Shieerialor Tr

Received 30 November 2011

Available online 7 November 2013

Keywords:ERTMSInteroperabilitySafetyETCS

rationeed to service a market that is open within and across industrial sectors and national boundaries. This in

facilitate not only interoperability but also enhancement of safety, capacity and efciency. The EuropeanRailway Trafc Management System (ERTMS) is designed to enable interoperability through use of one

markets that are more open, both within and across industrial sec-tors and national boundaries.

Development of railway systems such that they meet the EUsdrive for interoperability has led to increased levels of automation.Automation and modernisation of railways has faced a number ofconstraints which include incompatibility with legacy systems and

erfaces (Tessdrebed as a productceptions, cine comm

to, and the style and prociency of, an organisations healsafety management. Organisations with a positive safetyare characterised by communications founded on mutuashared by perceptions of importance of safety and by condencein the efciency of preventative measures (Rail Safety and Stan-dards Board, 2011). Thus, safety culture is a key consideration forrailway system interoperability; at corporate and industrial levelsorganisational culture has been shown to have a direct impact onsafety (Tessdre and UIC, 2004).

This paper evaluates a selection of European railway systemdevelopments, following modernisation through the introduction

Corresponding author. Tel.: +44 (0) 207594 6037.E-mail addresses: p.smith10@imperial.ac.uk (P. Smith), a.majumdar@imperial.

ac.uk (A. Majumdar), w.ochieng@imperial.ac.uk (W.Y. Ochieng).

Journal of Rail Transport Planning & Management 2 (2012) 7987

Contents lists availab

Journal of Rail Transport P

.e1 Tel.: +44 (0)20 7594 6104.EC (Europa Summaries of EU Legislation, 2011) details the expecta-tions of interoperability on high speed trans-European railwaylines. This directive is aimed at servicing a market that is openacross national boundaries, as reected in the current trend to

method for assessing organisational safety at intand UIC, 2004), alternatively, it has been descriof the individual and group values, attitudes, pertencies and patterns of behaviour that determ2210-9706/$ - see front matter 2013 Elsevier Ltd. All rights reserved.http://dx.doi.org/10.1016/j.jrtpm.2013.10.004ompe-itmentth andculturel trust,During the past decade, European railway system design andoperation has become increasingly complex. This change and mod-ernisation to railways has been driven by aims for an integratedEuropean railway network under the terms of interoperability.Interoperability aims for unication of signalling systems, techni-cal coherence and harmonisation. The European directive 96/48/

The EUs aspiration for an open market makes it desirable for acommon approach to safety related issues, where safety is denedas freedom from unacceptable risk of harm (Guidance for Engineers,1995). Of particular interest, an aspect of safety referred to as safetyculture is reviewed. Safety culture has been dened in a number ofways relative to its context, safety culture, has been dened as a1. Introductionunique signalling system as opposed to conventional signalling systems. However, the introduction ofERTMS must be undertaken to facilitate the European wide ambition to reduce risk on the railways.This paper addresses the issues relevant to the safe introduction of ERTMS into European railway sys-

tems, with a focus on the technical and procedural challenges of moving from conventional signalling to anew trafc management system. Existing literature, augmented with a targeted survey of subject matterexperts, is used for a critical appraisal of safety considerations across Europe. Differences and variationsacross networks and countries are identied, and used to determine the signicant issues that need to beaddressed to enable the safe introduction of ERTMS. Finally, generic observations are made on the factorsthat impact safety and human factors as a result of the introduction of new technologies and proceduresinto existing railway environments.

2013 Elsevier Ltd. All rights reserved.

changes in operational procedures, both of which have the poten-tial to impact safety.Revised 7 October 2013Accepted 11 October 2013

turn requires that the technologies and operational procedures that underpin the railway systemsAn overview of lessons learnt from ERTMrailways

Peri Smith a, Arnab Majumdar b,, Washington Y. OcaCentre for Transport Studies, Department of Civil and Environmental Engineering, Impb Imperial College London, Department of Civil and Environmental Engineering, Centre f

a r t i c l e i n f o

Article history:

a b s t r a c t

The European Unions aspi

journal homepage: wwwimplementation in European

ng b,1

College London, London SW7 2AZ, UKansport Studies, London SW7 2AZ, UK

n for railway systems that are interoperable across Europe is driven by the

le at ScienceDirect

lanning & Management

lsevier .com/locate / j r tpm

tion. Conversely, due to the unpredictability of such properties,they can also undermine factors such as system safety. Therefore,

1500 V DC.The International Union of Railways states that the goal of ERT-

MS is to enhance cross border interoperability and signalling pro-

t Plaemergent properties can have a negative output of increasing sys-tem vulnerability, either in a physical or functional context.

The safety of railway systems must be ensured through safetyrequirements and assessment methodologies that address differ-ent sub systems, their interfaces and how they integrate. In addi-tion, factors including contractual, commercial and societalrelationships must be accounted for. This requires, in the rst in-stance, a detailed understanding of the architecture from both aphysical and functional context of the railway system. Systemarchitecture has been developed utilising the industry experienceof the author and validated through technical discussions withengineers at Network Rail in the elds of Telecoms, Signalling,Electrication and Power, and Building Services.

