Short answer
Each railway safety system guards against one kind of failure. A crash happens when something goes wrong that none of them can catch. Most often that is during a fault, when people take over from the machines.
Where the layers came from
Why are railway safety rules written after crashes?
Many of the safety layers in the video became law after a crash.
In June 1889, the Armagh disaster in Ireland killed 80 people. The inquiry led to brakes that put themselves on if the brake system fails.5
That same year, a new law let the government require three safety measures on passenger lines: only one train on each stretch of track; signals and switches locked together, so two trains could not be given the same route; and those fail-safe brakes.4 The same three ideas still keep trains apart today.
Since then, each new layer has closed a gap that an earlier crash found. The timeline below mixes crashes with near misses, where a machine stopped the train in time.
- 1889Armagh: 80 dead. Blocks, linked signals and fail-safe brakes become law
- 2006Purley: stopped 35 m past a red
- 2013Santiago: 179 km/h on a curve meant for 80
- 2016Bad Aibling: head-on on a single track
- 2023Tempi: head-on, no train protection
- 2024Cuenca: stopped 5.4 m past a red
- 2026Urda and Adamuz, Spain
lawcaught by the machinecrash4218191820
The worst of these, Tempi, didn’t make it into the video. Here it is.
The crash we cut
What happened at Tempi?
On the night of 28 February 2023, a passenger train left Larissa, in Greece, heading north to Thessaloniki. It had 352 people on board and was 48 minutes late. At almost the same moment, a freight train left Neoi Poroi, a station 47 km further north, heading south.1
The line had no train protection at all, so nothing on board would brake for a driver. Station masters gave drivers their orders over the radio.1
There were problems with the signals too. Repair work on the line was unfinished, so the signal for trains leaving Larissa always showed red. Every northbound train had to be told, by radio or in writing, to drive past it.1
Amber: the passenger train, sent onto the southbound track. Red: the freight train. The two stations are 47 km apart.1
The station master at Larissa was alone that night, with broken equipment and a flood of calls.1 The station had an automatic way to set a train’s route, which would have set every switch correctly. But like every station master on the line, he moved the switches by hand, one at a time.1 He forgot to move one pair back. That sent the passenger train onto the southbound track, the one the freight train was on.1 The investigators say it is very unlikely he meant to do it.1
Thirteen minutes
- 23:05Both trains are told they can go
- 23:08The passenger train crosses onto the wrong track
- 23:09The two station masters swap departure times and miss the clash
- 23:18Head-on crash
At 23:05, both trains were cleared to go. The radio message to the passenger train said nothing about changing tracks, and its drivers did not repeat it back.1
At about 23:08 the train went over the switches onto the wrong track, and the drivers carried on.1 That may not have looked strange to them, because the train had already run on the opposite track earlier that evening.1 For about ten minutes it ran towards the freight train on the same track.1
Train cars are not built to survive a crash above 36 km/h, and the railway had no rule to slow trains down when the signals were not working.1
In July 2026, the head of Hellenic Railways told parliament that ETCS, Europe’s standard train protection system, was installed but not switched on anywhere in Greece.6 In September, Greece said the line now had a fully working remote signalling system.7
When the machine catches it
Does train protection ever stop a crash?
Yes, though you rarely hear about it. Tempi had no train protection. At Purley and Cuenca, a system stopped a train within metres of passing a red signal. But in both cases, a person then let the train move again.
A freight train’s safety system stopped it automatically. The driver reset the system without calling the signaller and drove on, until the signaller turned a later signal red. No one was hurt.2
ETCS stopped a high-speed train 8.6 m short of the spot the signal was protecting. Neither the driver nor the controller realised it had passed a red signal, so the controller let it carry on. A supervisor stopped it again two and a half minutes later.8
At Cuenca, Spain’s investigators said that once the train was moving again, the only thing left to prevent a crash was a person checking by eye that the track ahead was clear. That check, they wrote, “is liable to fail”.8
Coverage
How much of Europe has modern train protection?
