The Institution of Railway Signal Engineers Inc Australasian Section Incorporated

ETCS for Worldwide Train Control

Nick Terry BA CEng MIET MIRSE RPEQ Independent Consultant

SUMMARY This paper discusses the application of the European Train Control System (ETCS) now and into the future. From its beginnings in an EU Directive in 1989, it is today one of the worlds most successful cab signalling and train protection systems that can be applied to any railway in the world. Interoperability is a major feature of ETCS. To achieve this, compliant ETCS without modification must be deployed. The advantages and the limitations of making changes are discussed. The application of new developments of Baseline 3 and ETCS level 3 are briefly considered. Looking to the future, the addition of Automatic Train Operation to ETCS, and the confluence (or not) of ETCS and CBTC technologies is introduced. But overall, because ETCS includes so many options and parameters, the success of a particular installation now depends heavily on the application engineering. This is explained in some detail.

INTRODUCTION

In the 1980s, the European Union (EU) held the view that a major obstacle to the efficient and competitive operation of railways within Europe was the great variety in styles of railway systems and procedures. These restricted competition in the supply industry, and prevented trains running seamlessly across borders. Efficient transport of people and goods within and between countries within the EU was seen as essential to maintain the EUs competitiveness. This led to the European Council issuing a number of Interoperability Directives for high speed rail and for conventional rail. From these Directives came a series of Technical Specifications for Interoperability for Rail Command, Control and Signalling. ERTMS (European Railway Traffic Management System) is the system that implements these specifications. ERTMS can be broken down into a number of subsystems see Figure 1: ERTMS Constituents.

Figure 1: ERTMS Constituents

This paper discusses the ETCS element of ERTMS. The ETCS element provides two principal functions: Automatic Train Protection (ATP) and Cab Signalling. It is important to understand that these are two relatively separate functionalities which are provided by the one system (ETCS). Automatic Train Protection is the generic name given to a system that automatically applies the train brakes if a driver does not keep the trains speed below the specific trackside safe limits for the trains current location and operating conditions. Cab Signalling is the generic name given to a system that displays information inside a train cab about the current status of the track ahead such information was traditionally provided to the train driver by trackside signals and signs. ATP and cab signalling systems have quite different safety and operational requirements.

IRSE Australasia Technical Meeting: Brisbane

Page 1 of 7

20 July 2012

IRSE Australasia

ETCS for Worldwide Train Control

More detailed information, including the history of the development of ETCS, can be found in the Compendium on ERTMS (reference [1]). Detailed descriptions of the ETCS system and its functionality have been presented to the IRSE in Australia on several previous occasions. Papers were presented on several ETCS topics at the 2008 AGM in Sydney. There are also many publications in hard copy (see reference [1]) and on the internet (see reference [2]). Therefore the technical description of ETCS will not be repeated in this paper. It is assumed that the reader has a basic understanding of ETCS, including the concept of ETCS levels (0 to 3).

without any restricted access or implementation (source: reference [3]). Interoperability is a major feature of ETCS. Full interoperability requires both technical interoperability, and operational interoperability (the rules). ETCS can only achieve the first requirement; the latter is up to those responsible for its implementation on a particular railway. Figure 2 is a high level ETCS system diagram, showing the interoperable interfaces.

2
ATO ATP

NOTATION
Automatic Train Operation
l ia dic ing J u o rd c re

Radio Base Station

RBC

GSM-R mobile unit

Automatic Train Protection Communication-Based Train Control Driver-Machine Interface End of Authority
Train

Interlocking EVC

CBTC DMI EoA

ERTMS European Railway Traffic Management System ETCS EU EVC FFFIS FIS European Train Control System European Union European Vital Computer Form, Fit, Functional Interface Specification Functional Interface Specification

Balise

Euroloop

Control Centre FFFIS FIS

LEU

Non-ETCS

Figure 2: Interoperability within the ETCS system Those interfaces defined by Form, Fit and Functional Interface Specifications (FFFIS) support complete interoperability. Those interfaces defined only by Functional Interface Specifications (FIS) support the ETCS functionality, but the lower levels of the interface are left up to the suppliers, so the whole interface is not interoperable. It should be noted that the interfaces between the LEUs and the balise/Euroloop are defined by FFFIS, but have not been implemented as such by all manufacturers.

