The Institution of Railway Signal Engineers Inc

Australasian Section Incorporated

ETCS for Worldwide Train Control

Nick Terry
BA CEng MIET MIRSE RPEQ
Independent Consultant

SUMMARY
This paper discusses the application of the European Train Control System (ETCS) now and into the future.
From its beginnings in an EU Directive in 1989, it is today one of the world’s most successful cab signalling
and train protection systems that can be applied to any railway in the world.
Interoperability is a major feature of ETCS. To achieve this, compliant ETCS without modification must be
deployed. The advantages and the limitations of making changes are discussed.
The application of new developments of Baseline 3 and ETCS level 3 are briefly considered.
Looking to the future, the addition of Automatic Train Operation to ETCS, and the confluence (or not) of
ETCS and CBTC technologies is introduced.
But overall, because ETCS includes so many options and parameters, the success of a particular installation
now depends heavily on the application engineering. This is explained in some detail.

1 INTRODUCTION
In the 1980s, the European Union (EU) held the view
that a major obstacle to the efficient and competitive
operation of railways within Europe was the great variety
in styles of railway systems and procedures. These
restricted competition in the supply industry, and
prevented trains running seamlessly across borders.
Efficient transport of people and goods within and
between countries within the EU was seen as essential
to maintain the EU’s competitiveness. This led to the
European Council issuing a number of Interoperability
Directives for high speed rail and for conventional rail.
From these Directives came a series of Technical Figure 1: ERTMS Constituents
Specifications for Interoperability for Rail Command,
Control and Signalling. ERTMS (European Railway
Traffic Management System) is the system that This paper discusses the ETCS element of ERTMS.
implements these specifications. The ETCS element provides two principal functions:
ERTMS can be broken down into a number of Automatic Train Protection (ATP) and Cab Signalling. It
subsystems – see Figure 1: ERTMS Constituents. is important to understand that these are two relatively
separate functionalities which are provided by the one
system (ETCS). Automatic Train Protection is the
generic name given to a system that automatically
applies the train brakes if a driver does not keep the
train’s speed below the specific trackside safe limits for
the train’s current location and operating conditions.
Cab Signalling is the generic name given to a system
that displays information inside a train cab about the
current status of the track ahead – such information was
traditionally provided to the train driver by trackside
signals and signs. ATP and cab signalling systems
have quite different safety and operational requirements.

IRSE Australasia Technical Meeting: Brisbane Page 1 of 7 20 July 2012

IRSE Australasia
More detailed information, including the history of the
development of ETCS, can be found in the
“Compendium on ERTMS” (reference [1]).
Detailed descriptions of the ETCS system and its
functionality have been presented to the IRSE in
Australia on several previous occasions. Papers were
presented on several ETCS topics at the 2008 AGM in
Sydney. There are also many publications in hard copy
(see reference [1]) and on the internet (see reference
[2]). Therefore the technical description of ETCS will not
be repeated in this paper. It is assumed that the reader
has a basic understanding of ETCS, including the
concept of ETCS levels (0 to 3).
2 NOTATION
ATO Automatic Train Operation
ATP Automatic Train Protection
CBTC Communication-Based Train Control
DMI Driver-Machine Interface
EoA End of Authority
ERTMS European Railway Traffic Management System
ETCS European Train Control System
EU European Union
EVC European Vital Computer
FFFIS Form, Fit, Functional Interface Specification
FIS Functional Interface Specification
GSM-R Global System for Mobile communication –
Railways
IP Internet Protocol
LEU Lineside Electronic Unit
RBC Radio Block Centre
SIL Safety Integrity Level (as defined in EN50129)
SRS System Requirement Specification
SvL Supervised Location
UNISIG UNion of Industry of SIGnalling
3 ETCS for World Wide Train Control
ETCS is a set of tested and proven specifications for
train control subsystems and interfaces. More than six
suppliers now manufacture equipment that has been
independently validated as meeting the specifications.
ETCS is sufficiently flexible in the way that it can be
adapted to different railway operating rules, so that the
only outstanding issues to its worldwide adoption are
now application issues. This paper considers the major
application issues, with particular regard to ETCS being
applied outside of Europe.
