Journal of Rail Transport Planning & Management 2 (2012) 7987

Contents lists available at ScienceDirect

Journal of Rail Transport Planning & Management

journal homepage: www.elsevier.com/locate/jrtpm

An overview of lessons learnt from ERTMS implementation in European

railways
Peri Smith a, Arnab Majumdar b,, Washington Y. Ochieng b,1
a
b

Centre for Transport Studies, Department of Civil and Environmental Engineering, Imperial College London, London SW7 2AZ, UK
Imperial College London, Department of Civil and Environmental Engineering, Centre for Transport Studies, London SW7 2AZ, UK

a r t i c l e

i n f o

Article history:
Received 30 November 2011
Revised 7 October 2013
Accepted 11 October 2013
Available online 7 November 2013
Keywords:
ERTMS
Interoperability
Safety
ETCS

a b s t r a c t
The European Unions aspiration for railway systems that are interoperable across Europe is driven by the
need to service a market that is open within and across industrial sectors and national boundaries. This in
turn requires that the technologies and operational procedures that underpin the railway systems
facilitate not only interoperability but also enhancement of safety, capacity and efciency. The European
Railway Trafc Management System (ERTMS) is designed to enable interoperability through use of one
unique signalling system as opposed to conventional signalling systems. However, the introduction of
ERTMS must be undertaken to facilitate the European wide ambition to reduce risk on the railways.
This paper addresses the issues relevant to the safe introduction of ERTMS into European railway systems, with a focus on the technical and procedural challenges of moving from conventional signalling to a
new trafc management system. Existing literature, augmented with a targeted survey of subject matter
experts, is used for a critical appraisal of safety considerations across Europe. Differences and variations
across networks and countries are identied, and used to determine the signicant issues that need to be
addressed to enable the safe introduction of ERTMS. Finally, generic observations are made on the factors
that impact safety and human factors as a result of the introduction of new technologies and procedures
into existing railway environments.
2013 Elsevier Ltd. All rights reserved.

1. Introduction
During the past decade, European railway system design and
operation has become increasingly complex. This change and modernisation to railways has been driven by aims for an integrated
European railway network under the terms of interoperability.
Interoperability aims for unication of signalling systems, technical coherence and harmonisation. The European directive 96/48/
EC (Europa Summaries of EU Legislation, 2011) details the expectations of interoperability on high speed trans-European railway
lines. This directive is aimed at servicing a market that is open
across national boundaries, as reected in the current trend to
markets that are more open, both within and across industrial sectors and national boundaries.
Development of railway systems such that they meet the EUs
drive for interoperability has led to increased levels of automation.
Automation and modernisation of railways has faced a number of
constraints which include incompatibility with legacy systems and
Corresponding author. Tel.: +44 (0) 207594 6037.
E-mail addresses: p.smith10@imperial.ac.uk (P. Smith), a.majumdar@imperial.
ac.uk (A. Majumdar), w.ochieng@imperial.ac.uk (W.Y. Ochieng).
1
Tel.: +44 (0)20 7594 6104.
2210-9706/$ - see front matter 2013 Elsevier Ltd. All rights reserved.
http://dx.doi.org/10.1016/j.jrtpm.2013.10.004

changes in operational procedures, both of which have the potential to impact safety.
The EUs aspiration for an open market makes it desirable for a
common approach to safety related issues, where safety is dened
as freedom from unacceptable risk of harm (Guidance for Engineers,
1995). Of particular interest, an aspect of safety referred to as safety
culture is reviewed. Safety culture has been dened in a number of
ways relative to its context, safety culture, has been dened as a
method for assessing organisational safety at interfaces (Tessdre
and UIC, 2004), alternatively, it has been described as a product
of the individual and group values, attitudes, perceptions, competencies and patterns of behaviour that determine commitment
to, and the style and prociency of, an organisations health and
safety management. Organisations with a positive safety culture
are characterised by communications founded on mutual trust,
shared by perceptions of importance of safety and by condence
in the efciency of preventative measures (Rail Safety and Standards Board, 2011). Thus, safety culture is a key consideration for
railway system interoperability; at corporate and industrial levels
organisational culture has been shown to have a direct impact on
safety (Tessdre and UIC, 2004).
This paper evaluates a selection of European railway system
developments, following modernisation through the introduction

80

P. Smith et al. / Journal of Rail Transport Planning & Management 2 (2012) 7987

of the European Railway Trafc Management System (ERTMS).

Emphasis is placed on the technical capability of ERTMS, which is
the European Train Control System (ETCS) and the Global System
for Mobile CommunicationsRailways (GSM-R). This is facilitated
by specication of the functional and physical architecture that
comprise railways as an initial step to appreciate the relationships
that are crucial for an integrated railway system.
The paper is organised as follows. Section 2 describes the railway system, outlining its generic architecture and interfaces, for
a conventional signalled railway. This is followed in Section 3 by
the challenges faced across Europe with technically incompatible
conventional signalled systems and the reasons for moving to the
ERTMS. A case study is taken with respect to the status of deployment of ERTMS across four European countries and this is addressed in Section 4, highlighting areas of progression, key
challenges and lessons learnt with respect to safety. The paper is
concluded in Section 5 which surmises the move forward with
ERTMS technology.

