Dr Tomas Magyla

AECOM

European Train Control System Over IP The Challenges

European Train Control System Over IP The Challenges

__________________________________________________________________________________________

Dr Tomas Magyla
PhD, MSc, BSc, Dipl. Eng, MIRSE, MRTSA, MIET, MAPM
AECOM
SUMMARY
The paper presents a different way of implementing ETCS Application Level 2 train control system
using Internet Protocol based data radio and communications backbone, whilst retaining the ETCS
language and principles, and the Euroradio protocol.
The paper addresses some of the challenges of implementing ETCS L2 over IP from design,
technical standards and a safety compliance viewpoint. Amongst the various technical challenges, the
paper discusses the adoption of a connection oriented Euroradio protocol in a connection-less media
environment.
The paper provides an insight into the latest ETCS standards development and where the ETCS
industry is moving in the IP networking context.
1. INTRODUCTION
The existing ERTMS / ETCS Application Level 2
schemes worldwide (including the first Level 2
Pilot Trial installation in Australia) use GSM-R1, a
proven and robust radio communications
technology that implements a circuit-switched
connection.
The GSM-R technology is based on
specifications that emerged in the 1990s. The
GSM-R technology, compared to todays packetswitched technology alternatives, provides what
could be considered a rather basic performance.
Whilst the large installed base of GSM-R
infrastructure worldwide, and a wide spectrum of
products and services available from the GSM-R
industry suggests GSM-R is here to stay [1],
there are opinions suggesting GSM-R is
expected to become obsolete in Europe by 2025
[2].

hubs. The limitations of circuit-switched scheme,

legacy transmission protocols and the difficulty of
integrating the existing ETCS schemes with
tomorrows all-IP railway infrastructure, suggests
that the happy ETCS and GSM-R journey is
2
approaching its end .
The evolution and availability of modern
telecommunications
technologies
and
standardised communications protocols today
represent alternative options. This paper looks at
alternative ways of implementing ETCS over IP,
and explores some of the technical challenges
that are awaiting.
2. NOTATION
AUC
ACL
BSC
BTS
CBI
DES
EIRENE

The absence of a dedicated frequency spectrum

outside Europe is a significant restriction in
applying ERTMS/ETCS for many railway
administrations. In Europe, poor spectral
efficiency combined with the limited European
GSM-R frequency spectrum allocation (4 MHz),
potentially leads to congestion in major traffic

EIR
ERTMS
ETCS
2

With a few exceptions e.g. Wuppertal suspension railway,

Kazakh Railways etc.

Authentication Centre
Access Control List
Base Station Controller
Base Transceiver Station
Computer Based Interlocking
Data Encryption Standard
European Integrated Railway
Radio Enhanced Network
Equipment Identity Register
European
Rail
Traffic
Management System
European
Train
Control

In January 2015 Finland announced plans to shift to TETRA

and seek for a derogation from the current rules making
GSM-R the only option in EC

Dr Tomas Magyla
AECOM

European Train Control System Over IP The Challenges

System
EURORADIO
GGSN
GSM-R
GPRS
HDLC
HLR
HP
IP
ISA
ISDN
KMAC
KSMAC
LTE
MAC
MORANE
MSC
MS
MTBF
OBU
QoS
RAMS
RBC
SGSN
STM
TCP
TDM
TETRA
TIU
T.70
UDP
UMTS
VLAN
VLR
VRF
X.224

Radio Transmission System

for ETCS
Gateway GPRS Support
Node
Global System Mobile Rail
General
Packet
Radio
Service
High-Level
Data
Link
Control protocol
Home Location Register
High Priority
Internet Protocol
Independent
Safety
Assessor
Integrated Services Digital
Network
Long Term Key
Session Key
Long Term Evolution
Message
Authentication
Code
Mobile Radio for Railway
Networks in Europe
Mobile Switching Centre
Mobile Station (on-board
radio subscriber unit)
Mean Time Between Failures
On-board Unit
Quality of Services
Reliability,
Availability,
Maintainability and Safety
Radio Block Centre
Servicing GPRS Support
Node
Specific
Transmission
Module
Transmission
Control
Protocol
Time Division Multiplexing
Terrestrial Trunked Radio
Trackside Interface Unit
ITU-T transport service
Network Layer in ETCS
User Datagram Protocol
Universal
Mobile
Telecommunications System
Virtual Local Area Network
Visitor Location Register
Virtual
Routing
and
Forwarding
ITU-T transport service
Transport Layer in ETCS

3. CURRENT PRACTICE
The existing ERTMS/ETCS Application Level 2
schemes are based on GSM-R as an ETCS
radio transmission media [3]. Eurobalises are
used as a spot transmission device, mainly for
location referencing. The RBC recognises each
ETCS controlled train by the identity of its leading
on-board equipment (NID_ENGINE), and is
3
engaged in a regular communication to
exchange ETCS variables and packets so as to
maintain a safe separation and speed of trains.

