ON July 23 2013 a high-speed train travelling at 180km/h through a curve where the maximum speed was limited to 80km/h derailed in Santiago de Compostela, resulting in the death of 79 people and injuring more than a hundred.
The subsequent investigation by Spain's Railway Accident Investigation Commission (Ciaf), which is part of the Transport Ministry, cited driver error as the sole cause of the derailment and issued several recommendations, although none of them were related to the lack of working onboard ETCS equipment.
A judicial investigation to determine the causes of the accident also initially pointed to the human factor as the main cause, but it is now delving into the roots of other contributory causes and a fully- functioning ETCS onboard system has emerged as a crucial factor which could have helped to avert the accident. This is the conclusion of several of the expert reports commissioned by the litigants in the criminal process and especially those ordered by the judge.
The 85km Ourense - Santiago high-speed line is equipped with ERTMS/ETCS Level 1 for almost its entire length, except for the first kilometre and the last 5km, with Spain's national Asfa signalling system used as a backup throughout.
The line was inaugurated in December 2011 with services being operated by class 121 high-speed trains which normally used ETCS. On June 17 2012, class 730 trains (a hybrid version of the class 130 sets) also started commercial operations on the line with ETCS onboard installed and working normally.
Only seven days later, national train operator Renfe asked infrastructure manager Adif for permission to switch off ETCS on the train due to alleged operating problems, and Adif granted permission the same day. The onboard ETCS system remained inoperative for the following two years and was therefore absent the day the accident happened.
According to a judicial report, the lack of functioning ETCS onboard is now seen as a crucial factor, amongst others, in the investigation. The report was issued by independent telecommunications engineer Mr Cesar Mariñas from the IT consulting firm Gaia-TIC - who was commissioned by the judge after being chosen at random. According to the report, if onboard ETCS had been working the day the accident occurred, the following would have happened at the ETCS exit boundary (L1 to L0 transition), located at Km 80.1 on the line and at 4km from the curve where the accident occurred:
• Km 77.6: a text message announcing the transition would have appeared on the Driver Machine Interface (DMI) of the train, which was travelling at 200km/h
• Km 80.1: the DMI would have shown a message with a yellow flashing frame and would have emitted an acoustic signal asking the driver to acknowledge the transition by tapping on the screen, and
• if the driver failed to acknowledge the message within 5 seconds, service braking would have been applied continuously until the driver had acknowledged the transition or the train had stopped.
Additionally, if ATO driving is activated under ETCS (as is common when Full Supervision mode is activated, and was the case on the day of the accident), once the transition has been acknowledged, the ATO lever should have been reset to zero before setting a new speed. If this action is not performed in the class 730 trains, service braking is also activated until the ATO lever is set to the speed = 0 position and then set to the new desired speed.
According to the expert, this means that "it is more than probable that (those actions to be performed by the driver) would have sufficed to ensure his focus was again on the line, increasing his situational awareness" and reminding him that the train was approaching a sharp curve at more than double the maximum permitted speed, but still with sufficient distance (4km) to reduce the train speed from 200km/h to 80km/h or below.
This report has shed some light and cast some doubts on the motives which led to the ETCS disconnection, using internal databases from Renfe, Adif and the train manufacturer. According to those sources, the system was switched off on the class 730 trains only a week after their inauguration, and after operating in commercial service just 16 times.
In that week, ETCS operating problems arose on just four occasions. Two of the errors were caused by incorrect handling of the system by the train driver, and on only two occasions (12.5% of the services run) the train was automatically stopped by a signalling-communications problem, which was then described as "Issue-59". By comparison, class 121 trains registered no less than 13 ETCS-related issues during the first weeks of their operation on the same line in January 2012 but the onboard system was not switched off.
It has now been revealed that Issue-59 occurred only in the L0 to L1 transition at Km 1.9, and only on a few occasions, which made it difficult to identify at first. The cause was a processing delay in the onboard computer which left insufficient time to reconfigure the antennae after reading the transition announcement, and before reaching the following balise group where the transition is executed. This delay sometimes caused the class 730 trains to misread one of the transition execution balises, triggering an application of the train's service brakes until they brought the train to a halt. Subsequently, and due to the lack of a valid Movement Authority, the ETCS driving mode was set to Staff Responsible, which according to Spanish rules limits the maximum speed to 100km/h until the train can correctly read the next balise group, which is located at Km 15 on the Santiago - Ourense line.
To mitigate Issue-59, the train manufacturer made two proposals to Adif on July 25 2012 in a bid to overcome these problems while finding a permanent solution, although none of them were implemented. The proposals suggested moving the balises involved or reducing the maximum train speed to 75km/h, in order to increase the time available between the transition announcement and its execution. On August 3 2013 it was finally proposed to cut the processing time on the onboard system to allow trains to make the transition at 125km/h.
The Mariñas report also includes for the first time evidence of a still obscure situation: between October 10 and November 19 2012 no less than 24 services were operated on the line with the onboard ETCS switched on, in an apparent contravention of Adif's orders issued on June 23 to only use Asfa. Finally, on November 20 2012, Renfe issued a circular ordering all trains on the line to use Asfa instead of ETCS "between A Coruña and Ourense to avoid delays" and to inform the CTC centre located in Madrid, as an independent filmmaker Aitor Rei recently discovered when investigating the case for a documentary. The reasons for this atypical and contradictory situation, in which ETCS was used for commercial operation in spite of it being forbidden, nonetheless remain unclear.
Resolved
Issue-59 appears to have been finally resolved three months before the accident, in March 2013, when tests with the latest onboard software version (3.1.1.2) succeeded. Despite this, trains continued to operate with ETCS deactivated until August 2014.
The lack of working onboard ETCS equipment is also mentioned in a thorough risk analysis carried out by QBE, the insurance company covering risks for Renfe. The judicial investigation report cites different scenarios depending on the train protection and/or control systems available, and assigns each a probability for an identical accident occurring.
According to the report, the probability of an accident based on the actual track and rolling stock configuration which led to the disaster is 1.4 x 10-3, that is: "a derailment around every six months." With functioning onboard ECTS, the probability is reduced to 9.4 x 10-5. The best probability rate is considered to be that of a third but hypothetical scenario: should ERTMS have been installed along the entire line, thus covering the curve (and with ETCS working onboard), the probability of such an accident would have dropped to 8.6 x 10-10.
The judicial process is expected to last several more months but no more reports are expected, so it is now up to the judge to bring the investigation process to a conclusion before the trial phase can begin.
