Modelling and Simulation of ERTMS for Current and Future Mobile Technologies

Nowadays, train control in-lab simulation tools play a crucial role in reducing extensive and expensive on-site railway testing activities. In this paper, we present our contribution in this arena by detailing the internals of our European Railway Train Management System in-lab demonstrator. This demonstrator is built over a general-purpose simulation framework, Riverbed Modeler, previously Opnet Modeler. Our framework models both ERTMS subsystems, the Automatic Train Protection application layer based on movement authority message exchange and the telecommunication subsystem based on GSM-R communication technology. We provide detailed information on our modelling strategy. We also validate our simulation framework with real trace data. To conclude, under current industry migration scenario from GSM-R legacy obsolescence to IP-based heterogeneous technologies, our simulation framework represents a singular tool to railway operators. As an example, we present the assessment of related performance indicators for a specific railway network using a candidate replacement technology, LTE, versus current legacy technology. To the best of our knowledge, there is no similar initiative able to measure the impact of the telecommunication subsystem in the railway network availability.


Introduction
The European Commission in partnership with the European Railway Industry has just set up the SHIFT 2 RAIL joint undertaking in clear response to the increasing demands for higher capacity and higher performance in this domain.One of the key identified research issues is the development of train control in-lab demonstrators to minimize on-site testing activities.On-site testing activities may degrade performance indicators in operational railway lines, since they may introduce a waste of time and resources.The ultimate goal of our research activity is to reduce the cost of validation and verification in the development of current and future railway train control systems.In this sense, a significant effort is to be dedicated to the construction of the European Railway Train Management System (ERTMS) in-lab tools.The ERTMS is a standardized train control system consisting of two subsystems: the European Train Control System (ETCS)-the Automatic Train Protection (ATP) system-and GSM-Railway (GSM-R) as the standardized digital radio communication system based on Global System for Mobile Communications (GSM).
Although nowadays there are commercial ERTMS modelling and simulation frameworks such as ERSA tool [1], traditionally they do not include communication technologies and architectures in the same setting.And now, more than ever communication technologies and architectures affect the train control and command performance indicators and consequently, at some extent, may get an optimized configuration mode of the railway operation or may force a degraded one.
Moreover, train control and command, as a highly relevant and critical Information Technology (IT) service, need proper modelling so that "what-if" performance studies can be carried out and, consequently, new technologies and approaches, which could enhance transportation performance as a whole, can be identified.
Last but not least, European train control industry is facing the challenge of replacing the underlying and currently obsolete GSM-R technology for an emergent or a set of emergent communication technologies.Consequently, there is a need for simulation tools that allow performance evaluation of different candidate technologies.These simulation tools International Journal of Vehicular Technology should also recommend and facilitate future migration capabilities by assessing that the high constrains of the railway domain are always met.
Consequently, our contribution in this paper is to build the first, to the best of our knowledge, train control simulation framework that includes both ERTMS subsystems: the ATP system plus the complete communication technology protocol stack.Moreover, this simulation framework is focused on simulating current ERTMS and new ERTMS proposals based on IP and newer wireless technologies.
Our paper is structured as follows.In Section 2, we provide an overview on ERTMS and their different components and functionalities.In the following sections, Sections 3, 4, 5, 6, and 7, we detail the ERTMS modelling in a Discrete Event Simulation (DES) platform and how we model the complete protocol stack.Section 8 validates the model and introduces simulation results obtained from the model.Section 9 compares our proposal with other previous models for ERTMS.Finally, Section 10 provides additional details on the benefits of this tool, further research steps and conclusions.

