02016R0919 — EN — 16.06.2019 — 001.001

This text is meant purely as a documentation tool and has no legal effect. The Union's institutions do not assume any liability for its contents. The authentic versions of the relevant acts, including their preambles, are those published in the Official Journal of the European Union and available in EUR-Lex. Those official texts are directly accessible through the links embedded in this document

►B COMMISSION REGULATION (EU) 2016/919 of 27 May 2016 on the technical specification for interoperability relating to the ‘control-command and signalling’ subsystems of the rail system in the European Union (Text with EEA relevance) (OJ L 158 15.6.2016, p. 1)

Amended by:





Corrected by:









▼B

COMMISSION REGULATION (EU) 2016/919

of 27 May 2016

on the technical specification for interoperability relating to the ‘control-command and signalling’ subsystems of the rail system in the European Union

(Text with EEA relevance)







Article 1

Subject matter

The technical specification for interoperability (TSI) relating to the control-command and signalling (CCS) subsystems of the rail system in the European Union, as set out in the Annex, is hereby adopted.

Article 2

Scope

▼M1

1. The TSI shall apply to all new, upgraded or renewed ‘trackside control-command and signalling’ and “on-board control-command and signalling subsystems of the rail system as defined in points 2.3 and 2.4 of Annex II to Directive (EU) 2016/797 of the European Parliament and of the Council ( 1 ). Section 7.2.1a of the Annex shall apply to all changes to an existing On-Board subsystem.

▼B

2. The TSI shall not apply to existing ‘trackside control-command and signalling’ and ‘on-board control-command and signalling’ subsystems of the rail system already placed in service on all or part of any Member State’s railway network on the day this Regulation enters into force, except when the subsystem is subject to renewal or upgrading in accordance with ►M1 ————— ◄ Section 7 of the Annex.

▼M1 —————

▼B

4. The technical and geographical scope of the TSI is set out in points 1.1 and 1.2 of the Annex.

Article 3

Open points and specific cases

1. Within six months of the entry into force of this Regulation, each Member State shall send to the other Member States and the Commission a list of bodies designated in accordance with ►M1 Article 14 of Directive (EU) 2016/797 ◄ to carry out the conformity assessment and verification procedures in respect of:

(a) the open points specified in Annex G;

(b) the specific cases set out in point 7.6.2 of the Annex;

2. If a Member State has already sent this information pursuant to previous Commission Decisions, it shall be considered to have met this obligation.

Article 4

Projects at an advanced stage of development

In accordance with Article 9(3) of Directive 2008/57/EC, each Member State shall communicate to the Commission a list of projects being implemented within its territory and are at an advanced stage of development. This list shall be sent within one year of the entry into force of this Regulation.

▼M1 —————

▼B

Article 6

Implementation

1. Suppliers and applicants for authorisation for placing in service shall ensure that all equipment referred to in Article 2.1 and intended to be used on the networks referred to in Article 2(3) complies with the TSI set out in the Annex of this Regulation.

2. Notified bodies shall ensure that certificates based on the TSI set out in the Annex of this Regulation, specifically on the provisions set out in point 6, are issued within their responsibilities in accordance with ►M1 Articles 10 and 15 of Directive (EU) 2016/797 ◄ .

3. National safety authorities shall, within their responsibilities according to ►M1 Article 16 of Directive (EU) 2016/798 of the European Parliament and of the Council ( 2 ) ◄ of the European Parliament and of the Council ( 3 ), ensure that all equipment referred to in Article 2 and placed in service in their territory complies with the TSI set out in the Annex of this Regulation.

4. Member States shall draw up a national implementation plan, describing their actions to comply with this TSI, in accordance with Section 7 of the Annex, setting out the steps to be followed for the implementation of fully interoperable ‘control-command and signalling’ subsystems.

5. Member States shall send their national implementation plan to the other Member States and the Commission within one year of entry into force of this Regulation.

Article 7

Availability of ETCS on-board products compliant with Baseline 3 specifications

The Agency will prepare by 1 January 2018 a report to the Commission on the availability of ETCS on-board products compliant with Baseline 3 specifications. The Commission will present it to the Committee referred to in Article 29(1) of Directive 2008/57/EC and take appropriate measures.

Article 8

Class B systems

Member States shall ensure that the functionality, performance and interfaces of the Class B systems remain as currently specified, except where modifications are needed to mitigate safety-related flaws in those systems.

Article 9

EU-funded projects

1. ETCS shall be installed in railway infrastructure projects receiving financial support from European funds when:

(1) installing the train protection part of a CCS subsystem for the first time; or

(2) upgrading the train protection part of a CCS subsystem already in service, where upgrading changes the functions or the performance of the subsystem.

2. The Commission may grant a derogation from the obligation laid down in the paragraphs above when signalling is renewed on short (less than 150 km) and discontinuous sections of a line and provided that ETCS is installed before the earlier of these two dates:

— 5 years after the end of the project,

— the date on which the section of the line is connected to another ETCS equipped line.

3. The Member State concerned shall send the Commission a file with an economic analysis of the project showing that there is a substantial economic and/or technical advantage in putting ERTMS into service at the earlier of the two dates mentioned in the previous paragraph rather than during the course of the EU-funded project.

4. The Commission shall examine the file and the measures proposed by the Member State and shall inform the committee referred to in ►M1 Article 51(1) of Directive (EU) 2016/797 ◄ of its findings. If the Commission grants a derogation, the Member State shall ensure that ERTMS is installed before the earlier of the two dates mentioned in paragraph 2.

5. This derogation shall not prevent application of ►M1 Article 2(1) of Commission Implementing Regulation (EU) 2017/6 ( 4 ) and point 7.4.1.1 of the Annex to this Regulation. ◄

▼M1

Article 10

Error corrections

If errors that do not allow the system to provide a normal service are detected, the Agency shall of its own motion or at the request of the Commission identify as soon as possible solutions to correct them and an evaluation of their impact on the compatibility and stability of the existing ERTMS deployment. In such cases, the Agency shall send to the Commission an opinion on such solutions and the evaluation. The Commission shall analyse the Agency's opinion, assisted by the committee referred to in Article 51(1) of Directive (EU) 2016/797, and may recommend that the solutions specified in the Agency's opinion apply until the next revision of the TSI.

Article 11

ERTMS game changers

1. By June 2021, taking into consideration the input from Shift2Rail and the Agency, the Commission shall issue a report on the definition of the next generation communication system. The report shall include the conditions and possible strategies for the migration to that system with due considerations for the coexistence of the system and spectrum requirements.

2. Where the Agency has issued an opinion with the draft release specifications relating to an ERTMS game changer as identified within ERA-REP-150, suppliers and early implementers shall use those specifications in their pilots and shall inform the Agency.

▼M1

Article 11a

ERTMS compatibility and future revision

1. By 1 June 2020, the Agency shall send a report to the Commission on the implementation of ETCS system compatibility (ESC) and radio system compatibility (RSC). The report shall include an assessment of the differing types of ESC and RSC, and the potential for reducing the underlying technical divergences of ESC and RSC types. Member States shall provide the Agency with the necessary information to complete the analysis.

2. By 1 December 2021, the Commission shall, based on input from the Agency, define the necessary steps to eliminate the tests or checks to prove technical compatibility of on-board units with different ERTMS trackside implementations, in particular to achieve harmonisation of engineering and operational rules at Member State level and between Member States. Member States shall provide the Commission and the Agency with the necessary information to complete the analysis.

3. By 1 December 2020, the Agency shall send a report to the Commission on the potential for including further elements of trackside and vehicle control-command and signalling system architecture, in particular to achieve a future proof design, facilitating the use of state of the art technology and ensuring backward compatibility.

▼B

Article 12

Repeal

Decision 2012/88/EU is repealed.

Article 13

Transitional provisions

Points 7.3.1, 7.3.2, 7.3.4 and 7.3.5 of the Annex III to Decision 2012/88/EU shall apply until the date of application of the implementing acts referred to in Article 47(2) of Regulation (EU) No 1315/2013.