The approach employed in the specication of the architectureis to depict linear systems to represent track, overhead line equip-ment, transmission network and Ethernet/Internet protocol. TheUK railway infrastructure and electrication protection sectorsidentify the mainline railway as a linear electrical system withof the European Railway Trafc Management System (ERTMS).Emphasis is placed on the technical capability of ERTMS, which isthe European Train Control System (ETCS) and the Global Systemfor Mobile CommunicationsRailways (GSM-R). This is facilitatedby specication of the functional and physical architecture thatcomprise railways as an initial step to appreciate the relationshipsthat are crucial for an integrated railway system.

The paper is organised as follows. Section 2 describes the rail-way system, outlining its generic architecture and interfaces, fora conventional signalled railway. This is followed in Section 3 bythe challenges faced across Europe with technically incompatibleconventional signalled systems and the reasons for moving to theERTMS. A case study is taken with respect to the status of deploy-ment of ERTMS across four European countries and this is ad-dressed in Section 4, highlighting areas of progression, keychallenges and lessons learnt with respect to safety. The paper isconcluded in Section 5 which surmises the move forward withERTMS technology.

2. Railway systems

Railway systems from their inception in Great Britain in 1825have been designed for transportation of passengers and goods.Railways are complex networks and consist of a number of systemswhich interface and integrate through technical compliance andthrough application of and adherence to rules, regulations and pro-cedures (Glover, 1996). Failure in any of these systems and/or pro-cedures has the potential to not only degrade system performancebut to also cause a hazardous environment which could have a sig-nicant impact on the safety of a railway.

Treating the mainline railway as a system, it can be dened as aset of objects together with relationships between the objects andbetween their attributes (Hall and Fagan). Elaborating this deni-tion, a railway system can be considered to consist of parts whichare diverse in terms of their properties and variety, once linkedthese parts create relationships. All technical systems, includingrailways have emergent properties, which is dened as those prop-erties which lead to behaviours that stem from complex systeminteractions resulting in benecial or detrimental consequences(Johnson). For example, positive emergent properties can beadapted to support tasks that were never conceptualised duringdesign, as design alone may not have produced the optimal solu-

80 P. Smith et al. / Journal of Rail Transpormultiple sources of supply (Knight, 2011). Interfacing with theselinear systems are rolling stock, stations, control room and track-side equipment.curement by creating a single Europe wide standard for railwayswith the nal aim of improving competitiveness of the rail sector(Tessdre and UIC, 2004). The benets of ERTMS include enhancedtrafc management, optimised usage of energy and network re-sources and increased capacity, through receipt of optimal/antic-ipating schedules and guidelines. In order to realise the benets,ERTMS must underpin technical and operational interoperability(Unife, 2011).

Interoperability across Europe has been prioritised according tothe type of railway line. The rst priority is for the interoperabilityof high speed train lines followed by conventional lines (Bargeret al., 2010). Technical requirements for interoperability demandthe application and implementation of the same interfaces be-tween equipment. Operational requirements require applicationand implementation of the same interfaces between the driverFig. 1 captures a number of key features relevant to safety; thisincludes integration between key railway systems and backbonesystems of power and telecommunications which are vital foroperation (Dalton, 2011). Telecommunications increasingly facili-tates many existing and new customer services, creating a strongrelationship between the telecommunications and railway indus-tries. Additionally, interfacing between safety critical and non-safety critical systems, such as interlocking which is a vital systemfor safe route locking, thus preventing manipulation of levers thatcould otherwise endanger a train whilst it occupies a route sectionand point zone telephones for communication is another examplewhich shows a railways complexity. The architecture highlightsthe level of physical integration and in general is a visual aid toidentify issues that need addressing, such as the use of ageingassets and the integration of new and legacy equipment.

3. The move to interoperability

In 1989 the European Commission carried out a study on traincontrol and signalling issues (Europa Summaries of EU Legislation,2011). It found that the technical challenge of maintaining a safeconventional signalled railway is reected in the incompatibilityof signalling systems across Europe, and recommended a moveaway from conventional signalling to a signalling methodologywhich facilitates interoperability.

The study was required for the reason that existing railway pro-cedures across Europe in some cases required trains to be equippedwith up to seven navigation systems. This made it compulsory fortrains to switch over to the operational standard applicable at aparticular countrys border. Furthermore, there were concernsrelating to the size of the navigation system on-board the train.Other issues such as cost, differences in rail gauge, electricationsystems and the variation in the number and type of train protec-tion systems established across Europe have also been evaluated.Table 1 provides examples of these incompatibility issues, forexample, the differences in track gauge, that is, the difference be-tween the inside of the two rails. The standard gauge used in theUK and 60% of the worlds railway is 1435 mm. Spain and Portugaluse 1668 mm while Russia and its neighbours use 1524 mm (Sie-mens, 2011). Electrication is another area where there are incom-patible systems. The UK mainline railways, electried at 25 kV50 Hz AC match the high speed lines in France (in part). However,systems in Germany and Austria use 15 kV while Holland uses

nning & Management 2 (2012) 7987machine interfaces. Therefore, a move towards interoperabilityrequires convergence from a number of railway systems into asingle system. This convergence would bring about inter-running

t PlaP. Smith et al. / Journal of Rail Transporbetween countries, common manufacturing standards andincreased railway competition due to removal of trade barriers.