Fig.1 Typical components of ERTMS/ ETCS Level 2

scheme

A coherent set of ETCS variables, packets,

messages and telegrams are defined in ETCS
language [4]. System configuration in ETCS is
defined by assigning appropriate values to the
variables that are used by the different
components of the system and exchanged
between components as required (especially
between the trackside systems and the on-board
systems).
ETCS language provides means of exchanging
information over the radio, balise and loop
airgaps, and the STM interface.
Each ETCS transmission media type represents
a different case in terms of accessing and using
the media, and a different risk profile in terms of
safety related EN 50159 communications
network threats [5]. The radio transmission
media represents most complex scenario in this
respect, and is therefore the main focus of this
paper.

In a circuit-switched mode the channel is allocated

continuously, however the actual transmission event on the
channel is of discontinuous, sporadic burst character

Dr Tomas Magyla
AECOM

3.1 The Euroradio Protocol in the Safety

Context
In existing ERTMS/ ETCS Application Level 2
4
schemes the safety related functions (both
transmission and protection related) are carried
out by the safety related ETCS on-board
equipment (OBU), trackside equipment (RBC)
and the engineering process [6].
The existing schemes rely on the Euroradio
safety protocol in delivering this critical task.
The Euroradio implements a Safety Layer for
transmitting safety related information over a
non-trusted open transmission media. The
Euroradio Safety Connection provides protection
against the following communications threats [7]
that are characteristic to EN 50159 open
network:
Corruption;
Insertion;
Masquerade.
The protection is achieved by adding a safety
code MAC (Message Authentication Code not
to be confused with a Media Access Control
address) and a Safe Connection identifier
(source and destination identifier) to the ETCS
Application data.

European Train Control System Over IP The Challenges

The ETCS Application layer provides an

additional protection through implementation of
the native ETCS language features and
principles such as:
Adding a time stamp to each message
(e.g. T_TRAIN);
Verifying the length of the message (if
computed length is not equal to the
length given by the L_MESSAGE, the
entire message is rejected);
Authenticating through addition of the ID
of the parties involved in each message
(e.g. NID_ENGINE);
Message delivery acknowledgement
(e.g. M_ACK indicates whether the
message must be acknowledged).
The ETCS Application layer together with the
Euroradio protocol provide a comprehensive
protection against the generic communications
threats as defined in EN 50159. The question is
how adequate such protection is in an open
network environment.
A special case arises when the ETCS application
requires sending a High Priority (HP) message,
the mechanism of which does not involve setting
up the Euroradio Safe Connection. The
mechanism of sending HP messages with a
reduced thickness of the protection layer in the
legacy circuit-switched schemes was a normal
practice.
The application in a different environment (such
as IP based schemes) invites to be risk assessed
for the individual implementation circumstances.
3.2 Security Warrants Safety

Fig. 2 The layered structure of the Euroradio protocol

In existing schemes the underlying layers that

are part of the Euroradio protocol stack include
X.224 as the Transport Layer, the T.70 is the
Network Layer, HDLC is the Data Link layer.

The same would apply to Level 3 however detailed ETCS

Application Level 3 specifications are still under development.

The ability of the Euroradio protocol to safely

transmit movement authorities and other ETCS
data greatly relies on the security of the Message
Authentication Code. The MAC is derived by
using symmetrical cryptographic keys and a
block cipher algorithm to encrypt ETCS data [8].
The block cypher implemented in the existing
ETCS Application Level 2 schemes is the 3DES
(Data Encryption Standard) that was developed
in the early 1970s and uses three distinct 64 bit
keys. The algorithm takes the unencrypted data