▼M1

2. Member States may only in duly justified cases permit applicants not to apply Section 7.4.2.1 of the Annex pursuant to Article 7(1)(a) of Directive 2016/797/EC for projects for which the possibility to apply section 7.4.2.3 of the Annex exists or has expired. The application of section 7.4.2.3 of the Annex does not require the application of Article 7(1)(a) of Directive 2016/797/EC.

3. Without prejudice to sections 6.1.2.4 and 6.1.2.5 of the Annex, applicants may continue to apply the provisions of the original version of Regulation (EU) 2016/919 (and relevant Agency opinions) when applying for authorisation of:

(a) trackside projects which are at an advanced stage of development at the date of entry into force of this Regulation; and

(b) on-board projects developed in accordance with ERTMS specifications #2 or #3 listed in Table A.2 of Annex A which are at an advanced stage of development at the date of entry into force of this Regulation.

▼B

Article 14

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.









ANNEX

Technical specification for interoperability relating to the ‘control-command and signalling’ subsystems of the rail system in the European Union

TABLE OF CONTENTS 1. Introduction 1.1. Technical scope 1.2. Geographical scope 1.3. Content of this TSI 2. Subsystem definition and scope 2.1. Introduction 2.2. Scope 2.3. Trackside Application Levels (ETCS) 3. The Essential Requirements for the Control-command and signalling Subsystems 3.1. General 3.2. Specific Aspects of the Control-Command and Signalling Subsystems 3.2.1. Safety 3.2.2. Reliability and Availability 3.2.3. Health 3.2.4. Environmental Protection 3.2.5. Technical Compatibility 3.2.5.1. Engineering Compatibility 3.2.5.1.1 Physical environmental conditions 3.2.5.1.2 Railway Internal Electromagnetic Compatibility 3.2.6. Accessibility 4. Characterisation of the Subsystems 4.1. Introduction 4.1.1. Basic parameters 4.1.2. Overview of the requirements 4.1.3. Parts of Control-command and Signalling Subsystems 4.2. Functional and technical specifications of the Subsystems 4.2.1. Control-Command and Signalling reliability, availability and safety characteristics relevant to interoperability 4.2.1.1. Safety 4.2.1.2. Availability/Reliability 4.2.2. On-board ETCS functionality 4.2.3. Trackside ETCS functionality 4.2.4. Mobile communication functions for railways GSM-R 4.2.4.1. Basic communication function 4.2.4.2. Voice and operational communication applications 4.2.4.3. Data communication applications for ETCS 4.2.5. ETCS and GSM-R air gap interfaces 4.2.5.1. Radio communications with the train 4.2.5.2. Eurobalise communication with the train 4.2.5.3. Euroloop communication with the train 4.2.6. On-Board Interfaces Internal to Control-Command and Signalling 4.2.6.1. ETCS and Class B train protection 4.2.6.2. Interface between GSM-R Radio Data Communication and ETCS 4.2.6.3. Odometry 4.2.7. Trackside Interfaces Internal to Control-Command and Signalling 4.2.7.1. Functional interface between RBCs 4.2.7.2. RBC/RBC 4.2.7.3. GSM-R/trackside ETCS 4.2.7.4. Eurobalise/LEU 4.2.7.5. Euroloop/LEU 4.2.8. Key Management 4.2.9. ETCS-ID Management 4.2.10. Trackside Train Detection Systems 4.2.11. Electromagnetic Compatibility between Rolling Stock and Control-Command and Signalling trackside equipment 4.2.12. ETCS DMI (Driver-Machine Interface) 4.2.13. GSM-R DMI (Driver-Machine Interface) 4.2.14. Interface to Data Recording for Regulatory Purposes 4.2.15. Visibility of trackside Control-Command and Signalling objects 4.2.16. Construction of equipment used in CCS subsystems 4.2.17. ETCS and Radio System Compatibility 4.2.17.1. ETCS System Compatibility 4.2.17.2. Radio System Compatibility 4.3. Functional and technical specifications of the interfaces to other Subsystems 4.3.1. Interface to the Operation and Traffic Management Subsystem 4.3.2. Interface to the Rolling Stock Subsystem 4.3.3. Interfaces to Infrastructure Subsystem 4.3.4. Interfaces to Energy Subsystem 4.4. Operating rules 4.5. Maintenance rules 4.5.1. Responsibility of the manufacturer of equipment 4.5.2. Responsibility of the applicant for subsystem verification 4.6. Professional competences 4.7. Health and safety conditions 4.8. Registers 4.9. Route compatibility checks before the use of authorised vehicles 5. Interoperability Constituents 5.1. Definition 5.2. List of interoperability constituents 5.2.1. Basic interoperability constituents 5.2.2. Grouping of interoperability constituents 5.3. Constituents’ performance and specifications 6. Assessing the conformity and/or suitability for use of the constituents and verifying the subsystems 6.1. Introduction 6.1.1. General principles 6.1.1.1. Compliance with basic parameters 6.1.1.2. Essential requirements fulfilled by National Rules 6.1.1.3. Partial fulfilment of TSI requirements 6.1.2. Principles for testing ETCS and GSM-R 6.1.2.1. Principle 6.1.2.2. Operational test scenarios 6.1.2.3. Requirements for Operational test scenarios 6.1.2.4. Requirements for ETCS System Compatibility 6.1.2.5. Requirements for Radio System Compatibility 6.2. Interoperability constituents 6.2.1. Assessment procedures for Control-Command and Signalling Interoperability Constituents 6.2.2. Modules for Control-Command and Signalling Interoperability Constituents 6.2.3. Assessment requirements 6.2.4. Special issues 6.2.4.1. Mandatory tests for the on-board ETCS 6.2.4.2. The Specific Transmission Module (STM) 6.3. Control-Command and Signalling Subsystems 6.3.1. Assessment procedures for Control-Command and Signalling Subsystems 6.3.2. Modules for Control-Command and Signalling Subsystems 6.3.2.1. On-board Subsystem 6.3.2.2. Trackside Subsystem 6.3.2.3. Conditions for using modules for On-board and Trackside Subsystems 6.3.3. Assessment requirements for an On-board Subsystem 6.3.3.1. ETCS and radio system compatibility checks 6.3.4. Assessment requirements for a Trackside Subsystem 6.4. Provisions in case of the partial fulfilment of TSI requirements 6.4.1. Assessment of parts of control-command and signalling subsystems 6.4.2. Assessment in case of application of National Rules 6.4.3. Partial fulfilment of the requirements due to limited application of the TSI 6.4.3.1. Interoperability constituents 6.4.3.2. Subsystems 6.4.3.3. Content of certificates 6.4.4. Intermediate Statement of Verification 6.5. Management of errors 7. Implementing the TSI Control-Command and Signalling 7.1. Introduction 7.2. Generally applicable rules 7.2.1. Upgrading or renewing the Control-Command Subsystems or parts of them 7.2.1a. Changes to an existing On-Board subsystem 7.2.1a.1. Rules to manage changes in on-board CCS subsystems 7.2.1a.2. Conditions for a change in the On-board ETCS functionality that does not impact the basic design characteristics 7.2.1a.3. Conditions for a change in the on-board mobile communication functions for railways that does not impact the basic design characteristics 7.2.1b. Changes to an existing trackside subsystem 7.2.1b.1. Rules to manage changes in trackside CCS subsystems 7.2.1b.2. Conditions for a change in the trackside ETCS functionality that, if not fulfilled, requires new authorisation for placing in service 7.2.1b.3. Conditions for a change in the trackside mobile communication functions for railways that if not fulfilled requires a new authorisation for placing in service 7.2.1b.4. Impact on the technical compatibility between on-board and trackside parts of the CCS subsystems 7.2.2. Legacy systems 7.2.3. Availability of Specific Transmission Modules 7.2.4. Additional Class B equipment on a line equipped with Class A 7.2.5. Rolling stock with Class A and Class B equipment 7.2.6. Conditions for mandatory and optional functions 7.3. GSM-R specific implementation rules 7.3.1. Trackside installations 7.3.2. On-board installations 7.4. ETCS specific implementation rules 7.4.1. Trackside installations 7.4.1.1. High-speed network 7.4.2. On-board installations 7.4.2.1. New vehicles 7.4.2.2. Upgrading and renewal of existing vehicles 7.4.2.3. Application of the TSI requirements for new vehicles during a transition phase 7.4.3. Additional requirements 7.4.4. National Implementation Plans 7.4a. ETCS and radio system compatibility checks implementation rules 7.5. Train detection systems specific implementation rules 7.6. Specific cases 7.6.1. Introduction 7.6.2. List of specific cases 7.6.2.1. Belgium 7.6.2.2. UK 7.6.2.3. France 7.6.2.4. Poland 7.6.2.5. Lithuania, Latvia and Estonia 7.6.2.6. Sweden 7.6.2.7. Luxembourg 7.6.2.8. Germany 7.6.2.9. Italy 7.6.2.10. Czech Republic 7.6.2.11. The Netherlands Annex A Annex B Annex C Annex D Annex E Annex F Annex G

1. INTRODUCTION

1.1. Technical scope

This TSI concerns the Control Command and Signalling On-board Subsystem and the Control-Command and Signalling Trackside Subsystem.