Europe wide recognition of the concept of a single railway is incompliance with Technical Specications for Interoperability (TSIs)(Frsig, 2004). This can be categorised at a high level into four dis-tinct areas, focusing on Energy, Infrastructure, Rolling stock andSignalling. The realisation of a single system has the potential formany benets. For example, due to agreed specications, a traincould be maintained anywhere in Europe, as any afliated countrywould have access to a particular spare part.

The ERTMS consists of four layers: European Operating Rules(EOR), European Trafc Management Layer (ETML), Euro-radio(GSM-R) and European Train Control System (ETCS). The ETMLand EOR are operational layers whilst the ETCS and GSM-R aretechnical layers. The two technical layers will be discussed in moredetail to aid understanding of how the railway is modernised. TheETCS, located on-board rolling stock, is a computer based systemwhich compares the maximum permitted speed with the trainsactual speed. The ETCS is implemented across Europe and is in line

Fig. 1. Key features of

Table 1Technical incompatibilities across Europe.

Country Track gauge (mm)

Great Britain 1435FranceBelgiumNetherlandsItalySwedenNorwayGermanySwitzerlandSpain 1668 (Including some routes at 1435mm)PortugalIreland 1600Latvia 1520Estonianning & Management 2 (2012) 7987 81with EU directives and this is the signalling system for cross bordertrain operation and is the most complex layer (Knight, 2011). TheETCS interfaces with track and radio systems for speed optimisa-tion and control, however, ERTMS cannot be fully operational with-out GSM-R which is the carrier for speech and datacommunication. GSM-R is operational in frequency bands 876880 MHz and 921925 MHz providing functions such as onboardsignalling. Viewing ETCS in more detail, as shown in Table 2, ithas three core levels of technical operation.

Figs. 24 (http://www.ertms.com) depict at high level how thetrain and railway environment changes to achieve implementationof the ETCS, showing the move away from conventional signalling.The main trackside and on-board systems that comprise theERTMS application are indicated, highlighting three distinct ETCSlevels for train control. Level 1 ETCS involves track to train commu-nication, via track located euro-balises, otherwise termed balises.The balises interface with existing signalling and line side signalsare retained. Level 2 ETCS on the other hand, involves track-to-train and train-to-track communication. There is continuous

a railway system.

Electrication system Train protection system

25 kV, 50 Hz AC AWS/TPWSTVM/KVB/Crocodile

1.5 kV DC TBL/CrocodileATB-EG, ATB-NG

3 kV DC SCMT/BACC15 kV, 16.7 Hz AC Ebicab 700

PZB 90, LZBZUB 121, Integra-Signum

3 kV DC ASFA/LZB/Ebicab 90025 kV, 50 Hz AC Ebicab 700Non electried CAWS3.3 kV DC ALSN3 kV DC

on c

t PlaTable 2ETCS levels and functionality.

ETCSlevel

Train detection Driver notication

0 ETCS tted train travelling on untted infrastructureSTM ETCS tted train travelling on untted infrastructure but train protecti

European Vital Computer1 Balise at signal or balise at signal with

inllSignal and driver machineinterface

82 P. Smith et al. / Journal of Rail Transporradio communication from the track to train and interlockingconfers the train route to a Radio Block Centre (RBC). The RBCcalculates correct movement authority, giving authorisation toproceed, with balises used as an odometry reference. Level 2 isan enhancement to Level 1 ETCS with movement authority viadigital radio, the Global System for Mobile CommunicationsRailway (GSM-R) which enables elimination of trackside signals.

Level 3 ETCS further improves the ability of Level 2 ETCS byintroducing a train integrity function which will replace conven-tional train detection. At this level the RBC uses GSM-R for trans-mission between track and train. Level 3 also allows moving

2 GSM-R Signal and driver machineinterface

3 GSM-R Driver machine interface

Fig. 2. ETCS Level 1. (Source: http://www.ertms.com)

Fig. 3. ETCS Level 2. (Source: http://www.ertms.com)Description

ommands are accepted from a Class B national system which acts as a slave to the

Communication via balise - no data radio communicationLine-side signals retainedLine-side Equipment UnitTrain position is determined tracksideNo radio block centreCommunication via GSM-R radioNo requirement for line-side signals/line-side equipment unit or trackdetection deviceTrain position is determined tracksideCommunication via GSM-R radioNo line-side signalsTrain position determined onboard

nning & Management 2 (2012) 7987block technology, as the train travels, the track receives the trainlocation and train integrity from the train.

Figs. 24 show the train contains a Balise Transmission Module(BTM) (Yellow box). The BTM communicates bi-directionally withthe track located balises. The balises are energised when the BTMpasses over them and a response signal is sent.