Dr Tomas Magyla
AECOM

and applies three iterations of the DES

encryption, each time using a different key. The
algorithm is also used to derive the Session Keys
(KSMAC) from the Long Term Keys (KMAC).
The
KSMAC
authenticates
subsequent
messages in the sequence.
The algorithm represents a potential vulnerability,
in that the initial exchange of random values (that
are later used to derive the KSMAC) between the
OBU and RBC are unauthenticated. The nonauthenticating of the initial random values was
considered acceptable, assuming only the
authorised party with KMAC key will be able to
derive the KSMAC key for the session. However
if one party ever reuses the same random value
to generate KSMAC (theoretically possible over a
longer period of time), it is possible for an
attacker to replay any message in the session,
assuming they have acquired a large enough
sample of transmitted data. It would also allow
them to send specific commands and illegal
movement authorities.
This may potentially lead to a train stop, collision
or derailment, as the transmitted illegal data
would be accepted as genuine [9].
The existing 3DES based MAC application in IP
environment may be seen as requiring special
consideration to address the vulnerabilities
(perceived or real) arising from the individual
network implementation scenario and key
management process.
3.3 Circuit-Switched Versus Packet-Switched
In circuit-switched mode a dedicated connection
is allocated for each train for the duration of the
communications session (for the entire duration
of the journey) regardless of the actual amount of
transmitted data [1]. This is how most of the
existing ETCS schemes are implemented.
With a packet-switched scheme multiple users
(train OBUs) can be sharing a common radio
resource.
The nature of ETCS data transmission over radio
media is of sporadic, burst character. The size of
the message varies from as small as 32 bytes
(e.g. user data for Train to RBC Location reports)

European Train Control System Over IP The Challenges

to a few hundreds of bytes for other ETCS

messages.

Fig. 3 Packet-switched scheme multiple MS sharing

the same channel

The periodicity of the ETCS messages

transmission is low, in the region of every 20
seconds for the downlink and 6 seconds for the
uplink.
The sporadic, discontinuous transmission of
ETCS messages suggest the current circuitswitched scheme is not well suited for this
application, the radio resource is wasted due to
non-optimal bandwidth utilisation.
4. ALTERNATIVES
Given the limitations that the current circuitswitched scheme, and the ageing radio
technology represent, an option of migrating to
alternative packet-switched schemes that allow
retention of the existing ETCS language and
principles, is worth considering. Some of the
alternatives would also benefit from advantages
offered by modern communication technologies.
4.1 The Obvious Alternative - GPRS
GPRS provides an obvious opportunity for the
existing GSM-R based ETCS schemes to utilise
the existing GSM infrastructure and make an
efficient use of the existing network resource
[10].
GPRS uses a shared resource among multiple
active users due to the use of a packet oriented
transmission mechanism.

Dr Tomas Magyla
AECOM

In a typical GPRS scheme the SGSN (Serving

GPRS Support Node) is responsible for the
delivery of data packets from and to the OBU. Its
tasks include packet routing and transfer,
mobility management, logical link management
and authentication. The GGSN (Gateway GPRS
Support Node) acts as an interface to the RBC.

European Train Control System Over IP The Challenges

generation CBIs that do not natively support an

IP communications platform. Serial data is
encapsulated by preserving its contents and
structure, and using TCP/ IP as a transport. The
Physical layer of such solution is transparent
from the Application Layer perspective, and can
be anything transmission over fibre, copper,
radio or an optical spectrum.
A similar principle can be utilised in
encapsulating
Euroradio
protocol
for
transmission over TCP/IP. This preserves the
ETCS language based Application Layer, and
the existing ETCS principles are retained
unchanged.

Fig. 4 Typical GPRS scheme

Whilst GPRS is proven in telco cellular

applications, ETCS over GPRS is currently
undergoing trials in Europe. The key technical
challenges include Euroradio protocol stack
adaptation/ replacement with an equivalent one
based on IP, translation of the E.164
identification scheme to IP addressing, QoS
aspect, just to mention a few.
The GPRS option may be seen as attractive in
existing ETCS Application Level 2 schemes as it
addresses some of the limitations of a circuitswitched scheme and virtually extends the life of
the existing GSM-R asset. In a bigger picture
though it does not seem to offer a future proven
solution.
4.2 Euroradio Encapsulation Over IP Option
The reader may be familiar with a principle of
encapsulating serial signalling interlocking data
for transmission over IP media. This is common
in the signalling schemes implementing an older

Fig. 5. Euroradio protocol encapsulation. Header etc.

detail omitted for clarity.