3.1 Interoperability
Interoperability is a property of a product or system,
whose interfaces are completely understood, to work
with other products or systems, present or future,
IRSE Australasia Technical Meeting: Brisbane
ETCS for Worldwide Train Control
without any restricted access or implementation (source:
reference [3]). Interoperability is a major feature of
ETCS.
Full interoperability requires both technical
interoperability, and operational interoperability (the
rules). ETCS can only achieve the first requirement; the
latter is up to those responsible for its implementation on
a particular railway.
Figure 2 is a high level ETCS system diagram, showing
the interoperable interfaces.
Radio
Base RBC
Station
GSM-R
mobile unit
J u o rd
re
dic ing
c
ia
l
Interlocking
Train EVC
Control
Balise Euroloop
Centre
FFFIS
FIS
LEU
Non-ETCS
Figure 2: Interoperability within the ETCS system
Those interfaces defined by Form, Fit and Functional
Interface Specifications (FFFIS) support complete
interoperability. Those interfaces defined only by
Functional Interface Specifications (FIS) support the
ETCS functionality, but the lower levels of the interface
are left up to the suppliers, so the whole interface is not
interoperable.
It should be noted that the interfaces between the LEUs
and the balise/Euroloop are defined by FFFIS, but have
not been implemented as such by all manufacturers.
3.2 ETCS Braking Model
The ETCS braking model is shown in Figure 3.
This figure shows to the left the area of “Ceiling Speed
Supervision” where there is no target within braking
distance. In this area, the permitted speed is displayed
to the driver. If this is exceeded by 5km/hr, a warning is
given. If the permitted speed is exceeded by 10km/hr
then the service brake will be applied. If the permitted
speed is exceeded by 15km/hr then the emergency
brake will be applied. These margins are reduced at low
speeds. They are parameters that could be changed
outside of Europe, if a particular railway’s rollingstock’s
driving characteristics were such that larger differentials
are required.
Approaching a target, the service brake curve is
calculated back from the End of Authority (EoA), whilst
the emergency brake curve is calculated back from the
Danger Point, or end of the overlap, taking into account
all possible train location errors. This point is known as
the Supervised Location (SvL). It is the point beyond
which it is not safe for the train to proceed.
Page 2 of 7 20 July 2012
IRSE Australasia
Figure 3: ETCS Braking Model
In order to ensure that a train can actually reach the
EoA, the service brake is released at a speed known as
the Release Speed. This speed can either be calculated
onboard (as the speed at which a train tripped at the
EoA would stop before the SvL), or specified by the
trackside design.
All of the curves, distances and margins are defined in
the application engineering by setting onboard and
trackside ETCS parameters. Thus the application
engineering needs to consider the trade-offs between
safety and conservatism.
3.3 Conservatism versus Safety
All ATP systems require a trade-off to be made between
operational performance and safety. This trade-off
arises from the uncertainties and errors in the ATP
system. The uncertainties cannot be estimated
precisely. If they are under-estimated, then the system
may not stop the train before the SvL, and so be unsafe.
If they are over-estimated, then the system will be
conservative and stop the train too early.
Errors arise principally from the following sources:
• Train position errors from balise position
uncertainty and geographic data uncertainty
(typically 5m)
• Train odometry errors from tachometer errors
due to wheel slip/slide and wheel diameter
errors (typically 1% of the distance from the last
balise)
• Track gradient errors in the data due to the
granularity within the track data model
• Train braking rate errors due to a single braking
model being used for a whole class of trains
without considering individual trains
• Reduced rail-wheel adhesion limiting braking
• Errors from digital sampling and processing
delays in outputting information
In order for the system to be safe (ie. to always stop the
train before the SvL) conservative estimates of all of the
above errors are built into the system. This ensures
that, even with all of the above errors, the train will not
continue passed the Supervised Location (SvL).
Optimal application engineering will minimise these
errors, but, if left unchecked, they would still make the
system extremely conservative.