Introduction to ERTMS
During the last twenty years the European Union (EU) has been searching for an integrated Pan-European railway system.Thus, this fact has motivated the interoperability between the signalling and train control systems from the different European railway companies.In 1994, the EU launched the ERTMS [2] as the standard for signalling and management systems in Europe.
As it was pointed out before, ERTMS consists of two blocks: ETCS and GSM-R as the standardized telecommunication subsystem.The GSM-R architecture is based on the GSM phase 2+ norm and some specific functions including addressing and voice group call.
GSM-R is used in two of the three main operational modes of ERTMS.In fact, there are more than three operational modes, for instance, for fail over and for coexistence of trains equipped with ERTMS and tracks with national signalling system, but the following ones are the main operational modes of ERTMS.
Level 1.The track is equipped with Eurobalises and optionally with Euroloops.Both devices under normal circumstances are switched off, but when the train crosses over them they are switched on by electromagnetic induction and send information about the speed limit that must be fulfilled by the On-Board Unit (OBU) located inside the train.
Level 2. The OBU established a permanent communication with the Radio Block Centre (RBC) by using a GSM-R circuit.The safety instructions are provided by the RBC to the OBU and the track must be equipped also with Eurobalises, which are only used for positioning purposes.
Level 3. In this level, positioning and integrity of the train are performed by the train itself instead of being carried out by the track.There is only a permanent GSM-R communication between the OBU and the RBC, and there is no need for locating Eurobalises or Euroloops on the track side.
ERTMS Levels 2 and 3 require a permanent communication between the OBU and the RBC.Thanks to this permanent circuit, it is possible to continuously monitor and command trains from the remote command centre by using the ATP system, which is the ETCS in the ERTMS.
In 1994, the decision in favour of GSM-R technology was based on GSM success in the European mobile telecom industry.In fact, an important step in the railway communication scenario took place with GSM-R.In the last few years, railway communication architectures have migrated from a juxtaposition of different, and mostly proprietary, communication solutions each of them addressing a specific IT service to a single unique and integrated telecom architecture based on an open standard as GSM-R.
Current specifications of ERTMS [3] define the GSM-R interface and the protocols required for the communication between the OBU and the RBC.ISO 7776/ISO 3309 are the data link layer protocols required by the ERTMS specification.T.70 is the network protocol and X.224 the transport protocol.On top of these layers, the EuroRadio protocol is used to establish safety connections between the train and the RBC.Finally, the ATP application on top of EuroRadio sends and receives ETCS messages to guarantee safety and prevent train collisions.
Nowadays, there is a controversy regarding the possibility to evolve from GSM-R towards a more robust, efficient, and modern wireless technology [4,5].This evolution seems essential to leave an outdated wireless technology with many shortcomings [6] and to embrace the opportunities provided by latest technologies [7].There are multiple alternatives such as the natural evolution from GSM-R towards General Packet Radio Service (GPRS) [8] or the possibility to migrate directly to Worldwide Interoperability for Microwave Access (WiMAX) [9] or Long Term Evolution (LTE) [10].In any case, these newer wireless technologies are based on the IP family of protocols and not on the previously briefly described one.So, this change would imply not only a change of the wireless technology but also a significant change of the underlying protocols that are used in the ERTMS.
In the following sections, we explain how we have modelled the current ERTMS specification and how we model also ETCS over other network technologies in order to get valuable information for any migration plan.

Approach to Model ERTMS
This section and the following ones describe the internals of our integrated ERTMS simulation framework.Our context of work is to model the bidirectional ETCS traffic exchanged between trains and RBC over different communication protocols and network technologies mainly focused on GSM-R and LTE. Figure 1 simplifies the understanding of the communication architecture via three main blocks: application block, communication protocols, and wireless technologies that must be considered when modelling legacy and next generation IP-based ERTMS.
To build the model, specially the legacy one, we followed current specifications of ERTMS/ETCS published by the European Railway Agency (ERA).More specifically, we focused on the second set of specifications available.The EuroRadio FIS document [3] defines the technologies and communication protocols used for the current ERTMS specification.On the other hand, the use of new wireless technologies also implies the use of IP instead of the current protocol stack.Nowadays, there is no standard to follow in order to build our simulation apart from some documents studying the possible evolution from GSM-R [4] or the requirements to use GPRS instead of GSM-R [11].Thus, the model built for this new evolution of ETCS is flexible enough to test different approaches.
The model is implemented in Riverber Modeler [12], formerly known as Opnet Modeler, a general-purpose DES framework focused on networking.Riverbed Modeler was selected because of the high number of protocols and technologies supplied and the broad support available.Furthermore, we have completed the Riverbed Modeler with specific libraries for the railway communication domain not so common out of this domain and obviously not available until now in the simulation framework.
Following, we explain the implementation details of the three main building blocks of our ERTMS simulation framework developed in Riverbed Modeler.

Modelling the ATP Application and Safety Layer
According to Figure 1 two layers are equally used regardless of the communication protocols or network technology used below: the ATP application and the EuroRadio protocol.