The Euroradio protocol is well suited for

encapsulation over IP as it adds the MAC,
identifiers and its header after a complete ETCS
message is assembled.
However, the Euroradio protocol is connection
oriented and thus is not well suited for use in
connection-less media such as IP. Therefore an
external mechanism an Adaptation Layer in
this example is required to replace the
standard GSM-R call establishment procedure,

Dr Tomas Magyla
AECOM

to ensure that the correct end subscribers are

connected for the Euroradio protocol to convey
ETCS packets over IP media. The Data Transfer
state of the call establishment procedure
establishes the Euroradio Safety Connection,
and then transfers the Euroradio application data
between the connection subscribers.
The Euroradio protocol on its own does not
provide a complete protection from EN50159
communications threats characteristic to an open
network (ref. Section 3.1). The network layers
above and below the Euroradio layer need to
provide an additional protection against Delay,
Re-Sequencing, Deletion and Repetition threats.
The ETCS language mandates a principle for the
Variables Definitions to be independent of the
transport media over which they are used. ETCS
language mandates the Packet Definition does
not change when transmitted over a different
transmission media. The ETCS Application is
structured in a way that ensures the behaviour of
the receiver does not depend on the sequence of
the Packets delivered by the message. These
principles make the Euroradio encapsulation
over IP feasible.
In the existing ETCS schemes the end user (i.e.
OBU, RBC, TIU) is identified by its E.164 ISDN
identity number (a telephone number, in other
words). In an ETCS over IP option the E.164
identity number becomes irrelevant, as each
subscriber (a train, a RBC, a TIU) can be
identified by its IP address. Balise telegrams can
provide an IP address of the RBC for the OBU to
connect to. Disregarding the underlying
transmission technology/ method, the ETCS
language readily provides multiple additional
means of identifying a subscriber through the use
of its ETCS identity NID_ENGINE, train describer
NID_OPERATIONAL, or a radio subscriber
NID_RADIO at the Application Layer.
In Fig. 5 the IP data radio will provide a
transparent data pipe between the wayside
(RBC or TIU) and the onboard (OBU) part of the
signalling system. The UDP (User Datagram
Protocol) can be used as Transport Protocol.
UDP is generally preferred over TCP due to a
lower overhead and theoretically better timing

European Train Control System Over IP The Challenges

performance. However, UDP datagrams may

arrive out of order, come duplicated or
completely disappear, but, given that this is all
taken care by the ETCS Application Layer and
the other network layers, this UDP limitation is
not of concern. There are many examples of
signalling application using UDP for vital
signalling data communications, in conjunction
with other layers adding additional identifiers,
event counters and sequence numbers to
overcome this limitation.
Limitations of the proposed method
Retaining the original Euroradio stack with the
cumbersome underlying X.224, T.70 and HDLC
structure means additional tuning of these layers
is required for optimal performance and delivery
of ETCS QoS.
Performance may be limited by the legacy
protocol error handling capability (or the lack of
it), e.g. HDLC.
The legacy MAC authentication scheme is
retained and potentially represents a security
exposure in IP environment. Depending on the
individual network implementation this may need
additional consideration.
The new scheme will still be disadvantaged by a
poor Euroradio Safety Connection time
performance (circa 27 seconds, as it takes time
to apply 3 rounds of encoding).
The benefits & opportunities
Depending on the implementation there is no
change to the vital ETCS Application component.
Depending on the application country this
simplifies or negates additional work on the
Safety Case and the ISA assessment.
The existing ETCS Application, and its principles
are retained.
The approach is not of intrusive nature and
therefore may be well suited for converting
existing schemes, or being implemented in new
schemes.

Dr Tomas Magyla
AECOM

This approach allows an easy integration with

any existing or future IP based infrastructure.
The scheme can be migrated to about any IP
based bearer technology, e.g. radio (or even
optical spectrum) subject to the selected
technology meeting the intended capacity and
coverage expectations.
If operational necessity dictates, this solution can
be implemented as a combination of different IP
radio platforms, and this may be completely
invisible from the ETCS application point of view
as long as ETCS QoS is delivered. For example,
it may be more economical to have TETRA in the
low traffic density areas as this represents a
significant CAPEX reduction due to a greater RF
coverage to base station rate (assuming
implementation in Australian four hundred
megahertz frequency band), complemented with
LTE in major interchanges, or Wi-Fi in the
underground tunnels areas.
4.3 Additional Safety Measures
In the above approach the overall solution needs
to implement additional safety measures in
conjunction with those measures already built
into the Euroradio protocol and the ETCS
application, to provide comprehensive protection
against the open networks communications
threats (ref. [5]). The Adaptation Layer seems to
be a logical place for accommodating this.
In this regard there are some good safety
engineering examples that modern CBIs and
communications based axle counter applications
implement that can be relevant for this
application. Some examples could include:
Adding a Sequence number provides
protection from a Re-sequencing threat;
Adding an Event Counter provides
protection against data obsolescence;
Adding a Time Stamp provides
protection against data obsolescence
and re-sequencing;
Adding clear identification of messages
and its references provides protection
against repetition.