IRSE Australasia Technical Meeting: Brisbane
ETCS for Worldwide Train Control
The ETCS braking model manages the balance
between conservatism and safety by using two braking
curves. A service brake curve is calculated back from
the estimated End of Authority (typically a signal or block
marker). Beyond this point is a safety margin (similar to
a signalling overlap). The emergency brake curve is
calculated back from the end of the safety margin
(known as the Supervised Location, SvL). All of the
above errors are taken into account in calculating the
emergency brake curve, but not in calculating the
service brake curve. For optimal operation, the
application engineering (where all of these parameters
are set) must ensure that these two curves meet the
above requirements, but do not cross each other.
This is not a straightforward task, though it is heavily
aided with modelling and simulation. Some of these
parameters are determined by the trackside data and
layout, and others are determined by the onboard
characteristics of the particular train, which may not be
known when the trackside data is being prepared.
3.4 ETCS Data
ETCS only stores a minimal amount of data onboard the
train (train braking rates, maximum train speed, train
length, and many parameters describing the onboard
hardware configuration, but no geographical data).
Some of this data is modifiable by the driver.
All geographical data is stored in the LEUs (level 1) or
the RBC (levels 2 & 3). When a Movement Authority is
transmitted to the train from the trackside, it includes the
relevant extract of the geographical database for that
route (balise groups ahead, gradient, speed profile, and
any other special conditions of that route). Thus ETCS
application engineering consists mainly of establishing
the application rules (akin to Signalling Principles), of
trackside data preparation, and of electrical and
mechanical engineering for each class of train.
Because ETCS is a cab signalling and ATP system that
is acceptable to all European railways, it contains the
“lowest common denominator” of all European railway
operations. Most railways do not use many of the
features. But they all need either setting or disabling in
the application engineering. Thus there is much
opportunity within the application engineering to achieve
suboptimal or optimal operation. For example, ETCS
supports signalling-related speed restrictions, such as
those imposed by conventional speed signalling
systems. Railways based on route signalling will not
use these (and many railways based on speed signalling
Page 3 of 7 20 July 2012
IRSE Australasia
will not propagate them into an ETCS application in
order to increase performance).
ETCS data preparation is a complex task. Every balise
contains 1,023 bits of data. LEUs contain many
possible telegrams for each controlled balise in level one
areas. RBCs contain the equivalent amount of data for
level 2 & 3 installations. Therefore it is not practicable
for this quantity of data to be prepared manually.
Each ETCS supplier has developed their own
geographic data preparation system. They are not
interoperable, as they involve integration with the LEUs
and interlockings over non-interoperable interfaces.
Several sets of rules are used to achieve the final data –
this is represented in Figure 4: ETCS Data Prep
Hierarchy. More rules automatically applied by the data
preparation system lead to faster, cheaper and more
accurate data. But the rules must be optimised for the
particular application being designed – this will mean
either adjusting the supplier’s rules for a particular
application, or writing a new set of Infrastructure rules.
Compiled data
ETCS rules
Supplier’s
rules
Infrastructure
rules
Figure 4: ETCS Data Prep Hierarchy
3.5 Safety
The ETCS system, including radio transmission by
GSM-R (for levels 2&3), is designed to a Safety Integrity
Level (SIL) of 4. This achieves a tolerable hazard rating
-9
of 10 , meaning that the probability of a particular train
suffering a failure that leads to an unsafe situation is
-9
less than 10 per hour of operation of that train.
Although the overall ETCS system achieves SIL4, this
does not mean that all of the components individually
achieve this level. For example, the DMI only achieves
SIL0 or SIL2 (depending on supplier). But its operation
is protected by the SIL4 ATP functions of the EVC, so if
the wrong speed were presented to the driver then the
train/system would still be protected by ATP.
It should also be noted that the overall train control
system includes components outside of the ETCS
system, such as the interlocking and train detection
systems. These components are not covered by the
ETCS specifications so may or may not achieve SIL4. If
they do not, then the overall level of safety of the
complete ATP system will be lowered.
The new mode within Baseline 3 of Limited Supervision
(see section 3.9) allows only selected features to be
protected by ATP. These features should be chosen on
a cost versus risk basis. Therefore safety engineering
as part of the application will be required to justify the
choice of features to be fitted.
3.6 Availability
The ETCS specifications define the required system
safety, functionality, and the interfaces. They do not
IRSE Australasia Technical Meeting: Brisbane
ETCS for Worldwide Train Control
define the reliability requirements for each subsystem –
that is left up to the supplier.