Fig. 1 captures a number of key features relevant to safety; this

includes integration between key railway systems and backbone
systems of power and telecommunications which are vital for
operation (Dalton, 2011). Telecommunications increasingly facilitates many existing and new customer services, creating a strong
relationship between the telecommunications and railway industries. Additionally, interfacing between safety critical and nonsafety critical systems, such as interlocking which is a vital system
for safe route locking, thus preventing manipulation of levers that
could otherwise endanger a train whilst it occupies a route section
and point zone telephones for communication is another example
which shows a railways complexity. The architecture highlights
the level of physical integration and in general is a visual aid to
identify issues that need addressing, such as the use of ageing
assets and the integration of new and legacy equipment.

3. The move to interoperability

2. Railway systems
Railway systems from their inception in Great Britain in 1825
have been designed for transportation of passengers and goods.
Railways are complex networks and consist of a number of systems
which interface and integrate through technical compliance and
through application of and adherence to rules, regulations and procedures (Glover, 1996). Failure in any of these systems and/or procedures has the potential to not only degrade system performance
but to also cause a hazardous environment which could have a signicant impact on the safety of a railway.
Treating the mainline railway as a system, it can be dened as a
set of objects together with relationships between the objects and
between their attributes (Hall and Fagan). Elaborating this denition, a railway system can be considered to consist of parts which
are diverse in terms of their properties and variety, once linked
these parts create relationships. All technical systems, including
railways have emergent properties, which is dened as those properties which lead to behaviours that stem from complex system
interactions resulting in benecial or detrimental consequences
(Johnson). For example, positive emergent properties can be
adapted to support tasks that were never conceptualised during
design, as design alone may not have produced the optimal solution. Conversely, due to the unpredictability of such properties,
they can also undermine factors such as system safety. Therefore,
emergent properties can have a negative output of increasing system vulnerability, either in a physical or functional context.
The safety of railway systems must be ensured through safety
requirements and assessment methodologies that address different sub systems, their interfaces and how they integrate. In addition, factors including contractual, commercial and societal
relationships must be accounted for. This requires, in the rst instance, a detailed understanding of the architecture from both a
physical and functional context of the railway system. System
architecture has been developed utilising the industry experience
of the author and validated through technical discussions with
engineers at Network Rail in the elds of Telecoms, Signalling,
Electrication and Power, and Building Services.
The approach employed in the specication of the architecture
is to depict linear systems to represent track, overhead line equipment, transmission network and Ethernet/Internet protocol. The
UK railway infrastructure and electrication protection sectors
identify the mainline railway as a linear electrical system with
multiple sources of supply (Knight, 2011). Interfacing with these
linear systems are rolling stock, stations, control room and trackside equipment.

In 1989 the European Commission carried out a study on train

control and signalling issues (Europa Summaries of EU Legislation,
2011). It found that the technical challenge of maintaining a safe
conventional signalled railway is reected in the incompatibility
of signalling systems across Europe, and recommended a move
away from conventional signalling to a signalling methodology
which facilitates interoperability.
The study was required for the reason that existing railway procedures across Europe in some cases required trains to be equipped
with up to seven navigation systems. This made it compulsory for
trains to switch over to the operational standard applicable at a
particular countrys border. Furthermore, there were concerns
relating to the size of the navigation system on-board the train.
Other issues such as cost, differences in rail gauge, electrication
systems and the variation in the number and type of train protection systems established across Europe have also been evaluated.
Table 1 provides examples of these incompatibility issues, for
example, the differences in track gauge, that is, the difference between the inside of the two rails. The standard gauge used in the
UK and 60% of the worlds railway is 1435 mm. Spain and Portugal
use 1668 mm while Russia and its neighbours use 1524 mm (Siemens, 2011). Electrication is another area where there are incompatible systems. The UK mainline railways, electried at 25 kV
50 Hz AC match the high speed lines in France (in part). However,
systems in Germany and Austria use 15 kV while Holland uses
1500 V DC.
The International Union of Railways states that the goal of ERTMS is to enhance cross border interoperability and signalling procurement by creating a single Europe wide standard for railways
with the nal aim of improving competitiveness of the rail sector
(Tessdre and UIC, 2004). The benets of ERTMS include enhanced
trafc management, optimised usage of energy and network resources and increased capacity, through receipt of optimal/anticipating schedules and guidelines. In order to realise the benets,
ERTMS must underpin technical and operational interoperability
(Unife, 2011).
Interoperability across Europe has been prioritised according to
the type of railway line. The rst priority is for the interoperability
of high speed train lines followed by conventional lines (Barger
et al., 2010). Technical requirements for interoperability demand
the application and implementation of the same interfaces between equipment. Operational requirements require application
and implementation of the same interfaces between the driver
machine interfaces. Therefore, a move towards interoperability
requires convergence from a number of railway systems into a
single system. This convergence would bring about inter-running

81

P. Smith et al. / Journal of Rail Transport Planning & Management 2 (2012) 7987

Fig. 1. Key features of a railway system.