The interface between the train and the driver is via the DriverMachine Interface, a driving transition at levels 2 and 3 ERTMS.Where trackside signals are no longer required.

4. ERTMS deployment

Fig. 5 maps the expected status of ERTMS deployment for ERT-MS ETCS levels 1 and 2. In addition to Fig. 5, a comprehensive com-parison of ETCS technology has been conducted as shown inTable 3. The ndings highlight the deployment issues faced acrossEurope from both a technological, operational and procedural per-spective. Where applicable, these ndings have been mapped tothe resultant impact on safety and human factors.

This section presents a comparison of the experiences from se-lected European countries that have made advancements in theimplementation of ERTMS. This analysis is based on data obtainedfrom a structured questionnaire targeted at Spanish InfrastructureManager ADIFs Subject Matter Experts, supplemented by informa-tion in the public domain. For the other European cases, data hasbeen obtained from structured interviews with Subject Matter Ex-perts in the eld of railway safety also supplemented withinformation available in the public domain which includes presen-tations and website information.

Fig. 4. ETCS Level 3. (Source: http://www.ertms.com)

technology sophistication are being realised. Unfortunately, the re-cent fatal high prole railway crash in Spains Santiago de Compos-tela region in July 2013 is an example of the failure in legacy traincontrol and reinforces the need for enhanced safety systems. Thiscrash resulted in a train impacting with a concrete wall followingexcessive speed. This event has again brought to light the impor-tance of safety measures in railway systems.

The high prole nature of this case can be likened to the disas-ters that occurred in the UK such as the Ladbroke Grove railwaycrash. In this case, the investigating judge identied that;

The main cause of the accident was the trains excessive speed.

The judge additionally noted human factors as a crucial areastating that;

Those responsible for safety should have foreseen that humanerrors, caused by fatigue or habit, could pose a risk on what

t Planning & Management 2 (2012) 7987 83The implementation of ERTMS across Europe indicates thatSpain not only has the largest area of European train control appli-cation but it was the rst to implement it on its countries com-muter lines. Figures from Spain show that with ETCS technology,reliability is at 99% (Railway Track and Structures) and this is lar-gely due to the use of testing laboratories that simulate a rangeof railway environments. Consequently, Spain widely encouragesthe use of ERTMS testing laboratories. This is specically becauseof the high trafc density on the Spanish networks, which wouldotherwise cause complication and incur high costs if tests werecarried out during passenger hours. Furthermore, with the applica-tion of ERTMS Spain has seen signicant growth in patronage. Forexample, the route Madrid to Valladolid has seen an increase of109% (2008 gures), http://www.ertms.com/media/2434/fact-5.pdf. To achieve these benets, Spain has faced a number of chal-lenges deploying ETCS technology, such as:

The existence of many versions of ETCS with technical problemsand therefore, requiring the need for a backup system.

Instability of specications, leading to changes during thedevelopment and validation of projects.

Increased complexity of integration, due to the number of sup-pliers who provided train and trackside systems that also hadtechnical integration issues.

Moving forward in the development of Spains implementationof ETCS, a number of challenges have been identied for Level 2ETCS. This includes installation of ETCS Level 2 (L2) separately fromLevel 1 (L1), thereby having only Level 2 on the line where thiswould be inuenced by factors such as line functionality. Spain isin the process of testing the reliability of Level 2. However, the pro-cess has suffered due to incomplete specications which is furtherhampered by the companies involved (Iglesias et al., 2011). Forexample, it has been shown that the lack of a full specicationfor GSM-R has caused further delays.

To avoid the likelihood of system susceptibility to failures insafety, a number of techniques have been employed; this includestrackside integration and mass laboratory (SS 076) testing. Analy-sis of system failures occurs with available onboard tools such asthe Juridical Recorder Unit which collects data. Comparatively,analysis of Radio Block Centre logs provides information on track-side events.

The issues above highlight the complexities involved in migrat-ing from a conventional signalled network to ERTMS. The inuenceof unstable specications, for example in the case of GSM-R canimpact the voice and data communication paths to the train inter-face, impacting the movement authority given to the train. GSM-Ris a core transmission method and it interfaces with the RadioBlock Centre which sends information to the trains computer viaGSM-R for train control.

In addition to the technical complexities that accompany themigration to ERTMS, a signicant challenge is the transition forthe train driver. This transition requires a change in concentrationfrom the line-side signalled route to ETCS signalling where concen-tration is on the in-cab Driver Machine Interface (DMI) screen. Thisintroduces a signicant change to driving practices. This drivingchange known as head down driving requires the driver to focuson the information presented on the DMI in the cab rather thanthe line-side signals (Porter, 2011). This change can introduce com-plications with the actions exhibited by the train driver; the traindriver who would have gained route knowledge depending onthe level of driver experience is now required to focus on the mes-sages displayed by the user interface altering the drivers attention

P. Smith et al. / Journal of Rail Transporand focus.The examples above show that while technology migration has

a number of facets for consideration, however the benets ofwas known to be a difcult curve. (Euronews, 2013)

These two extracts note both the technical and human factorsthat contribute to railway safety. In this case, excessive speed andinadequate braking could have beenmitigated by the technology of-fered by the ETCS. ETCS continuouslymonitors the speed of a train inrelation to its permitted safe speed for that route, enforcing an emer-gency brake on the train if required. The failures by themanagementstructure to recognise bad practice will require the emphasis onsafety training and driver understanding to be re-evaluated.

