European Train Control System Over IP The Challenges

Transcription

1 Dr Tomas Magyla PhD, MSc, BSc, Dipl. Eng, MIRSE, MRTSA, MIET, MAPM SUMMARY The paper presents a different way of implementing ETCS Application Level 2 train control system using Internet Protocol based data radio and communications backbone, whilst retaining the ETCS language and principles, and the Euroradio protocol. The paper addresses some of the challenges of implementing ETCS L2 over IP from design, technical standards and a safety compliance viewpoint. Amongst the various technical challenges, the paper discusses the adoption of a connection oriented Euroradio protocol in a connection-less media environment. The paper provides an insight into the latest ETCS standards development and where the ETCS industry is moving in the IP networking context. 1. INTRODUCTION The existing ERTMS / ETCS Application Level 2 schemes worldwide (including the first Level 2 Pilot Trial installation in Australia) use GSM-R 1, a proven and robust radio communications technology that implements a circuit-switched connection. The GSM-R technology is based on specifications that emerged in the 1990s. The GSM-R technology, compared to today s packetswitched technology alternatives, provides what could be considered a rather basic performance. Whilst the large installed base of GSM-R infrastructure worldwide, and a wide spectrum of products and services available from the GSM-R industry suggests GSM-R is here to stay [1], there are opinions suggesting GSM-R is expected to become obsolete in Europe by 2025 [2]. The absence of a dedicated frequency spectrum outside Europe is a significant restriction in applying ERTMS/ETCS for many railway administrations. In Europe, poor spectral efficiency combined with the limited European GSM-R frequency spectrum allocation (4 MHz), potentially leads to congestion in major traffic 1 With a few exceptions e.g. Wuppertal suspension railway, Kazakh Railways etc. hubs. The limitations of circuit-switched scheme, legacy transmission protocols and the difficulty of integrating the existing ETCS schemes with tomorrow s all-ip railway infrastructure, suggests that the happy ETCS and GSM-R journey is approaching its end 2. The evolution and availability of modern telecommunications technologies and standardised communications protocols today represent alternative options. This paper looks at alternative ways of implementing ETCS over IP, and explores some of the technical challenges that are awaiting. 2. NOTATION AUC Authentication Centre ACL Access Control List BSC Base Station Controller BTS Base Transceiver Station CBI Computer Based Interlocking DES Data Encryption Standard EIRENE European Integrated Railway Radio Enhanced Network EIR Equipment Identity Register ERTMS European Rail Traffic Management System ETCS European Train Control 2 In January 2015 Finland announced plans to shift to TETRA and seek for a derogation from the current rules making GSM-R the only option in EC 1

2 System EURORADIO Radio Transmission System for ETCS GGSN Gateway GPRS Support Node GSM-R Global System Mobile Rail GPRS General Packet Radio Service HDLC High-Level Data Link Control protocol HLR Home Location Register HP High Priority IP Internet Protocol ISA Independent Safety Assessor ISDN Integrated Services Digital Network KMAC Long Term Key KSMAC Session Key LTE Long Term Evolution MAC Message Authentication Code MORANE Mobile Radio for Railway Networks in Europe MSC Mobile Switching Centre MS Mobile Station (on-board radio subscriber unit) MTBF Mean Time Between Failures OBU On-board Unit QoS Quality of Services RAMS Reliability, Availability, Maintainability and Safety RBC Radio Block Centre SGSN Servicing GPRS Support Node STM Specific Transmission Module TCP Transmission Control Protocol TDM Time Division Multiplexing TETRA Terrestrial Trunked Radio TIU Trackside Interface Unit T.70 ITU-T transport service Network Layer in ETCS UDP User Datagram Protocol UMTS Universal Mobile Telecommunications System VLAN Virtual Local Area Network VLR Visitor Location Register VRF Virtual Routing and Forwarding X.224 ITU-T transport service Transport Layer in ETCS 3. CURRENT PRACTICE The existing ERTMS/ETCS Application Level 2 schemes are based on GSM-R as an ETCS radio transmission media [3]. Eurobalises are used as a spot transmission device, mainly for location referencing. The RBC recognises each ETCS controlled train by the identity of its leading on-board equipment (NID_ENGINE), and is engaged in a regular 3 communication to exchange ETCS variables and packets so as to maintain a safe separation and speed of trains. Fig.1 Typical components of ERTMS/ ETCS Level 2 scheme A coherent set of ETCS variables, packets, messages and telegrams are defined in ETCS language [4]. System configuration in ETCS is defined by assigning appropriate values to the variables that are used by the different components of the system and exchanged between components as required (especially between the trackside systems and the on-board systems). ETCS language provides means of exchanging information over the radio, balise and loop airgaps, and the STM interface. Each ETCS transmission media type represents a different case in terms of accessing and using the media, and a different risk profile in terms of safety related EN communications network threats [5]. The radio transmission media represents most complex scenario in this respect, and is therefore the main focus of this paper. 