ATP Application.
The ATP application is responsible for providing safety in the railway domain.This implies blocking the application of actions by the driver or even activating the emergency brake automatically in trains without requiring the intervention of the driver.Generally, ATP applications consist of one client-server architecture where the client, which is the OBU inside the train, must enforce safety measures ordered by the remote RBC.The communication between these two components, in the case of the ERTMS signalling system, is performed via ETCS messages.ETCS messages are defined in the System Requirements Specification document [13] of the ERMTS specification.The document defines the type and format of ETCS messages.However, it does not provide information about the ETCS message flow because it depends on the ATP implementation basis and the specific operational state of the train.
Consequently, in order to model a realistic ETCS message exchange, we have made use of the standardized routines and we use as a reference for implementation a real trace of ETCS messages, which was provided by a train operator.A piece of this real trace is detailed in Table 1.
In the trace in Table 1, the first three messages are required to establish an ETCS connection between the train and the RBC.Once the session is established, three additional messages are required in order to exchange the capabilities of the two devices that form the ETCS connection.From that moment on, normal operation begins: RBC sends periodically General Messages, which must be acknowledged by the train; RBC sends Movement Authorities to allow the train to continue moving whereas the train answers them with acknowledgment messages; and the train sends Position Report messages to inform the RBC about its current location.If there is any loss of communication, this process should begin again by reestablishing the ETCS connection and exchanging the Validated Train Data information.
This message exchange has been implemented in Riverbed Modeler with different models for the train and the RBC.For example, the model for the ATP application in the train node is shown in Figure 2. The model for the RBC is symmetrical but more complex in order to support multiple train connections simultaneously.
These models can be easily configured before launching the simulation.For example, Figure 3 details the configuration options for the train.In this case, it is possible to configure when the train must try the connection with the RBC, the connection retry period in case of connection loss, the frequency for sending Position Report ETCS messages, if Movement Authority Request ETCS messages should be sent and its frequency, and so forth.
Apart from these models, eleven ETCS message formats have been fully defined in Riverbed Modeler. Figure 4 shows the format of the Position Report message.This detailed characterization allows setting the exact number of bytes per message to get realistic throughput estimations and it also allows   using the desired fields to implement specific functionalities in our models.For example, in the Position Report messages D LRBG and V TRAIN fields are used to report the actual position and speed of the train to the RBC.Depending on that information, the RBC sends Movement Authority messages to the train to allow the movement of the train up to a specific position and under a specific speed limit.When this position is reached or the ETCS connection is lost, the train stops.Thus, the model can simulate how a communication loss impacts the availability of the train service.

EuroRadio
Protocol.This protocol is also known as Safety Layer or Safe Functional Module in [3].This layer provides safe communications to the upper ATP application.It performs firstly peer entity authentication in order to establish a safe connection among peers and it also verifies the integrity of every message exchanged.If there is any error in the authentication of peers or in the integrity of messages, the safe connection is released or optionally an error is reported to the upper application.All the ETCS data is protected by this layer, but the high priority data.This protocol is considered to be used even in new deployments based on the IP protocol, although in a future this layer could be replaced by other protocols used already in Internet such as SSL/TLS or IPsec.Instead of implementing the full protocol, a first basic model of this protocol is included in the ERTMS model.This model adds overhead bytes corresponding to the EuroRadio protocol headers to the ATP application's ETCS messages in order to pass them to the lower layer and it also removes them before passing the ETCS messages from the lower layer to the ATP application.
This layer has been implemented in a flexible manner, so that it can be connected to the X.224 model, in the case of modelling the legacy ERTMS, or to the Transport Adaptation Layer (TPAL) Application Programming Interface (API) of Riverbed Modeler, to model novel IP-based ERTMS approaches.

Modelling the Communication Protocols
Depending on the wireless technology used, communication protocols must be selected accordingly.Currently, in the railway high speed domain, there are two main approaches: to use the OSI protocol stack defined in the document for GSM-R, the legacy solution, or to use the IP based protocols for new IP-based wireless technologies such as GPRS or LTE.

OSI Protocols.
Communication protocols used by the current ERTMS specification [13] are X.224, T.70, and LAPB.Riverbed Modeler lacks the implementation of X.224 and T.70 and the provided LAPB implementation must be also modified.