Train driver experience following implementation of ERTMS onthe UKs Cambrian Line has identied a number of issues with theDriver Machine Interface. This includes screen visibility issuescaused by sun glare, this is converse to an overly brightened screendisplay which has also been reported during night driving. This is-sue with the DMI has also been exhibited on the GSM-R radioscreen. Other issues have also been identied and include the sim-ilarity of the display icons and the size of the icons deemed toosmall and too similar in some cases (Leppard). Issues such as thesecan introduce human error into operational activities carried outby the driver. These issues should be identied during the designand test phases where they could have been resolved. It has beenillustrated by Shepherd and Marshall (2005) that many designerswork according to technical specications rather than consideringtask analysis which if effectively carried out would have accountedfor the human element.

These issues emphasise the need for operational understandingof how the driver operates in the new environment. For example,in the event of a system failure if the driver is having difculty see-Fig. 5. ERTMS deployment throughout Europe. Source reference (European RailTransport, 2009)

erop

t PlaTable 3European comparison study.

Country Route information Implementationschedule

Capacityinuences and

Int

84 P. Smith et al. / Journal of Rail Transporing the screen, or deciphering the icons, this will impact the dri-vers response, altering performance, increasing cognitive work-load and pressure on the driver.

Structured interviews have also been carried out in the Nether-lands and Switzerland, this aids identication and analysis of theimpact of ERTMS implementation on safety. The interviews were

technology

GreatBritain

Cambrian line[Shrewsbury -Aberystwyth/Pwllheli] 215 km ETCS L2

Start date: 2005 Commissioned:March 2011

Blockoptimisation atMachynellth toenable 3 minheadway 1No. RBC

Ansalddesign Limit Retrorestrict Conwith G DMIoperatiunread DMI Balise Radiotrains a Intercof mph Odom

Netherlands Havenspoorlijn partof Betuwe line ETCSL1 Rotterdam -Emmerich-Germanborder 110 km ETCSL2 + F/B HSL South 93 km Amsterdam -Utrecht 30 kmHanzelijn 70 km

C/S June 2007 C/S June 2009 20th December,2010 mainlinecommissioned P/S: 2012

Maximumline speed120 km/h Maximumline speed300 km/h Maximumline speed200 km/h

Betuwworkintrain oinfrastrFitmewith Gsystem To aidadvisabrelevan It is rrequireaccepte

Spain Madrid - Barcelona650 km ETCS L1 Cordoba - Malaga155 km ETCS L1/L2 Madrid Valladolid197 km ETCS L1/L2 Madrid Toledo21 km ETCS L1 Toledo Access 25 kmETCS L1/L2 Zaragoza - Huesca79.5 km ETCS L1

Earliest C/Simplementationsin Madrid - LeridaL1 2006

Max speed200 km/h Maxspeed 350 km/h

ERTMconsoli Speciintegra Evoluand moand pr The tsupplietracksiothers Collabetweeconsoli Signidevelo

Switzerland Mattstetten Rothrist - 45 km ETCSL2 Gotthard Base65 km tunnel Frutigen -Lotschberg-Visp Olten Lucerne Limited supervision 3000 km (95% ofSBB network)6.Lotschberg BaseTunnel 35km

Start date: 2002C/S: 2007 Start date: 2003P/S: 2017 Start date: 2007P/S:20156. Start date:2007

Mattstetten Rothrist 1No.RBC Lotschberg1No. RBC Maximumspeed 250 km/h

SBB mconvenbackupcooperto carroperati For cprocescompliofcialrailway

Note: (-) indicates missing data in the column titled length; (F/B) indicates a Fallback sindicates ETCS Level 2 and Level 1. This table incorporates references Ministerio de Fomerability issues experienced Safety and human factors

nning & Management 2 (2012) 7987designed to provide an insight into development and applicationissues, infrastructure, rolling stock, technology and procedures.

Analysis of the responses from Lloyds Register Rails Safety ex-perts in the Netherlands, who were closely involved with ERTMStrials in the country, identied that the main issues experiencedrelate to complexities between stakeholders and the countries in-

o took a holistic approach to systemand rules, key challenges include:ed testing time - 4 h slotstment of 20 year old trains withed spacerming integration and performanceSM-Rscreen blanking out duringon/sun glare resulting in anable DMIicon sizeTansmission Module failuresBlock Centre confusion over twot platforms seeking MAhanging between the speed unitsand kphetry faults