This TSI is applicable to control-command and signalling trackside Subsystems of the rail network defined in the point 1.2 (Geographical scope) of this TSI and to the control-command and signalling on-board subsystems of vehicles which are (or are intended to be) operated on it. These vehicles are of one of the following types (as defined in ►M1 Annex I point 2 of Directive (EU) 2016/797 ◄ ):

▼M1

(1) locomotives and passenger rolling stock, including thermal or electric traction units, self-propelling thermal or electric passenger trains, and passenger coach, if equipped with a driving cab.

(2) special vehicles, such as on-track machines, if equipped with a driving cab and intended to be used in transport mode on its own wheels.

This list of vehicles shall include those which are specially designed to operate on the different types of high-speed lines described in point 1.2. (Geographical scope).

1.2. Geographical Scope

The geographical scope of this TSI is the network of the whole rail system, as described in Annex I point 1 of Directive (EU) 2016/797 and excludes the infrastructure cases referred to in Articles 1(3) and 1(4) of Directive (EU) 2016/797.

The TSI shall apply to networks with 1 435 mm, 1 520 mm, 1 524 mm, 1 600 mm and 1 668 mm track gauges. However, it shall not apply to short border crossing lines with 1 520 mm track gauges that are connected to the network of third countries.

▼B

1.3. Content of this TSI

In accordance with ►M1 Article 4(3) of Directive (EU) 2016/797 ◄ , this TSI:

(1) indicates its intended scope — Chapter 2 (Subsystem Definition and Scope);

(2) lays down essential requirements for the Control-Command and Signalling Subsystems and their interfaces vis-à-vis other subsystems — Chapter 3 (The Essential Requirements of the Control-Command and Signalling Subsystems);

(3) lays down the functional and technical specifications to be met by the Subsystems and their interfaces vis-à-vis other subsystems — Chapter 4 (Characterisation of the Subsystem);

(4) determines the interoperability constituents and interfaces which must be covered by European specifications, including European standards, and which are necessary to achieve interoperability within the Union rail system — Chapter 5 (Interoperability Constituents);

(5) states, in each case under consideration, which procedures are to be used to assess the conformity or the suitability for use of the interoperability constituents and for the ‘EC’ verification of the subsystems — Chapter 6 (Assessing the Conformity and/or Suitability For Use of the Constituents and Verifying the Subsystems);

(6) indicates the strategy for implementing this TSI. — Chapter 7 (Implementing the Control-Command and Signalling Subsystems TSI);

(7) indicates the professional competences and health and safety conditions at work required for the staff operating and maintaining these subsystems and implementing the TSI — Chapter 4 (Characterisation of the Subsystem);

▼M1

(8) indicates the provisions applicable to the existing subsystems, in particular in the event of upgrading and renewal and, in such cases, the modification work which requires an application for a new authorisation for the vehicle or trackside subsystem — Chapter 7 (Implementing the Control-Command and Signalling Subsystems TSI);

(9) indicates the parameters of the subsystems to be checked by the railway undertaking and the procedures to be applied to check those parameters after the delivery of the vehicle authorisation for placing on the market and before the first use of the vehicle to ensure compatibility between vehicles and the routes on which they are to be operated — Chapter 4 (Characterisation of the Subsystems).

▼B

In accordance with ►M1 Article 4(5) of Directive (EU) 2016/797 ◄ , provisions for specific cases are indicated in Chapter 7 (Implementing the Control-Command and Signalling Subsystems TSI).

This TSI also sets out, in Chapter 4 (Characterisation of the Subsystems), the operating and maintenance rules which specifically apply to the scope indicated in paragraphs 1.1 and 1.2 above.

2. SUBSYSTEM DEFINITION AND SCOPE

2.1. Introduction

▼M1

The Control-Command and Signalling Subsystems are defined in Annex II of Directive (EU) 2016/797 as:

(a) Trackside control-command and signalling as: ‘all the trackside equipment required to ensure safety and to command and control movements of trains authorised to travel on the network.’

(b) On-board control-command and signalling as ‘all the on-board equipment required to ensure safety and to command and control movements of trains authorised to travel on the network’.

▼B

The features of the Control-Command and Signalling Subsystems are:

(1) the functions that are essential for the safe control of railway traffic, and that are essential for its operation, including those required for degraded modes ( 5 );

(2) the interfaces;

(3) the level of performance required to meet the essential requirements.

2.2. Scope

▼M1

The Control-Command and Signalling Subsystem TSI specifies only those requirements which are necessary to assure the interoperability of the Union rail system and the compliance with the essential requirements ( 6 ).

▼B

The Control-Command and Signalling Subsystems include the following parts:

(1) train protection;

(2) voice radio communication;

(3) data radio communication;

(4) train detection.

The Class A train protection system is ETCS ( 7 ) whilst the Class A radio system is GSM-R.

For Class A train detection this TSI specifies only the requirements for the interface with other subsystems.

▼M1

Class B systems for the trans-European rail system network are a limited set of train protection and voice radio legacy systems that were already in use in the trans-European rail network before 20 April 2001.

Class B systems for other parts of the network of the rail system in the European Union are a limited set of train protection and voice radio legacy systems that were already in use in those networks before 1 July 2015.

The list of Class B systems is established in the European Union Agency for Railways technical document ‘List of CCS Class B systems, ERA/TD/2011-11, version 4.0.’

▼B

The requirements for the Control-Command and Signalling On-board Subsystem are specified in relation to Class A radio mobiles and train protection.

The requirements for the Control-Command and Signalling Trackside Subsystem are specified in relation to:

(1) the Class A radio network;

(2) Class A train protection;

(3) the interface requirements for train detection systems, to ensure their compatibility with rolling stock.

▼M1

All Control-Command and Signalling Subsystems, even where not specified in this TSI, shall be assessed according with Commission Implementing Regulation (EU) No 402/2013.

▼M1

2.3. Trackside Application Levels (ETCS)

The interfaces specified by this TSI define the means of data transmission to, and (where appropriate) from trains. The ETCS specifications referenced by this TSI provide application levels from which a trackside implementation may choose the means of transmission that meet its requirements.

This TSI defines the requirements for all application levels.

For the technical definition of the ETCS application levels see Annex A, 4.1 c.

▼B

3. THE ESSENTIAL REQUIREMENTS FOR THE CONTROL-COMMAND AND SIGNALLING SUBSYSTEMS

3.1. General

►M1 Directive (EU) 2016/797 ◄ requires that the subsystems and the interoperability constituents including interfaces meet the essential requirements set out in general terms in Annex III to the Directive.

The essential requirements are:

(1) Safety;

(2) Reliability and Availability;

(3) Health;

(4) Environmental Protection;

(5) Technical compatibility;

▼M1

(6) Accessibility.

▼B

The essential requirements for Class A systems are described below.

The requirements for Class B systems are the responsibility of the relevant Member State.

3.2. Specific Aspects of the Control-Command and Signalling Subsystems

▼M1

3.2.1. Safety

Every Control-Command and Signalling Subsystems project shall take the measures necessary to ensure that the level of risk of an incident occurring within the scope of the Control-Command and Signalling Subsystems, is not higher than the objective for the service.