X.224 Protocol.
It is a transport protocol defined by ITU-T [14].It supports five transport classes, which offer different transport functionalities.However, ERTMS specification [3] only uses the 2nd transport class (TP2), which is similar to TP1 but with the functionality for multiplexing X.224 transport connections over the same network connection.Furthermore, ERTMS specification also implements a customized version of TP2 with some changes to standard TP2.For instance, the segmentation and reassembling mechanism of TP2 is not used in the X.224 implementation for ERTMS.
The X.224 model we have developed for Riverbed Modeler provides the functionalities of X.224 TP2 with the specific customizations required for ERTMS.This model supports multiplexing of multiple transport connections.In order to do that, we use two models: first model, the parent model, which processes every X.224 packet and forwards it to the second model, the child model, which is responsible for managing the X.224 connection the packet belongs to. Figure 5 shows the X.224 child process that manages one X.224 connection.

T.70 Protocol.
It is a network protocol defined by ITU-T [15], which must interact with the transport and link layers.The implementation for ERTMS specification [3] states that this layer must only add the header bytes-2 bytes-and provide segmentation and reassembly functionality.

LAPB Protocol.
The data link layer is covered by the HDLC standards with specific customizations for the railway domain, which are detailed in EuroRadio FIS document [3].Furthermore, Table 41 of [3] recommends values ranges to configure parameters of the LAPB protocol.It is worth mentioning that in order to have accurate network performance it is critical to model this protocol correctly, because packet retransmissions are carried out by this layer.
Riverbed Modeler comes with a current implementation of the LAPB protocol.Nevertheless, it was needed to check that it meets the HDLC standards with the required modifications according to the EuroRadio FIS document [3] and to configure it with the recommended values for the railway domain.Moreover, the model was also modified to be able to run with the TDMA wireless model and the T.70 model since the original implementation was supposed to work only with the X.25 family of protocols.

IP Protocols.
Riverbed Modeler supplies an in-depth library of models for IP related protocols.Thus, no new protocols are required to be modelled and the TPAL API of Riverbed Modeler is used to connect the developed EuroRadio layer with the transport protocol.
The main advantage of the TPAL API is that it abstracts the specific underlying transport protocol.In this way, the upper layer can easily change between UDP or TCP simply by changing the value of a configuration parameter instead of coding the support for both protocols.
Although initially it is possible to use UDP and TCP, we are making use of TCP to transfer ETCS messages because it provides a guarantee and ordered data transmission similar to the one required by the legacy ERTMS specification, which is provided with the LAPB protocol.

Modelling the Wireless Technologies
Current ERTMS is built on top of GSM-R.However, Riverbed Modeler lacks specific GSM or GSM-R implementation.Instead, it has a generic Time Division Multiple Access (TDMA) wireless model, which we use to emulate GSM/GSM-R wireless links.The TDMA model is able to provide a time slot with the required bandwidth in the frequency band for GSM and GSM-R networks, and so we can simulate and study the ETCS data traffic sent through this channel.
On the other hand, in order to use newer wireless technologies, Riverbed Modeler already provides a detailed implementation of modern IP-based wireless technologies such a WiFi, WiMAX, or LTE.In fact, these implementations make use of detailed channel model characterization for different mobility and environment patterns that can be used for exhaustive propagation studies.

Modelling the ERTMS Nodes
Once all the required protocols and technologies have been developed, we define the different types of nodes involved in the ETCS communication flow.Figure 6   types of nodes involved.The train or OBU and the RBC are the main components of the system.These nodes support the ATP service and exchange ETCS messages between them.The rest of the elements are the devices used to model the GSM-R and LTE networks.As depicted in Figure 7, legacy train and RBC make use of all the protocol layers required to encapsulate ETCS messages before sending them through the GSM-R end-to-end circuit.The models used by the rain and RBC are quite similar, the main differences are located in the ATP application and the physical interfaces.On the one hand, ATP applications are different because the ATP application of the RBC must support multiple instances simultaneously in order to control multiple trains simultaneously.On the other hand, the train has a GSM-R interface that is emulated with the TDMA model, whereas the RBC has a wired interface.
Similarly, in an IP-based ERTMS scenario such as LTE in Figure 6(b), nodes that Riverbed Modeler supplies with the desired wireless technology-in this case LTE-can be modified to include the ATP application and EuroRadio layer on top of the TPAL layer of the node.Moreover, wireless base stations already modelled by Riverbed Modeler can be used to build the desired communication network.Figure 8 shows a LTE node of Riverbed Modeler modified to support ERTMS over LTE and consequently it performs as a train.