Table 1
Technical incompatibilities across Europe.
Country

Track gauge (mm)

Electrication system

Train protection system

Great Britain
France
Belgium
Netherlands
Italy
Sweden
Norway
Germany
Switzerland
Spain
Portugal
Ireland
Latvia
Estonia

1435

25 kV, 50 Hz AC

AWS/TPWS
TVM/KVB/Crocodile
TBL/Crocodile
ATB-EG, ATB-NG
SCMT/BACC
Ebicab 700

1.5 kV DC
3 kV DC
15 kV, 16.7 Hz AC

1668 (Including some routes at 1435mm)

1600
1520

between countries, common manufacturing standards and

increased railway competition due to removal of trade barriers.
Europe wide recognition of the concept of a single railway is in
compliance with Technical Specications for Interoperability (TSIs)
(Frsig, 2004). This can be categorised at a high level into four distinct areas, focusing on Energy, Infrastructure, Rolling stock and
Signalling. The realisation of a single system has the potential for
many benets. For example, due to agreed specications, a train
could be maintained anywhere in Europe, as any afliated country
would have access to a particular spare part.
The ERTMS consists of four layers: European Operating Rules
(EOR), European Trafc Management Layer (ETML), Euro-radio
(GSM-R) and European Train Control System (ETCS). The ETML
and EOR are operational layers whilst the ETCS and GSM-R are
technical layers. The two technical layers will be discussed in more
detail to aid understanding of how the railway is modernised. The
ETCS, located on-board rolling stock, is a computer based system
which compares the maximum permitted speed with the trains
actual speed. The ETCS is implemented across Europe and is in line

3 kV DC
25 kV, 50 Hz AC
Non electried
3.3 kV DC
3 kV DC

PZB 90, LZB

ZUB 121, Integra-Signum
ASFA/LZB/Ebicab 900
Ebicab 700
CAWS
ALSN

with EU directives and this is the signalling system for cross border
train operation and is the most complex layer (Knight, 2011). The
ETCS interfaces with track and radio systems for speed optimisation and control, however, ERTMS cannot be fully operational without GSM-R which is the carrier for speech and data
communication. GSM-R is operational in frequency bands 876
880 MHz and 921925 MHz providing functions such as onboard
signalling. Viewing ETCS in more detail, as shown in Table 2, it
has three core levels of technical operation.
Figs. 24 (http://www.ertms.com) depict at high level how the
train and railway environment changes to achieve implementation
of the ETCS, showing the move away from conventional signalling.
The main trackside and on-board systems that comprise the
ERTMS application are indicated, highlighting three distinct ETCS
levels for train control. Level 1 ETCS involves track to train communication, via track located euro-balises, otherwise termed balises.
The balises interface with existing signalling and line side signals
are retained. Level 2 ETCS on the other hand, involves trackto-train and train-to-track communication. There is continuous

82

P. Smith et al. / Journal of Rail Transport Planning & Management 2 (2012) 7987

Table 2
ETCS levels and functionality.
ETCS
level

Train detection

0
STM

ETCS tted train travelling on untted infrastructure

ETCS tted train travelling on untted infrastructure but train protection commands are accepted from a Class B national system which acts as a slave to the
European Vital Computer
Balise at signal or balise at signal with Signal and driver machine
Communication via balise - no data radio communication
inll
interface
Line-side signals retained
Line-side Equipment Unit
Train position is determined trackside
No radio block centre
GSM-R
Signal and driver machine
Communication via GSM-R radio
interface
No requirement for line-side signals/line-side equipment unit or track
detection device
Train position is determined trackside
GSM-R
Driver machine interface
Communication via GSM-R radio
No line-side signals
Train position determined onboard

Driver notication

Description

Fig. 4. ETCS Level 3. (Source: http://www.ertms.com)

Fig. 2. ETCS Level 1. (Source: http://www.ertms.com)

block technology, as the train travels, the track receives the train
location and train integrity from the train.
Figs. 24 show the train contains a Balise Transmission Module
(BTM) (Yellow box). The BTM communicates bi-directionally with
the track located balises. The balises are energised when the BTM
passes over them and a response signal is sent.
The interface between the train and the driver is via the Driver
Machine Interface, a driving transition at levels 2 and 3 ERTMS.
Where trackside signals are no longer required.

4. ERTMS deployment

Fig. 3. ETCS Level 2. (Source: http://www.ertms.com)

radio communication from the track to train and interlocking

confers the train route to a Radio Block Centre (RBC). The RBC
calculates correct movement authority, giving authorisation to
proceed, with balises used as an odometry reference. Level 2 is
an enhancement to Level 1 ETCS with movement authority via
digital radio, the Global System for Mobile Communications
Railway (GSM-R) which enables elimination of trackside signals.
Level 3 ETCS further improves the ability of Level 2 ETCS by
introducing a train integrity function which will replace conventional train detection. At this level the RBC uses GSM-R for transmission between track and train. Level 3 also allows moving

Fig. 5 maps the expected status of ERTMS deployment for ERTMS ETCS levels 1 and 2. In addition to Fig. 5, a comprehensive comparison of ETCS technology has been conducted as shown in
Table 3. The ndings highlight the deployment issues faced across
Europe from both a technological, operational and procedural perspective. Where applicable, these ndings have been mapped to
the resultant impact on safety and human factors.
This section presents a comparison of the experiences from selected European countries that have made advancements in the
implementation of ERTMS. This analysis is based on data obtained
from a structured questionnaire targeted at Spanish Infrastructure
Manager ADIFs Subject Matter Experts, supplemented by information in the public domain. For the other European cases, data has
been obtained from structured interviews with Subject Matter Experts in the eld of railway safety also supplemented with
information available in the public domain which includes presentations and website information.