To ensure that the measures taken to achieve safety do not jeopardise interoperability, the requirements of the basic parameter defined in point 4.2.1 (Control-Command and Signalling reliability, availability and safety characteristics relevant to interoperability) shall be respected.

For the ETCS Class A system the safety objective is apportioned between the Control-Command and Signalling On-board and Trackside Subsystems. The detailed requirements are specified in the basic parameter defined in point 4.2.1 (Control-Command and Signalling reliability, availability and safety characteristics relevant to interoperability). This safety requirement shall be met together with the availability requirements as defined in Point 3.2.2 (Reliability and Availability).

For the ETCS Class A system:

(a) the changes made by railway undertakings and infrastructure managers shall be managed in compliance with the processes and procedures of their safety management system;

(b) the changes made by other actors (e.g. manufacturers or other suppliers) shall be managed according to the risk management process set out in Annex I to the Commission Implementing Regulation (EU) No 402/2013 ( 8 ), as referred to in Article 6(1)(a) of Directive (EU) 2016/798 of the European Parliament and of the Council ( 9 ).

Additionally the correct application of the risk management process as set out in Annex I of Regulation (EU) No 402/2013, as well as the appropriateness of the results from this application, shall be independently assessed by a CSM assessment body according to Article 6 of that Regulation. The CSM Assessment Body shall be accredited or recognised according to the requirements in Annex II of Regulation (EU) No 402/2013 in the fields of ‘Control-command and signalling’ and ‘System safe integration’ as listed in item 5 ‘classification’ of ERADIS database entry for Assessment Bodies.

The application of the specifications as referred to in Annex A, Table A 3 is an appropriate means to fully comply to the risk management process as set out in Annex I of the Commission Implementing Regulation (EU) No 402/2013 for design, implementation, production, installation and validation (incl. Safety acceptance) of interoperability constituents and subsystems. When different specifications from the ones referred to in Annex A, Table 3 are applied, at least equivalence shall be demonstrated with the specifications in Annex A, Table 3.

Whenever the specifications as referred to in Annex A, Table A 3 are used as an appropriate means to fully comply to the risk management process as set out in Annex I of the Commission Implementing Regulation (EU) No 402/2013, in order to avoid unnecessary duplication of independent assessment work, the independent safety assessment activities that are required by the specifications referred to in Annex A, Table A 3 shall be carried out by an Assessment Body accredited or recognized as specified in the section above instead of a CENELEC independent safety assessor.

▼B

3.2.2. Reliability and Availability

For the Class A system, the reliability and availability objectives are apportioned between the Control-Command and Signalling On-board and Trackside Subsystems. The detailed requirements are specified in the basic parameter defined in point 4.2.1 (Control-Command and Signalling safety characteristics relevant to interoperability).

▼M1

The level of risk caused by age and wear of constituents used within the subsystem shall be monitored. The requirements for maintenance stated in point 4.5 shall be respected.

▼B

3.2.3. Health

In accordance with Union legislation and with national legislation that is compatible with the Union legislation, care shall be taken to ensure that the materials used in and the design of the Control-Command and Signalling Subsystems do not constitute a health hazard to persons having access to them.

3.2.4. Environmental Protection

In accordance with Union legislation and with national legislation that is compatible with Union legislation:

(1) the Control-Command and Signalling equipment, if subjected to excessive heat or fire, shall not exceed limits for the emission of fumes or gases which are harmful to the environment;

(2) the Control-Command and Signalling equipment shall not contain substances which may abnormally contaminate the environment during their normal use;

(3) the Control-Command and Signalling equipment shall be subject to the Union legislation in force controlling the limits to the emission of and the susceptibility to electromagnetic interference along the boundaries of railway property;

(4) the Control-Command and Signalling equipment shall comply with existing regulations on noise pollution;

(5) the Control-Command and Signalling equipment shall not give rise to any inadmissible level of vibration which could jeopardise the integrity of the infrastructure (when the infrastructure is in the correct state of maintenance).

3.2.5. Technical Compatibility

Technical compatibility includes the functions, interfaces and performances required to achieve interoperability.

The requirements of technical compatibility are subdivided in the following three categories:

(1) The first category sets out the general engineering requirements for interoperability namely environmental conditions, internal electromagnetic compatibility (EMC) within the railway boundaries, and installation. These compatibility requirements are defined in this chapter.

(2) The second category describes how the Control Command and Signalling Subsystems have to be applied technically and what functions they have to perform to ensure interoperability. This category is defined in Chapter 4.

(3) The third category describes how the Control Command and Signalling Subsystems have to be operated in order that interoperability is achieved. This category is defined in Chapter 4.

3.2.5.1. Engineering Compatibility

3.2.5.1.1 Physical environmental conditions

Control Command and Signalling equipment shall be capable of operating under the climatic and physical conditions which characterise the area in which the relevant part of the Union rail system is located.

The requirements of basic parameter 4.2.16 (Construction of equipment used in CCS Subsystems) shall be respected.

3.2.5.1.2 Railway Internal Electromagnetic Compatibility

In accordance with Union legislation and with national legislation that is compatible with the Union legislation, the Control Command and Signalling equipment shall neither interfere with nor be interfered with by other control-command and signalling equipment or other subsystems.

The basic parameter related for electromagnetic compatibility between rolling stock and control-command and signalling trackside equipment is described in point 4.2.11 (Electromagnetic Compatibility).

▼M1 —————

▼M1

3.2.6. Accessibility

No requirements are mandated for the CCS subsystems for the essential requirement accessibility.

▼B

4. CHARACTERISATION OF THE SUBSYSTEMS

4.1. Introduction

4.1.1. Basic parameters

In accordance with the relevant essential requirements, the Control-Command and Signalling Subsystems are characterised by the following basic parameters:

(1) Control-Command and Signalling safety characteristics relevant to interoperability (point 4.2.1)

(2) On-board ETCS functionality (point 4.2.2)

(3) Trackside ETCS functionality (point 4.2.3)

(4) Mobile communication functions for railways — GSM-R (point 4.2.4)

(5) ETCS and GSM-R air gap interfaces (point 4.2.5)

(6) On-board interfaces Internal to Control-Command and Signalling (point 4.2.6)

(7) Trackside interfaces Internal to Control-Command and Signalling (point 4.2.7)

(8) Key management (point 4.2.8)

(9) ETCS-ID management (point 4.2.9)

(10) Train detection systems (point 4.2.10)

(11) Electromagnetic compatibility between rolling stock and Control-Command and Signalling trackside equipment (point 4.2.11)

(12) ETCS DMI (driver-machine interface) (point 4.2.12)

(13) GSM-R DMI (driver-machine interface) (point 4.2.13)

(14) Interface to data recording for regulatory purposes (point 4.2.14)

(15) Visibility of trackside Control-Command and Signalling objects (point 4.2.15)

(16) Construction of equipment used in CCS subsystems ( ►M1 point 4.2.16 ◄ ).

▼M1

(17) ETCS and Radio System Compatibility (point 4.2.17).

▼B

4.1.2. Overview of the requirements

All requirements in point 4.2 (Functional and technical specifications of the Subsystems) related to these basic parameters shall be applied to the Class A system.

Requirements for Class B systems and for STMs (which enable the Class A On-board system to operate on Class B infrastructure) are the responsibility of the appropriate Member State.

This TSI is based on the principles of enabling the Control-Command and Signalling Trackside Subsystem to be compatible with TSI-compliant Control-Command and Signalling On-board Subsystems. To achieve this goal:

(1) functions, interfaces and performances of the Control-Command and Signalling On-board Subsystem are standardised, ensuring that every train will react in a predictable way to data received from trackside;

(2) for the Control-Command and Signalling Trackside Subsystem, track-to-train and train-to-track communication are fully standardised in this TSI. The specifications referenced in the points below allow Control-Command and Signalling trackside functionality to be applied in a flexible way, so that it can be optimally integrated into the railway system. This flexibility shall be exploited without ►M1 limiting the movement of vehicles with TSI-compliant on-board subsystems. ◄

The Control-Command and Signalling functions are classified in categories indicating whether they are optional or mandatory. The categories are defined in the specifications referred to in Annex A and these texts also state how the functions are classified.