European Train Control System Over IP The Challenges

4.4 Other Alternatives

The Euroradio encapsulation approach described
above could be taken one step further by
completely removing the legacy layers X.224,
T.70 and HDLC and replacing with an IP oriented
transport model. The legacy Euroradio Transport
Layer X.224 is completely replaced with
connection oriented TCP. The Network Layer
T.70 is replaced with a connection-less IP
protocol. The Adaptation Layer in this option is
still required and provides a similar function to
the previous option.
This approach is similar to the new RBC-to-RBC
communication over IP concept, just recently
embedded in the new ETCS Subset 098
Specification.
Domain Name Service can be introduced to
resolve the ETCS identities into a routable IP
address through the use of lookup table or a
direct translation method.
It is worth noting that a number of RBC products
already exist from the major signalling suppliers
with native Ethernet/ IP communication interface.
Until the recent times these were mainly used in
conjunction with ISDN gateways to provide a
backwards
compatible
interface
to
IFIX
specifications.
The TCP/IP model features, such as port QoS
class assignment [11] can be implemented to
assist achieving an end-to-end QoS.
This alternative is free from the limitations of the
previous option, due to removal of the X.224,
T.70 and HDLC, however appears to be a more
intrusive approach that may be seen as
detracting from a standard approach and
therefore may be better suited for implementing
in new ETCS schemes.
Obviously there is no single best alternative that
suits all the intended applications and individual
scenarios. Other alternatives exist that may be
better suited for a particular scheme. Such
examples include modifying the Euroradio Safety
Protocol for the IP environment, or implementing
an IP bearer solution (e.g. LTE) that simulates a

Dr Tomas Magyla
AECOM

switched-circuit scheme etc. but that is a subject

of a separate discussion, to be covered
elsewhere.
5. THE IMPORTANCE OF QoS
In the ETCS application context QoS is of
paramount importance as some of the
communication threats detection and defence
techniques rely on an end-to-end deterministic
QoS.
Short connection disturbances and transmission
errors may be completely invisible to the ETCS
application as the underlying transport layers will
deal with it until a larger outage triggers a new
connection re-establishment. The system
response (i.e. Movement Authority suspension,
etc.) is subject to ETCS application design.
6. A CLOSED OR AN OPEN NETWORK
A question arises - what is required a Closed or
Open transmission network (in terms of
EN50159) for implementing ETCS over IP when
using the earlier described encapsulation
approach.
The radio media is commonly considered as an
Open transmission media. Therefore for
ensuring the security threats have been
adequately addressed within the radio segment
of the overall scheme, the ETCS Application
layer, together with the Euroradio Safety Layer,
the Adaptation Layer and the underlying layers of
communication protocols must provide adequate
measures to mitigate EN 50159 threats typical
for an open network. In case of the earlier
discussed
Encapsulation approach,
such
protection extends end-to-end from the OBU
across the radio domain, and the backhaul
network that interconnects the various radio
system components, and any fixed networks that
interconnect the radio core node with the RBC.
This negates a requirement for implementing a
closed topology fixed communications network.
There are other factors that may influence
decision to implement a closed type of
communications network. If the same network is
to be used to interconnect other safety critical
components such as CBIs, axle counters etc. the
ISA safety certification/ type approval constraints

