Train Protection

By Dr. P. Connor and Prof. F. Schmid


Railway signalling is the basic safety system controlling the movements of trains. It is the safety critical part of the train control function of the railway. Once instructed by a signaller or an automatic system, it is responsible for setting up non-conflicting and safe routes for trains, for defining (safe) limits of movement and for transmitting instructions or commands to train drivers. 

There are two principal parts to a train protection system, train detection (knowing where the train is) and movement authority (telling the train how far it can go). The train protection system uses these two parts to safeguard a train's operation.


Traditionally, signalling systems in Britain and in many other countries have relied on the train drivers reacting to indications displayed to them by line-side semaphore or colour light signals and controlling the train’s speed in line with the instructions. During the 150 years of the use of railway signalling, drivers’ failures to respond to commands transmitted by signal aspects of any type can and have led to a number of accidents, some causing very large numbers of fatalities. In response to the continuing need to reduce risks created by train drivers failing to respond to signal instructions, various forms of driver warning devices and signal command enforcement systems have been developed. These have become known as Train Protection Systems. Those systems that continuously monitor actual train speed and enforce adherence to a commanded speed pattern are referred to as Automatic Train Protection (ATP) systems.

More Resources

Track Circuits

CBTC Explanation

Indusi - the German system

Types of Train Protection Systems

All types of train protection systems are based on the desire to reduce or eliminate the possibility of driver error resulting in a train movement related accident by failing to obey a visually displayed line-side or in-cab signal instruction. The development of train protection on main line railways began with the introduction of warning systems and subsequently progressed to enforcement of the instructions issued by these systems.

Originally, the warning systems alerted the driver that he or she was approaching an adverse or restrictive line-side signal aspect and required him or her to acknowledge the warning. Otherwise the systems would initiate a brake application after a short delay. Later developments by national railway administrations included various levels of speed limitation and enforcement. Also, some systems were expanded to cater for speed limits for permanent or temporary speed restrictions. Technologies adopted for such warning and train stop systems include combinations of permanent magnets and electromagnets, inductive polarity-changing responders, coded beacons and simply coded track circuits.

More recently, fully Automatic Train Protection (ATP) systems have been developed to enforce speed limits and movement authorities at the full range of restrictive signals, with and without line-side signals and including permanent and temporary line speed limits. Driving is still manual but speed limits are always enforced. Degraded modes though invariably include low speed driving on sight.

Two-Channel Safety Systems

Many older train protection systems are designed to rely on the statistical nature of driver and equipment failure. By designing the systems appropriately, it may safely be assumed that driver error and equipment failure will not occur simultaneously. A key characteristic of such systems is that the driver does not receive an indication of whether the train protection system is operating or not and is therefore encouraged to drive taking full responsibility for the movement of the train. The technical subsystem will only intervene if the driver attempts to pass a signal or to drive too fast. TPWS, train stop and Indusi are typical examples of this type of arrangement.

Types of Balise

Passive Balise: Track based transponder that is ‘woken up’ by a low frequency signal and receives its energy from a passing train and then sends packets of information to the train.

Active Balise: Track based transponder that is powered from the signalling supply and that continuously sends packets of information to passing trains.

Passive and active balises can transmit either fixed or variable information or both. Many railways prefer to use balises powered-up by the passing trains. Simple location information is almost invariably transmitted by means of passive balises.

Automatic Train Protection Systems

There are broadly two implementations of ATP systems – intermittent and continuous. Intermittent systems use electronic beacons (inductive or radio frequency) or short electrical loops positioned within the four-foot. These types of short-range devices are often referred to as "balises" (from the French word for ‘marker’). See Beacon Transmission for more information.  The continuous systems use a permanently active data transmission and monitoring system, either through electrical inductive coupling by means of track loops or coded track circuits or by means of radio transmission of limit of movement authorities.

Fully operational ATP systems were first introduced on metros in the late 1960s and are now common on such systems all over the world. Most metro applications use continuous systems in conjunction with automatic train operation. ATP was also introduced to the Japanese Shinkansen high speed route in 1964 and has since been introduced in various forms on a number of main line railways, often in conjunction with high speed train operation.


The basic defining principle of ATP is that train speed is monitored against the current permitted speed limit. The speed may be limited by line profile or signal indication, that is, the need to protect routes of other trains and track related constraints. If the allowable speed is exceeded, a brake application is invoked until the speed is brought within the required limit or the train is stopped.

Most ATP systems are based on conventional block signalling although these can be very short. Each block is described by a fixed dataset related to its location, length, gradient(s) and maximum (civil) speed limit(s). Each block will also have a variable data set derived from the signal aspects ahead and their effect on the resulting speed limit(s) for that block and the next block(s).


The speed limit on the approach to a restrictive signal forms a gradually reducing curve that follows the braking profile required to reach the target speed at the signal. If the signal shows a stop aspect, the target speed will be zero. The on-board monitoring equipment will continuously compare the train speed with the curve required to achieve the target speed and will initiate a warning – usually both audio and visual. If action is not taken, the system will cause a brake application.

Siemens Eurobalise

Figure 1: Photo of a track mounted balise and the train mounted data reader. The balise may be passive or active. Passive balises provide fixed data such as train location updates or permanent speed limits. Active balises provide variable data concerning signal aspects and the associated limit of movement authority. Photo: Siemens.

In some implementations, a braking curve infringement calls for a full service brake initiation, in others for emergency brake. There are also differences in the brake release function. Some systems allow the driver to release the brake once the train speed has returned within the prescribed curve. In others, the brake command is irrevocable and the train must be brought to a stand before the driver can release the brake. There are also railway undertaking specific rules about the consequences when the ATP system has intervened.

Train Data

On the train, data comprising train weight, length, braking capability and maximum technically permitted speed are necessary to ensure compliance with speed limits set by the ATP system. Usually, the train consist data must be input by the driver before the trains starts its journey. Ways of validating this may be considered necessary.


In most cases, the performance of the equipment is monitored and recorded for further analysis in case of infringements or failures of the system. These systems are variously known as On Train Monitoring Systems (OTMS), On Train Data Recorders (OTDRs) or On Train Monitoring Recorders (OTMRs). They are the equivalent of the aircraft industry’s ‘black box’.

Drawbacks of Intermittent Systems

Continuous ATP systems allow constant data updates to be transmitted to trains so that the train driver can respond to changes in signal aspects as soon as they occur. Intermittent systems can only transmit changes in signal aspects when the train passes over a beacon or loop. This can restrict line capacity if a driver is unable to respond to a signal clearance, even though he or she can see the change of aspect, until the train’s on-board ATP computer has received a message from the balise located at the relevant signal.