The following is a list of some examples of redundant
architectures (physical and/or functional) used by
suppliers to increase system availability:
• Duplicated balises within a single group
• Long Movement Authorities permitting the next
balise group to be missed
• 100% overlapping radio coverage
• 2-out-of-3 or 1-out-of-2 processing
architectures
• Redundant onboard odometry
• Dual fitting the trackside with levels 1 and 2
It is a matter for the application engineering to determine
which of the above to apply (if any), and how, in order to
meet the required availability targets.
3.7 Track Capacity
Whether the introduction of ETCS leads to increased or
decreased track capacity (headway) is a complex issue.
The direct technical effect of introducing either level 1 or
2 as an overlay over conventional signalling should be
minimal. Even level 1 with no intermediate (infill) balises
should have no impact on headway because trains
should not be running so close together that they are
approaching signals at danger.
In practice, whether the introduction of ETCS affects
headway depends primarily on the application
engineering. Even with level 1, the presence of an ATP
system can be used to justify reducing the length of
overly long overlaps, and junction signalling can be
relaxed to allow fitted trains to take the junction at the
civil design speed, not the signalling speed. Both of
these factors can lead to significant improvements in
headway. Whilst such improvements require alterations
to the existing signalling systems and careful integration
with the operating rules, on railways currently using full
braking overlaps, significant benefit could be realised.
3.8 ERTMS Regional
“ERTMS Regional” is the name that has been adopted
to describe the first application of ETCS level 3. It has
been developed and deployed in Sweden. It is aimed at
the large number of low density, regional lines where it
is essential to minimise the quantity of trackside
signalling equipment. On these lines, the number of
trains in operation is small, and they may be fitted with
ETCS onboard equipment anyway so that they can
operate over other fitted lines. Headway is not critical.
ERTMS Regional can be described as a simplified
ETCS level 3 application. Train integrity is assured by
operational procedures, as a device providing the
required level of safety for variable composition trains
has not yet been developed and approved.
GSM-R is provided throughout for voice radio
communications between drivers and the control centre.
As a result, GSM-R is also used for the data
transmission of ETCS data. Due to the low density of
the train services on such lines, radio network capacity
is less of an issue in this application than in mainline
applications.
Although ETCS level 3 will support moving block
operation, ERTMS Regional is a fixed block application.
This is sufficient for the train density on such lines, and
still permits trackside signalling infrastructure to be
Page 4 of 7 20 July 2012
IRSE Australasia
minimised, with no signals and only intermittent train
detection equipment.
ERTMS Regional is currently being deployed within
Sweden, where it commenced commercial trial
operation earlier this year. It is an important step
towards higher capacity level 3 applications in the future.
3.9 Limited Supervision
Limited Supervision is an onboard mode that will be
introduced in the new release of ETCS (Baseline 3 –
see section 3.10). The aim of this mode is to give fully
fitted ETCS trains some train protection at minimal cost
to the infrastructure on conventional lines where full
trackside ETCS fitment cannot be justified.
In this mode, the driver is not given any maximum nor
target speed information from the ETCS equipment.
The driver must drive to the conventional trackside
signals. The onboard ETCS equipment reads balises,
which give intermittent speed profile and authority
information. High risk signals and speed restrictions can
be fitted with ETCS trackside equipment, and low risk
signals and restrictions omitted. The onboard
equipment will enforce those features that it has
information about, but will not lead the driver into
exceeding those features about which it has no
information. It is a limited ATP system without cab
signalling.
3.10 Baseline 3
ETCS versions are generally referred to by the version
number of the ETCS System Requirement Specification.
The first version to be released into commercial service
was 2.2.2. Lessons learnt from this were incorporated
into an updated version 2.3.0. However this was rapidly
replaced with a “debugged” version 2.3.0.d in 2008
(reference [4]). Many systems have now been upgraded
to this version, and all new systems currently being
implemented are to this version.
Improvements and extensions to ETCS are continuously
being proposed. In order to maintain interoperability
across Europe, release of changes has to be heavily
controlled.