European Train Control System Over IP The Challenges

for a particular signalling product may require a

closed network environment.
It is interesting to observe the changing trend
towards most of the new CBI and axle counter
products implementing an adequate protection
from communications threats that allows
implementing them in an open network
environment.
7. IS
COMPLIANCE
TO
EN50159
SUFFICIENT TO GUARANTEE THE
SAFETY?
The EN 50159 has become part of our daily
vocabulary. ISA assessments, product type
approvals quote EN 50159 compliance. The
current pace of technological evolution, the
opportunities and challenges it represents is
becoming difficult to follow. Hence the curious
human nature presents surprises that are difficult
to account for, even if compliance with EN 50159
is followed.
Recently numerous issues were discovered with
a modern computer based interlocking during
network testing using rapid ping and port probe.
If the CBI had its Vital or Non-Vital ports probed
via a tool such as NMAP, any probe on its ports
caused the CBI to become unresponsive. The
CBI would only become responsive after a cold
restart. If the CBI was the end-host of a rapid
ping, the ping caused the CBI to lock up and
drop traffic for seconds. This influenced the
decision to place ACLs on the edge VLANs and
not just rely on the firewall and VRF separation.
As new interlocking products are introduced into
the signalling market, we see more and more
generic
hardware
processing
platforms.
Depending on the application that the hardware
is loaded with, the processing platform may
become an OBU, a CBI or an RBC. Given the
generic nature of the hardware platform, multiple
same family products may potentially be exposed
to the same vulnerability.
The fringes of the VLANs, especially any 3rd
party interface, such as a shared infrastructure
use, or a maintenance access security aspect
needs to be carefully considered in network
design.

Dr Tomas Magyla
AECOM

8. ONE, TWO OR MORE DATA RADIOS?

Implementing ETCS over IP introduces multiple
alternative radio technology options to choose
from.
A question arises - how many data radios for
ETCS? There are different schools of thought on
this subject. Some of the criteria that assist with
decision include:
The seamless RBC handover / network
handover aspect;
The RAMS aspect;
The data traffic load sharing aspect;
The RF interference aspect;
The available roof space aspect.
The RBC handover aspect
ERTMS/ETCS Baseline 3 supports one or two
simultaneous OBU to RBC communications
sessions. In Application Level 2 and 3 a single
communications session is sufficient for a train
handover from one RBC to another. However in
a single session option the preparation of the
Accepting RBC for taking over the train
supervision is not possible until such a point in
time when the on-board unit disconnects from
the Handing Over RBC, and establishes a new
session with the Accepting RBC, validates the
version etc. The Application Level 2 performance
may be penalised in a single communications
session option.

European Train Control System Over IP The Challenges

The voice/data mode aspect also needs to be

taken into account. The same MS unit typically
can be switched from Voice to Data (assuming
voice and data related I/Os are available on the
same unit), thus providing a fall-back option for
one
or
another
mode
(Switzerland
implementation).
The load sharing aspect
The scenario of two on-board data radios sharing
the load introduces an additional degree of
resiliency over the open communications media
assuming two I FIX1_IP and IFIX2_IP interfaces at the
RBC end are introduced, and this option provides
a fall-back scenario in event of one of the
interfaces failing (Kazakhstan implementation).
The RF interference aspect
Any additional data radio has a potential to
become an out-of-band or in-band interferer for
any existing radio services. The higher the MS
emitted EIRP power, the smaller the separation
from the Uplink to the Downlink frequency
spectrum, the lower the frequency band of
operation, the more difficult it is to maintain a
sufficient separation distance between the
various services antennas so as to achieve
sufficient port to port isolation to reduce the risk
of interference.

In ETCS Application Level 3 performance will be

penalised as the train will no longer be able to
transmit position reports from the moment of
disconnecting from the Handing Over RBC to the
Accepting RBC.
The RAMS aspect
The ability to use the second data radio as a fallback represents a parallel redundant instance in
the Reliability Block Diagram that increases the
overall Operational Availability performance of
the on-board system. However the MTBF of a
single radio may well be sufficient to achieve the
mandated ETCS Availability target.

Fig. 6. Antenna port to port isolation testing for GSM-R

Dr Tomas Magyla
AECOM

Is there enough space on the roof to provide

enough separation, without exceeding the
antenna feeder system attenuation limit target?
The actual receiver blocking performance is of
equal importance, and will be substantially
different for a different technology solution. For
example, the acceptable interferer for GSM-R
ranges from -25 to -13 dBm, UMTS and TETRA
are ranging from -52 dBm to -40 dBm, and LTE
ranges from -52 dBm to -43 dBm [1].
Considering the Australian 1.8 GHz frequency
band, the RF interference issue in Australia is
somewhat easier to mitigate due to a rather wide
separation between the Uplink and the Downlink
(75 MHz) the potential interferer becomes an
out of band interferer, outside the RX band pass
filter. Additionally, lower EIRP levels (compared
to Europe) are mandated in Australia. On the
other hand the wayside installations on this
frequency band are penalised due to a relatively
poor RF coverage to base station rate (typically
6.5 km in city).
The available roof space aspect
Often the available roof space is insufficient for
all on-train voice, ATP data, condition based
monitoring etc. radio needs. Establishing the
actual port to port isolation for all combinations of
train roof co-located antennas is the starting
point in determining the minimum antenna
separation requirement. The actual worst case
port to port isolation figure can then be replicated
in controlled environment to determine the actual
receiver blocking performance for the particular
radio transceiver make and model or to validate
compliance against the generic receiver blocking
performance parameters.