GSM-R Global System for Mobile communication Railways IP LEU RBC SIL SRS SvL Internet Protocol Lineside Electronic Unit Radio Block Centre Safety Integrity Level (as defined in EN50129) System Requirement Specification Supervised Location

3.2

ETCS Braking Model

The ETCS braking model is shown in Figure 3. This figure shows to the left the area of Ceiling Speed Supervision where there is no target within braking distance. In this area, the permitted speed is displayed to the driver. If this is exceeded by 5km/hr, a warning is given. If the permitted speed is exceeded by 10km/hr then the service brake will be applied. If the permitted speed is exceeded by 15km/hr then the emergency brake will be applied. These margins are reduced at low speeds. They are parameters that could be changed outside of Europe, if a particular railways rollingstocks driving characteristics were such that larger differentials are required. Approaching a target, the service brake curve is calculated back from the End of Authority (EoA), whilst the emergency brake curve is calculated back from the Danger Point, or end of the overlap, taking into account all possible train location errors. This point is known as the Supervised Location (SvL). It is the point beyond which it is not safe for the train to proceed.

UNISIG UNion of Industry of SIGnalling

ETCS for World Wide Train Control

ETCS is a set of tested and proven specifications for train control subsystems and interfaces. More than six suppliers now manufacture equipment that has been independently validated as meeting the specifications. ETCS is sufficiently flexible in the way that it can be adapted to different railway operating rules, so that the only outstanding issues to its worldwide adoption are now application issues. This paper considers the major application issues, with particular regard to ETCS being applied outside of Europe.

3.1

Interoperability

Interoperability is a property of a product or system, whose interfaces are completely understood, to work with other products or systems, present or future,

IRSE Australasia Technical Meeting: Brisbane

Page 2 of 7

20 July 2012

IRSE Australasia

ETCS for Worldwide Train Control

Figure 3: ETCS Braking Model In order to ensure that a train can actually reach the EoA, the service brake is released at a speed known as the Release Speed. This speed can either be calculated onboard (as the speed at which a train tripped at the EoA would stop before the SvL), or specified by the trackside design. All of the curves, distances and margins are defined in the application engineering by setting onboard and trackside ETCS parameters. Thus the application engineering needs to consider the trade-offs between safety and conservatism. The ETCS braking model manages the balance between conservatism and safety by using two braking curves. A service brake curve is calculated back from the estimated End of Authority (typically a signal or block marker). Beyond this point is a safety margin (similar to a signalling overlap). The emergency brake curve is calculated back from the end of the safety margin (known as the Supervised Location, SvL). All of the above errors are taken into account in calculating the emergency brake curve, but not in calculating the service brake curve. For optimal operation, the application engineering (where all of these parameters are set) must ensure that these two curves meet the above requirements, but do not cross each other. This is not a straightforward task, though it is heavily aided with modelling and simulation. Some of these parameters are determined by the trackside data and layout, and others are determined by the onboard characteristics of the particular train, which may not be known when the trackside data is being prepared.