If train drivers fail to successfully adaptto the new DMI interface this couldprovide the tendency for incorrectapplication of procedures causingpassenger journey disruption and or trainimmobilisation Inconsistency in the speed units used byGB and mainland Europe, where GB usemph. Potential safety issue of nonadherence to speed proles creating anemergency situation In regard to odometry failures safety ofthe Emergency braking system isdependent on the accuracy of speed anddistance provided by the odometrysystem. The ETCS must be able tosuccessfully command the Emergencybrake

e line: complexity arose because ofg with ve stakeholders includingperating, lease companies anducture managersnt of ETCS required interoperabilityerman, Belgian and Dutch nationalsthe speed of getting approvals, it isle to know the right people in thet countryecommended that changes inments should not be readilyd

Working to EN50126/-129 has thebenet of: Using the same language for all parties Application of known and acceptedprocesses for project set up Re-use of previous documents, templatesand processes

S was a new system with nondated specicationscation evolution while developing,ting and validating projectstion of new entities, different rolesdications in authorisation processocedurerains supplied by any of the 5 unitrs in Spain are able to run onde equipment built by any of the

boration and communicationn entities involved in thedation process of the specicationscant expense has been spent onping tests to debug ETCS equipment

Reliability testing found: Functional issues with the RBC wherethere were reception packets withunknown values Hardware failures in the RBCmultiplexors GSM radio interferences withfrequencies specic to railway operationhave the potential to impact critical voiceoperation having serious impact during anemergency scenario

ade a decision to remove thetional line side signalling, i.e. nosystem which requiredation between SBB and Bombardiery out systematic analysis of allonal problemsross border trafc, transitionses were not clearly identied andcations arose with the differentregulations and languages ofnetworks

Mixed trafc to optimise the trafc ow Passenger and freight running on thesame line

ystem; (C/S) indicates Commercial Service; (P/S) indicates Planned Service; (L2/L1)ento (2010) and information from structured interviews.

voice element of GSM-R suffering dropped calls. A dropped callis an unexpected termination of a call, and has caused failure of

has shown it is vital that technical and procedural issues areaddressed together, because of their close interdependence.

t Plavolved. However, these complexities were reduced through appli-cation of European standard EN50126 which facilitated in dealingwith roles and goals in complex projects, as it provided a coherentprocess to establish reliability, availability, maintainability andsafety (Hajonides, 2011).

In the case of the Netherlands, the experience of ERTMS deploy-ment on the AmsterdamUtrecht line shows alignment with theSpanish experience, whereby laboratory testing took a key role infacilitating deployment of ERTMS technology. General laboratorytests carried out proved of particular importance because of hightrafc density and the ability to achieve instant feedback on theprogress of development (Zweers et al., 2011).

Although cross acceptance has been a problem for the Nether-lands, due to delays in the specication of the National SafetyAuthority procedures, specic safety aspects have implementedEuropean standards (EN50126 and EN50129) which aid the safetyapproval process. These standards, EN50126 and EN50129, areconcerned with a systematic process for specifying requirementsfor Reliability, Availability, Maintainability and Safety (RAMS),and the evidence to be presented for the acceptance of safetyrelated systems respectively. Their application has assisted theapproval process as they are accepted and implemented acrossEuropean Member States and are used as a tool to formulate thesafety case structure.

From a procedural point of view, whilst working on the BetuweLine, complexity arose due to the number of stakeholders involvedin decision processes; this proved costly; the project cost was closeto tripling. It was concluded that for interoperability and deploy-ment of ERTMS to be successful, Member States need to interfacewillingly to enable faster implementation of systems and thiswould require efcient national safety authorities and transparentsafety requirements.

In the case of Switzerland, the experience of the Swiss FederalRailways (SBB) safety experts has been largely similar to thatexperienced in the Netherlands. The factors that emerged as neces-sary for the successful deployment of ERTMS are:

A cohesive working relationship between track and trainoperators.

Colleagues from different stakeholder companies should inter-act on a more informal basis.

There should be increased focus on operational rules in additionto technology.

However, not all of Switzerlands railway routes have been de-ployed with ERTMS, e.g. it is not deployed in the region of Granges-prs-Marnand near to which there was a fatal railway crash. Thisarea of Western Switzerland runs its railway system on the legacytrain protection system, Signum (De Vore and Swissinfo, 2013),and this accident occurred as a result of trains travelling on thesame track at the same point in time. The failure in this instancewas caused by a train passing a signal at danger, which can beattributed to driver error as brake activation was delayed. This er-ror led to the train entering a single-track area; in this case theETCS would have avoided this as per its functionality describedin Section 3. This crash has garnered varying opinions, Von Adrianidenties that the cost would almost be double of that agreed forinvestment to improve safety by the Swiss government. Meyeron the other hand, stated risk in the train business will never bereduced to zero (De Vore and Swissinfo, 2013). Both the recentrailway crashes in Spain and Switzerland have occurred on rail-ways where there was legacy signalling; human error was a con-tributory factor in both cases. The application of ETCS may have

P. Smith et al. / Journal of Rail Transporprevented both events, though as Meyers statement above notes,it is impossible to reduce risk to nil.Current methods consider them in isolation (International Unionof Railways, 2011), largely due to different practices in countrieswhere Member States employ different philosophies, e.g. problemsexperienced between France and Switzerland. The resolution ofthis requires countries to aim to achieve goals together, betweeninfrastructure managers and train operators, with easy means fordirect contact. Core ndings applicable to a safety critical railwaysystem have been summarised and categorised below.