3 In a circuit-switched mode the channel is allocated continuously, however the actual transmission event on the channel is of discontinuous, sporadic burst character 2

3 3.1 The Euroradio Protocol in the Safety Context In existing ERTMS/ ETCS Application Level 2 schemes 4 the safety related functions (both transmission and protection related) are carried out by the safety related ETCS on-board equipment (OBU), trackside equipment (RBC) and the engineering process [6]. The existing schemes rely on the Euroradio safety protocol in delivering this critical task. The Euroradio implements a Safety Layer for transmitting safety related information over a non-trusted open transmission media. The Euroradio Safety Connection provides protection against the following communications threats [7] that are characteristic to EN open network: Corruption; Insertion; Masquerade. The protection is achieved by adding a safety code MAC (Message Authentication Code not to be confused with a Media Access Control address) and a Safe Connection identifier (source and destination identifier) to the ETCS Application data. The ETCS Application layer provides an additional protection through implementation of the native ETCS language features and principles such as: Adding a time stamp to each message (e.g. T_TRAIN); Verifying the length of the message (if computed length is not equal to the length given by the L_MESSAGE, the entire message is rejected); Authenticating through addition of the ID of the parties involved in each message (e.g. NID_ENGINE); Message delivery acknowledgement (e.g. M_ACK indicates whether the message must be acknowledged). The ETCS Application layer together with the Euroradio protocol provide a comprehensive protection against the generic communications threats as defined in EN The question is how adequate such protection is in an open network environment. A special case arises when the ETCS application requires sending a High Priority (HP) message, the mechanism of which does not involve setting up the Euroradio Safe Connection. The mechanism of sending HP messages with a reduced thickness of the protection layer in the legacy circuit-switched schemes was a normal practice. The application in a different environment (such as IP based schemes) invites to be risk assessed for the individual implementation circumstances. Fig. 2 The layered structure of the Euroradio protocol In existing schemes the underlying layers that are part of the Euroradio protocol stack include X.224 as the Transport Layer, the T.70 is the Network Layer, HDLC is the Data Link layer. 4 The same would apply to Level 3 however detailed ETCS Application Level 3 specifications are still under development. 3.2 Security Warrants Safety The ability of the Euroradio protocol to safely transmit movement authorities and other ETCS data greatly relies on the security of the Message Authentication Code. The MAC is derived by using symmetrical cryptographic keys and a block cipher algorithm to encrypt ETCS data [8]. The block cypher implemented in the existing ETCS Application Level 2 schemes is the 3DES (Data Encryption Standard) that was developed in the early 1970s and uses three distinct 64 bit keys. The algorithm takes the unencrypted data 3

4 and applies three iterations of the DES encryption, each time using a different key. The algorithm is also used to derive the Session Keys (KSMAC) from the Long Term Keys (KMAC). The KSMAC authenticates subsequent messages in the sequence. The algorithm represents a potential vulnerability, in that the initial exchange of random values (that are later used to derive the KSMAC) between the OBU and RBC are unauthenticated. The nonauthenticating of the initial random values was considered acceptable, assuming only the authorised party with KMAC key will be able to derive the KSMAC key for the session. However if one party ever reuses the same random value to generate KSMAC (theoretically possible over a longer period of time), it is possible for an attacker to replay any message in the session, assuming they have acquired a large enough sample of transmitted data. It would also allow them to send specific commands and illegal movement authorities. This may potentially lead to a train stop, collision or derailment, as the transmitted illegal data would be accepted as genuine [9]. The existing 3DES based MAC application in IP environment may be seen as requiring special consideration to address the vulnerabilities (perceived or real) arising from the individual network implementation scenario and key management process. 