3.3

Conservatism versus Safety

All ATP systems require a trade-off to be made between operational performance and safety. This trade-off arises from the uncertainties and errors in the ATP system. The uncertainties cannot be estimated precisely. If they are under-estimated, then the system may not stop the train before the SvL, and so be unsafe. If they are over-estimated, then the system will be conservative and stop the train too early. Errors arise principally from the following sources: Train position errors from balise position uncertainty and geographic data uncertainty (typically 5m) Train odometry errors from tachometer errors due to wheel slip/slide and wheel diameter errors (typically 1% of the distance from the last balise) Track gradient errors in the data due to the granularity within the track data model Train braking rate errors due to a single braking model being used for a whole class of trains without considering individual trains Reduced rail-wheel adhesion limiting braking Errors from digital sampling and processing delays in outputting information

3.4

ETCS Data

ETCS only stores a minimal amount of data onboard the train (train braking rates, maximum train speed, train length, and many parameters describing the onboard hardware configuration, but no geographical data). Some of this data is modifiable by the driver. All geographical data is stored in the LEUs (level 1) or the RBC (levels 2 & 3). When a Movement Authority is transmitted to the train from the trackside, it includes the relevant extract of the geographical database for that route (balise groups ahead, gradient, speed profile, and any other special conditions of that route). Thus ETCS application engineering consists mainly of establishing the application rules (akin to Signalling Principles), of trackside data preparation, and of electrical and mechanical engineering for each class of train. Because ETCS is a cab signalling and ATP system that is acceptable to all European railways, it contains the lowest common denominator of all European railway operations. Most railways do not use many of the features. But they all need either setting or disabling in the application engineering. Thus there is much opportunity within the application engineering to achieve suboptimal or optimal operation. For example, ETCS supports signalling-related speed restrictions, such as those imposed by conventional speed signalling systems. Railways based on route signalling will not use these (and many railways based on speed signalling
Page 3 of 7 20 July 2012

In order for the system to be safe (ie. to always stop the train before the SvL) conservative estimates of all of the above errors are built into the system. This ensures that, even with all of the above errors, the train will not continue passed the Supervised Location (SvL). Optimal application engineering will minimise these errors, but, if left unchecked, they would still make the system extremely conservative.
IRSE Australasia Technical Meeting: Brisbane

IRSE Australasia

ETCS for Worldwide Train Control

will not propagate them into an ETCS application in order to increase performance). ETCS data preparation is a complex task. Every balise contains 1,023 bits of data. LEUs contain many possible telegrams for each controlled balise in level one areas. RBCs contain the equivalent amount of data for level 2 & 3 installations. Therefore it is not practicable for this quantity of data to be prepared manually. Each ETCS supplier has developed their own geographic data preparation system. They are not interoperable, as they involve integration with the LEUs and interlockings over non-interoperable interfaces. Several sets of rules are used to achieve the final data this is represented in Figure 4: ETCS Data Prep Hierarchy. More rules automatically applied by the data preparation system lead to faster, cheaper and more accurate data. But the rules must be optimised for the particular application being designed this will mean either adjusting the suppliers rules for a particular application, or writing a new set of Infrastructure rules.
Compiled data ETCS rules Suppliers rules Infrastructure rules

define the reliability requirements for each subsystem that is left up to the supplier. The following is a list of some examples of redundant architectures (physical and/or functional) used by suppliers to increase system availability: Duplicated balises within a single group Long Movement Authorities permitting the next balise group to be missed 100% overlapping radio coverage 2-out-of-3 or 1-out-of-2 processing architectures Redundant onboard odometry Dual fitting the trackside with levels 1 and 2

It is a matter for the application engineering to determine which of the above to apply (if any), and how, in order to meet the required availability targets.

3.7

Track Capacity

Whether the introduction of ETCS leads to increased or decreased track capacity (headway) is a complex issue. The direct technical effect of introducing either level 1 or 2 as an overlay over conventional signalling should be minimal. Even level 1 with no intermediate (infill) balises should have no impact on headway because trains should not be running so close together that they are approaching signals at danger. In practice, whether the introduction of ETCS affects headway depends primarily on the application engineering. Even with level 1, the presence of an ATP system can be used to justify reducing the length of overly long overlaps, and junction signalling can be relaxed to allow fitted trains to take the junction at the civil design speed, not the signalling speed. Both of these factors can lead to significant improvements in headway. Whilst such improvements require alterations to the existing signalling systems and careful integration with the operating rules, on railways currently using full braking overlaps, significant benefit could be realised.

