Sorry, but ordering trains to drive manually after the system locks itself down, is the proper procedure. Of course you are still supposed to only send trains to free sections, but the error is in that step, not that they ordered a train to drive on it's own.
Also the fallback procedure is also aided by automatic systems and a sizable number of accidents in the past were caused by that information being faulty.
It is the proper procedure, and it does come (in a lot of countries, AFAIK) with a lot of guardrails:
There will be a so-called "train order" allowing passage of a specific section ignoring the safety system warnings, which has strict validity limits both in time and in the area where it applies, usually denoted by specific hectometric mileposts
When cab signaling is involved (LZB is one of these) and it malfunctions, the entire system normally changes to "driving on sight only" - which indeed limits the train to 40, 30, 20, sometimes - 15 km/h (see https://fr.wikipedia.org/wiki/Marche_%C3%A0_vue) or the line gets switched to lineside signaling - if it is available.
I don't know how you could violate all of those rules - both from the driver's side and from the traffic control side - but it sounds absolutely horrible. Like an override of at least 2 (if not 3) very explicit safety margins.
(The following is speculation:) The issue is that there was still a fallback system operating (ASFA), so they likely assumed that there is still a safety system running, while actually it needed to be ignored, because due to virtual blocks of LZB there is then more than one train in a ASFA block. This means that the next signal shows you "clear", so you accelerate thinking you are back into normal operation, but there is actually a train in front of you, just not in the next block, but in your very own block, which is a situation that is not supposed to happen. So the issue is kind of different train control systems interacting disagreeing with each other. Ironically it would have been actual if there would not have been another safety system, because then they would have known, that they need to operate manually right away.
So they have lineside signaling as backup but it does not have blocks? That looks like misengineering, wow. Some reports said that the renfe train rolled for 25km - if this is what their fallback is like - it is absolutely inexcusable. Oh my...
There are audio recording from this incident where you can hear the "train orders" being given and acknowledged.
They were the wrong orders apparently.
Why is that?
I remember a long time ago I was stuck in a train in a field a considerable time because of a similar failure and conductor just wouldn't move unless green
I was expecting the same here, conductor is the first to die so just refuse until the idiots fix their system
> Why is that?
What exactly?
A conductor always just gets a movement order. They are not able to assess whether the track is clear, that's the reason why the signalling system exists in the first place. How they get that movement order doesn't necessarily tell what the security steps were to back it.
Of course an attentive conductor can notice and mention there something being weird ("Doesn't the other train normally arrive first?"), but that's a rare lucky occasion, nothing to be relied on. And they just need to swallow the answer ("No, you go first today...") anyway.
> and conductor just wouldn't move unless green
The conductor won't ever move unless they get a movement authority, which most of the time is a green signal.
so in this case, couldnt conductor just say - make it green, not my problem, staying still until then
Theoretically yes, but in practice if you tell your boss to screw off multiple times a year because they don't want to spend the money to fix the base problem, you will be replaced or fired.
In some industries that is how they keep costs low while pretending they are being safe. They have alarms or procedures that say something is bad or wrong, but fixing some problems costs more money than it saves so they want them to be ignored, and managers will get angry and admonish you or eventually fire you if you keep following procedure and stopping to check problems. So eventually they build a team of people essentially trained to ignore problems. Which is why many oil pipelines still use ancient and unreliable leak detectors, they know those systems are unreliable and the operators will get alarm fatigue from the 200 false alarms, and that way they also ignore when a real problem happens, and worse case for the company they scapegoat the operator. They don't care that 2,000 gallons of oil leaked into the wilderness and poisoned the land if it would cost 2,000+ gallons of oil profit to shut down and repair the leak. They have a financial interest to not fix it.
If i understand correctly, it was green. Meaning the next block was indeed clear but the other train was stopped in the same block and there aren't supposed to be 2 trains in the same block. That's the disagreement between the new virtual system and the old system.
Why would they trust "a random blinking green light", but not a written and stamped order? Yes, they could do that (and sometimes it will actually prevent an accident), but it will be more being a snowflake, then being a decision for safety. A conductor is simply not responsible for whether it's safe to drive on a given track. Their equivalent is not a car driver.
The "random blinking green light" is generally more reliable
Being a snowflake here has 2 benefits:
1. Getting company managing tracks to fix the lights (they need to deal with angry customers and pay off damages for delays and more), so there's a direct path from unreliable lights to economic damage.
2. Avoid crashing and killing yourself and passengers on the offchance the person on the radio is a moron
> The "random blinking green light" is generally more reliable
Yes, but not because of the light itself, but due to the safety steps done before. Which should also have happened before the movement order in any other form.
As a train driver, you do not have the information required to distinguish these situations. If drivers simple refuse all movement orders, besides "green lights", running trains will become a rare occasion and the drivers will simply get fired for not doing their job. _The train driver is not the one who decides where a train goes._ For this safety-relevant decision a driver is (roughly speaking) nothing more than an innocent bystander.
You can think of a train driver more of the person who makes sure the automatic engine works correctly and also has an eye, that nothing weird happens. Most of your train driver education is knowing how the train works and how to get a broken train back working fast. In addition you also learn the safety protocols how you get the information in which state the engine should operate in. This is what train signals are, it's not really the equivalent of a green traffic light for car traffic.
Actually in this case it looks like the error was that the light did show green, when it should be ignored: https://news.ycombinator.com/item?id=50298796
Many train systems have a trip-stop on signals that will automatically activate the trains's emergency brake if one passes a red signal.
It cannot be bypassed, if an operator must go through a red they have to manually reset the e-brake on each car once it passes the signal.
Yes, but just with max. 40km/h
So that's why my train slowed to 40kmph when the Norwegian Telecom died for a few hours 3 weeks ago.
Yes, 40km/h is for driving on sight in most Europa. I think in France it's even 30km/h.
In the UK at night it's walking pace. Literally. The guard gets out and walks and the train follows. (At least that was the case 25 years ago when I had a very slow train journey.)
Depends. For example German Zs1 (https://en.wikipedia.org/wiki/Railway_signals_in_Germany#Zs1...) would give them the full clear outside of stations.
If you're referring to "If the main signal is a (train station's) exit signal ("Ausfahrsignal"), this speed limit applies until the last set of points/switch has been passed by the complete train, after which regular speed is permitted.", I think that means "once you see a normally working signal again, if it's of a specific type (the exit signal), you still have to stay at 40 km/h until you have passed all switches.". As far as I understand the article, Zs1 is mostly intended for very local speed reductions, the kind of speed caution relevant to this discussion sounds more like the Zs7 signal.