P. Smith et al. / Journal of Rail Transport Planning & Management 2 (2012) 7987

The implementation of ERTMS across Europe indicates that

Spain not only has the largest area of European train control application but it was the rst to implement it on its countries commuter lines. Figures from Spain show that with ETCS technology,
reliability is at 99% (Railway Track and Structures) and this is largely due to the use of testing laboratories that simulate a range
of railway environments. Consequently, Spain widely encourages
the use of ERTMS testing laboratories. This is specically because
of the high trafc density on the Spanish networks, which would
otherwise cause complication and incur high costs if tests were
carried out during passenger hours. Furthermore, with the application of ERTMS Spain has seen signicant growth in patronage. For
example, the route Madrid to Valladolid has seen an increase of
109% (2008 gures), http://www.ertms.com/media/2434/fact5.pdf. To achieve these benets, Spain has faced a number of challenges deploying ETCS technology, such as:
 The existence of many versions of ETCS with technical problems
and therefore, requiring the need for a backup system.
 Instability of specications, leading to changes during the
development and validation of projects.
 Increased complexity of integration, due to the number of suppliers who provided train and trackside systems that also had
technical integration issues.
Moving forward in the development of Spains implementation
of ETCS, a number of challenges have been identied for Level 2
ETCS. This includes installation of ETCS Level 2 (L2) separately from
Level 1 (L1), thereby having only Level 2 on the line where this
would be inuenced by factors such as line functionality. Spain is
in the process of testing the reliability of Level 2. However, the process has suffered due to incomplete specications which is further
hampered by the companies involved (Iglesias et al., 2011). For
example, it has been shown that the lack of a full specication
for GSM-R has caused further delays.
To avoid the likelihood of system susceptibility to failures in
safety, a number of techniques have been employed; this includes
trackside integration and mass laboratory (SS 076) testing. Analysis of system failures occurs with available onboard tools such as
the Juridical Recorder Unit which collects data. Comparatively,
analysis of Radio Block Centre logs provides information on trackside events.
The issues above highlight the complexities involved in migrating from a conventional signalled network to ERTMS. The inuence
of unstable specications, for example in the case of GSM-R can
impact the voice and data communication paths to the train interface, impacting the movement authority given to the train. GSM-R
is a core transmission method and it interfaces with the Radio
Block Centre which sends information to the trains computer via
GSM-R for train control.
In addition to the technical complexities that accompany the
migration to ERTMS, a signicant challenge is the transition for
the train driver. This transition requires a change in concentration
from the line-side signalled route to ETCS signalling where concentration is on the in-cab Driver Machine Interface (DMI) screen. This
introduces a signicant change to driving practices. This driving
change known as head down driving requires the driver to focus
on the information presented on the DMI in the cab rather than
the line-side signals (Porter, 2011). This change can introduce complications with the actions exhibited by the train driver; the train
driver who would have gained route knowledge depending on
the level of driver experience is now required to focus on the messages displayed by the user interface altering the drivers attention
and focus.
The examples above show that while technology migration has
a number of facets for consideration, however the benets of

83

technology sophistication are being realised. Unfortunately, the recent fatal high prole railway crash in Spains Santiago de Compostela region in July 2013 is an example of the failure in legacy train
control and reinforces the need for enhanced safety systems. This
crash resulted in a train impacting with a concrete wall following
excessive speed. This event has again brought to light the importance of safety measures in railway systems.
The high prole nature of this case can be likened to the disasters that occurred in the UK such as the Ladbroke Grove railway
crash. In this case, the investigating judge identied that;
The main cause of the accident was the trains excessive speed.
The judge additionally noted human factors as a crucial area
stating that;
Those responsible for safety should have foreseen that human
errors, caused by fatigue or habit, could pose a risk on what
was known to be a difcult curve. (Euronews, 2013)
These two extracts note both the technical and human factors
that contribute to railway safety. In this case, excessive speed and
inadequate braking could have been mitigated by the technology offered by the ETCS. ETCS continuously monitors the speed of a train in
relation to its permitted safe speed for that route, enforcing an emergency brake on the train if required. The failures by the management
structure to recognise bad practice will require the emphasis on
safety training and driver understanding to be re-evaluated.
Train driver experience following implementation of ERTMS on
the UKs Cambrian Line has identied a number of issues with the
Driver Machine Interface. This includes screen visibility issues
caused by sun glare, this is converse to an overly brightened screen
display which has also been reported during night driving. This issue with the DMI has also been exhibited on the GSM-R radio
screen. Other issues have also been identied and include the similarity of the display icons and the size of the icons deemed too
small and too similar in some cases (Leppard). Issues such as these
can introduce human error into operational activities carried out
by the driver. These issues should be identied during the design
and test phases where they could have been resolved. It has been
illustrated by Shepherd and Marshall (2005) that many designers
work according to technical specications rather than considering
task analysis which if effectively carried out would have accounted
for the human element.
These issues emphasise the need for operational understanding
of how the driver operates in the new environment. For example,
in the event of a system failure if the driver is having difculty see-