In 2008, the European Commission and the railway
representing associations agreed a timetable for the
rollout of Baseline 3. They agreed that by the end of
2012 the SRS for baseline 3 would be agreed and
stable. That timetable is broadly being met.
Changes included within Baseline 3 (as per reference
[5]) include the introduction of the following features:
• Limited Supervision mode (see section 3.9)
• Speed restrictions defined by the length of a
train’s braking distance
• Train horn control
• Station platform position, side and height
• Level crossing announcement and speed
enforcement
• A unified braking model (see reference [6] for
published braking model tools)
• Service Brake feedback
• A pre-indication of approaching a target
• Cold movement detection
IRSE Australasia Technical Meeting: Brisbane
ETCS for Worldwide Train Control
Each of these features increases the amount of
application engineering that will be required for a
specific implementation. They increase the number of
options available, which either require disabling, or
configuring, on a project by project basis.
3.11 Variations to ETCS
Within Europe, the railways that carry the majority of the
long distance traffic are covered by the European
Regulations which make it compulsory for any upgraded
train control system to be compliant ETCS. Outside of
Europe, this requirement does not exist. But, as
discussed earlier, there are several very strong reasons
for any railway adopting ETCS, to apply it in a totally
compliant manner:
• No development is required
• Multiple suppliers are available (both now and
in the future)
• System support is guaranteed
• The system is well documented
• Trained and experienced staff exist
• Upgrade paths to level 3 and beyond are
available
As soon as the first change from standard ETCS is
made, then immediately all of the above advantages are
lost. Therefore it is strongly in any railway’s interest to
implement compliant ETCS, even when the proposed
railway is a closed network.
Having stated the above, there is one area in which
railways outside Europe may be forced to deviate from
compliant ETCS, and it is also the weakest area of
ETCS: the choice of radio system. ETCS (levels 2&3)
makes use of the radio equipment of the ERTMS family
for the transmission of data. Whilst the ETCS bandwidth
requirements are relatively low, the latency must also be
low, as any delay will directly impact train headway, and
hence decrease line capacity. With ERTMS having
chosen GSM-R radio systems for the standard voice
radio system across Europe, ETCS uses these same
systems to transmit data. But GSM-R is fundamentally
a circuit-switched system, so the ETCS system takes up
a whole channel per ETCS train, for all the time that the
train is in service. For the majority of the time, the
channel is not transmitting useful data. The number of
available GSM-R channels is limited – this leads to limits
on the number of trains that can be in service in one
area at any one time. For this reason, and that GSM
systems are near the end of their life (being replaced
with 3G and 4G systems), there is a strong argument for
applications outside Europe to replace the GSM-R
systems with an alternative packet-based radio system.
Although the radio system is outside the ETCS section
of the ERTMS specifications, the fact that the radio
system is GSM-R is embedded within the ETCS
specifications. Thus there are two solutions to changing
the radio system:
• Introduce GSM-R emulators so that the
alternative radio system appears to be GSM-R
to the ETCS system
• Re-design the interface to the radio system to
make it IP-based, but technology-agnostic.
The development costs of the two solutions are similar,
but the second option is superior as this would then
allow any suitable radio system to be used. Radio
technology changes faster than train control technology,
so a standard interface (such as an Internet Protocol
Page 5 of 7 20 July 2012
IRSE Australasia
interface) that supports such changes in the future
would be advantageous for all ETCS systems. The
requirements for an alternative radio system should be
described in IP-based interface specifications for the
boundaries, and a specification for the required Quality
of Service for the connection between the train and the
RBC.
The first project to apply ETCS with an alternative radio
system (TETRA in this case) is currently being
implemented in Kazakhstan. This project is being
watched by several parties interested in operating ETCS
level 2 without GSM-R.
3.12 Automatic Train Operation with ETCS
ETCS was designed for mainline, high speed and long
distance railways where interoperability is a key factor.
These railways do not currently use Automatic Train
Operation (ATO), nor do they intend to in the near
future. Therefore there is no approved plan to add ATO
functionality to ETCS.
ATO is widely used on Metro systems, and is being
introduced onto some suburban railways as the train
service becomes more like a Metro. The underlying
ATP system within ETCS is able to operate in a metro
environment. ETCS can be configured for high braking
rates and short sections.