3.3 Circuit-Switched Versus Packet-Switched In circuit-switched mode a dedicated connection is allocated for each train for the duration of the communications session (for the entire duration of the journey) regardless of the actual amount of transmitted data [1]. This is how most of the existing ETCS schemes are implemented. With a packet-switched scheme multiple users (train OBUs) can be sharing a common radio resource. The nature of ETCS data transmission over radio media is of sporadic, burst character. The size of the message varies from as small as 32 bytes (e.g. user data for Train to RBC Location reports) to a few hundreds of bytes for other ETCS messages. Fig. 3 Packet-switched scheme multiple MS sharing the same channel The periodicity of the ETCS messages transmission is low, in the region of every 20 seconds for the downlink and 6 seconds for the uplink. The sporadic, discontinuous transmission of ETCS messages suggest the current circuitswitched scheme is not well suited for this application, the radio resource is wasted due to non-optimal bandwidth utilisation. 4. ALTERNATIVES Given the limitations that the current circuitswitched scheme, and the ageing radio technology represent, an option of migrating to alternative packet-switched schemes that allow retention of the existing ETCS language and principles, is worth considering. Some of the alternatives would also benefit from advantages offered by modern communication technologies. 4.1 The Obvious Alternative - GPRS GPRS provides an obvious opportunity for the existing GSM-R based ETCS schemes to utilise the existing GSM infrastructure and make an efficient use of the existing network resource [10]. GPRS uses a shared resource among multiple active users due to the use of a packet oriented transmission mechanism. 4

5 In a typical GPRS scheme the SGSN (Serving GPRS Support Node) is responsible for the delivery of data packets from and to the OBU. Its tasks include packet routing and transfer, mobility management, logical link management and authentication. The GGSN (Gateway GPRS Support Node) acts as an interface to the RBC. generation CBIs that do not natively support an IP communications platform. Serial data is encapsulated by preserving its contents and structure, and using TCP/ IP as a transport. The Physical layer of such solution is transparent from the Application Layer perspective, and can be anything transmission over fibre, copper, radio or an optical spectrum. A similar principle can be utilised in encapsulating Euroradio protocol for transmission over TCP/IP. This preserves the ETCS language based Application Layer, and the existing ETCS principles are retained unchanged. Fig. 4 Typical GPRS scheme Whilst GPRS is proven in telco cellular applications, ETCS over GPRS is currently undergoing trials in Europe. The key technical challenges include Euroradio protocol stack adaptation/ replacement with an equivalent one based on IP, translation of the E.164 identification scheme to IP addressing, QoS aspect, just to mention a few. The GPRS option may be seen as attractive in existing ETCS Application Level 2 schemes as it addresses some of the limitations of a circuitswitched scheme and virtually extends the life of the existing GSM-R asset. In a bigger picture though it does not seem to offer a future proven solution. 4.2 Euroradio Encapsulation Over IP Option The reader may be familiar with a principle of encapsulating serial signalling interlocking data for transmission over IP media. This is common in the signalling schemes implementing an older Fig. 5. Euroradio protocol encapsulation. Header etc. detail omitted for clarity. The Euroradio protocol is well suited for encapsulation over IP as it adds the MAC, identifiers and its header after a complete ETCS message is assembled. However, the Euroradio protocol is connection oriented and thus is not well suited for use in connection-less media such as IP. Therefore an external mechanism an Adaptation Layer in this example is required to replace the standard GSM-R call establishment procedure, 5