Annex A, 4.1c provides the Glossary of ETCS terms and definitions, which are used in the specifications referred to in Annex A.

4.1.3. Parts of Control-command and Signalling Subsystems

According to point 2.2 (Scope) the Control-Command and Signalling Subsystems can be subdivided in parts.

The following table indicates which basic parameters are relevant for each subsystem and for each part.

▼M1







Table 4.1 Subsystem Part Basic parameters Control-Command and Signalling On-board Train protection 4.2.1, 4.2.2, 4.2.5, 4.2.6, 4.2.8, 4.2.9, 4.2.12, 4.2.14, 4.2.16, 4.2.17 Voice radio communication 4.2.1.2, 4.2.4.1, 4.2.4.2, 4.2.5.1, 4.2.13, 4.2.16, 4.2.17 Data radio communication 4.2.1.2, 4.2.4.1, 4.2.4.3, 4.2.5.1, 4.2.6.2, 4.2.16, 4.2.17 Control-Command and Signalling Trackside Train protection 4.2.1, 4.2.3, 4.2.5, 4.2.7, 4.2.8, 4.2.9, 4.2.15, 4.2.16, 4.2.17 Voice radio communication 4.2.1.2, 4.2.4, 4.2.5.1, 4.2.7, 4.2.16, 4.2.17 Data radio communication 4.2.1.2, 4.2.4, 4.2.5.1, 4.2.7, 4.2.16, 4.2.17 Train detection 4.2.10, 4.2.11, 4.2.16

▼B

4.2. Functional and technical specifications of the Subsystems

4.2.1. ►M1 Control-Command and Signalling reliability, availability and safety characteristics relevant to interoperability ◄

This basic parameter describes the requirements for the Control-Command and Signalling On-board Subsystem and Trackside subsystem with reference to point 3.2.1 (Safety) and point 3.2.2 (Availability and Reliability).

In order to achieve interoperability, when implementing Control-Command and Signalling On-board and Trackside subsystems the following provisions shall be respected:

(1) The design, implementation and use of a Control-Command and Signalling On-board or Trackside subsystem shall not export any requirements:

(a) across the interface between Control-Command and Signalling On-board and Trackside subsystems in addition to the requirements specified in this TSI;

(b) to any other subsystem in addition to the requirements specified in the corresponding TSIs.

(2) The requirements set out in points 4.2.1.1 and 4.2.1.2 below shall be respected.

4.2.1.1. Safety

The Control-Command and Signalling On-board and Trackside subsystems shall respect the requirements for ETCS equipment and installations stated in this TSI.

For the hazard ‘exceeding speed and/or distance limits advised to ETCS’ the tolerable rate (THR) is 10– 9 h– 1 for random failures, for on-board ETCS and for trackside ETCS. See Annex A 4.2.1 a.

To achieve interoperability, the on-board ETCS shall fully respect all requirements specified in Annex A 4.2.1. Nevertheless, less stringent safety requirements are acceptable for trackside ETCS provided that, in combination with TSI-compliant Control-Command and Signalling On-board subsystems, the safety level for the service is met.

4.2.1.2. Availability/Reliability

This point refers to the occurrence of failure modes not causing safety hazards but creating degraded situations, the management of which could decrease the overall safety of the system.

In the context of this parameter, ‘failure’ means the termination of the ability of an item to perform a required function with the required performance and ‘failure mode’ means the effect by which the failure is observed.

To ensure that the relevant infrastructure managers and railway undertaking are given all the information they need to define appropriate procedures for managing degraded situations, the technical file accompanying the EC declaration of verification for an on-board or trackside CCS subsystem shall contain the calculated availability/reliability values related to failure modes having an impact on the capability of the CCS subsystem to supervise the safe movement of one or more vehicles or to establish radio voice communication between traffic control and the train drivers.

Compliance with the following calculated values shall be ensured:

(1) Mean time of hours of operation between failures of a CCS on-board subsystem requiring the isolation of the train protection functions: (open point).

(2) Mean time of hours of operation between failures of a CCS on-board subsystem preventing radio voice communication between traffic control and the train driver: (open point).

To allow the infrastructure managers and railway undertakings to monitor, during the life of the subsystems, the level of risk and the respect of the reliability/availability values used for the definition of procedures to manage degraded situations, the requirements for maintenance stated in point 4.5 (Maintenance rules) shall be respected.

▼M1

4.2.2. On-board ETCS functionality

The basic parameter for ETCS on-board functionality describes all of the functions needed to run a train in a safe way. The primary function is to provide automatic train protection and cab signalling:

(1) setting the train characteristics (e.g., maximum train speed, braking performance);

(2) selecting the supervision mode on the basis of information from trackside;

(3) performing odometry functions;

(4) locating the train in a coordinate system based on Eurobalise locations;

(5) calculating the dynamic speed profile for its mission on the basis of train characteristics and of information from trackside;

(6) supervising the dynamic speed profile during the mission;

(7) providing the intervention function.

These functions shall be implemented in accordance with Annex A 4.2.2 b and their performance shall conform to Annex A 4.2.2 a.

The requirements for tests are specified in Annex A 4.2.2 c.

The main functionality is supported by other functions, to which Annex A 4.2.2 a and Annex A 4.2.2 b also apply, together with the additional specifications indicated below:

(1) Communication with the Control-Command and Signalling Trackside Subsystem.

(a) Eurobalise data transmission. See point 4.2.5.2 (Eurobalise communication with the train).

(b) Euroloop data transmission. See point 4.2.5.3 (Euroloop communication with the train). This functionality is optional on-board unless Euroloop is installed trackside in ETCS Level 1 and the release speed is set to zero for safety reasons (e.g. protection of danger points).

(c) Radio data transmission for radio infill. See Annex A, 4.2.2 d, point 4.2.5.1 (Radio communications with the train), point 4.2.6.2 (Interface between GSM-R Radio Data Communication and ETCS) and point 4.2.8 (Key Management). This functionality is optional on-board unless radio data transmission for radio in-fill is installed trackside in ETCS Level 1 and the release speed is set to zero for safety reasons (e.g., protection of danger points).

(d) Radio data transmission. See point 4.2.5.1 (Radio communications with the train), point 4.2.6.2 (Interface between GSM-R Radio Data Communication and ETCS) and point 4.2.8 (Key Management). This radio data transmission is optional unless operating on an ETCS level 2 or level 3 lines.

(2) Communicating with the driver. See Annex A, 4.2.2 e and point 4.2.12 (ETCS DMI).

(3) Communicating with the STM. See point 4.2.6.1 (Interface between ETCS and STM). This function includes:

(a) managing the STM output;

(b) providing data to be used by the STM;

(c) managing STM transitions.

(4) Managing information about the completeness of the train (train integrity) — Supplying the train integrity to the on-board subsystem, is optional unless it is required by trackside.

(5) Equipment health monitoring and degraded mode support. This function includes:

(a) initialising the on-board ETCS functionality;

(b) providing degraded mode support;

(c) isolating the on-board ETCS functionality.

(6) Support data recording for regulatory purposes. See point 4.2.14 (Interface to Data Recording for Regulatory Purposes).

(7) Forwarding information/orders and receiving state information from rolling stock:

(a) to the DMI. See point 4.2.12 (ETCS DMI)

(b) to/from the train interface unit. See Annex A, 4.2.2 f.

4.2.3. Trackside ETCS functionality

This Basic parameter describes the ETCS trackside functionality. It contains all ETCS functionality to provide a safe path to a specific train.

The main functionality is:

(1) locating a specific train in a coordinate system based on Eurobalise locations (level 2 and level 3);

(2) translating the information from trackside signalling equipment into a standard format for the Control-Command and Signalling On-board Subsystem;

(3) sending movement authorities including track description and orders assigned to a specific train.

These functions shall be implemented in accordance with Annex A 4.2.3 b and their performance shall conform to Annex A 4.2.3 a.