5.1. Requirements, specications and testing

The Netherlands have emphasised the benet of transparenttesting procedures. This would prevent clients from requestingspecic features which results in tailor made solutions. Transpar-ency can reduce issues such as requirements creep which couldlead to solutions that are no longer suitable for an interoperablerailway and which may produce unexpected outputs followingsystem integration that could be of detriment to system safety.Validating the safety of railway subsystems can be aided throughusage of testing laboratories, which has been widely encouragedand increasingly used. Laboratory testing enables mitigation ofmajor severity (International Union of Railways, 2011) whichwould have signicant impact if occurring during an emergencycall.

In addition to the cases presented above, a comparison study ofERTMS ETCS deployment in four European countries is detailed inTable 3. These four countries have been chosen for sampling from awider study that has been carried out as they can be construed tobe representative of the European environment.

5. Conclusion

This paper has presented examples of challenges faced by Euro-pean countries that have deployed ERTMS and are moving towardinteroperable railway networks. A number of challenges have beendemonstrated, which include technical system integration, techni-cal system failures and human factor considerations. Informationin the public domain, augmented by structured interviews, hasbeen used to compare and critically appraise the experiences ofthe deployment of the ERTMS.

To enable an interoperable railway system, safety consider-ations must be made in relation to trackside, train, human interfaceand procedural issues. Aspects of human interfacing are importantwith respect to safety and have been discussed; with the mainfocus on technology and procedural issues. In summary, this paperOperation and installation of ERTMS has been shown to benetfrom interoperability tests performed in laboratories. Testing onnew lines also proved an easier option than would be faced ifworking on an existing line. The Swiss found problems with onboard train parameters; furthermore, braking curves were prob-lematic, where the lines were too at leading to changes in brakingcurve parameters. Again the usage of laboratory tests facilitatedthe resolution of such issues.

Aside from the issues and solutions presented above, France hasalso experienced operational issues, in particular, with the GSM-Relement of ERTMS which has a complex topology as detailed by(Smith et al., 2013). France has experienced the impact on the

nning & Management 2 (2012) 7987 85safety issues as there is potential to simulate a greater range of sce-narios and environments. Such safety issues would otherwise befound through testing on the track or during commercial service

Dalton, G., March 2009. Doubts remain over true ERTMS interoperability.

Unife, 2011. The European Rail Industry ERTMS Benets. (accessed 28th July, 2011).

t Plaoperation, something which occurred during Spains commercialexploitation.

5.2. Operational procedures

Expansion of ERTMS has been shown to be hampered by restric-tive rules, for example, the requirement for individual applicationsfor line by line implementation of ERTMS as opposed to the fastermore convenient method of applying by country.

Non-consolidated requirements and operating rules are shownto also be a major issue that affects the operability and deploymentof ERTMS technology. Issues such as this introduce risk into designand processes, as there is movement away from structured andveried methodologies. This will subsequently impact the safetyof railway processes put into place for the systems that comprisethe railway.

In order for processes and procedures to be successful in imple-mentation across Europe, the various Member States need to im-prove working relationships, harmonisation and identifyorganisational weaknesses in existing ways of working. That is tosay, at an organisational level, culture and behaviour towards fac-tors that inuence safety need to be addressed so that the safetyprocesses which drive the railway are not negatively impacted.

Furthermore, interoperability enables interdependency be-tween freight, conventional and high speed lines which are sup-ported by a culmination of interoperability directives, technicalspecications for interoperability and European specications.

5.3. Human factors

This paper has shown that a number of the issues as identiedin Table 3 can impact technical operation and safety. Some ofwhich, rooted in human factors have been identied through workin the human factors domain.

As an example, thorough examination of human factor engi-neering with respect to the consequences of safety failure has beencarried out. It has found that data input is associated with a highlevel of error, since it is a dull repetitive task that requires a highlevel of concentration (Ministerio de Fomento, 2010). Furthermore,the ergonomic change in utilisation of the driver machine interfacewhich requires entry of safety critical data at start up has raisedsuggestions that this should be an automated process. To minimisethe likelihood of error in data entry it is suggested that safety crit-ical data should be uploaded automatically, with the driver beingrequired only to check and accept system generated data (Porter,2011). Human factor safety analysis thus needs to be integratedand considered alongside technical safety issues.

5.4. Cost

ERTMS is a safety critical system with complex procedures andtechnology, both of which are costly to implement. ETCS, the coretechnological component of ERTMS has been shown to be morecostly at Level 1, as at this level, existing signalling equipment isretained for its operation, which incurs additional maintenancecosts. This is seen as a signicant drawback. However, the transi-tion to Level 2 is progressing and would mitigate such costs.