In order to overcome this problem, infill loops or balises are provided at some signals (e.g., in 65% of the locations on the UK GWML system) to provide drivers with an update of a signal aspect and to allow brake release if a less restrictive aspect is shown.

Automatic Warning System (AWS)

Following a Signal Passed at Danger (SPAD) accident in poor visibility at Harrow and Wealdstone in 1952 when 112 persons were killed, British Railways decided to deploy their Automatic Warning System (AWS) over the whole network to provide train drivers with an in-cab warning of the indication of the next signal (Figure 2). This was a non-contact version of a system originally used on the Great Western Railway. Following a long development and approval programme, widespread installation started in 1956. This system is still in use today.

Figure 2: Schematic showing arrangement of AWS Ramp on the approach to a signal. When a train passes over the ramp, an indication of the signal aspect is provided in the driver’s cab. In the case of a caution or stop aspect, the system will enforce an application of the brakes unles the indication is acknowledged by the driver. Diagram Author.

The system took the form of a track mounted, non-contact inductor, which became known as the AWS “ amp", placed about 185 metres (200 yards) on the approach side of the signal (Figure 2).

The AWS ramp is placed between the rails so that a detector on the train will pass over it and receive a signal.  The ramp will thus warn the driver of the status of the signal.  The French railways use a similar system called "the Crocodile", the Germans, the "Indusi".

Figure 3: Photo showing position of AWS Ramp in the track on the approach to a signal.

The AWS ramp contains a pair of magnets, the first permanent, the second an electro-magnet linked to the signal to provide an indication of the aspect.  The ramp is placed between the rails so that a detector on the train can receive the indication data.  The more observant passenger on a station platform can often see the ramps between the rails.  They are usually a dirty yellow.

In operation, the train first passes over the permanent magnet and the on-board receiver sets up a trigger for a brake application.  Next it passes over the electro-magnet.  If the signal is green the electro-magnet is energised, the brake trigger is disarmed, a chime or bell rings in the driver’s cab and a black indicator disc is displayed. The driver takes no action.  If the signal is yellow or red, as shown in Figure 2, the electro-magnet is de-energised, so a siren sounds in the cab and the disc becomes black and yellow.  The driver must "cancel" the warning, otherwise the automatic application of the train brakes is triggered. 

The use of AWS was extended to protect certain permanent speed restrictions after an accident at Morpeth in 1969, which was caused by a driver failing to reduce the train speed for a speed restriction. AWS was installed at speed restriction locations where the train approach speed is over 60 mph or the reduction in speed required is more than one third of the approach speed. This is mandated in a railway group standard.

After an accident at Nuneaton in 1975, the use of AWS was extended further to include temporary speed restrictions. It is now also used for emergency speed restrictions.

Although AWS has been partially effective in reducing train movement accidents, it has not eliminated SPAD or over-speed errors entirely. By design, it is only intended to provide an alert and a reminder of a restrictive signal aspect or speed restriction. As long as the alert is acknowledged, the driver may continue to drive the train at any speed. A number of accidents occurred where drivers forgot the restrictive aspect warning – despite the visual reminder in the shape of the so-called ‘sunflower’ device.

AWS may be considered to a limited extent as a fail-to-safety system since the main trigger element is a permanent magnet. Failure of the electro magnet results in a warning indication to the driver. However, removal of the permanent magnet from the track is not detected.

Driver’s Reminder Appliance (DRA)

The Driver’s Reminder Appliance (DRA) was introduced from 1998 to assist with the prevention of SPADs, particularly at station starting signals. It is not really a train protection device in the narrow sense of the terminology. The DRA device consists of a push button in the driver’s cab. The driver is required to operate this whenever the train is detained at a red signal. The button disables traction and prevents the driver from restarting the train until he has reset the button. The primary purpose is to prevent trains starting against a red signal when inadvertently given the "right away" by a conductor or station staff. The effectiveness of this system is a matter of debate because its operation may become ‘automated’ as part of the train starting sequence.

Train Protection and Warning System (TPWS)

To overcome the limitations of AWS, an enforcement system was developed for the British railway system, known as TPWS (Train Protection and Warning System). This is designed to enforce observance of restricted speed requirements and signal stops by imposing a full brake application when over-speed is detected or when a train is being driven past a stop signal. TPWS was first tried on a section of the Thameslink route in 1996 and was then installed across most of the UK network between March 2000 and December 2003.

Figure 4: Schematic of TPWS setup on the approach to a stop signal. The Arming Loop switches on a timer and the Trigger Loop assesses the time elapsed to determine the speed of the train. If the time is too short, showing the speed is too high, the trigger will activate the train brakes. Diagram: Author.

The idea behind TPWS is that, if a train approaches a stop signal showing a danger aspect at too high a speed to enable it to stop at the signal, it will be forced to stop, regardless of any action (or inaction) by the driver. The equipment is arranged as shown in Figure 4.

For each signal equipped with TPWS, two pairs of electronic loops are placed between the rails, one pair at the signal itself, the other pair some 200 to 450 metres on the approach side of the signal. Each pair consists of, first an arming loop and secondly, a trigger loop. The loops are activated if the signal is showing a stop aspect. 

The pair of approach loops first met by the train at 400 to 200 metres before the signal, are set between 4 and 36 metres apart. When the train passes over the arming loop, an on-board timer is switched on to detect the elapsed time while the train passes the distance between the arming loop and the trigger loop. This time period provides a speed test. If the test indicates the train is travelling too fast, a full brake application will be initiated. In case the train passes the speed test successfully at the first pair of loops but then fails to stop at the signal, the second set of loops at the signal will cause a brake application.  In this case, both loops are together (see Figure 5) so that, if a train passes over them, the time elapsed will be so short that the brake application will be initiated at any speed.

What TPWS Does

TPWS has certain features which allow it to provide an additional level of safety over the existing AWS system but it has certain limitations and does not provide the absolute safety of a full Automatic Train Protection (ATP) system.  What TPWS does is reduce the speed at which a train approaches a stop signal if the driver fails to get the speed of the train under control to allow him to stop at the signal.  If the approach speed is too fast, TPWS will apply a full brake but the train may still overrun the signal.  Fortunately, since the train is already braking and there is usually a "cushion" of  200 yards (183 metres) between the signal and the block it is protecting, there will be a much reduced risk of damage (human and propertywise) if the train hits anything.  With a possible total distance of 2000 feet (about 600 m) between the brake initiation and the block entrance, trains "hitting" the first loops at up to 120 km/h (75mph) could be stopped safely. 