Those near misses show what train protection can do. But how much of Europe has it? By the end of 2025, about 22,000 km of track had ETCS, counting the EU, Switzerland and Norway. The EU’s railways alone add up to 201,314 km.3
Each dot is about 1,000 km of EU railway. The amber dots are the lines with ETCS.3
The rest of Europe uses older systems that each country built for itself. Some work well, and many are out of date.3 Only six EU countries say more than 90% of their network has the best level of protection: Germany, Spain, Italy, Luxembourg, the Netherlands and Romania. In other countries, a large share of lines has no train protection at all.3
The United States finished fitting its own train protection system, called PTC, on 57,536 miles of track in 2020. Investigators found it works well at stopping trains at red signals, but it doesn’t prevent every collision.9
Spain is one of the six countries with more than 90% coverage, and it still had two deadly crashes in 2026.1011 Good protection can’t help when it is switched off, or when the failure is somewhere it can’t see.
The handover
Why do things go wrong when people take over?
To see why, it helps to look at how the safety layers work together. The safety researcher James Reason drew them as slices of Swiss cheese. Each slice has holes, and the holes open, close and move. An accident gets through only when the holes in every slice line up for a moment.12
Each slice has holes. A mistake gets through only when the holes line up.12
Reason also said that after an accident, the useful question is not who made the mistake. It is how and why the defences failed.12
In 1983, the engineer Lisanne Bainbridge described the trouble with asking people to take over from machines. She called it the ironies of automation. We fit a machine because it does the job better than a person. Then we ask a person to watch it, and to take over when it fails.13 But skills fade when they aren’t used. So the person who has to step in has had little practice, at the very moment the job is hardest.13
You can see this at Tempi, Purley and Cuenca, and at Urda in the video. Each time, the machine was off or had already done its job, and a person on the radio or the phone was the last layer. ETCS is built this way too: in its backup modes, the driver is responsible for the train, not the system.14
Still open
Where do the Spanish investigations stand?
As of 28 October 2026, neither of this year’s crashes in Spain has a final report.
- 12 Nov 2026Adamuz: recorders to be read in courtThe trains’ data recorders are due to be read in court. AITAT, Spain’s new accident investigation body, took over the case on 15 July. It says its final report will not come before mid-2027.15
- Open
Quick answers
Questions people ask
What happened in the Tempi train crash?
On 28 February 2023, near Tempi in Greece, a passenger train and a freight train crashed head-on on the same track. A switch near Larissa had been left the wrong way, the line had no train protection, and 57 people died.
Does train protection ever stop a crash?
Yes. At Purley in 2006 and at Cuenca in 2024, the system stopped a train just past a red signal. In both cases, people then let the train move again before anyone understood what had happened.
How much of Europe's railway has ETCS?
About 22,000 km at the end of 2025, counting the EU, Switzerland and Norway. The EU's railways alone add up to 201,314 km, so most lines still use older national systems.
Sources
Every source on this page
Each number in the text links here. We keep a saved copy of every source, and the quote below each one is the line the claim rests on.
- 1HARSIA/EODASAAM Rail Accident Report RL01-2025: Head-on collision between a passenger train and a freight train in Tempi, 28 February 2023 (English, mirror copy)
In total, 57 people, of which 11 staff members or subcontractors working for Hellenic Train, lost their life in the accident, 81 people were seriously injured, and 99 had minor physical injuries.
primary source - 2RAIB Report 27/2007: Signal passed at danger, Purley
The freight train was automatically stopped following a TPWS intervention, 35 m (38.27 yards) past signal T172.
primary source - 3ERA, Report on Railway Safety and Interoperability in the EU 2026
By the end of 2025, around 22 000 km of lines were equipped with the ETCS.
primary source - 4Regulation of Railways Act 1889 (as enacted)
(a) To adopt the block system on all or any of their railways open for the public conveyance of passengers ;
primary source - 5ORR: The story of HM Railway Inspectorate
In June 1889, the Armagh disaster killed 80 people and injured 260. The subsequent inquiry led to legislation and a new requirement for continuous and automatic brakes on trains, which we see today in the form of a failsafe brakes on system.
