About the tragedy of Urda

The Urda tragedy makes me reflect on safety mechanisms in transport, whether for automobiles, trucks, airplanes, or trains.

These mechanisms have an automatic component and a human component. And they have layers. The usual one ensures operation under normal conditions. The emergency ones come into action if something goes wrong. In all of them, there are automatisms and human decisions. In the case of the Urda trains, I see two layers of emergency: in the first, the automatic reaction prevails (if the LZB system fails, the trains stop), in the second, the human component is very present in the decisions of the Atocha center to restart.

Which ones prevail at any given moment will depend on what technologies are available. Also on their cost (more relevant for an automobile than for a railway network), customs, and inertia. We observe a trend: the automatic component is increasing with respect to the human one. Technological advances and the reduction in their cost allow for significant safety gains. Today I am convinced –I was not three years ago– that, as far as the automobile is concerned, we are moving, in the medium term, towards a world of autonomous vehicles that will cause a drastic reduction in accidents. Those who look at us from centuries from now will see it as a barbaric trait of our time that we moved in vehicles where safety depended on the driver's reflexes. And that the 1.16 million deaths in the year 2025 were considered de facto as a tolerable collateral effect.

The idea that the optimal system must combine automation with human control is correct if the technology is not yet perfect or if it is too expensive. This describes the reality of the present, but if one day we reach the desirable milestone where the accident rate is practically zero, it will be because of the technology. It is possible that for some means of transport (the airplane, the automobile) the recourse to human decision as a last resort must be maintained: it is good for passengers to see a company official who shares the risk. And if everything fails, it is necessary to give options to those whose lives are at stake, even if this option might, in aggregate terms, increase the accident rate. But to think that, as a principle, in every situation the last word must always be had by a human is a mistake. It has been in Urda.

Explicitly or implicitly, well-designed safety systems are based on probability estimates of emergency situations. If these are not exceptional, it is even more important that the system minimizes the impact of human decisions. In our case, it seems to me that the second layer of emergency (that of Atocha) was based on a very significant human component, on an ambition of rapid restoration of normality (restarting the trains quickly) that did not minimize the risk, and on the presumption of a very low probability of an emergency. We now know that the LZB system had failed 170 times since the beginning of the year. If either the system or the goal of restarting quickly was not changed, the accident would sooner or later have occurred. Unfortunately, it occurred before the substitution for a less fragile system was completed.

The fact that the probability of an emergency is extraordinarily low does not solve the problem of human control either. A very notorious case is that of Air France flight 447 from Rio de Janeiro to Paris on June 1, 2009. In the middle of the Atlantic and a storm, some sensors failed and the pilots, with many hours of flight, had to take control of the craft. They did not know how to manage the anomalous situation. The plane crashed with 228 people on board. They all perished. The investigation concluded that the pilots were not sufficiently trained in emergencies of a different type than the most common ones.

In short, the greater the role of humans in safety systems, the more we will remain constrained by the need for caution. If the type of emergency is little known (and who would bet that we have a complete catalog?) we find ourselves with the problem of training. If it is known, it is likely because it occurs with some frequency, in which case the law of large numbers works against us. In the case that motivates this article, the risk increases due to safety protocols that are not prudent and that add risk (restarting quickly).

The goal becomes clear: to move towards automatic systems for means of transport. It will arrive.