Figure 5: A pair of TPWS grids on the approach to a stop signal at a station platform. The AWS ramp for the same signal is also visible. The distance between the TPWS grids provides the time difference used to check the train speed to ensure it is low enough to stop at the signal. Photo:

TPWS is also provided at many Permanent Speed Restrictions (PSRs) to ensure that a train does not pass through a restricted section of line (say one with a sharp curve) at too high a speed. However, there have been a number of issues related to the use of TPWS in these cases. Drivers have complainted that, although they were approaching the PSR at a speed which would allow the train to run at the correct speed within the restriction, they still got stopped by the TPWS "speed trap". This has led to some vigorus discussions between Network Rail, the train operating companies and the HSE. An add-on to TPWS, called TPWS+ is provided at certain signals where train speeds are above 100 mph or 160km/h.

TPWS does not replace the existing AWS system. AWS is retained, so the driver will still get the warnings advising him of adverse signals. The TPWS equipment is designed to interface with the existing on-board wiring of trains so that it can be fitted quickly.In an attempt to reduce the SPAD risks at certain high-speed locations, an add-on to TPWS, called TPWS+ is provided at certain signals where train speeds are above 100 mph. An additional loop pair is set about 770m in rear of the signal in order to provide the braking distance for a train "tripped" at 100 mph. Therefore, in these locations the signal approach has two speed traps. There are about 500 sites chosen on a risk assessment basis.

A further variation of TPWS, designed to be compliant with European requirements (q.v. below) and known as TPWS-E, was tried on a section of the British Great Western Main Line (GWML) but it was not proceeded with further in order to allow rapid deployment of the already approved TPWS equipment.

TPWS is also provided at many (about 3000) Permanent Speed Restrictions (PSRs) to ensure that a train does not pass through the section of line at too high a speed. TPWS has also been provided at terminal platforms to ensure the train speed is reduced to 15 mph on the approach to the stops. This has had the effect of reducing capacity at some terminals because of the time taken for trains to clear the routes over the throat into the terminus. This type implementation may also encourage drivers to re-motor when travelling along a platform.

In spite of the limitations of TPWS, it is suggested in published data that 60% of potential accidents due to SPADs can be prevented by the installation of TPWS at critical locations. This has been achieved, it is said, at 10% of the installation costs of a full ATP system. However, this financial target was not achieved because of a decision to monitor the status of the TPWS beacons. With the lack of any in-built failure warning capability for TPWS, it was decided to link installations to the signal in rear, so that, in the event of a TPWS failure, the signal would display a red aspect. This addition to the original specification significantly increased costs.

TPWS does not replace the existing AWS system. AWS is retained, so that drivers still receive the warnings advising of adverse signal indications. The TPWS equipment was designed to interface with the existing on-board AWS equipment on trains or to replace it so that it could be fitted quickly.

Radio Electronic Token Block (RETB)

In some rural areas of the UK, where long sections of single line require token block operation, a system for centralised control, using modern computer technology, was adopted (Figure 6). It is known as Radio Electronic Token Block (RETB).

Each train operating over the single line is equipped with a special speech and data radio transmitter/receiver with a unique identity. At the start of the single line, the driver stops and calls the control centre for authority to enter the section. If the line is clear, the signalman in the control centre transmits a coded "electronic token" data message which is received by the train and then shows the authority for that section on a cab display. The driver will then call for confirmation that he can enter the section. Once in the single line section, he will advise the control centre that he has cleared the loop track. A clearance marker board is specially provided to help him. When he has reached the end of the single line section, the driver calls the control centre again and offers to give up the token. After a "handshake" procedure by the control centre, he sends the token back by radio data transmission to release the section.

The signaller is provided with a computer system that allocates the coded tokens to each section and prevents more than one token being issued for an occupied section. It also receives the tokens sent back by each train as it reaches the end of the single line section.

At the exits of the single line sections, the points are permanently set in the direction of normal running and are "trailable" for trains entering the section, i.e. they allow a train to pass through at reduced speed using the wheel flanges to move the point (switch) blades aside reset to the normal position.

Figure 6: Diagram of route with Radio Electronic Token Block system. Diagram: Author.

A "Distant Board" complete with AWS ramp, warns the driver that he must slow down for the movement over the points leaving the single line. The Points Indicator shows the position of the points. A "Stop Board" at the end of the passing loop warns the driver to stop and ask for permission to enter the next single line section. Stop board locations are provided with TPWS loops that are linked by radio to the signal controller. A "Loop Clear" board indicates to the driver when the rear of the train is clear of the points.

An excellent description of the basic operation of RETB is available at The Modernisation of the Cambrian Lines by Alan Jones on the Signal Box Site. This system has been superceded by the test installation of ERTMS on the route. The East Suffolk Line's system was converted to conventional track circuit block with axle counters when the service frequency was increased to a level where RETB could not have handled it. It was phased out in October 2012. Some RETB versions remain in use on some of the more remote routes in Scotland.

Induktives Sicherungssystem (Indusi, Tyne and Wear Metro, Germany and Austria)

Indusi is a German designed main line railway warning and supervision system used on the Tyne & Wear Metro. It is also standard in Germany and Austria. A track-mounted inductive transponder is used to transmit signal warning and speed limit codes to the train. The transponder is mounted on the sleeper ends just outside the four-foot, unlike most other systems where the transmitter is mounted between the rails.

The approach to a danger signal is protected by a transponder that indicates a maximum speed and causes emergency braking if a preset level is exceeded. On the main line version, an adverse distant signal indication must be acknowledged by the driver to prevent an emergency brake application. More details are available at the Indusi pages, by Wolfgang Meyenberg.

The system is used in Germany for lines with a maximum speed up to 160 km/h and in Austria for line speeds up to 120 km/h. In the more recent electronic version, it includes speed supervision to a braking curve. It is not fully designed to vital standards.

Continuous Automatic Warning System (CAWS, Ireland)

Some sections of the main line routes in the Republic of Ireland and the whole of the line between Dublin and Cork are equipped with coded track circuits that provide in-cab signal indications. The system is known as the Continuous Automatic Warning System (CAWS).

