Rail is a highly complex mass-transit mode whose safety cannot depend solely on the human factor. This is why signalling and train protection systems exist to allow trains to run without risk of collision with other services and even without exceeding the permitted maximum speed. Today, in Encarrilando by Railin, we explain the system that, unfortunately, is on everyone’s lips: LZB.
Although it was invented in the 1960s — the first version entered service in 1965 — it has been continuously modernised to adapt to new technologies and requirements, while retaining the robustness that has always characterised it.
LZB is an electronic supervisor that accompanies the driver, indicates the speed the train may reach and brakes the train if that speed is not respected. If it stops working, the train cannot simply carry on as if nothing had happened: it must switch to a fallback system governed by strict rules and be driven with less supervision.
That last point is key to understanding what happened at Urda (Toledo), where Transport Ministry locates the origin of the incident in the failure of this system. The definitive causes will be determined by the technical investigation.
What it is: the co-driver that never gets distracted
LZB stands for Linienzugbeeinflussung (do you dare to pronounce it correctly?), which can be translated as “continuous train control”. The key word is “continuous”. Other systems communicate with the train only as it passes fixed trackside points known as balises, whereas LZB maintains the conversation throughout, using a cable laid in the centre of the track.
It works like a very strict co-driver. It tells the driver the speed at which the train may travel, the speed it will need to have further ahead — including the 0 km/h of a stop — and at what distance. If the train exceeds the permitted limit, the system triggers the emergency brake.
Imagine there is a stationary train ahead. LZB does not allow the following train to get too close, and monitors that it reduces speed in time to stop with sufficient margin.
Moreover, because it uses a continuous cable, it increases line capacity.
Let us see why.
A line is divided into short sections called physical block sections. Each has a signal at one or both ends — a traffic light, for ordinary mortals — which permits a train to enter if the block section is clear (no other train is inside). If it is occupied, the signal is placed at danger (red) and the train must wait until the other has left and it is safe to proceed. This is the basic concept of railway block working.
If the driver passes a signal at danger, more rudimentary train protection systems such as ASFA brake the train immediately.
Block sections are usually very long, often several kilometres. LZB, however, allows them to be safely subdivided into smaller sections known as LZB block sections or, in more accessible terms, virtual block sections. In this way, more trains can fit within the same physical block section.
These virtual block sections are crucial, because these short sections have no signals to permit or prevent entry; they depend on the whole system functioning correctly.
How it works: a cable to keep the conversation going
The system has two parts that communicate with each other.
One comprises the trackside equipment, including a control centre that knows the status of the line and calculates movement authorities.
The other is the train-borne equipment, which receives and transmits vehicle data, displays it in the cab and supervises whether the movement complies with the established limits.
Information travels through a cable laid along the track, with which the train exchanges messages. Messages travel in both directions, from the control centre to the train and from the train to the control centre. It is a constant conversation, continuous as emphasised earlier: “What can I do?”, “This is what you must do”, “This is what I permit you to do”.
LZB is not a radar or a camera that “sees” obstacles. It works with precise information: where trains are located, which sections are occupied and how each train brakes. Because every train brakes differently.
Where it is used
It is a German technology also used in Austria. In Spain, it is associated with the Madrid–Sevilla high-speed line, opened in 1992, and with Madrid commuter line C-5. Spanish regulations permit operation at up to 300 km/h with LZB in service. On the metre-gauge network operated by Euskotren, EuroLoop, based on the German system, is used.
Today, the high-speed line is in transition to the European ERTMS system. Adif awarded the renewal contract to Thales — now Hitachi — in 2021 for around €94 million, and LZB still coexists with the system being installed.
In Germany, DB plans to withdraw LZB from its lines by December 2029, an objective subject to securing the necessary funding.
What happens when it fails
Here it is useful to distinguish three scenarios that may seem similar but have important differences:
- Normal exit: the train leaves the LZB-equipped area as planned.
- Loss of transmission: the train stops receiving information from the system.
- On-board equipment failure: the fault is on the train.
In the event of a transmission loss, Spanish regulations distinguish two cases according to what is displayed in the cab.
If the section up to the next signal is clear, the driver brakes and continues to be guided by the trackside colour-light signals, as in conventional railway operation. After all, they are reliable, since they do not permit entry to an occupied block section.
What happens if the section — the physical block section — is occupied by another train? The following train no longer has any signal preventing it from entering that section, because it is already inside. Without LZB, neither the train nor the driver can know whether there is another train ahead. That information is held only in the CRC (Traffic Regulation Centre).
For that reason, when there is more than one train in a physical block section and LZB fails, all trains stop and the driver notifies the traffic controller, who is located in the CRC. After the necessary checks, the signaller may authorise movement only at restricted speed, since at some point along the route the train could collide with the train ahead in the same section.
In the Toledo accident, the physical block section was occupied by the Iryo train, and the AVE was authorised to proceed normally, without restricted-speed working, as if there were no other train in the same section.
What restricted-speed working means
When no automatic train protection system is active and no colour-light signal can be seen, the driver’s own sight is the only protection for the train. Under restricted-speed working, the driver may proceed only at a speed low enough to stop before colliding with an obstruction on the track — such as a train, a tree or a fallen rock — or a signal at danger. It is not simply “going a bit more slowly”.
In this case, the maximum speed in this mode would have been 40 km/h. Ministry sources indicate that the AVE reached around 200 km/h before the collision.
What Germany does when LZB fails
If you wonder how DB InfraGO — Germany’s rail infrastructure manager — manages such a failure, it neither stops the entire line nor simply lets trains continue. Its rule distinguishes two block-working modes.
In the first, the train may continue to be guided by signals if it has already travelled 2,000 metres at a maximum of 160 km/h while observing all of them. If it has not, it must travel 2,000 metres at a maximum of 40 km/h; in both cases, it must notify the signaller. In other words, the first 2 km are worked at restricted speed, after which the train may accelerate to 160 km/h.
In the second mode, the train stops, reports its position and continues only under the regulatory instructions, including one for restricted-speed working to the next signal. The explanatory texts state that this requirement responds to a demand from the German railway authority.
Is it as safe as claimed?
Railway professionals are clear that, despite its age, it is a very safe system. Some even describe it as the safest in Europe, ahead of ERTMS.
It supervises continuously, brakes automatically and monitors itself: three computers process the same data in parallel, and if one disagrees, the other two continue. If a further one fails, the equipment is taken out of service. This is the fail-safe principle: when in doubt, the system restricts rather than permits.
But safe does not mean infallible. It protects within what it can see and within the rules applied around it. Its failure is not the danger in itself: what matters is what happens after it stops working — a scenario that must be avoided, but for which operators must be prepared when it occurs.
With Toledo, the question is not only why LZB failed, but how traffic was managed without it and why the rear-end collision was not prevented from the CRC. Answering it will require analysis of the on-board recorders, communications and the instructions issued from the control centre.