European Train Control System Over IP The Challenges

9. FURTHER OPPORTUNITIES
The migration to an IP based scheme represents
an opportunity of selecting any digital radio
transmission technology that implements a
compatible IP interface. The vast diversity of
implementation environments and differing
railway needs does not justify committing to a
single data radio transmission technology option.
An ETCS over IP implementation allows
combining a number of digital radio technologies,
thus the end user railway - benefiting from
selectively utilising the best features the relevant
technology can offer.
10. TRENDS
6

The ERTMS/ETCS Baseline 3 specifications

already recognise packet-switched services
option, with further significant work currently
under way in amending the Euroradio FFFIS and
other specifications, to allow ETCS data
transmission over a packet-switched technology,
such as GPRS, while maintaining the current
ETCS capabilities.
The EDOR, ETCS Data Only Radio has been
recognised.
A number of European Commission, European
Rail Agency, Trans-European Transport Network
Executive Agency incentives and projects are
currently proceeding at full steam, aimed at
undertaking further testing and validation
program to harmonize the usage of packetswitched services (GPRS based) [12, 13].
In 2013 UNIFE launched a New Generation
Train Control project [14] that focus research
activities on IP-based radio communication in
preparing the ground for the future research and
demonstration activities planned to be carried out
by the SHIFTRAIL, the first major rail research
initiative at European level.
Outside Europe, the effort is focused at migrating
towards ETCS over IP through the use of
alternative data radio technologies such as LTE
and TETRA.

Fig. 7. Five antennas co-located in close proximity.

6

At the time of preparing this paper - only some of them e.g.

Subset 098.

10

Dr Tomas Magyla
AECOM

European Train Control System Over IP The Challenges

11. CONCLUSION
Migration to ETCS over an IP scheme takes us
closer to the ultimate, an all-IP integrated
infrastructure milestone.
This facilitates implementing a Services Oriented
Architecture that allows different software
modules to be implemented as interoperable
services connected over the network.
Shifting the processing and communications
tasks from hardware to software seems to be the
right direction. What is beyond doubt is that
radio is the only logical technology for future train
control applications and that an international
approach is needed to ensure future spectrum
availability and commonality of technical
specifications[15].
12. ACKNOWLEDGEMENTS
The author wishes to acknowledge the
contribution of Mr Edward Hawes (KOORA Pty
Ltd Technical Director).
13. REFERENCES
[1] ETSI TR 103 134 V1.1.1, 2013-03
[2] European Railway Review, Vol. 21, Issue 1,
2015
[3] MORANE Radio Transmission FFFIS for
Euroradio, A11T600112
[4] ERTMS/ ETCS SRS, Subset 026

11

[5] EN 50129 Railway applications Communication, signalling and processing

systems - Safety related electronic systems for
signalling
[6] ERTMS/ ETCS Failure Modes and Effects
Analysis for Transmission System in Application
Level 2, Subset 081-2
[7] ERTMS/ ETCS RBC-RBC Safe Communication
Interface, Subset 098
[8] ERTMS/ ETCS Off-line Key Management FIS,
Subset 038
[9] KPMG IT Advisory Amstelveen, April 2013.
KMS WG IT Security Threat identification, Risk
Analysis and Recommendations.
[10] ERTMS/GSM-R Operators Group, 11 April
2013. GSM-R Packet-switched Domain
Engineering Recommendations for EURORADIO
transport.
[11] ITU-T Y.1541 Internet protocol aspects
Quality of service and network performance
[12] ETCS over GPRS
- EUROPEAN
COMMISSION DECISION C(2012) 6939
[13] Interoperability of the rail system. Directive
2008/57/EC of the European Parliament and of
the Council 17 June 2008
[14] http://www.ngtc.eu/objectives
[15] http://www.railengineer.uk/2012/05/24/
report-on- railtel-europe-2012