Figure 4: ETCS Data Prep Hierarchy

3.5

Safety

The ETCS system, including radio transmission by GSM-R (for levels 2&3), is designed to a Safety Integrity Level (SIL) of 4. This achieves a tolerable hazard rating -9 of 10 , meaning that the probability of a particular train suffering a failure that leads to an unsafe situation is -9 less than 10 per hour of operation of that train. Although the overall ETCS system achieves SIL4, this does not mean that all of the components individually achieve this level. For example, the DMI only achieves SIL0 or SIL2 (depending on supplier). But its operation is protected by the SIL4 ATP functions of the EVC, so if the wrong speed were presented to the driver then the train/system would still be protected by ATP. It should also be noted that the overall train control system includes components outside of the ETCS system, such as the interlocking and train detection systems. These components are not covered by the ETCS specifications so may or may not achieve SIL4. If they do not, then the overall level of safety of the complete ATP system will be lowered. The new mode within Baseline 3 of Limited Supervision (see section 3.9) allows only selected features to be protected by ATP. These features should be chosen on a cost versus risk basis. Therefore safety engineering as part of the application will be required to justify the choice of features to be fitted.

3.8

ERTMS Regional

ERTMS Regional is the name that has been adopted to describe the first application of ETCS level 3. It has been developed and deployed in Sweden. It is aimed at the large number of low density, regional lines where it is essential to minimise the quantity of trackside signalling equipment. On these lines, the number of trains in operation is small, and they may be fitted with ETCS onboard equipment anyway so that they can operate over other fitted lines. Headway is not critical. ERTMS Regional can be described as a simplified ETCS level 3 application. Train integrity is assured by operational procedures, as a device providing the required level of safety for variable composition trains has not yet been developed and approved. GSM-R is provided throughout for voice radio communications between drivers and the control centre. As a result, GSM-R is also used for the data transmission of ETCS data. Due to the low density of the train services on such lines, radio network capacity is less of an issue in this application than in mainline applications. Although ETCS level 3 will support moving block operation, ERTMS Regional is a fixed block application. This is sufficient for the train density on such lines, and still permits trackside signalling infrastructure to be
Page 4 of 7 20 July 2012

3.6

Availability

The ETCS specifications define the required system safety, functionality, and the interfaces. They do not
IRSE Australasia Technical Meeting: Brisbane

IRSE Australasia

ETCS for Worldwide Train Control

minimised, with no signals and only intermittent train detection equipment. ERTMS Regional is currently being deployed within Sweden, where it commenced commercial trial operation earlier this year. It is an important step towards higher capacity level 3 applications in the future.

Each of these features increases the amount application engineering that will be required for specific implementation. They increase the number options available, which either require disabling, configuring, on a project by project basis.

of a of or

3.11 Variations to ETCS

Within Europe, the railways that carry the majority of the long distance traffic are covered by the European Regulations which make it compulsory for any upgraded train control system to be compliant ETCS. Outside of Europe, this requirement does not exist. But, as discussed earlier, there are several very strong reasons for any railway adopting ETCS, to apply it in a totally compliant manner: No development is required Multiple suppliers are available (both now and in the future) System support is guaranteed The system is well documented Trained and experienced staff exist Upgrade paths to level 3 and beyond are available

3.9

Limited Supervision

Limited Supervision is an onboard mode that will be introduced in the new release of ETCS (Baseline 3 see section 3.10). The aim of this mode is to give fully fitted ETCS trains some train protection at minimal cost to the infrastructure on conventional lines where full trackside ETCS fitment cannot be justified. In this mode, the driver is not given any maximum nor target speed information from the ETCS equipment. The driver must drive to the conventional trackside signals. The onboard ETCS equipment reads balises, which give intermittent speed profile and authority information. High risk signals and speed restrictions can be fitted with ETCS trackside equipment, and low risk signals and restrictions omitted. The onboard equipment will enforce those features that it has information about, but will not lead the driver into exceeding those features about which it has no information. It is a limited ATP system without cab signalling.