The in-cab signal indications repeat line-side indications and are accompanied by an alarm buzzer when there is a change to a more restrictive aspect. The driver is required to acknowledge the alarm within 8s to prevent an irrevocable automatic emergency brake application. After the operation of the emergency brake, there is a two-minute delay before the system can be reset and the train is allowed to proceed.

The system is not vital in that the driver can acknowledge a restrictive signal warning and can then allow the train to proceed without reducing speed.

Train Stops (Trip-Cocks, London Underground)

LUL uses mechanical train stops combined with fixed blocks and individually calculated signal overlaps to provide train protection on its manually operated lines. The system prevents collisions by providing an individually calculated full speed braking distance beyond every stop signal so that a train "tripped" by the train stop will come to a stand without infringing a restricted block. Trains are restricted to 10 mph for 3 minutes after being tripped to enforce driving on sight at caution speed. This is known as SCAT (Speed Control After Tripping).

Degraded Operation

None of the systems mentioned is used for continuous speed supervision and all of them can be isolated in the cab and the train can be driven at normal speeds regardless of signal aspects. Most of the systems require a positive action to issue a warning or restrictive data. However, TASS displays some of the behaviour of a true ATP system in that it can detect missing balises.

As mentioned before, in the case of TPWS, the transmitters at a location are linked to the signal in rear so that this signal will show a red aspect in the event of TPWS failure at the next signal. This is because passing trains cannot detect failures of the track-mounted equipment.

Whilst the described systems above all provide some protection against collisions and over-speed derailments, none provide the full and vital protection that is available from modern Automatic Train Protection systems.

Automatic Train Operation with Train Stops (Glasgow Subway)

The Glasgow Subway has fixed blocks divided by stations. Each block stretches from station starting signal to station starting signal. There are no intermediate signals except at the depot connection. A recently replaced ATO system uses Siemens equipment with track-mounted beacons and on-broad processors that control the train driving and braking functions. Each station is provided with 2 approach beacons for the ATO profile requirements and a third start beacon in the platform that is linked to the starting signal and provides authority to proceed to the next station. The system software is designed to SIL Level 2.

Train protection is provided by contactless train stops provided at each signal. The equipment was supplied by SAGEM. The track mounted device consists of a permanent magnet supplemented by additional induction coils to indicated a proceed signal. Absence of the induction signal will trigger a train brake command.

If a train fails to respond to the ATO commands (or a train in manual mode passes a signal at danger) the on-board receiver will trigger an irrevocable emergency brake. The driver is required to operate a reset button to restart the train and speed is limited to 25 km/h until another start beacon is passed in the "clear" position.

Automatic Train Control (ATO and ATP, London Underground)

On the Victoria and Central Lines, full Automatic Train Protection is provided by two different Automatic Train Control systems that also include Automatic Train Operation. ATP failure enforces manual driving with speed of movement reduced to 10 mph. The system on the Victoria line was introduced in 1967 and has been replaced by a new Distance to Go (DtG) system together with new rolling stock. The Central line use continuous data transmission through coded track circuits carrying up to 13 different codes. 

The Jubilee and Northern line both have ATC, using the Thales (formerly Seltrac) S40 system using CBTC with track based wire loops. This is marketed as “moving block” although, in reality, it uses small fixed blocks built into the cable loop profile. It is very similar to the system now working on the Docklands Light Railway (see below) and other metro routes in Canada and elsewhere.

BR-ATP (Two Versions)

British Rail installed two Automatic Train Protection systems with full speed supervision for trial purposes in the early 1990s, one on the Great Western Main Line (by ACEC Belgium – now Alstom) and one on Chiltern Railways (Selcab by Alcatel) between Marylebone and Aynho Junction. Both are intermittent systems with infill loops, added to allow early release of the braking demand and its supervision when signal aspects change.

The information transmitted to the train consists of signal aspect, routing, applicable speed restrictions, the distance to the next signal and gradients. Drivers are shown the permitted train speeds by LEDs displayed around the circumference of the cab speedometer. Green LEDs show the target speed while yellow LEDs show the permitted release speed. Information on the number of signals to the next red and speed restrictions is also displayed.

The drivers set up the systems using train data input unit in the cabs that interface with the vehicle computers. The systems generate three speed curves, one for movement authority, a warning curve and an intervention curve. Each is separated by 3 mph. If the train exceeds the warning curve speed, the driver gets an audio/visual warning. If the speed reaches the intervention curves, the brakes are applied.

Although the systems were introduced as a trial they are still operational and, since the Southall accident, it has been the policy for both train-operating companies that a train will not be allowed to enter service unless the ATP system is operational.

Tilt Authorisation and Speed Supervision (TASS)

TASS (Tilt Authorisation and Speed Supervision) has been introduced on the West Coast Main Line (WCML) in order to allow tilting train to operate safely within the somewhat restricted UK railway infrastructure gauge. The primary purpose of TASS is to ensure that a train is prevented from tilting where clearances between adjacent trains or between trains and infrastructure are restricted. TASS also imposes line speed limits for equipped trains depending on whether or not the tilting system is operational.

The TASS system is installed on the Virgin Pendolino Class 390and Super Voyager Class 221 fleets and is designed to European Rail Traffic Management System (ERTMS) standards. Data is transmitted to the train by track mounted "Eurobalises" and collected by an antenna mounted under the leading vehicle. Speed limits are different for the two classes of tilting trains.

The speed limits for tilting trains are displayed on line-side signs alongside the signage for non-tilting trains. As the train passes over the first TASS balise, the driver is shown an indication light to verify the operating status of the system. Each TASS balise transmits to the train-borne equipment the position of the next balise, thus ensuring a continuous ‘daisy-chain’ of supervision. A further indication shows when tilt is enabled. The driver is responsible for driving within the correct speed throughout the trip. AWS and TPWS are provided since TASS does not sense or transmit signal aspects.

Over-speed is indicated by an audio-visual alarm and, if speed is not reduced, the train brakes are applied automatically. The brakes are released and the alarm can be reset when the train speed is reduced to the correct level. Where clearances are restricted, the train automatically stops tilting but the speed is still monitored by TASS. The train speed must be reduced by 25 mph, that is, conventional operation, if tilt fails or a balise is not detected.

