliding?
Several layers of protection work together. No single system can prevent every type of railway accident, and the precise equipment differs by country and line.
Signalling and train detection
Track circuits and other detection systems establish whether a section of track is occupied. The signalling system uses this information to regulate train movements.
If a train is already in a protected section, the system should prevent another from entering it. But the protection depends on accurate detection and on the system responding safely when information is lost or corrupted.
Automatic train protection
Automatic train protection, or ATP, monitors whether a train is operating within its permitted movement and speed limits. Depending on the system, it can warn the driver and automatically apply the brakes.
The European Train Control System, or ETCS, is a form of ATP used across European railway networks. It supervises permitted speed and the distance a train is authorised to travel.
This is a critical distinction: a warning asks a person to act; automatic protection can intervene when the person does not.
Centralised traffic management
Control centres monitor train movements and coordinate routes, particularly when services are delayed or equipment fails. Controllers can stop trains, change routes and issue instructions to drivers.
But centralised control is not automatically a safeguard against every error. If controllers receive misleading information or an unsafe instruction overrides the normal protection, a control centre can become part of the chain of failure.
Systems should therefore limit unsafe commands, require explicit confirmation for high-risk overrides and preserve an independent means of preventing a collision.
Redundancy and fail-safe design
A safety-critical railway system should not depend on one sensor, one computer or one communication link working perfectly at all times.
Redundancy means that independent components can cross-check information or take over when another component fails. Fail-safe design means that the system responds to uncertainty by restricting movement rather than assuming everything is safe.
These principles are not guarantees against every accident. Redundant systems can share the same design flaw, and a faulty procedure can undermine several technical safeguards at once. That is why independent testing and regular safety audits matter.