3.10 Baseline 3
ETCS versions are generally referred to by the version number of the ETCS System Requirement Specification. The first version to be released into commercial service was 2.2.2. Lessons learnt from this were incorporated into an updated version 2.3.0. However this was rapidly replaced with a debugged version 2.3.0.d in 2008 (reference [4]). Many systems have now been upgraded to this version, and all new systems currently being implemented are to this version. Improvements and extensions to ETCS are continuously being proposed. In order to maintain interoperability across Europe, release of changes has to be heavily controlled. In 2008, the European Commission and the railway representing associations agreed a timetable for the rollout of Baseline 3. They agreed that by the end of 2012 the SRS for baseline 3 would be agreed and stable. That timetable is broadly being met. Changes included within Baseline 3 (as per reference [5]) include the introduction of the following features: Limited Supervision mode (see section 3.9) Speed restrictions defined by the length of a trains braking distance Train horn control Station platform position, side and height Level crossing announcement enforcement and speed

As soon as the first change from standard ETCS is made, then immediately all of the above advantages are lost. Therefore it is strongly in any railways interest to implement compliant ETCS, even when the proposed railway is a closed network. Having stated the above, there is one area in which railways outside Europe may be forced to deviate from compliant ETCS, and it is also the weakest area of ETCS: the choice of radio system. ETCS (levels 2&3) makes use of the radio equipment of the ERTMS family for the transmission of data. Whilst the ETCS bandwidth requirements are relatively low, the latency must also be low, as any delay will directly impact train headway, and hence decrease line capacity. With ERTMS having chosen GSM-R radio systems for the standard voice radio system across Europe, ETCS uses these same systems to transmit data. But GSM-R is fundamentally a circuit-switched system, so the ETCS system takes up a whole channel per ETCS train, for all the time that the train is in service. For the majority of the time, the channel is not transmitting useful data. The number of available GSM-R channels is limited this leads to limits on the number of trains that can be in service in one area at any one time. For this reason, and that GSM systems are near the end of their life (being replaced with 3G and 4G systems), there is a strong argument for applications outside Europe to replace the GSM-R systems with an alternative packet-based radio system. Although the radio system is outside the ETCS section of the ERTMS specifications, the fact that the radio system is GSM-R is embedded within the ETCS specifications. Thus there are two solutions to changing the radio system: Introduce GSM-R emulators so that the alternative radio system appears to be GSM-R to the ETCS system Re-design the interface to the radio system to make it IP-based, but technology-agnostic.

A unified braking model (see reference [6] for published braking model tools) Service Brake feedback A pre-indication of approaching a target Cold movement detection

The development costs of the two solutions are similar, but the second option is superior as this would then allow any suitable radio system to be used. Radio technology changes faster than train control technology, so a standard interface (such as an Internet Protocol
Page 5 of 7 20 July 2012

IRSE Australasia Technical Meeting: Brisbane

IRSE Australasia

ETCS for Worldwide Train Control

interface) that supports such changes in the future would be advantageous for all ETCS systems. The requirements for an alternative radio system should be described in IP-based interface specifications for the boundaries, and a specification for the required Quality of Service for the connection between the train and the RBC. The first project to apply ETCS with an alternative radio system (TETRA in this case) is currently being implemented in Kazakhstan. This project is being watched by several parties interested in operating ETCS level 2 without GSM-R.

are forced to do this by an external organisation, they will not. But there is nothing to stop a compliant ETCS system having a non-interoperable ATO system laid on top of it other operators trains would just not have ATO in that area.