Docklands Light Railway

The Docklands Light Railway (DLR) uses an ATP system with full continuous speed supervision known as Seltrac, originally supplied by Alcatel of Canadaand now part of the Thales empire . Seltrac is a transmission-based, automatic train control (ATC) system, combining both automatic train protection (ATP) and automatic train operation (ATO). The duplex transmission system is via a continuous track mounted cable, with loops crossovers at 25m intervals forming train position validators. Effectively, the system provides pseudo moving block capability thanks to very short ‘virtual’ blocks. Train detection and inductive data transmission between track and train are effected by means of the cable. A fixed block back-up system uses axle counters for train detection.

Trains are operated fully automatically without driver intervention but a train captain is provided on every train and can operate the train at reduced speed in an emergency. A Vehicle On Board Computer (VOBC), linked to the transmission system, controls the on-board vital and driving functions. All trains are controlled by Vehicle Control Computers (VCCs) from a central control facility.

The system has a good safety record but it requires continuous track cables and uses a back-up axle counter train detection system. It is therefore relatively expensive to install and maintain. As with any system requiring extensive track-mounted cabling, there is the risk of damage to the cables during track maintenance activities. This type of system can only be considered for a metro-type operation with a high service frequency.

Transmission Voie-Machine 430 (TVM 430)

Phase 1 of the Channel Tunnel Rail Link (CTRL) is equipped with the French continuous transmission ATP system known as TVM 430. This is also the system used in the Channel Tunnel and the system that will be used on Phase 2 (except for the station area at St. Pancras International. TVM 430 ("track to train transmission") is a cab signalling system used on the more recent TGV lines, developed from the earlier TVM 300 system by the French company CSEE.

With TVM 430, the line is divided into fixed blocks from 500 to 1500m long. The length of the block depends on the location, civil track speed limit and the train capacity required in the area. Line-side marker boards indicate block boundaries visually. Each block carries a speed code that is injected into the rails as part of the track circuit current and transmitted to the train as it progresses through the block. There are five standard codes representing speed limits between 0 km/h and 300 km/h. The codes are generated according to the condition of the route ahead, that is, the distance to the next ‘obstacle’. In the case of a failure, the driver can "drive on sight" up to a maximum speed of 35 km/h.

The driver is presented with the codes in the cab display with the target speed at the end of the current block and the target speed at the end of the following block. The target speed is the speed at which the train should exit the current block and enter the next.

In older versions of TVM, the target speed indication for the driver was updated only at every block boundary, resulting in a stepped speed profile. With TVM 430 the train has a continuously varying target speed through calculations by the on-board computer, giving a much more realistic speed profile for the driver to follow.

Eurostar trains are provided with a system of network codes in order to allow the train to comply with varying line speed limits over different routes. On lines where the maximum speed limit is 300 km/h (186 mph), a different network code is used from that used on the section through the Channel Tunnel, where the speed limit is 160 km/h (100 mph).

TVM is a safe, reliable and well-proven system but it relies on track circuit based continuous transmission technology and is therefore expensive to install and maintain.


Crocodile (France)

This is a French designed AWS system very similar in concept to the UK AWS. The name derives from the corrugated appearance of the track-mounted equipment. It is officially described as Brosse Repetition Signal (BRS). BRS is installed on all main lines of SNCF, SNCB and CFL. A brush on the train contacts the track-mounted device as it passes. +/- 20V from a battery is supplied to the Crocodile, depending on the signal aspect. There is a bell and flashing light indication to the driver and, if not acknowledged, an automatic brake application occurs.

Crocodile only acts as a vigilance system. Crocodile is less safe than AWS since absence of voltage cannot be detected. It does not provide any warning to the driver if it becomes defective. It may now be considered as outdated.

ASFA (Spain)

ASFA is a cab-signalling and train protection system widely used in Spain. Intermittent track-to-train communication is based on magnetically coupled resonant circuits in such a way that nine different sets of data can be transmitted. A resonant circuit trackside is tuned to a frequency representing the signal aspect. The system is not fail safe, but reminds the driver of the signalling conditions and requires him to acknowledge restrictive aspects within 3s. Lamp and bell warnings are provided for the driver.

Three different train types can be selected on-board to give continuous speed supervision of line speed and after passing a restrictive signal (160 km/h or 180 km/h). A speed check can be carried out (60 km/h, 50 km/h or 35 km/h, depending on train type) after passing a transponder 300m before reaching a stop signal and a train trip is provided at signals at danger. There is an irrevocable emergency brake upon violation.

Automatische Trein Beïnvloeding (ATB EG, Netherlands)

The Dutch railways ATB system appears in two basic versions on Dutch railway lines - ATB EG and ATB NG. ATB-EG ("ATB Eerste Generatie": ATB first generation) is the original continuous system and ATB-NG ("ATB Nieuwe Generatie": ATB new generation) is a new intermittent system designed for speeds up to 360 km/h – see next section.

ATB EG is installed on the vast majority of lines of ProRail (the new Dutch infrastructure authority) and is a fail-safe system using coded track circuits of conventional design and two versions of on-board equipment, ACEC (computerised) or GRS (electronic). The transmission between coded track circuits and on-board equipment is via vehicle-mounted induction pickup coils suspended above the rails.

There are six speed codes (40, 60, 80, 130 or 140 km/h) that are picked up by the train and displayed to the driver. There is a gong warning at a code change and a bell if the system requests a brake application. The emergency brake is invoked on over-speed or if the driver does not react to an acoustic warning.

The system does not distinguish between the 40km/h limit and stop. This allows driving on sight in the event of an equipment failure.

Transmission Balise Locomotive – (TBL, Belgium)

TBL is available in two versions, TBL1 and TBL2. TBL1 simply provides an advance indication of the signal aspect followed by an emergency brake application,  together with a train trip function for signals passed at danger. Data is supplied through track-mounted loops. The TBL loops require an external power supply, unlike most other balise systems.

BACC (Italy)

BACC is installed on most of the infrastructure of RFI (Rete Ferroviaria Italiana) in two versions, both of which operate in a similar way. Conventional coded track circuits operate at one of two carrier frequencies to deal with two train classes – those operating either above or below 180 km/h. The transmission between coded track circuits and on-board equipment is via induction pickup coils suspended above the rails.

For the <180 km/h trains a 50Hz carrier frequency is used for 5 amplitude modulated (AM) speed codes. A 178 Hz carrier frequency with 10 AM speed codes is used for higher speed trains. In the cab the driver sees the speed corresponding to the code and the signal aspect. The emergency brake is applied upon over-speed but can be released when the speed is reduced to the approved level. The version of BACC used on the Rome to Florence high-speed line is effectively an automatic train protection system with full speed supervision.