Fig. 5. ERTMS deployment throughout Europe. Source reference (European Rail

Transport, 2009)

84

P. Smith et al. / Journal of Rail Transport Planning & Management 2 (2012) 7987

Table 3
European comparison study.
Country

Route information

Implementation
schedule

Capacity
inuences and
technology

Interoperability issues experienced

Safety and human factors

Great
Britain

Cambrian line
[Shrewsbury Aberystwyth/
Pwllheli]
215 km
ETCS L2

Start date: 2005

Commissioned:
March 2011

Block
optimisation at
Machynellth to
enable 3 min
headway
1No. RBC

Ansaldo took a holistic approach to system

design and rules, key challenges include:
Limited testing time - 4 h slots
Retro tment of 20 year old trains with
restricted space
Conrming integration and performance
with GSM-R
DMI screen blanking out during
operation/sun glare resulting in an
unreadable DMI
DMI icon size
Balise Tansmission Module failures
Radio Block Centre confusion over two
trains at platforms seeking MA
Interchanging between the speed units
of mph and kph
Odometry faults

Netherlands

Havenspoorlijn part
of Betuwe line ETCS
L1
Rotterdam Emmerich-German
border 110 km ETCS
L2 + F/B
HSL South 93 km
Amsterdam Utrecht 30 km
Hanzelijn 70 km

C/S June 2007

C/S June 2009
20th December,
2010 mainline
commissioned
P/S: 2012

Maximum
line speed
120 km/h
Maximum
line speed
300 km/h
Maximum
line speed
200 km/h

Spain

Madrid - Barcelona
650 km ETCS L1
Cordoba - Malaga
155 km ETCS L1/L2
Madrid Valladolid
197 km ETCS L1/L2
Madrid Toledo
21 km ETCS L1
Toledo Access 25 km
ETCS L1/L2
Zaragoza - Huesca
79.5 km ETCS L1

Earliest C/S
implementations
in Madrid - Lerida
L1 2006

Max speed
200 km/h Max
speed 350 km/
h

Switzerland

Mattstetten
Rothrist - 45 km ETCS
L2
Gotthard Base
65 km tunnel
Frutigen Lotschberg-Visp
Olten Lucerne
Limited supervision
3000 km (95% of
SBB network)
6.Lotschberg Base
Tunnel 35km

Start date: 2002

C/S: 2007
Start date: 2003
P/S: 2017
Start date: 2007
P/S:2015
6. Start date:
2007

Mattstetten
Rothrist 1No.
RBC
Lotschberg
1No. RBC
Maximum
speed 250 km/
h

Betuwe line: complexity arose because of

working with ve stakeholders including
train operating, lease companies and
infrastructure managers
Fitment of ETCS required interoperability
with German, Belgian and Dutch national
systems
To aid the speed of getting approvals, it is
advisable to know the right people in the
relevant country
It is recommended that changes in
requirements should not be readily
accepted
ERTMS was a new system with non
consolidated specications
Specication evolution while developing,
integrating and validating projects
Evolution of new entities, different roles
and modications in authorisation process
and procedure
The trains supplied by any of the 5 unit
suppliers in Spain are able to run on
trackside equipment built by any of the
others
Collaboration and communication
between entities involved in the
consolidation process of the specications
Signicant expense has been spent on
developing tests to debug ETCS equipment
SBB made a decision to remove the
conventional line side signalling, i.e. no
backup system which required
cooperation between SBB and Bombardier
to carry out systematic analysis of all
operational problems
For cross border trafc, transition
processes were not clearly identied and
complications arose with the different
ofcial regulations and languages of
railway networks

If train drivers fail to successfully adapt

to the new DMI interface this could
provide the tendency for incorrect
application of procedures causing
passenger journey disruption and or train
immobilisation
Inconsistency in the speed units used by
GB and mainland Europe, where GB use
mph. Potential safety issue of non
adherence to speed proles creating an
emergency situation
In regard to odometry failures safety of
the Emergency braking system is
dependent on the accuracy of speed and
distance provided by the odometry
system. The ETCS must be able to
successfully command the Emergency
brake
Working to EN50126/-129 has the
benet of:
Using the same language for all parties
Application of known and accepted
processes for project set up
Re-use of previous documents, templates
and processes

Reliability testing found:

Functional issues with the RBC where
there were reception packets with
unknown values
Hardware failures in the RBC
multiplexors
GSM radio interferences with
frequencies specic to railway operation
have the potential to impact critical voice
operation having serious impact during an
emergency scenario