6 to ensure that the correct end subscribers are connected for the Euroradio protocol to convey ETCS packets over IP media. The Data Transfer state of the call establishment procedure establishes the Euroradio Safety Connection, and then transfers the Euroradio application data between the connection subscribers. The Euroradio protocol on its own does not provide a complete protection from EN50159 communications threats characteristic to an open network (ref. Section 3.1). The network layers above and below the Euroradio layer need to provide an additional protection against Delay, Re-Sequencing, Deletion and Repetition threats. The ETCS language mandates a principle for the Variables Definitions to be independent of the transport media over which they are used. ETCS language mandates the Packet Definition does not change when transmitted over a different transmission media. The ETCS Application is structured in a way that ensures the behaviour of the receiver does not depend on the sequence of the Packets delivered by the message. These principles make the Euroradio encapsulation over IP feasible. In the existing ETCS schemes the end user (i.e. OBU, RBC, TIU) is identified by its E.164 ISDN identity number (a telephone number, in other words). In an ETCS over IP option the E.164 identity number becomes irrelevant, as each subscriber (a train, a RBC, a TIU) can be identified by its IP address. Balise telegrams can provide an IP address of the RBC for the OBU to connect to. Disregarding the underlying transmission technology/ method, the ETCS language readily provides multiple additional means of identifying a subscriber through the use of its ETCS identity NID_ENGINE, train describer NID_OPERATIONAL, or a radio subscriber NID_RADIO at the Application Layer. In Fig. 5 the IP data radio will provide a transparent data pipe between the wayside (RBC or TIU) and the onboard (OBU) part of the signalling system. The UDP (User Datagram Protocol) can be used as Transport Protocol. UDP is generally preferred over TCP due to a lower overhead and theoretically better timing performance. However, UDP datagrams may arrive out of order, come duplicated or completely disappear, but, given that this is all taken care by the ETCS Application Layer and the other network layers, this UDP limitation is not of concern. There are many examples of signalling application using UDP for vital signalling data communications, in conjunction with other layers adding additional identifiers, event counters and sequence numbers to overcome this limitation. Limitations of the proposed method Retaining the original Euroradio stack with the cumbersome underlying X.224, T.70 and HDLC structure means additional tuning of these layers is required for optimal performance and delivery of ETCS QoS. Performance may be limited by the legacy protocol error handling capability (or the lack of it), e.g. HDLC. The legacy MAC authentication scheme is retained and potentially represents a security exposure in IP environment. Depending on the individual network implementation this may need additional consideration. The new scheme will still be disadvantaged by a poor Euroradio Safety Connection time performance (circa 27 seconds, as it takes time to apply 3 rounds of encoding). The benefits & opportunities Depending on the implementation there is no change to the vital ETCS Application component. Depending on the application country this simplifies or negates additional work on the Safety Case and the ISA assessment. The existing ETCS Application, and its principles are retained. The approach is not of intrusive nature and therefore may be well suited for converting existing schemes, or being implemented in new schemes. 6

7 This approach allows an easy integration with any existing or future IP based infrastructure. The scheme can be migrated to about any IP based bearer technology, e.g. radio (or even optical spectrum) subject to the selected technology meeting the intended capacity and coverage expectations. If operational necessity dictates, this solution can be implemented as a combination of different IP radio platforms, and this may be completely invisible from the ETCS application point of view as long as ETCS QoS is delivered. For example, it may be more economical to have TETRA in the low traffic density areas as this represents a significant CAPEX reduction due to a greater RF coverage to base station rate (assuming implementation in Australian four hundred megahertz frequency band), complemented with LTE in major interchanges, or Wi-Fi in the underground tunnels areas. 