Automatische Trein Beïnvloeding (ATB NG, Netherlands)

The ATB NG system was introduced to the NS (Netherlands) in the mid-1990s to implement full ATP and to eliminate the expensive and maintenance intensive coded track circuits. It consists of track mounted balises and on-board computing equipment. An infill function based on a cable loop is also available. The data transmission is between the active balise and an antenna on-board. The system is direction sensitive, so the balises are mounted between the rails with a small offset from the centre line. ATB NG on-board equipment is fully interoperable with the original ATB EG trackside equipment. 

To initialise the system, the driver must input train length, maximum speed and brake characteristics. The driver has a display for maximum line speed, the target speed, the target distance and the braking curve. The line speed, speed restrictions, the target stopping point and the brake performance are monitored. Advance warning audio and visual alarms of over-speeds are provided. The emergency brake is invoked if movement supervision is violated or the driver does not react to a warning.

Ebicab (Sweden, Norway, etc.)

Ebicab is the standard ATP system in Sweden, Norway, Portugal and Bulgaria. Identical software in Sweden and Norway enables cross-border train operations without changing drivers or locomotives, despite the differences in signalling systems and rules. Software variations are used for the systems in Portugal and Bulgaria.

There are two versions of the system, Ebicab 700 and Ebicab 900, both providing similar safety functions. The system consists of signal encoders sending data to balises mounted in the middle of the track that are in communication with on-board computerised equipment. The data transmission takes place between passive balises (two to five per signal) and an antenna under the vehicle that also powers up the balise as it passes above it.

Inputs by the driver include the usual train parameters plus a facility to advise the train-borne computer of adverse railhead conditions. Displays show the driver the maximum line speed, target speed and advanced information for up to five blocks’ worth of speed restrictions beyond the first signal. The time to a service brake intervention is also shown if an over-speed is predicted, together with three warnings.

Service braking is initiated when the train speed exceeds the permitted speed by 10 km/h (5 km/h for Ebicab 900) but this is released when the speed has returned to the permitted level. If an emergency brake is initiated by failure to maintain the required deceleration through the service brake, the train must come to a stand before it can be released. A default speed of 40 km/h is allowed for trains passing a signal under authorisation or to cope with failure modes.

KVB (France)

This is the standard ATP system used in France and is technically similar to Ebicab, although the information provided on the driver’s display is more limited. The system is installed on the conventional railway network, in particular on the routes where high speed trains (trains à grande vitesse or TGV) approach major termini. Some sections of the high-speed lines (ligne à  grande vitesse or LGV) use the system in place of or together with TVM for certain spot transmissions and for the supervision of temporary speed restrictions where appropriate speed levels are not available from TVM codes. Spot transmissions include such items as door release authority, overhead line section switches and radio channel changes.

The system is overlaid on the conventional signalling system. The data is transmitted inductively between passive balises (between two and nine may be required per signal) and the on-board antenna which activates (powers up) the balise as it passes. The data transmission capacity is limited, hence the need for many additional balises.

The driver must input train data unless the train is a modern, fixed formation unit, where data is automatically programmed into the on-board supervision computer. In the event of any over-speed, the driver will receive a warning and then an irrevocable emergency brake will apply. The brake cannot be released until the train is at a stand.

This system is provided on Eurostar trains and it is installed on certain limited sections of the CTRL, most notably on the approach to St. Pancras station.

TBL 2 (Belgium)

TBL 2 is used on all lines in Belgium where the permitted line speed is greater than 160 km/h. TBL 2 is a cab signal system and is similar to the UK GWML ATP system (see under Britain) which uses a powered balise in the form of a steel loop with additional, long infill cable loops provided to give early warning of signal indication changes. TBL 2 is direction sensitive. This capability is provided by having the balises mounted between the rails with a small offset from the centre.

The driver is shown the maximum allowed speed (from a braking curve), the target speed, the target distance and the train speed. Audio-visual warnings of violations are provided with an emergency brake in the event of no acknowledgement.

Linienförmige Zugbeeinflussung (LZB)

This is a continuous ATP system installed on all lines in Germany where speeds exceed 160 km/h. It is also installed on some lines in Austria and on the Spanish high-speed line (alta velocidád or AVE) between Madrid and Sevilla. The on-board equipment is normally integrated with the German Indusi system and incident recorders. Data transmission is via inductive cable loops and on-board ferrite antennae. One conductor of the loop is clipped to the foot of one of the running rails while the other is fixed in the middle of sleepers. The two conductors are crossed over at regular intervals to allow the trains to obtain an accurate reading of position and speed thanks to the 180° phase shift.

The driver inputs train length, maximum train speed and train braking characteristics. A two-needle speedometer displays the maximum permitted speed and actual speed. A separate linear display provides the operating mode, the status of data transmission as well as the target speed and the distance to the target (limit of movement authority).

The on-board system monitors line speed including temporary and permanent speed restrictions, maximum train speed, the target stopping point, the train’s direction and the dynamic speed profile. It is also capable of including auxiliary functions, such as circuit breaker and pantograph operation. The emergency brake is called if the speed supervision is violated. The brake can be released when the train speed is restored within limits.

The system can be used in vital automatic train control connected with automatic motor and brake control. Line-side signals are not required for LZB equipped trains. Drivers of such trains are instructed to ignore wayside signals that are provided for non-equipped trains. LZB is the earliest continuous automatic train protection system that is not track circuit based, to the best knowledge of the authors of this report.


European Interoperability Directives

The question of the application of full ATP on UK railways cannot be separated from the requirements for European interoperability. It would not be legal or cost effective to pursue a policy of ATP installation on the UK network without incorporating the technical requirements for interoperability. Rolling stock and signalling suppliers in the UK are already installing equipment that is compliant with or capable of upgrading to the standards required by European interoperability directives and the Technical Standards for Interoperability (TSIs).

The European interoperability requirements are enshrined in the European Rail Traffic Management System (ERTMS). ERTMS has been developed to support the implementation of two European 'interoperability' directives: 96/48/EC for high-speed lines and 2001/16/EC for conventional services. These offer guidelines for the adoption of technical standards across the EU for rolling stock, traction current and signalling and control systems. The technical requirements and UK national guidelines for high-speed lines have already been issued and those for conventional railways are expected shortly.