The main functionality is supported by other functions, to which Annex A 4.2.3 a and Annex A 4.2.3 b also apply, together with the additional specifications indicated below:

(1) communicating with the Control-Command and Signalling On-board Subsystem. This includes:

(a) Eurobalise data transmission. See point 4.2.5.2 (Eurobalise communication with the train) and point 4.2.7.4 (Eurobalise/Line-side Electronic Unit (LEU));

(b) Euroloop data transmission. See point 4.2.5.3 (Euroloop communication with the train) and point 4.2.7.5 (Euroloop/LEU). Euroloop is only relevant in level 1, in which it is optional;

(c) Radio data transmission for radio infill. See Annex A, 4.2.3 d, point 4.2.5.1 (Radio communications with the train), point 4.2.7.3 (GSM-R/trackside ETCS functionality) and point 4.2.8 (Key Management). Radio in-fill is only relevant in level 1, in which it is optional;

(d) Radio data transmission. See point 4.2.5.1 (Radio communications with the train), point 4.2.7.3 (GSM-R/trackside ETCS functionality) and point 4.2.8 (Key Management). Radio data transmission is only relevant to level 2 and level 3.

(2) generating information/orders to the on-board ETCS, e.g. information related to closing/opening the air flaps, lowering/raising the pantograph, opening/closing the main power switch, changing from traction system A to traction system B. Implementation of this functionality is optional for trackside; it can however be required by other applicable TSIs or national rules or the application of risk evaluation and assessment to ensure safe integration of subsystems;

(3) managing the transitions between areas supervised by different Radio Block Centres (RBCs) (only relevant for level 2 and level 3). See point 4.2.7.1 (Functional interface between RBCs) and point 4.2.7.2 (Technical interface between RBCs).

▼B

4.2.4. Mobile communication functions for railways GSM-R

This basic parameter describes the radio communication functions. Such functions shall be implemented in the Control-Command and Signalling On-board and Trackside subsystems, according to the specifications indicated below.

4.2.4.1. Basic communication function

The general requirements are specified in Annex A 4.2.4a.

In addition, the following specifications shall be respected:

(1) ASCI features; Annex A 4.2.4b;

(2) SIM card; Annex A 4.2.4c;

(3) location-dependent addressing; Annex A 4.2.4e.

4.2.4.2. Voice and operational communication applications

The general requirements are defined in Annex A 4.2.4f.

The requirements for tests are specified in Annex A 4.2.4g.

In addition, the following specifications shall be respected:

(1) confirmation of high priority calls; Annex A 4.2.4h;

(2) functional addressing; Annex A 4.2.4j;

(3) presentation of functional numbers; Annex A 4.2.4k;

(4) User-to-User Signalling; Annex A 4.2.4d.

4.2.4.3. Data communication applications for ETCS

The general requirements are defined in Annex A 4.2.4f.

The requirements for tests are specified in Annex A 4.2.4g.

The ‘data radio communication’ part of the On-board Control-command and Signalling Subsystem shall be able to support the establishment of at least two simultaneous communication sessions with the Trackside Control-command and signalling Subsystem.

This functionality is mandatory only in the case of ETCS level 2 and level 3 and radio in-fill applications.

4.2.5. ETCS and GSM-R air gap interfaces

This basic parameter specifies the requirements for the air gap between Control-Command and Signalling Trackside and On-board subsystems and has to be taken into account in conjunction with the requirements for the interfaces between ETCS and GSM-R equipment, as specified in point 4.2.6 (On-board Interfaces Internal to Control-Command and Signalling) and point 4.2.7 (Trackside Interfaces Internal to Control-Command and Signalling).

This basic parameter includes:

(1) the physical, electrical and electromagnetic values to be respected to allow safe functioning;

(2) the communication protocol to be used;

(3) the availability of the communication channel.

The applicable specifications are listed below.

4.2.5.1. Radio communications with the train

Class A radio communication interfaces shall operate in the frequency band specified in Annex A 4.2.5a and in Annex A 4.2.4f.

On-board Control-command and Signalling Subsystems shall be protected against interference, fulfilling the requirements specified in Annex A 4.2.4f.

For data communication the protocols shall comply with Annex A 4.2.5b.

Where radio in-fill is implemented, the requirements stated in Annex A 4.2.5c shall be respected.

4.2.5.2. Eurobalise communication with the train

Eurobalise communication interfaces shall comply with Annex A 4.2.5d.

4.2.5.3. Euroloop communication with the train

Euroloop communication interfaces shall comply with Annex A 4.2.5e.

4.2.6. On-Board Interfaces Internal to Control-Command and Signalling

This Basic Parameter consists of three parts.

4.2.6.1. ETCS and Class B train protection

Where ETCS and Class B train protection functions are installed on-board, the transitions between them can be managed with a standardised interface as specified in Annex A, 4.2.6 a.

Annex A, 4.2.6b specifies the K interface (to allow certain STMs to read information from Class B balises through the ETCS on-board antenna) and Annex A 4.2.6c the G interface (air gap between ETCS on-board antenna and Class B balises).

Implementation of Interface ‘K’ is optional, but if done it must be in accordance with Annex A, 4.2.6b.

Furthermore, if Interface ‘K’ is implemented, the on-board transmission channel functionality must be able to handle the properties of Annex A, 4.2.6c.

If the transitions between ETCS and Class B train protection on-board are not managed using the standardised interface specified in Annex A, 4.2.6 a, steps must be taken to ensure that the method used does not impose any additional requirements on the Control-Command and Signalling Trackside Subsystem.

4.2.6.2. Interface between GSM-R Radio Data Communication and ETCS

The requirements for the interface between the Class A radio and the on-board ETCS functionality are specified in Annex A 4.2.6d.

Where radio in-fill is implemented the requirements stated in Annex A 4.2.6e shall be respected.

4.2.6.3. Odometry

The interface between the odometry function and on-board ETCS shall meet the requirements of Annex A, ►M1 ————— ◄ . This interface contributes to this Basic Parameter only when odometry equipment is supplied as a separate interoperability constituent (see point 5.2.2, Grouping of interoperability constituents).

4.2.7. Trackside Interfaces Internal to Control-Command and Signalling

This Basic Parameter consists of five parts.

4.2.7.1. Functional interface between RBCs

This interface defines the data to be exchanged between neighbouring RBCs to allow the safe movement of a train from one RBC area to the next:

(1) Information from the ‘Handing Over’ RBC to the ‘Accepting’ RBC.

(2) Information from the ‘Accepting’ RBC to the ‘Handing Over’ RBC.

The requirements are specified in Annex A, 4.2.7a.

4.2.7.2. RBC/RBC

This is the technical interface between two RBCs. The requirements are specified in Annex A, 4.2.7b.

4.2.7.3. GSM-R/trackside ETCS

This is the interface between the Class A radio system and the trackside ETCS functionality. The requirements are specified in Annex A, 4.2.7c.

4.2.7.4. Eurobalise/LEU

This is the interface between Eurobalise and the LEU. The requirements are specified in Annex A, 4.2.7d.

This interface contributes to this basic parameter only when Eurobalise and LEU are supplied as separate interoperability constituents (see point 5.2.2, Grouping of interoperability constituents).

4.2.7.5. Euroloop/LEU

This is the interface between Euroloop and the LEU. The requirements are specified in Annex A, 4.2.7e.

This interface contributes to this Basic Parameter only when Euroloop and LEU are supplied as separate interoperability constituents (see point 5.2.2, Grouping of interoperability constituents).

4.2.8. Key Management

This basic parameter specifies requirements for the management of cryptographic keys used for the protection of data transmitted via radio.

The requirements are specified in Annex A 4.2.8a. Only requirements related to the interfaces of Control-Command and Signalling equipment fall within the scope of this TSI.

4.2.9. ETCS-ID Management

This basic parameter concerns the ETCS-identities (ETCS-IDs) for equipment in Control-Command and Signalling Trackside and On-board Subsystems.

The requirements are specified in Annex A, 4.2.9a.

4.2.10. Trackside Train Detection Systems

This basic parameter specifies the interface requirements between the trackside train detection systems and rolling stock, related to vehicle design and operation.