Mixed trafc to optimise the trafc ow

Passenger and freight running on the
same line

Note: (-) indicates missing data in the column titled length; (F/B) indicates a Fallback system; (C/S) indicates Commercial Service; (P/S) indicates Planned Service; (L2/L1)
indicates ETCS Level 2 and Level 1. This table incorporates references Ministerio de Fomento (2010) and information from structured interviews.

ing the screen, or deciphering the icons, this will impact the drivers response, altering performance, increasing cognitive workload and pressure on the driver.
Structured interviews have also been carried out in the Netherlands and Switzerland, this aids identication and analysis of the
impact of ERTMS implementation on safety. The interviews were

designed to provide an insight into development and application

issues, infrastructure, rolling stock, technology and procedures.
Analysis of the responses from Lloyds Register Rails Safety experts in the Netherlands, who were closely involved with ERTMS
trials in the country, identied that the main issues experienced
relate to complexities between stakeholders and the countries in-

P. Smith et al. / Journal of Rail Transport Planning & Management 2 (2012) 7987

volved. However, these complexities were reduced through application of European standard EN50126 which facilitated in dealing
with roles and goals in complex projects, as it provided a coherent
process to establish reliability, availability, maintainability and
safety (Hajonides, 2011).
In the case of the Netherlands, the experience of ERTMS deployment on the AmsterdamUtrecht line shows alignment with the
Spanish experience, whereby laboratory testing took a key role in
facilitating deployment of ERTMS technology. General laboratory
tests carried out proved of particular importance because of high
trafc density and the ability to achieve instant feedback on the
progress of development (Zweers et al., 2011).
Although cross acceptance has been a problem for the Netherlands, due to delays in the specication of the National Safety
Authority procedures, specic safety aspects have implemented
European standards (EN50126 and EN50129) which aid the safety
approval process. These standards, EN50126 and EN50129, are
concerned with a systematic process for specifying requirements
for Reliability, Availability, Maintainability and Safety (RAMS),
and the evidence to be presented for the acceptance of safety
related systems respectively. Their application has assisted the
approval process as they are accepted and implemented across
European Member States and are used as a tool to formulate the
safety case structure.
From a procedural point of view, whilst working on the Betuwe
Line, complexity arose due to the number of stakeholders involved
in decision processes; this proved costly; the project cost was close
to tripling. It was concluded that for interoperability and deployment of ERTMS to be successful, Member States need to interface
willingly to enable faster implementation of systems and this
would require efcient national safety authorities and transparent
safety requirements.
In the case of Switzerland, the experience of the Swiss Federal
Railways (SBB) safety experts has been largely similar to that
experienced in the Netherlands. The factors that emerged as necessary for the successful deployment of ERTMS are:
 A cohesive working relationship between track and train
operators.
 Colleagues from different stakeholder companies should interact on a more informal basis.
 There should be increased focus on operational rules in addition
to technology.
However, not all of Switzerlands railway routes have been deployed with ERTMS, e.g. it is not deployed in the region of Grangesprs-Marnand near to which there was a fatal railway crash. This
area of Western Switzerland runs its railway system on the legacy
train protection system, Signum (De Vore and Swissinfo, 2013),
and this accident occurred as a result of trains travelling on the
same track at the same point in time. The failure in this instance
was caused by a train passing a signal at danger, which can be
attributed to driver error as brake activation was delayed. This error led to the train entering a single-track area; in this case the
ETCS would have avoided this as per its functionality described
in Section 3. This crash has garnered varying opinions, Von Adrian
identies that the cost would almost be double of that agreed for
investment to improve safety by the Swiss government. Meyer
on the other hand, stated risk in the train business will never be
reduced to zero (De Vore and Swissinfo, 2013). Both the recent
railway crashes in Spain and Switzerland have occurred on railways where there was legacy signalling; human error was a contributory factor in both cases. The application of ETCS may have
prevented both events, though as Meyers statement above notes,
it is impossible to reduce risk to nil.

85

Operation and installation of ERTMS has been shown to benet

from interoperability tests performed in laboratories. Testing on
new lines also proved an easier option than would be faced if
working on an existing line. The Swiss found problems with on
board train parameters; furthermore, braking curves were problematic, where the lines were too at leading to changes in braking
curve parameters. Again the usage of laboratory tests facilitated
the resolution of such issues.
Aside from the issues and solutions presented above, France has
also experienced operational issues, in particular, with the GSM-R
element of ERTMS which has a complex topology as detailed by
(Smith et al., 2013). France has experienced the impact on the
voice element of GSM-R suffering dropped calls. A dropped call
is an unexpected termination of a call, and has caused failure of
major severity (International Union of Railways, 2011) which
would have signicant impact if occurring during an emergency
call.
In addition to the cases presented above, a comparison study of
ERTMS ETCS deployment in four European countries is detailed in
Table 3. These four countries have been chosen for sampling from a
wider study that has been carried out as they can be construed to
be representative of the European environment.