4.3 Additional Safety Measures In the above approach the overall solution needs to implement additional safety measures in conjunction with those measures already built into the Euroradio protocol and the ETCS application, to provide comprehensive protection against the open networks communications threats (ref. [5]). The Adaptation Layer seems to be a logical place for accommodating this. In this regard there are some good safety engineering examples that modern CBIs and communications based axle counter applications implement that can be relevant for this application. Some examples could include: Adding a Sequence number provides protection from a Re-sequencing threat; Adding an Event Counter provides protection against data obsolescence; Adding a Time Stamp - provides protection against data obsolescence and re-sequencing; Adding clear identification of messages and its references provides protection against repetition. 4.4 Other Alternatives The Euroradio encapsulation approach described above could be taken one step further by completely removing the legacy layers X.224, T.70 and HDLC and replacing with an IP oriented transport model. The legacy Euroradio Transport Layer X.224 is completely replaced with connection oriented TCP. The Network Layer T.70 is replaced with a connection-less IP protocol. The Adaptation Layer in this option is still required and provides a similar function to the previous option. This approach is similar to the new RBC-to-RBC communication over IP concept, just recently embedded in the new ETCS Subset 098 Specification. Domain Name Service can be introduced to resolve the ETCS identities into a routable IP address through the use of lookup table or a direct translation method. It is worth noting that a number of RBC products already exist from the major signalling suppliers with native Ethernet/ IP communication interface. Until the recent times these were mainly used in conjunction with ISDN gateways to provide a backwards compatible interface to I FIX specifications. The TCP/IP model features, such as port QoS class assignment [11] can be implemented to assist achieving an end-to-end QoS. This alternative is free from the limitations of the previous option, due to removal of the X.224, T.70 and HDLC, however appears to be a more intrusive approach that may be seen as detracting from a standard approach and therefore may be better suited for implementing in new ETCS schemes. Obviously there is no single best alternative that suits all the intended applications and individual scenarios. Other alternatives exist that may be better suited for a particular scheme. Such examples include modifying the Euroradio Safety Protocol for the IP environment, or implementing an IP bearer solution (e.g. LTE) that simulates a 7

8 switched-circuit scheme etc. but that is a subject of a separate discussion, to be covered elsewhere. 5. THE IMPORTANCE OF QoS In the ETCS application context QoS is of paramount importance as some of the communication threats detection and defence techniques rely on an end-to-end deterministic QoS. Short connection disturbances and transmission errors may be completely invisible to the ETCS application as the underlying transport layers will deal with it until a larger outage triggers a new connection re-establishment. The system response (i.e. Movement Authority suspension, etc.) is subject to ETCS application design. 6. A CLOSED OR AN OPEN NETWORK A question arises - what is required a Closed or Open transmission network (in terms of EN50159) for implementing ETCS over IP when using the earlier described encapsulation approach. The radio media is commonly considered as an Open transmission media. Therefore for ensuring the security threats have been adequately addressed within the radio segment of the overall scheme, the ETCS Application layer, together with the Euroradio Safety Layer, the Adaptation Layer and the underlying layers of communication protocols must provide adequate measures to mitigate EN threats typical for an open network. In case of the earlier discussed Encapsulation approach, such protection extends end-to-end from the OBU across the radio domain, and the backhaul network that interconnects the various radio system components, and any fixed networks that interconnect the radio core node with the RBC. This negates a requirement for implementing a closed topology fixed communications network. There are other factors that may influence decision to implement a closed type of communications network. If the same network is to be used to interconnect other safety critical components such as CBIs, axle counters etc. the ISA safety certification/ type approval constraints for a particular signalling product may require a closed network environment. It is interesting to observe the changing trend towards most of the new CBI and axle counter products implementing an adequate protection from communications threats that allows implementing them in an open network environment. 