The interface requirements to be respected by the train detection systems are specified in Annex A 4.2.10a.

4.2.11. Electromagnetic Compatibility between Rolling Stock and Control-Command and Signalling trackside equipment

This basic parameter specifies the interface requirements for electromagnetic compatibility between rolling stock and trackside ►M1 Control-Command and Signalling train detection equipment. ◄

The interface requirements to be respected by the train detection system are specified in Annex A 4.2.11a

4.2.12. ETCS DMI (Driver-Machine Interface)

This basic parameter describes the information provided from ETCS to the driver and entered into the on-board ETCS by the driver. See Annex A, 4.2.12a.

It includes:

(1) ergonomics (including visibility);

(2) ETCS functions to be displayed;

(3) ETCS functions triggered by driver input.

4.2.13. GSM-R DMI (Driver-Machine Interface)

This basic parameter describes the information provided from GSM-R to the driver and entered into the GSM-R on-board by the driver. See Annex A, 4.2.13a.

It includes:

(1) ergonomics (including visibility);

(2) GSM-R functions to be displayed;

(3) call-related information outgoing;

(4) call-related information incoming.

4.2.14. Interface to Data Recording for Regulatory Purposes

This basic parameter describes:

(1) data exchange between the on-board ETCS and the rolling stock recording device;

(2) communication protocols;

(3) physical interface.

See Annex A 4.2.14a.

4.2.15. Visibility of trackside Control-Command and Signalling objects

This basic parameter describes:

(1) the characteristics of retro-reflecting signs to ensure correct visibility;

(2) the characteristics of interoperable marker boards.

See Annex A 4.2.15a.

In addition, the installation of trackside Control-Command and Signalling objects shall be compatible with the driver’s field of view and the infrastructure requirements.

4.2.16. Construction of equipment used in CCS subsystems

The environmental conditions specified in the documents listed in Annex A, Table A2 of this TSI shall be respected.

Requirements for materials referred to in Regulation (EU) No 1302/2014 (LOC&PAS TSI) (e.g. related to fire protection) shall be respected ►M1 by Control-command and signalling On-board Interoperability Constituents and Subsystems ◄ .

▼M1

4.2.17. ETCS and Radio System Compatibility

Due to the different possible implementations and the status of the migration to fully compliant CCS Subsystems, checks shall be performed in order to demonstrate the technical compatibility between the on-board and trackside CCS Subsystems. The necessity of these checks shall be considered as a measure to increase the confidence on the technical compatibility between the CCS subsystems. It is expected that these checks will be reduced until the principle stated in 6.1.2.1 is achieved.

4.2.17.1. ETCS System Compatibility

ETCS System Compatibility (ESC) shall be the recording of technical compatibility between ETCS on-board and the trackside parts ETCS of the CCS subsystems within an area of use.

ESC type shall be the value assigned to record the technical compatibility between an ETCS on-board and a section within the area of use. All sections of the Union network which require the same set of checks for the demonstration of ESC shall have the same ESC type.

4.2.17.2. Radio System Compatibility

Radio System Compatibility (RSC) shall be the recording of technical compatibility between voice or data radio on-board and the trackside parts of GSM-R of the CCS subsystems.

RSC type shall be the value assigned to record the technical compatibility between a voice or data radio and a section within the area of use. All sections of the Union network which require the same set of checks for the demonstration of RSC shall have the same RSC type.

▼B

4.3. Functional and technical specifications of the interfaces to other Subsystems

▼M1

4.3.1. Interface to the Operation and Traffic Management Subsystem







Interface with Operation and Traffic Management TSI Reference CCS TSI Reference Operation and Traffic Management TSI (1) Parameter Point Parameter Point Operating rules (normal and degraded conditions) 4.4 Rule book Operating rules 4.2.1.2.1 4.4 Visibility of trackside Control-Command and Signalling objects 4.2.15 Signal and line-side marker sighting 4.2.2.8 Train braking performance and characteristics 4.2.2 Braking performance 4.2.2.6 Use of sanding equipment On-board flange lubrication Use of composite brake blocks 4.2.10 Rule book 4.2.1.2.1 Interface to Data Recording for Regulatory Purposes 4.2.14 Data recording on-board 4.2.3.5 ETCS DMI 4.2.12 Train running number 4.2.3.2.1 GSM-R DMI 4.2.13 Train running number 4.2.3.2.1 Key Management 4.2.8 Ensuring that the train is in running order 4.2.2.7 Route compatibility checks before the use of authorised vehicles 4.9 Parameters for the vehicle and train compatibility over the route intended for operation Appendix D1 (1) Commission Regulation (EU) 2015/995 of 8 June 2015 amending Decision 2012/757/EU concerning the technical specification for interoperability relating to the ‘operation and traffic management’ subsystem of the rail system in the European Union (OJ L 165, 30.6.2015, p. 1).

4.3.2. Interface to the Rolling Stock Subsystem







Interface with Rolling Stock TSIs Reference CCS TSI Reference Rolling Stock TSIs Parameter Point Parameter Point Compatibility with trackside train detection systems: vehicle design 4.2.10 Rolling stock characteristics to be compatible with train detection systems based on track circuits HS RS TSI (1) wheelset location 4.2.7.9.2 axle load 4.2.3.2 sanding 4.2.3.10 electrical resistance between wheels 4.2.3.3.1 CR RS TSI (2) 4.2.3.3.1.1 LOC & PAS TSI (3) 4.2.3.3.1.1 Wagon TSI (4) 4.2.3.2 Rolling stock characteristics to be compatible with train detection systems based on axle counters HS RS TSI wheelset geometry 4.2.7.9.2 wheels 4.2.7.9.3 CR RS TSI 4.2.3.3.1.2 LOC & PAS TSI 4.2.3.3.1.2 Wagon TSI 4.2.3.3 Rolling stock characteristics to be compatible with loop equipment HS RS TSI None CR RS TSI 4.2.3.3.1.3 LOC & PAS TSI 4.2.3.3.1.3 Wagon TSI 4.2.3.3 Electromagnetic compatibility between rolling stock and Control-Command and Signalling trackside equipment 4.2.11 Rolling stock characteristics to be compatible with train detection systems based on track circuits HS RS TSI 4.2.6.6.1 CR RS TSI 4.2.3.3.1.1 LOC & PAS TSI 4.2.3.3.1.1 Wagon TSI 4.2.3.3 Rolling stock characteristics to be compatible with train detection systems based on axle counters HS RS TSI 4.2.6.6.1 CR RS TSI 4.2.3.3.1.2 LOC & PAS TSI 4.2.3.3.1.2 Wagon TSI 4.2.3.3 Train braking performance and characteristics 4.2.2 Emergency braking performance HS RS TSI Emergency braking 4.2.4.1 Service braking 4.2.4.4 CR RS TSI Emergency braking 4.2.4.5.2 Service braking 4.2.4.5.3 LOC & PAS TSI Emergency braking 4.2.4.5.2 Service braking 4.2.4.5.3 Wagon TSI 4.2.4.1.2 Position of Control-Command and Signalling on-board antennas 4.2.2 Kinematic gauge HS RS TSI 4.2.3.1 CR RS TSI 4.2.3.1 LOC & PAS TSI 4.2.3.1 Wagon TSI none Isolation of on-board ETCS functionality 4.2.2 Operating rules HS RS TSI 4.2.7.9.1 CR RS TSI 4.2.12.3 LOC & PAS TSI 4.2.12.3 Wagon TSI none Data interfaces 4.2.2 Monitoring and diagnostic concepts HS RS TSI 4.2.7.10 CR RS TSI 4.2.1.1 LOC & PAS TSI 4.2.1.1 Wagon TSI None Visibility of trackside Control-Command and Signalling objects 4.2.15 External visibility Head lights HS RS TSI 4.2.7.4.1.1 CR RS TSI 4.2.7.1.1 LOC & PAS TSI 4.2.7.1.1 Wagon TSI None Driver's external field of view HS RS TSI line of sight 4.2.2.6 b windscreen 4.2.2.7 CR RS TSI line of sight 4.2.9.1.3.1 windscreen 4.2.9.2 LOC & PAS TSI line of sight 4.2.9.1.3.1 windscreen 4.2.9.2 Wagon TSI None Interface to data recording for regulatory purposes 4.2.14 Recording device HS RS TSI 4.2.7.10 CR RS TSI 4.2.9.6 LOC & PAS TSI 4.2.9.6 Wagon TSI none Commands to rolling stock equipment 4.2.2 4.2.3 Phase separation HS RS TSI 4.2.8.3.6.7 CR RS TSI 4.2.8.2.9.8 LOC & PAS TSI 4.2.8.2.9.8 Wagon TSI none Emergency braking command 4.2.2 Emergency braking command HS RS TSI none CR RS TSI 4.2.4.4.1 LOC & PAS TSI 4.2.4.4.1 Wagon TSI none Construction of equipment 4.2.16 Material requirements HS RS TSI 4.2.7.2.2 CR RS TSI 4.2.10.2.1 LOC&PAS TSI 4.2.10.2.1 Wagon TSI none (1) HS RS TSI is Commission Decision of 21 February 2008 concerning a technical specification for interoperability relating to the rolling stock sub-system of the trans-European high-speed rail system (2008/232/CE). (2) CR RS TSI is Commission Decision of 26 April 2011 concerning a technical specification for interoperability relating to the rolling stock subsystem — Locomotives and passenger rolling stock of the trans-European conventional rail system (2011/291/EU). (3) LOC & PAS TSI is Commission Regulation (EU) No 1302/2014 of 18 November 2014 concerning a technical specification for interoperability relating to the ‘rolling stock — locomotives and passenger rolling stock’ subsystem of the rail system in the European Union. (4) Wagon TSI is Commission Regulation (EU) No 321/2013 of 13 March 2013 concerning the technical specification for interoperability relating to the subsystem rolling stock — freight wagons of the rail system in the European Union and repealing Decision 2006/861/EC.