5. Conclusion
This paper has presented examples of challenges faced by European countries that have deployed ERTMS and are moving toward
interoperable railway networks. A number of challenges have been
demonstrated, which include technical system integration, technical system failures and human factor considerations. Information
in the public domain, augmented by structured interviews, has
been used to compare and critically appraise the experiences of
the deployment of the ERTMS.
To enable an interoperable railway system, safety considerations must be made in relation to trackside, train, human interface
and procedural issues. Aspects of human interfacing are important
with respect to safety and have been discussed; with the main
focus on technology and procedural issues. In summary, this paper
has shown it is vital that technical and procedural issues are
addressed together, because of their close interdependence.
Current methods consider them in isolation (International Union
of Railways, 2011), largely due to different practices in countries
where Member States employ different philosophies, e.g. problems
experienced between France and Switzerland. The resolution of
this requires countries to aim to achieve goals together, between
infrastructure managers and train operators, with easy means for
direct contact. Core ndings applicable to a safety critical railway
system have been summarised and categorised below.

5.1. Requirements, specications and testing

The Netherlands have emphasised the benet of transparent
testing procedures. This would prevent clients from requesting
specic features which results in tailor made solutions. Transparency can reduce issues such as requirements creep which could
lead to solutions that are no longer suitable for an interoperable
railway and which may produce unexpected outputs following
system integration that could be of detriment to system safety.
Validating the safety of railway subsystems can be aided through
usage of testing laboratories, which has been widely encouraged
and increasingly used. Laboratory testing enables mitigation of
safety issues as there is potential to simulate a greater range of scenarios and environments. Such safety issues would otherwise be
found through testing on the track or during commercial service

86

P. Smith et al. / Journal of Rail Transport Planning & Management 2 (2012) 7987

operation, something which occurred during Spains commercial

exploitation.
5.2. Operational procedures
Expansion of ERTMS has been shown to be hampered by restrictive rules, for example, the requirement for individual applications
for line by line implementation of ERTMS as opposed to the faster
more convenient method of applying by country.
Non-consolidated requirements and operating rules are shown
to also be a major issue that affects the operability and deployment
of ERTMS technology. Issues such as this introduce risk into design
and processes, as there is movement away from structured and
veried methodologies. This will subsequently impact the safety
of railway processes put into place for the systems that comprise
the railway.
In order for processes and procedures to be successful in implementation across Europe, the various Member States need to improve working relationships, harmonisation and identify
organisational weaknesses in existing ways of working. That is to
say, at an organisational level, culture and behaviour towards factors that inuence safety need to be addressed so that the safety
processes which drive the railway are not negatively impacted.
Furthermore, interoperability enables interdependency between freight, conventional and high speed lines which are supported by a culmination of interoperability directives, technical
specications for interoperability and European specications.
5.3. Human factors
This paper has shown that a number of the issues as identied
in Table 3 can impact technical operation and safety. Some of
which, rooted in human factors have been identied through work
in the human factors domain.
As an example, thorough examination of human factor engineering with respect to the consequences of safety failure has been
carried out. It has found that data input is associated with a high
level of error, since it is a dull repetitive task that requires a high
level of concentration (Ministerio de Fomento, 2010). Furthermore,
the ergonomic change in utilisation of the driver machine interface
which requires entry of safety critical data at start up has raised
suggestions that this should be an automated process. To minimise
the likelihood of error in data entry it is suggested that safety critical data should be uploaded automatically, with the driver being
required only to check and accept system generated data (Porter,
2011). Human factor safety analysis thus needs to be integrated
and considered alongside technical safety issues.
5.4. Cost
ERTMS is a safety critical system with complex procedures and
technology, both of which are costly to implement. ETCS, the core
technological component of ERTMS has been shown to be more
costly at Level 1, as at this level, existing signalling equipment is
retained for its operation, which incurs additional maintenance
costs. This is seen as a signicant drawback. However, the transition to Level 2 is progressing and would mitigate such costs.
In Summary, this paper has shown that ERTMS deployment
across European railways has had many inuencing factors, ranging from specic national safety requirements which potentially
differ from one Member State to another to the number and
involvement of stakeholders. Safety and interoperability of the
new railway signalling system would benet from open engagement between stakeholders and suppliers. The use of testing facilities would greatly aid not only deployment of ERTMS but the
ability to test scenarios that could occur during passenger opera-

tion and thus mitigate known failure scenarios through efcient

laboratory testing. A key inuence on the safety of ERTMS ETCS
systems is the requirements and specications. These need to be
homogeneous and conclusive as changes in this arena will increase
the amount of rework and hamper the process of upgrading lines.
The various levels of ETCS are shown to have different inuencing
factors, Level 1 has limitations of aspect signalling which impacts
train frequency and restricts movement to block sections for safe
movement Level 2 ETCS avoids this by continual radio transmission, and continuous calculation of train speed and enhanced driver notication.
Overall, a number of issues have been identied that impact
deployment of ERTMS and in some cases work is already in progress to address these problems. The impacts of ERTMS implementation have been largely positive, due to the potential benets that
this technology can offer.