The routes requiring interoperable systems for high-speed lines are defined in the Trans European Network (TEN). Four UK high-speed main lines are included in the TEN:

The West Coast Main Line

The East Coast Main Line

The Great Western Main Line and

The Channel Tunnel Rail Link

The European Rail Traffic Management System (ERTMS) is a fundamental building block for the implementation of interoperability on the TEN. The European Train Control System (ETCS) covers the physical signalling and train control part of ERTMS.


The ETCS specification has three substantially different ATP operating levels allowing a stepped transition from conventional line-side signalling to a full moving block concept, with some incremental additions. The levels provide full speed supervision and varying amounts of in-cab information, throughout a train’s journey, and may be summarised as follows:

Level 1 – No Infill (System A)

The Level 1 system is overlaid on existing visual signalling systems. It is based on Eurobalises providing ATP supervision and protection. It can have an adverse effect on route capacity, in a range of 5-15%, generally, because of trains having to reduce the speed as demanded by the supervision curve before receiving new information at the next signal position.

Level 1 – With Infill (System B)

This level uses infill signal indication updates between the main balises, either by means of additional balises, using so-called EuroLoop or by radio. The driver thus receives updated information on the status of the next signal(s) before reaching the main balises. This option reduces the adverse effect on route capacity, but is more expensive to install and operate, as additional line-side equipment is required.

Level 2

Level 2 uses conventional, fixed block train detection (with track circuits or axle counters) but the driver receives all train movement authority information via bi-directional GSM-R radio. It has full continuous ATP supervision and protection with in-cab signalling displays. It can improve route capacity and line-side signals can be removed. With signals retained it is referred to as System C and with signals removed as System D.

Level 3

Fixed blocks are not required for Level 3. This level uses balises and on-board tachometry to detect train position. All conventional signalling is removed and all data communication is via GSM-R radio. It can improve route capacity but, although technically feasible, it has not been proven on an existing main line railway and, in our view, it currently represents a significant risk in terms of operability and reliability. These issues have yet to be resolved.

United Kingdom Development

ETCS was first installed on the Cambrian Line in Wales. The project involved the equipment of 14 trains and 220 route-km of railway with full ETCS Level 2 equipment, RBCs and GSM-R communications. The existing Radio Electronic Token Block (RETB) and line-side signals were removed and cab signalling was provided on the trains (Class 158 DMUs and Class 37 Locomotives). The system became operational in 2010. Another test installation has been installed on the Hertford loop line both of London. This is electrified and is currently being used as a test bed for various fleets being introduced with ETCS equipment already installed. It is also installed on the Crossrail (Elizabeth Line) route in London and other short sections of lines. The objective is to fit the UK network with ETCS Level 2 or even Level 3 wherever a business case can be made.

Global System for Mobile communications (GSM-R)

The introduction of ETCS Levels 2/3 is reliant on the installation of GSM-R as the data and speech carrier. The testing and installation of the system for UK ETCS is running in parallel with the Cambrian Line trials. The UK train radio system and fixed telephone network are also being upgraded. Any failure of the GSM-R project to maintain parallel implementation with ETCS will delay the implementation of train control interoperability in the UK. There is some suggstion that bandwidth is an issue already for GSM-R and that there's no capacity in the existing equipment for anything more than normal traffic. Emergency traffic might overload the system.

GSM-R or satellite based train control systems will still require some ground based validation (passive Eurobalises) and train detection through track circuits will very likely be required for turnout locking and in complex junction areas.

Conventional (Community) Railways

The ETCS technical requirements for conventional railways are not yet published but it is very likely that the equipment will be similar to and compatible with that required for high-speed lines. This will allow trains to move freely between ETCS fitted high-speed lines and community railways without the need for dual fitting of different systems.

It is inevitable that existing conventional railways will continue to use the systems that are currently standard in the country of origin and that the progress towards commonality will be slow. Both the high-speed and conventional interoperability regulations drawn up by the British authorities require that new rolling stock and signalling equipment be designed and built to accommodate ETCS equipment in addition to any "legacy" equipment needed to operate on the existing railway network. This has already been achieved on the Eurostar fleets and, in principle, therefore could be applied to existing UK fleets.

Conventional lines should be converted to ETCS as systems are due for renewal or where the use of communications based train control can be shown to reduce substantially the operating and maintenance costs.

Metros and Light Railways

Although most metro systems worldwide are already fitted with more or less advanced train protection system and risks are generally low, there are European Union moves to standardise a unified European Urban ATP system. Implementation of this is likely to be a long-term objective since most operators have their own standards. The benefits of the adoption of a unified metro train protection might seem to be small but could lead to substantial reductions in replacement costs.

Questions of interfaces with main line railways must be addressed. In the UK this relates particularly to London Underground and the Newcastle Metro. Both systems share lines with Network Rail and must be considered in the context of interoperability for community or conventional (non-high speed) railways. There will also be the question of electro-magnetic interference on shared and adjacent routes, which will require a separate study for each route. This will also apply to light rail routes adjacent to main line systems like those in Wimbledon (Croydon) and Nottingham.


High Speed Line Requirements

The difficulty of preventing driver perception overload has resulted in a situation in Britain where line-side signals are no longer acceptable for trains running at speeds greater than 125 mile/h. In order to provide an increase in operating speeds to 140mph and above, full ATP with cab signalling will be essential and the use of ETCS compliant equipment is the logical way to provide this.

The existing systems will have to be retained for conventional trains and may also be required for fall-back purposes at least during the early years of operation of any stand-alone ETCS Level 2/3 system, until reliability and operational experience allow removal of line-side signals. This is a long way off.

Conventional Railways

It will be a logical progression for conventional railways to incorporate ATP using ETCS standards when signalling renewals become unavoidable. It is likely that this will be shown as a cost effective solution for renewals once the GSM-R network has been developed and the removal of full line-side signalling has been accepted as viable.

It is the authors’ view that the future strategy for train protection in the UK should be based on the continued use of AWS/TPWS until replaced by ATP in conformity with the ETCS requirements. The replacement will have to be carried out on a route upgrade basis.

It may be possible to consider other, low cost systems such as CBTC, as long as these are acceptable for lightly used community railways in remote areas with relatively low frequency services and a dedicated rolling stock fleet. However, it may be found that standardisation of ETCS across the whole network is more cost effective.

Life Cycle Approach

It is essential to view the implementation of any new system on the basis of a life cycle approach. The railway business does not allow for rapid technological change. The cost of equipment and the need to design to robust specifications to protect against a harsh operating environment leads to the need for a long period of depreciation before replacement. This restricts the capacity for adopting technological change and development. Shortages of skills will further limit change to what can be managed in a life-cycle replacement programme.