Simulation Results
In this section we present the results obtained from simulating the scenarios defined in Figure 6 for GSM-R and LTE communications.In this scenarios, the train is moving from west to east at 50 km/h for 15 minutes.The train establishes a ETCS connection with the RBC thanks to the existent wireless communication access to the base station.It is worth pointing out that we are applying the same ETCS configuration for both scenarios in order to be able to compare them.In fact, Figure 3 details the ETCS configuration applied in both scenarios.
Firstly, in order to validate the correct operation of the simulation framework, we generate a detailed log that contains all the ETCS messages exchanged between every train and the RBC during the simulation.By crossing the real ETCS trace, which was provided by a train operator, and this log, we can verify that the exact sequence of ETCS messages has been replicated correctly in the simulation tool.Table 2 details a piece of the logs obtained running a simulation for the reference scenario shown in Figure 6(a).
Since we are applying the same ETCS configuration in both scenarios, the rate of ETCS messages, shown in Figure 9, is exactly the same in both scenarios.
However, as it is shown in Figure 10, the bitrate of data sent or received through GSM-R or LTE is quite different due to the different protocol layers used in each case.Thus, the TCP/IP protocol family introduces more overhead in the communication.Nevertheless, this issue is not meaningful since it is still quite low and LTE is a broadband wireless communication technology and provides more bandwidth than GSM-R.
Another important key parameter is the latency in the message exchange between the train and the RBC, graphically depicted in Figure 11.GSM-R offers a more stable latency with less jitter, although the latency is significantly higher than in the case of using LTE.This result is caused by the use of GSM Circuit Switched Data (CSD) in transparent mode, a dedicated circuit, which is the data mode that must be used in ERTMS according to the specifications and that provides International Journal of Vehicular Technology a constant delay in the transmission independently of the network load.On the other hand, the evolution of GSM towards new broadband wireless technologies implies the migration from circuit switching technologies to packet switching.These packet switching technologies offer a much better delay but they are prone to higher jitter indicators.
Finally, GSM-R has a limitation in the capacity of trains due to the number of circuits available per cell.In fact, busy junction scenarios represent one of the key limitations of currently deployed legacy GSM-R technology and it is one of the reasons to consider other wireless technologies.On the other hand, broadband wireless candidate replacement technologies such as LTE use packet switching technology and thus it does not have such a limit.However, there is an implicit limit due to the best-effort policies, which are usually applied in packet switching technologies.These policies, in loaded network conditions, may degrade the communication performance by increasing the latency, the jitter, and the packet losses.To solve this issue, it will be necessary to limit the traffic up to a certain level or to enforce Quality of Service (QoS) mechanisms.
Figure 12 shows the mean latency experienced in the communication between one specific train and the RBC  when there are multiple trains connected to the same base station.In this figure, different scenarios are evaluated: a single train scenario versus a 10-train scenario and a 20-train scenario.All these scenarios are realistic scenarios and correspond to different busy junctions.In order to obtain statistically valid results, the simulations were performed 30 times for each case.As it is shown, the mean latency of the ETCS connection increases on the basis of the network load.By modelling the full protocol stack-specific ETCS application layer included-this simulation framework provides valuable guidance to identify the maximum number of trains in busy junction scenarios for the different candidate communication technologies or even to consider the provision of additional data services verifying that the QoS of the ETCS traffic is not affected.