7. IS COMPLIANCE TO EN50159 SUFFICIENT TO GUARANTEE THE SAFETY? The EN has become part of our daily vocabulary. ISA assessments, product type approvals quote EN compliance. The current pace of technological evolution, the opportunities and challenges it represents is becoming difficult to follow. Hence the curious human nature presents surprises that are difficult to account for, even if compliance with EN is followed. Recently numerous issues were discovered with a modern computer based interlocking during network testing using rapid ping and port probe. If the CBI had its Vital or Non-Vital ports probed via a tool such as NMAP, any probe on its ports caused the CBI to become unresponsive. The CBI would only become responsive after a cold restart. If the CBI was the end-host of a rapid ping, the ping caused the CBI to lock up and drop traffic for seconds. This influenced the decision to place ACLs on the edge VLANs and not just rely on the firewall and VRF separation. As new interlocking products are introduced into the signalling market, we see more and more generic hardware processing platforms. Depending on the application that the hardware is loaded with, the processing platform may become an OBU, a CBI or an RBC. Given the generic nature of the hardware platform, multiple same family products may potentially be exposed to the same vulnerability. The fringes of the VLANs, especially any 3 rd party interface, such as a shared infrastructure use, or a maintenance access security aspect needs to be carefully considered in network design. 8

9 8. ONE, TWO OR MORE DATA RADIOS? Implementing ETCS over IP introduces multiple alternative radio technology options to choose from. A question arises - how many data radios for ETCS? There are different schools of thought on this subject. Some of the criteria that assist with decision include: The seamless RBC handover / network handover aspect; The RAMS aspect; The data traffic load sharing aspect; The RF interference aspect; The available roof space aspect. The RBC handover aspect ERTMS/ETCS Baseline 3 supports one or two simultaneous OBU to RBC communications sessions. In Application Level 2 and 3 a single communications session is sufficient for a train handover from one RBC to another. However in a single session option the preparation of the Accepting RBC for taking over the train supervision is not possible until such a point in time when the on-board unit disconnects from the Handing Over RBC, and establishes a new session with the Accepting RBC, validates the version etc. The Application Level 2 performance may be penalised in a single communications session option. The voice/data mode aspect also needs to be taken into account. The same MS unit typically can be switched from Voice to Data (assuming voice and data related I/Os are available on the same unit), thus providing a fall-back option for one or another mode (Switzerland implementation). The load sharing aspect The scenario of two on-board data radios sharing the load introduces an additional degree of resiliency over the open communications media assuming two I FIX1_IP and I FIX2_IP interfaces at the RBC end are introduced, and this option provides a fall-back scenario in event of one of the interfaces failing (Kazakhstan implementation). The RF interference aspect Any additional data radio has a potential to become an out-of-band or in-band interferer for any existing radio services. The higher the MS emitted EIRP power, the smaller the separation from the Uplink to the Downlink frequency spectrum, the lower the frequency band of operation, the more difficult it is to maintain a sufficient separation distance between the various services antennas so as to achieve sufficient port to port isolation to reduce the risk of interference. In ETCS Application Level 3 performance will be penalised as the train will no longer be able to transmit position reports from the moment of disconnecting from the Handing Over RBC to the Accepting RBC. The RAMS aspect The ability to use the second data radio as a fallback represents a parallel redundant instance in the Reliability Block Diagram that increases the overall Operational Availability performance of the on-board system. However the MTBF of a single radio may well be sufficient to achieve the mandated ETCS Availability target. Fig. 6. Antenna port to port isolation testing for GSM-R 9

