Veritasium · Engineering Failures
The Most Dangerous Escalator In Europe
When football fans crowded onto a Rome metro escalator in 2018, three layers of safety engineering failed in sequence. The reason the last one failed was not mechanical.
Tap a timestamp pill below to jump the video to that moment.
The problem
An overloaded escalator accelerated out of control—and none of its safety systems stopped it
In October 2018, fans leaving a CSKA Moscow vs. Roma Champions League match descended into the Spagna metro station in Rome. They crowded onto one of the long escalators leading down to the platform. The combined weight pushed the load on the main motor past a tipping point, and it began to accelerate uncontrollably—instead of descending at a controlled speed, the escalator was now running away with its passengers.
Safety sensors in the machine detected the anomaly and fired two responses in rapid succession: power to the motor was cut, and the main brake engaged. Two massive arms clamped onto the drum to lock it in place. By design, this brake alone should have had enough stopping power to halt a fully loaded escalator even under extreme strain. The redundancy was built in precisely because the engineers who designed the system knew motors could fail.
How they solve it
Three failsafes, three failures—the last one was deliberate
The main brake did not stop the escalator. Post-incident testing was unambiguous: its braking force had degraded to around 37% of the manufacturer’s rated specification. Nobody knows exactly when the deterioration happened, but by the night of the incident the brake was badly compromised—enough stopping power under normal load, not nearly enough for a staircase packed with 50 fans.
Tests after the incident showed braking force far too low, around 37% of spec…
With the main brake failing, the auxiliary brake triggered automatically when the escalator’s speed exceeded 120% of its rated maximum. Steel wedges were supposed to drive into a disk on the drive shaft—a purely mechanical last resort that required no sensors, no power, no decision logic. This was the backstop that was supposed to be impossible to defeat by anything short of catastrophic structural damage.
But when investigators opened the auxiliary brake housing, they found it had been partially disabled. Someone had physically tied plastic straps around one of the two brake wedges, preventing it from engaging. One of the two mechanical safeguards of the final failsafe system had been deliberately neutralised by a person, not worn down by time or load.
When investigators opened this brake, they were shocked. The final backstop had been partially disabled…
The video’s core argument is architectural: redundant safety systems are only as strong as their independence. Three separate mechanisms—motor cutoff, main brake, auxiliary brake—were designed assuming each could fail on its own. The design did not account for a failure mode where a human intentionally corrupted a component that no sensor could detect. When that assumption breaks, the entire redundancy structure collapses into a single point of failure: the integrity of the people with access to the machine.
Takeaway
The quick version
- Three independent safety layers were engineered to prevent exactly this failure. All three were compromised on the night.
- The main brake had degraded to 37% of rated braking force—likely undetected during routine maintenance.
- The auxiliary brake was deliberately disabled: plastic straps tied around a wedge, preventing it from engaging.
- Redundant safety design assumes independent failure modes. Human tampering breaks that assumption entirely.
“Someone had physically tied plastic straps around one of the two brake wedges and rendered it useless.”— Veritasium
The most dangerous escalator in Europe wasn’t dangerous because engineering failed. It was dangerous because someone made sure it would.