primary source - 6To Vima: Greek rail chief admits ETCS safety system still not running
he was forced to concede that the system is not currently in use anywhere, despite being installed, functional and licensed on most sections of the train line, and that licensing is under way on the rest.
secondary source - 7The National Herald: Greece's main railway line finally has fully operational remote traffic management system (Sept 2026)
Rail services on the Athens-Thessaloniki route have been operating since September 2 with the remote traffic management and signalling systems in operation
secondary source - 8CIAF IF 64/2024: incidente operacional, Cuenca-Fernando Zóbel, 25.06.2024
Este TRIP no fue interpretado como un rebase indebido de señal ni por el maquinista ni por el RC del CRC de Albacete.
primary source - 9NTSB RIR-23-12: Beyond Full Implementation: Next Steps in Positive Train Control Technology
In December 2020, the Federal Railroad Administration (FRA) announced that positive train control (PTC) was fully implemented
primary source - 10CIAF: expediente 19012026 Adamuz
El balance provisional de víctimas del accidente es de 39 muertos
primary source - 11El Diario de Madrid: Accidente de Urda, 69 muertos, cajas negras (29 Oct)
El balance de víctimas mortales del accidente ferroviario de Urda, en Toledo, ha aumentado a 69 tras el fallecimiento de una persona hospitalizada
secondary source - 12Reason, Human error: models and management, BMJ 2000
In reality, however, they are more like slices of Swiss cheese, having many holes—though unlike in the cheese, these holes are continually opening, shutting, and shifting their location. The presence of holes in any one “slice” does not normally cause a bad outcome. Usually, this can happen only when the holes in many layers momentarily line up to permit a trajectory of accident opportunity
primary source - 13Bainbridge, Ironies of Automation, Automatica 19(6) 1983 (archived NC State copy)
A more serious irony is that the automatic control system has been put in because it can do the job better than the operator, but yet the operator is being asked to monitor that it is working effectively.
primary source - 14European Commission, ERTMS: ETCS levels and modes
in this mode, the information is simplified (especially the trackside Static Speed Profile) and the driver is responsible for the train’s movement.
primary source - 15CIAF: nota de actualizacion sobre el accidente de Adamuz (23 enero 2026)
Las únicas conclusiones válidas serán las incluidas en el informe final.
primary source - 16CMM: Última hora accidente de tren en Urda
la investigación judicial corresponde a la Sección Civil y de Instrucción del Tribunal de Instancia de Orgaz, plaza número 2, en funciones de guardia.
secondary source - 17Qué!: tres errores del accidente de Urda (29 Oct)
Puente evitó calificar los hechos como error humano.
secondary source - 18CIAF Informe final accidente 0054/2013 Santiago de Compostela (24.07.2013)
La causa del accidente fue un exceso de velocidad del tren (circulaba a 179 km/h) en la curva de entrada a Bifurcación A Grandeira (curva de Angrois, limitada a 80 km/h)
primary source - 19BEU Untersuchungsbericht Zugkollision Bad Aibling - Kolbermoor 09.02.2016
Am 09.02.2016 gegen 06:47 Uhr kollidieren auf der Bahnstrecke Holzkirchen – Rosenheim (Streckennummer 5622) zwischen den Bahnhöfen Bad Aibling und Kolbermoor die beiden Züge DPN 79505 und DPN 79506 der Bayerischen Oberlandbahn (BOB) etwa in Streckenkilometer 30,29.
primary source - 20eldiario.es: Puente ve inexplicable la orden del centro de control
el tren recorre 25 kilómetros con el tren Iryo detenido y acaba impactando
secondary source
Next
What lies under Canada's biggest lakesWhy Canada has so many big lakes, how deep Great Slave Lake really goes, a fault that slid 75 km, and land that is still rising: what our lakes video left out.