Related Work
The complexity of the ERTMS leads to the use of ERTMS modelling and simulation platforms for mainly three purposes: (1) to verify and validate implementations, (2) to carry out performance and "what-if" analysis on ERTMS, and (3) to study new proposals.
Firstly, the second set of the ERTMS specification covers a complex group of documents, actually more than 50, which are constantly evolving and generating new versions.Thus, it is not easy to guarantee the fulfilment of standards and the interoperability between software implementations of different manufacturers.For example, in order to prevent specification errors, authors in [16] propose a model for formal verification and validation of the implementations.As the aim of the presented tool is the reduction of costs associated with the field test of signalling deployments by simulating them, formal modelling of ERTMS does not apply.However, both strategies play a key role in a common strategy, which is the reduction of the CAPEX associated with the deployment of a new product and the decrease of OPEX derived from the reservation of railway corridors for the field tests.Our model is not a real implementation.Moreover, it is based on a real trace of ERTMS devices that are supposed to pass all the required validations.Thus, the validation of our model is firstly carried out against this real trace and secondly against the set of ERTMS specifications.As a future research point, we will integrate our simulation platform with external ERTMS/ETCS devices or software implementations already validated thanks to the use of System-in-the-Loop (SITL) and the ESYS module of Riverbed Modeler.Thus, it would be possible to test different ETCS use-cases with the communication protocols and ERTMS nodes developed in our simulation platform without requiring the implementation and validation of these specific ETCS use-cases in the simulation platform.
Secondly, some models are used to carry out performance analysis on ERTMS.In this sense, [17] presents a Unified Modeling Language (UML) model for the ERTMS Level 2. This model can be used to perform simulations and obtain the Reliability, Availability, and Maintainability (RAM) values in order to verify that the railway system is meeting specific RAM goals such as a specific value of unavailability.However, this proposal does not model properly the communication subsystem.In fact, the network failure is modeled according to probabilities to have a failure or to recover from a failure.Instead, our model could be used to obtain the network failure statistics of one specific scenario.
Finally, as mentioned before, there is also an important piece of work on developing models to study new proposals.In this sense, authors in [18] and in [19] present models to study new communication proposals.
Authors in [18] explain the use of satellites technologies for railway localization and perform simulations to study RAM properties of the proposed system.Our model is used for OBU-RBC communication and not for railway localization.Consequently, it could be also used to study OBU-RBC communication via satellite since Riverbed Modeler supports satellite communications and terrain modelling.Thanks to this study, it could be verified if this kind of communication meets the QoS requirements for GSM-R defined in the Subset-093 [20], EIRENE SRS [21], and EIRENE FSR [22], and it could be also possible to compare obtained QoS values with those obtained from the GSM-R model thanks to applying the same ATP to different communication technologies.
Authors in [19] also propose to use Riverbed Modeler, named it as Opnet Modeler in the paper, to validate the migration towards LTE.However, this proposal does not model ETCS as a process but as a specific flow of unformatted packages.Modelling ETCS as a process offers the advantage of modelling more realistically the protocol and also its procedures like error handling and reconnection.Furthermore, as said before, our ETCS model can be applied to different protocol stacks to compare simulation results among them.

Conclusion
In this paper we present the internals of our ERTMS model developed over a DES platform.This tool is an integrated simulation framework to study the network performance of the ERTMS communications between the OBU and the RBC and its impact on the availability of the train service.Thanks to the developed framework, ERTMS communications can be tested against unusual situations such as abnormal electromagnetic conditions or specific GSM-R deployments, which could be quite costly and difficult to check in real deployments or even in controlled environments such as small labs.Apart from that, this model is a crucial tool to study innovative approaches and strategies that affect train communications.Thus, for example, the current trend on considering IP and new wireless technologies for the next ERTMS specification can also benefit from this simulation model in order to assess and validate approaches against the constrains of the railway domain and the specific applications used in this domain.Last but not least, the modelling methodology presented in this work may serve as a reference to other approaches to model other critical industrial communication services and protocols.

Figure 2 :
Figure 2: Model for the ATP application of the train.

Figure 3 :
Figure 3: ETCS configuration options for the train.

Figure 4 :
Figure 4: Format of the Position Report ETCS message.

Figure 6 :
Figure 6: Simulation scenarios for ERTMS over GSM-R and LTE.
shows two reference scenarios to simulate ERTMS over GSM-R, based on OSI protocols, and ERTMS over LTE, based on IP protocols.They are ERTMS simplified scenarios showing all the different

Figure 7 :
Figure 7: Train and RBC models for ERTMS over GSM-R.

Figure 8 :Figure 9 :Figure 10 :
Figure 8: Model of one Riverbed Modeler LTE node modified to support ERTMS.

Figure 12 :
Figure 12: ETCS latency with LTE and different network load.

Table 1 :
A piece of the real ETCS trace used to implement and validate the ATP application.