Appendix A
Fig. 1 System architecture depicting a legacy railway with
high level system interaction

References
Europa Summaries of EU Legislation, 2011. Interoperability of Trans European High
Speed Rail System. <http://europa.eu/legislation_summaries/internal_market/
single_market_for_goods/technical_harmonisation/l24095_en.htm> (accessed
28th July, 2011).
Hazards Forum, March 1995. Safety-Related Systems: Guidance for Engineers.
Tessdre, D., UIC, International Union of Railways, 2004. Safe Culture, A Method for
Assessing Organisational Safety at Interfaces. UIC/Communications
Department, Edition: JC Dan Partners. 06/2004.
Rail Safety and Standards Board, March 2003. Research Programme Engineering
Life Cycle Management of Data Used for the European Rail Trafc Management
System (accessed 12th October, 2011.
Glover, J., 1996. Londons Underground.
Hall, A.D., Fagan, R.E. Denition of a System. <http://www.isss.org/yearbook/1C%20Hall%20&%20Fagen.pdf>.
Johnson, C.W. What are Emergent Properties and How Do They Affect the
Engineering of Complex Systems? Department of Computing Science
University of Glasgow.
Knight, D.C., 2011. Protection for DC Substations an AC Track Feeder Stations. In:
REIS Conference (accessed June 2011).
Dalton, G., March 2009. Doubts remain over true ERTMS interoperability.
International
Railway
Journal.
<http://www.nxtbook.com/nxtbooks/sb/
irj0309/index.php?startid=19#/20>.
Siemens, 2011. Technical and Administrative Barriers for Rail Trafc. <http://www.
mobility.siemens.com/mobility/global/en/interurban-mobility/rail-solutions/
locomotives/vectron/boundlessness/technical-barriers/Pages/technical-barriers.
aspx> (accessed 28th July, 2011).
Unife, 2011. The European Rail Industry ERTMS Benets. <http://www.ertms.com/
ertms/ertms-benets.aspx> (accessed 28th July, 2011).
Barger, P., Schn, W., Bouali, M., January 2010. A Study of Railway ERTMS Safety
with Colored Petri Nets. Universit de Technologie de Compigne, France.
Frsig, P., June 2004. ERTMS/ETCS future train control, ERTMS/ETCS/GSM-R UIC,
Banestyrelsen DK, UIC ETCS and ERTMS Regional Project Manager. EURAIL,
FORUM.
ERTMS ETCS Level Images. <http://www.ertms.com>.
European Rail Transport, 2009. A Major Step towards a Harmonised Signalling
System,
EUROPA,
2009.
<http://europa.eu/rapid/press-release_IP-091167_lt.htm?locale=en>.
Railway Track and Structures, David Briginshaw. ERTMS struggles to nd its feet in
Europe. International Railway Journal. <http://www.railjournal.com/index.php/
europe/ertms-struggles-to-nd-its-feet-in-europe.html>.
Unife The European Rail Industry, 2011. ERTMS Factsheet No. 5. <http://
www.ertms.com/media/2434/fact-5.pdf>.
Iglesias, J., Arranz, A., Cambronero, M., et al., 2011. ERTMS deployment in Spain as a
real demonstration of interoperability. Near future challenges. In: 9th World
Conference on Railway, Research, May 2226 2011.
Porter, D., 2011. Implementing ERTMS in the UK: Human Factors Implications for
Train Drivers Human Factors Skill Leader AEA Technology Rail (accessed 12th
October, 2011).
Leppard, P. Introduction of ERTMS in the UK A View After Our First 12 Months.
<http://www.banekonference.dk/sites/default/les/ERTMS%20UK%202012.pdf>.
Shepherd, A., Marshall, E., 2005. Task Specication in Designing for Human
Factors in Railway Operations, Rail Human Factors Supporting the Integrated
Railway.

P. Smith et al. / Journal of Rail Transport Planning & Management 2 (2012) 7987
Hajonides, H., March 2011. Case of ETCS Retrot class 66 applying EN50126/
50129. Lloyds Register Rail Europe.
Zweers, M., Bronsema, F., Wulfse, M., 2011. Amsterdam Utrecht: ERTMS L2 as an
Overlay to Conventional Signalling, SIGNAL + DRAHT(103) 2/2011.
Smith, P., Kyriakidis, M., Majumdar, A., Ochieng, W., 2013. Impact of ERTMS on
Human Performance European Findings. <http://docs.trb.org/prp/130851.pdf>.
International Union of Railways, 2011. Interferences into GSM-R due to Public Radio
Networks.

87

Experiences in the Implementation of the ERTMS/ETCS System from National

Perspective, NSA Spain. Ministerio de Fomento. Annual Safety Conference, 27th
September 2010.
Euronews, 2013. Safety Ofcials Charged Over Train Crash in Spain, Article date 21/
08/13. <http://www.euronews.com/2013/08/21/safety-ofcials-charged-overtrain-crash-in-spain/>.
De Vore,V., Swissinfo.Ch, 2013. Media Singles Out Signals in Accident Aftermath,
Article date 31/07/13. <http://www.swissinfo.ch/eng/swiss_news/Media_singles_
out_signals_in_accident_aftermath.html?cid=36578870>.