In Summary, this paper has shown that ERTMS deploymentacross European railways has had many inuencing factors, rang-ing from specic national safety requirements which potentiallydiffer from one Member State to another to the number andinvolvement of stakeholders. Safety and interoperability of thenew railway signalling system would benet from open engage-

86 P. Smith et al. / Journal of Rail Transporment between stakeholders and suppliers. The use of testing facil-ities would greatly aid not only deployment of ERTMS but theability to test scenarios that could occur during passenger opera-Barger, P., Schn, W., Bouali, M., January 2010. A Study of Railway ERTMS Safetywith Colored Petri Nets. Universit de Technologie de Compigne, France.

Frsig, P., June 2004. ERTMS/ETCS future train control, ERTMS/ETCS/GSM-R UIC,Banestyrelsen DK, UIC ETCS and ERTMS Regional Project Manager. EURAIL,FORUM.

ERTMS ETCS Level Images. .European Rail Transport, 2009. A Major Step towards a Harmonised Signalling

System, EUROPA, 2009. .

Railway Track and Structures, David Briginshaw. ERTMS struggles to nd its feet inEurope. International Railway Journal. .

Unife The European Rail Industry, 2011. ERTMS Factsheet No. 5. .

Iglesias, J., Arranz, A., Cambronero, M., et al., 2011. ERTMS deployment in Spain as areal demonstration of interoperability. Near future challenges. In: 9th WorldConference on Railway, Research, May 2226 2011.

Porter, D., 2011. Implementing ERTMS in the UK: Human Factors Implications forTrain Drivers Human Factors Skill Leader AEA Technology Rail (accessed 12thOctober, 2011).

Leppard, P. Introduction of ERTMS in the UK A View After Our First 12 Months..International Railway Journal. .

Siemens, 2011. Technical and Administrative Barriers for Rail Trafc. (accessed 28th July, 2011).tion and thus mitigate known failure scenarios through efcientlaboratory testing. A key inuence on the safety of ERTMS ETCSsystems is the requirements and specications. These need to behomogeneous and conclusive as changes in this arena will increasethe amount of rework and hamper the process of upgrading lines.The various levels of ETCS are shown to have different inuencingfactors, Level 1 has limitations of aspect signalling which impactstrain frequency and restricts movement to block sections for safemovement Level 2 ETCS avoids this by continual radio transmis-sion, and continuous calculation of train speed and enhanced dri-ver notication.

Overall, a number of issues have been identied that impactdeployment of ERTMS and in some cases work is already in pro-gress to address these problems. The impacts of ERTMS implemen-tation have been largely positive, due to the potential benets thatthis technology can offer.

Appendix A

Fig. 1 System architecture depicting a legacy railway withhigh level system interaction

References

Europa Summaries of EU Legislation, 2011. Interoperability of Trans European HighSpeed Rail System. (accessed28th July, 2011).

Hazards Forum, March 1995. Safety-Related Systems: Guidance for Engineers.Tessdre, D., UIC, International Union of Railways, 2004. Safe Culture, A Method for

Assessing Organisational Safety at Interfaces. UIC/CommunicationsDepartment, Edition: JC Dan Partners. 06/2004.

Rail Safety and Standards Board, March 2003. Research Programme Engineering Life Cycle Management of Data Used for the European Rail Trafc ManagementSystem (accessed 12th October, 2011.

Glover, J., 1996. Londons Underground.Hall, A.D., Fagan, R.E. Denition of a System. .Johnson, C.W. What are Emergent Properties and How Do They Affect the

Engineering of Complex Systems? Department of Computing ScienceUniversity of Glasgow.

Knight, D.C., 2011. Protection for DC Substations an AC Track Feeder Stations. In:REIS Conference (accessed June 2011).

nning & Management 2 (2012) 7987Shepherd, A., Marshall, E., 2005. Task Specication in Designing for HumanFactors in Railway Operations, Rail Human Factors Supporting the IntegratedRailway.

Hajonides, H., March 2011. Case of ETCS Retrot class 66 applying EN50126/50129. Lloyds Register Rail Europe.

Zweers, M., Bronsema, F., Wulfse, M., 2011. Amsterdam Utrecht: ERTMS L2 as anOverlay to Conventional Signalling, SIGNAL + DRAHT(103) 2/2011.

Smith, P., Kyriakidis, M., Majumdar, A., Ochieng, W., 2013. Impact of ERTMS onHuman Performance European Findings. .

International Union of Railways, 2011. Interferences into GSM-R due to Public RadioNetworks.

Experiences in the Implementation of the ERTMS/ETCS System from NationalPerspective, NSA Spain. Ministerio de Fomento. Annual Safety Conference, 27thSeptember 2010.

Euronews, 2013. Safety Ofcials Charged Over Train Crash in Spain, Article date 21/08/13. .

De Vore,V., Swissinfo.Ch, 2013. Media Singles Out Signals in Accident Aftermath,Article date 31/07/13. .

P. Smith et al. / Journal of Rail Transport Planning & Management 2 (2012) 7987 87

An overview of lessons learnt from ERTMS implementation in European railways1 Introduction2 Railway systems3 The move to interoperability4 ERTMS deployment5 Conclusion5.1 Requirements, specifications and testing5.2 Operational procedures5.3 Human factors5.4 Cost

Appendix AReferences