Why "unsafe"? Isn't safety supposed to be handled at a different abstraction level (in hardware)?
Other systems that might normally provide safety critical redundancy could be providing the sole measure of safety, with no other redundancy available in case one of those fails.
“Unsafe” is always defined based on context.
Edit: and to be clear, we're not talking about holding down a resetable circuit breaker to avoid being late, we're talking about the rail network of an entire nation being inoperable for a day.
You can never know if the primary safety system is functioning perfectly, so you need other systems to be there to step in when the primary fails unexpectedly.
If you detect the primary system has failed, isn’t it reasonable that you should stop operation as quickly and safely as possible, and be thankful nothing bad happened while you lacked redundancy? Any SPoF could be fatal for hundreds of people.
This isn't some consumer appliance where you have to stupid proof every inch of it. These systems are bespoke and their architecture is mostly a matter of business decisions and not at all a matter of the internet peanut gallery trying to figure out how safe they can make it.
Calling me a ”clipboard warrior” isn’t furthering your argument, though.
This comment provides an excellent example along the lines I was talking about: https://news.ycombinator.com/item?id=30902016
There was an incident a few years ago where a LIRR track crew member stepped in front of a train going 78mph and died.
https://www.ntsb.gov/investigations/AccidentReports/Reports/...
The employee that died had been on duty for 38 of the 50 hours leading up to the fatality. One of the NTSB's recommendations is to implement software that avoids worker fatigue:
"The FRA encourages the use of certified biomathematical models, such as the Fatigue Audit InterDyne Model and the Fatigue Avoidance Scheduling Tool (FAST) by railroads to help them develop work schedules for safety-sensitive employees that align with healthy work-rest scheduling practices; however, these safety measures do not apply to roadway workers. 14 The work schedules developed through biomathematical models avoid many pitfalls causing worker fatigue that arise from excessively long work hours, highly variable work shift times that disrupt human circadian rhythms, and infringement on sleep opportunity times."
TL;DR: it's not about the trains crashing into each other. It's about sleepy people making bad decisions that gets them or their colleagues killed.
I'm not from the NL, but I have travelled there by train. My feeling is that they have very dense traffic, but in a relatively small country most trains don't travel more than 2 hours. That means each driver and each conductor needs to make 4 different trips a day. And because they need breaks they proably switch trains during a working day. If all this planning has been computerized for many years it just means that nobody knows what to do next if the computer screen remains blank. Probably they don't get a printout in the morning like it was some decades ago. No idea how adaptively the system would react during the day dependening on delays and disruptions.
Just guessing, maybe some insider knows more.
See https://nl.m.wikipedia.org/wiki/Rondje_om_de_kerk (in Dutch, use Google Translate to translate to a language of your choice).
https://en.wikipedia.org/wiki/Railway_signalling#History_of_...
The worst will have been avoided, but at least one of the train will have to back down to the nearest junction, and depending on how packed it is they might have to back down a few more train as well. I’d assume in reality it would deadlock from there.
Sure stopping all trains must be burning a crazy amount of money, but the above scenario would be burning the same amount of money (I assume they have refund policies or they'd be operating with no ticketing), employee sanity, and urgent care for anything that could happen during that time.
I have faith in Dutch people's kindness, the same happening in Paris would be riots and physical danger for the staff if they kept the trains running.
What is more interesting is how they get away with this when PTC is now mandatory (a lot of special operating rules/restrictions).
Some local routes with few trains a day, where there is no longer any track-side staff, operate in a simplified rules (there is a whole code for that). There, the train will arrive to a station and depending on a symbol in the timetable, it will either continue to the next station without any signals or permissions needed or will wait for crossing train in oposite direction (the train driver must also unlock the station office and call the dispatcher on phone in some cases). Switches are either operated by train crew or they are self-returning (one direction always go to track 1 in station, the other direction goes to track 2, and the switches can be travelled through in the oposite direction without setting them first (this is an accident on standard switches) and they return back.
So, the problem was that the crossing was there on some days and wasn't on some other days, driver forgot or misread the day and the train left into oncoming train...
Was a big discussion after that to do anything, even an uncertified mobile app to shout "train coming" at the driver... Otherwise Czech rep. has a very modern European rail infra, just some local branch routes run like this saving them from being cancelled completely, but the rules were simified maybe too much.
Lets say there is a north-south train line that is shared.
The schedule can create a number of north slots and south slots into which a train of a given speed and length can fit. A variety of different trains could fit into the same slot.
If a train is late, that train is moved into a later slot. That leaves a free slot where the train was going to go. Perhaps every later train is then delayed into a later slot also. Lets call this a rippling delay.
You would probably schedule some spare slots to prevent delays rippling through the entire day's schedule. Some slots might be long enough to permit several trains going in the same direction to travel (it's more efficient if 10 north trains go then 10 south trains rather than 10 north/south interleaved).