10 Is there enough space on the roof to provide enough separation, without exceeding the antenna feeder system attenuation limit target? The actual receiver blocking performance is of equal importance, and will be substantially different for a different technology solution. For example, the acceptable interferer for GSM-R ranges from -25 to -13 dbm, UMTS and TETRA are ranging from -52 dbm to -40 dbm, and LTE ranges from -52 dbm to -43 dbm [1]. Considering the Australian 1.8 GHz frequency band, the RF interference issue in Australia is somewhat easier to mitigate due to a rather wide separation between the Uplink and the Downlink (75 MHz) the potential interferer becomes an out of band interferer, outside the RX band pass filter. Additionally, lower EIRP levels (compared to Europe) are mandated in Australia. On the other hand the wayside installations on this frequency band are penalised due to a relatively poor RF coverage to base station rate (typically 6.5 km in city). The available roof space aspect Often the available roof space is insufficient for all on-train voice, ATP data, condition based monitoring etc. radio needs. Establishing the actual port to port isolation for all combinations of train roof co-located antennas is the starting point in determining the minimum antenna separation requirement. The actual worst case port to port isolation figure can then be replicated in controlled environment to determine the actual receiver blocking performance for the particular radio transceiver make and model or to validate compliance against the generic receiver blocking performance parameters. Fig. 7. Five antennas co-located in close proximity. 9. FURTHER OPPORTUNITIES The migration to an IP based scheme represents an opportunity of selecting any digital radio transmission technology that implements a compatible IP interface. The vast diversity of implementation environments and differing railway needs does not justify committing to a single data radio transmission technology option. An ETCS over IP implementation allows combining a number of digital radio technologies, thus the end user railway - benefiting from selectively utilising the best features the relevant technology can offer. 10. TRENDS The ERTMS/ETCS Baseline 3 specifications 6 already recognise packet-switched services option, with further significant work currently under way in amending the Euroradio FFFIS and other specifications, to allow ETCS data transmission over a packet-switched technology, such as GPRS, while maintaining the current ETCS capabilities. The EDOR, ETCS Data Only Radio has been recognised. A number of European Commission, European Rail Agency, Trans-European Transport Network Executive Agency incentives and projects are currently proceeding at full steam, aimed at undertaking further testing and validation program to harmonize the usage of packetswitched services (GPRS based) [12, 13]. In 2013 UNIFE launched a New Generation Train Control project [14] that focus research activities on IP-based radio communication in preparing the ground for the future research and demonstration activities planned to be carried out by the SHIFT²RAIL, the first major rail research initiative at European level. Outside Europe, the effort is focused at migrating towards ETCS over IP through the use of alternative data radio technologies such as LTE and TETRA. 6 At the time of preparing this paper - only some of them e.g. Subset

11 11. CONCLUSION Migration to ETCS over an IP scheme takes us closer to the ultimate, an all-ip integrated infrastructure milestone. This facilitates implementing a Services Oriented Architecture that allows different software modules to be implemented as interoperable services connected over the network. Shifting the processing and communications tasks from hardware to software seems to be the right direction. What is beyond doubt is that radio is the only logical technology for future train control applications and that an international approach is needed to ensure future spectrum availability and commonality of technical specifications [15]. 12. ACKNOWLEDGEMENTS The author wishes to acknowledge the contribution of Mr Edward Hawes (KOORA Pty Ltd Technical Director). 13. REFERENCES [1] ETSI TR V1.1.1, [2] European Railway Review, Vol. 21, Issue 1, 2015 [3] MORANE Radio Transmission FFFIS for Euroradio, A11T [4] ERTMS/ ETCS SRS, Subset 026 [5] EN Railway applications - Communication, signalling and processing systems - Safety related electronic systems for signalling [6] ERTMS/ ETCS Failure Modes and Effects Analysis for Transmission System in Application Level 2, Subset [7] ERTMS/ ETCS RBC-RBC Safe Communication Interface, Subset 098 [8] ERTMS/ ETCS Off-line Key Management FIS, Subset 038 [9] KPMG IT Advisory Amstelveen, April KMS WG IT Security Threat identification, Risk Analysis and Recommendations. [10] ERTMS/GSM-R Operators Group, 11 April GSM-R Packet-switched Domain Engineering Recommendations for EURORADIO transport. [11] ITU-T Y.1541 Internet protocol aspects Quality of service and network performance [12] ETCS over GPRS - EUROPEAN COMMISSION DECISION C(2012) 6939 [13] Interoperability of the rail system. Directive 2008/57/EC of the European Parliament and of the Council 17 June 2008 [14] [15] report-on- railtel-europe