CONCLUSION

3.12 Automatic Train Operation with ETCS

ETCS was designed for mainline, high speed and long distance railways where interoperability is a key factor. These railways do not currently use Automatic Train Operation (ATO), nor do they intend to in the near future. Therefore there is no approved plan to add ATO functionality to ETCS. ATO is widely used on Metro systems, and is being introduced onto some suburban railways as the train service becomes more like a Metro. The underlying ATP system within ETCS is able to operate in a metro environment. ETCS can be configured for high braking rates and short sections. Convergence between ETCS technology and metro solutions is starting to occur, due to the following factors: Some suppliers have based their metro ATP solution on ETCS already ETCS Baseline 3 includes some of the missing ATP features needed for the metro environment ETCS level 3 is the same level of ATP functionality as is used on modern metros today.

ETCS is an advanced and extremely flexible ATP and in-cab signalling system it has to be flexible to cope with the many variations in railway operating practices within Europe. This flexibility means that a lot of engineering is still required to tailor it to the particular application or installation. This engineering, if done well, can make it a very effective ATP system. The application engineering is also the key to increasing line capacity whilst maintaining availability, and especially when applied as part of programme of ongoing signalling renewals intended to lead, in the long term, to a Level 3 railway. ETCS is the only predictive ATP system available from multiple suppliers. It is proven to be interoperable, and has an improvement plan and support for the long term. With development already complete and paid for, the implementation of standard ETCS is faster, cheaper and a lower risk than for any other advanced ATP system. All the above benefits would be lost if individual railways make changes to the system, so it should be applied by making no more changes than just the setting of the many parameters. With the careful choice of a radio system, ETCS can be easily extended to higher levels and upgraded. ATO can be added to give the worlds first CBTC system with interoperable ATP.

Thus, from a technical point of view, all that is required is the addition of an ATO module onboard the train to control the acceleration, brakes and doors, communicating with an ATO controller at the control centre, as illustrated in Figure 5: Possible ATO on top of ETCS.

ACKNOWLEDGEMENTS

Brian Smith, IRSE Swiss Section

6 [1] [2] [3] [4]

REFERENCES Winter, P, 2009. Compendium on ERTMS. 1st ed. Hamburg: Eurailpress http://www.ertms.net http://en.wikipedia.org/wiki/Interoperability UNISIG System Requirement Specification, SUBSET 026 version 2.3.0.d UNISIG System Requirement Specification, SUBSET 026 draft version 3.1.1. http://www.era.europa.eu/CoreActivities/ERTMS/Pages/Braking-CurvesSimulation-Tool.aspx

Figure 5: Possible ATO on top of ETCS A radio system is required to transmit the ATO information from the trackside to the train. This could either be a totally separate radio system, or the GSM-R of ERTMS, or the configurable packet 44 within the Euroradio layer of the GSM-R system. To be consistent with the ERTMS philosophy, the ATO should be defined as interoperable. Unless suppliers
IRSE Australasia Technical Meeting: Brisbane

[5]

[6]

Page 6 of 7

20 July 2012

IRSE Australasia

ETCS for Worldwide Train Control

AUTHOR

leading the S&T engineering for Euston Resignalling in 2000, he moved to light rail projects: firstly the Nottingham tram, followed by re-locating to Portugal to work on Metro do Porto for 2 years. Nearly six years ago, Australia beckoned, with its resources boom, and the spin-off into increased urban rail transport. Since then, he has worked on signalling projects throughout Queensland, and led the ETCS deployment in Auckland, New Zealand from tender through to the running of the first test train. He was also part of a team deploying CBTC technology into China, and considering CBTC versus ERTMS technology for other projects. Employment has been for an infrastructure owner and several contractors: British Rail, Westinghouse/Invensys Rail, Balfour Beatty and Bombardier Transportation. He is currently an independent consultant.

Nick Terry studied Electrical Engineering at Cambridge University, UK, and was a sponsored student on British Rails S&T Engineering Management training programme. He then undertook various roles managing signalling construction sites and projects around the Midlands in the UK in the last days of British Rail and the first of the privatised rail industry. After

IRSE Australasia Technical Meeting: Brisbane

Page 7 of 7

20 July 2012