New electronics-based systems tend to have shorter life spans than traditional railway technology. Typical life periods of 15 years are now being adopted in project assessments for electronic systems as opposed to the traditional railway periods of 30-40 years. The 15 to 20 years may well be the maximum period for which suppliers will maintain spares for their products. However, well-designed, modular systems lend themselves to component replacement once subsystems become obsolescent, as has been shown in the case of the Victoria Line in London. A new ATP system will require a life cycle analysis to determine its cost-effectiveness.

Making a Business Case

In any strategic decision making process, the viability of the proposals from a cost/benefit perspective must be taken into account. In the case of the installation of full ATP on the UK railway network, there should be a review of the benefits and how much it will cost to achieve and maintain those benefits. Looking at these issues in depth and developing a strong business and safety rationale for implementation will lead to wider acceptance by railway companies and government agencies alike.

As an example, in examining the UK main line rail system, it can be seen that some 12% of the network has a line speed of 35mph or less and a further 55% has line speeds between 40 and 75mph. These lines are fully protected by TPWS. On the other hand, high-speed routes (only 17 per cent of the UK network) contribute 49 per cent of the ATP safety benefit and high-density passenger routes with line speeds of between 60 mph and 100 mph (22 per cent of the network) contribute 33 per cent of the ATP safety benefit. In conjunction with renewal requirements, it could be shown where the most benefit will be obtained from the introduction of ETCS compliant ATP.

With the completion of TPWS and TPWS+ over the UK network, the benefits of installing a fully ETCS compliant ATP system will be difficult to sustain in many areas.

A case for ETCS fitment might be augmented by operational advantages or the need for interoperability with the ETCS fitted network. It is possible that a detailed examination will show that a financial case for ETCS installation could be supported by the elimination of line-side visual signals and by improvements in line capacity. However, this will only be achieved when the technical reliability of the systems is universally accepted.

The question is further complicated when maintenance is considered. The goal of infrastructure managers is to reduce line-side or track-based hardware that requires regular maintenance. However, the balance must be found between the cost of supplying sophisticated technology and maintaining the software with highly qualified technicians on the one hand and the ground-based hardware requiring regular but cheaper maintenance on the other. With modern safe working practice requirements and the expansion of electronic signalling systems and its associated expertise, this balance will most likely favour ETCS systems.

In the case of new trains, however, the position over the provision of ETCS capability is clearer - all new stock is being provided with at least the physical capability of accommodating ETCS. It should also be a requirement that the future design of rolling stock should allow for the needs and sensitivities of the new generation of electronic control and protection systems.


It is worth saying here that passing a signal at danger is something that every driver fears and tries to avoid but knows that, in a moment of distraction or in an attempt to make up time, it will happen to him one day. The normal pattern of such incidents is that the signal (and, in case you ask, yes, it has happened to me) is passed because of an error of judgement in braking, not due to ignoring a signal aspect. Usually, such overruns are not at high speed and the overlap beyond the signal absorbs it so that the train does not enter the occupied block. Sometimes and more seriously, the overrun occurs when the driver misses a caution and cancels an AWS warning. Several serious collisions occurred as a result of this and it is something which TPWS has almost eliminated.

One area where TPWS has turned out to be more trouble than it prevents is at terminal platforms. A too restrictive 15 mph speed limit on the approach to the buffers in a terminal platform has meant an increase in the time for a train to clear the routes into the terminus. At many termini in the UK, this has affected capacity at peak times and has the effect of reducing the number of trains arriving and departing. This will lead to a reduction in service or will reduce recovery capability.

Since modern rolling stock is built to a high standard of crashworthiness, a 20 mph buffer stop collision is unlikely to cause a serious deformation of a vehicle. Any speed restriction below this level for arriving trains causes a severe operating restriction on the terminus with little apparent safety benefit. In my view, there should be an immediate increase in terminal entry speed to 20 mph. 


AEA Technology Rail (for RSSB), ‘Baseline ERTMS Parameters - Recommendations For National Values’, Derby, 2004.

Bailey, C. (Ed.), ‘European Railway Signalling’, A & C Black, London, 1995.

Emmerson, A. (Ed.), ‘Railway Telecommunications’, IRSE, London, 2004.

Ford, R., ‘Signalling: One Crisis after Another’, Modern Railways, Shepperton UK, July 2004.

Goddard, E. (Ed.), ‘Metro Railway Signalling’, IRSE, London, 2003.

Interfleet Technology, ‘Collating, Recording and Configuration Management of ERTMS Train Parameters’, Derby, 2002.

Kitchenside & Williams, ‘Two Centuries of Railway Signalling’, OPC, Sparkford, UK, 1998.

Morris et al, ‘Train Protection: Advice to Ministers on the Rail Industry’s Plans to install the European Rail Traffic Management System (ERTMS)’, HSC, London, 2002.

Muttram, R.I., ‘A Train Protection Strategy for the UK’, Institution of Electrical Engineers, London, 10 October 2001.

NERA for HSE, ‘Train Protection - Review of Economic Aspects of the Work of the ERTMS Programme Team’, 2003.

Official Journal of the European Communities, Commission Decision Concerning TSI, L245/37, 2002.

Pincock, A.J.L., ‘Safe Passage to Europe – Eurostar’s In-cab Signalling Systems’, Proceedings of Institution of Mechanical Engineers Vol 212 Part F,Pp 235-251, London 1998.

Raymond, G., et al., ‘Innovation brings satellite-based train control within reach’, Railway Gazette International, December 2004.

Simmons, A., ‘An Overview of Network Rail Signalling Policy’, IRSE, London, 12 November 2003.

Uff and Cullen, ‘The Southall and Ladbroke Grove Joint Inquiry into Train Protection Systems’, H&SC 2001.

Urech, P.-A. et al., ‘A year of experience with Level 2’, Railway Gazette International, August 2003.

Watson, C. and Schmid, F., ‘Report on the Review of Literature on Adhesion and ATP’, Prepared for Railway Safety and Standards Board, Railway Safety Research Programme, Task Rserv254 ERTMS and Adhesion, March 2003.

Woodland, D. and Schmid, F., ‘The History of Automation In Train Control’, IEE History of Technology Event, 12 July 2003.

Wright, N. & A. Hamilton, ‘ATP – The Train Operator’s Perspective’, IRSE, 16 January 2002, London.

© The Railway Technical Website 2023