Convergence between ETCS technology and metro
solutions is starting to occur, due to the following factors:
• Some suppliers have based their metro ATP
solution on ETCS already
• ETCS Baseline 3 includes some of the missing
ATP features needed for the metro
environment
• ETCS level 3 is the same level of ATP
functionality as is used on modern metros
today.
Thus, from a technical point of view, all that is required
is the addition of an ATO module onboard the train to
control the acceleration, brakes and doors,
communicating with an ATO controller at the control
centre, as illustrated in Figure 5: Possible ATO on top of
ETCS.
Figure 5: Possible ATO on top of ETCS
A radio system is required to transmit the ATO
information from the trackside to the train. This could
either be a totally separate radio system, or the GSM-R
of ERTMS, or the configurable packet 44 within the
Euroradio layer of the GSM-R system.
To be consistent with the ERTMS philosophy, the ATO
should be defined as interoperable. Unless suppliers
IRSE Australasia Technical Meeting: Brisbane
ETCS for Worldwide Train Control
are forced to do this by an external organisation, they
will not. But there is nothing to stop a compliant ETCS
system having a non-interoperable ATO system laid on
top of it – other operators’ trains would just not have
ATO in that area.
4 CONCLUSION
ETCS is an advanced and extremely flexible ATP
and in-cab signalling system – it has to be flexible
to cope with the many variations in railway
operating practices within Europe. This flexibility
means that a lot of engineering is still required to
tailor it to the particular application or installation.
This engineering, if done well, can make it a very
effective ATP system.
The application engineering is also the key to
increasing line capacity whilst maintaining
availability, and especially when applied as part of
programme of ongoing signalling renewals
intended to lead, in the long term, to a Level 3
railway.
ETCS is the only predictive ATP system available
from multiple suppliers. It is proven to be
interoperable, and has an improvement plan and
support for the long term. With development
already complete and paid for, the implementation
of standard ETCS is faster, cheaper and a lower
risk than for any other advanced ATP system.
All the above benefits would be lost if individual
railways make changes to the system, so it should
be applied by making no more changes than just
the setting of the many parameters.
With the careful choice of a radio system, ETCS
can be easily extended to higher levels and
upgraded. ATO can be added to give the world’s
first CBTC system with interoperable ATP.
5 ACKNOWLEDGEMENTS
Brian Smith, IRSE Swiss Section
6 REFERENCES
[1] Winter, P, 2009. Compendium on ERTMS.
1st ed. Hamburg: Eurailpress
[2] http://www.ertms.net
[3] http://en.wikipedia.org/wiki/Interoperability
[4] UNISIG System Requirement
Specification, SUBSET 026 version
2.3.0.d
[5] UNISIG System Requirement
Specification, SUBSET 026 draft version
3.1.1.
[6] http://www.era.europa.eu/Core-
Activities/ERTMS/Pages/Braking-Curves-
Simulation-Tool.aspx
Page 6 of 7 20 July 2012
IRSE Australasia
AUTHOR
Nick Terry studied Electrical Engineering at
Cambridge University, UK, and was a sponsored
student on British Rail’s S&T Engineering
Management training programme. He then
undertook various roles managing signalling
construction sites and projects around the
Midlands in the UK in the last days of British Rail
and the first of the privatised rail industry. After
IRSE Australasia Technical Meeting: Brisbane
ETCS for Worldwide Train Control
leading the S&T engineering for Euston
Resignalling in 2000, he moved to light rail
projects: firstly the Nottingham tram, followed by
re-locating to Portugal to work on Metro do Porto
for 2½ years.
Nearly six years ago, Australia beckoned, with its
resources boom, and the spin-off into increased
urban rail transport. Since then, he has worked on
signalling projects throughout Queensland, and led
the ETCS deployment in Auckland, New Zealand
from tender through to the running of the first test
train. He was also part of a team deploying CBTC
technology into China, and considering CBTC
versus ERTMS technology for other projects.
Employment has been for an infrastructure owner
and several contractors: British Rail,
Westinghouse/Invensys Rail, Balfour Beatty and
Bombardier Transportation. He is currently an
independent consultant.
Page 7 of 7 20 July 2012