▼B

4.3.3. Interfaces to Infrastructure Subsystem







Interface with Infrastructure TSI Reference CCS TSI Reference Infrastructure TSI Parameter Clause Parameter Clause Train detection systems (space for installation) 4.2.10 Minimum infrastructure gauge Structure gauge Structure gauge HS INF TSI (1) CR INF TSI (2) INF TSI (3) 4.2.3 4.2.4.1 4.2.3.1 Eurobalise communication (space for installation) 4.2.5.2 Minimum infrastructure gauge Structure gauge Structure gauge HS INF TSI CR INF TSI INF TSI 4.2.3 4.2.4.1 4.2.3.1 Euroloop communication (space for installation) 4.2.5.3 Minimum infrastructure gauge Structure gauge Structure gauge HS INF TSI CR INF TSI INF TSI 4.2.3 4.2.4.1 4.2.3.1 Visibility of trackside Control-Command and Signalling objects 4.2.15 Minimum infrastructure gauge Structure gauge Structure gauge HS INF TSI CR INF TSI INF TSI 4.2.3 4.2.4.1 4.2.3.1 (1) HS INF TSI is 2008/217/EC: Commission Decision of 20 December 2007 concerning a technical specification for interoperability relating to the infrastructure sub-system of the trans-European high-speed rail system (OJ L 77, 19.3.2008, p. 1). (2) CR INF TSI is 2011/275/EU: Commission Decision of 26 April 2011 concerning a technical specification for interoperability relating to the ‘infrastructure’ subsystem of the trans-European conventional rail system (OJ L 126, 14.5.2011, p. 53). (3) INF TSI is Commission Regulation (EU) No 1299/2014 of 18 November 2014 on the technical specifications for interoperability relating to the ‘infrastructure’ subsystem of the rail system in the European Union (OJ L 356, 12.12.2014, p. 1).

4.3.4. Interfaces to Energy Subsystem







Interface with Energy TSI Reference CCS TSI Reference Energy TSI Parameter Clause Parameter Clause Commands to rolling stock equipment 4.2.2 4.2.3 ►M1 Phase separation sections ◄ System separation points Phase separation points System separation points Phase separation points System separation points HS ENE TSI (1) CR ENE TSI (2) ENE TSI (3) 4.2.21 4.2.22 4.2.19 4.2.20 4.2.15 4.2.16 (1) HS ENE TSI is 2008/284/EC: Commission Decision of 6 March 2008 concerning a technical specification for interoperability relating to the energy sub-system of the trans-European high-speed rail system (OJ L 104, 14.4.2008, p. 1). (2) CR ENE TSI is 2011/274/EU: Commission Decision of 26 April 2011 concerning a technical specification for interoperability relating to the ‘energy’ subsystem of the trans-European conventional rail system (OJ L 126, 14.5.2011, p. 1). (3) ENE TSI is Commission Regulation (EU) No 1301/2014 of 18 November 2014 on the technical specifications for interoperability relating to the ‘energy’ subsystem of the rail system in the Union (OJ L 356, 12.12.2014, p. 179).

4.4. Operating rules

The rules for operating a railway service with ETCS and GSM-R are specified in the ►M1 Operation and Traffic Management TSI ◄ .

4.5. Maintenance rules

The maintenance rules of the subsystems covered by this TSI shall ensure that the values quoted in the basic parameters indicated in Chapter 4 are maintained within the required limits throughout the lifetime of the subsystems. However, during preventative or corrective maintenance, the subsystem may not be able to respect the values quoted in the basic parameters; the maintenance rules shall ensure that safety is not prejudiced during these activities.

The entity in charge of the Control-Command and Signalling Subsystems shall set up maintenance rules to achieve the above objectives. To assist with the preparation of these rules, the following requirements shall be respected.

4.5.1. Responsibility of the manufacturer of equipment

The manufacturer of equipment incorporated in the subsystem shall specify:

(1) all maintenance requirements and procedures (including health monitoring, diagnosis of events, test methods and tools and also the required professional competence) necessary for achieving essential requirements and values quoted in the mandatory requirements of this TSI throughout the equipment life-cycle (transport and storage before installation, normal operation, failures, repair work, checking and maintenance, decommissioning, etc.). ►M1 For equipment error corrections see point 6.5; ◄

(2) the health and safety risks that may affect the public and the maintenance staff;

(3) the conditions for first line maintenance, i.e. the definition of Line Replaceable Units (LRUs), the definition of approved compatible versions of hardware and software, the procedures for replacing failed LRUs, the conditions for storing LRUs and for repairing failed LRUs;

(4) the checks to be carried out if equipment is subject to exceptional stress (e.g. adverse environmental conditions or abnormal shocks);

(5) the checks to be carried out when maintaining equipment other than Control-Command and Signalling equipment and which influences the Control-Command and Signalling Subsystems (e.g. changing the wheel diameter).

4.5.2. Responsibility of the applicant for subsystem verification

The applicant shall:

(1) ensure that the maintenance requirements as described in point 4.5.1 (Responsibility of the Manufacturer of Equipment) are defined for all components within the scope of this TSI regardless of whether or not they are interoperability constituents;

(2) complete the above requirements taking into account the risks arising from interactions between different components of the subsystem and interfaces to other subsystems.

4.6. Professional competences

The manufacturers of the equipment and of the subsystem shall provide information sufficient to define the professional competences required for the installation, final inspection and maintenance of the Control-Command and Signalling Subsystems. See point 4.5 (Maintenance rules).

4.7. Health and safety conditions

Care shall be taken to ensure health and safety for maintenance and operations staff, in accordance with Union legislation and the national legislation that is compatible with the Union legislation.

Manufacturers shall indicate the risks for health and safety that arise from using and maintaining their equipment and subsystems. See point 4.4 (Operating rules) and point 4.5 (Maintenance rules).

▼M1

4.8. Registers

The data to be provided for the registers provided for in Articles 48 and 49 of Directive (EU) 2016/797 are those indicated in Commission Implementing Decision 2011/665/EU ( 10 ) and Commission Implementing Regulation (EU) 2019/777 ( 11 ).

▼M1

4.9. Route compatibility checks before the use of authorised vehicles

The parameters of the on-board CCS subsystem to be used by the railway undertaking, for the purpose of route compatibility check, are described in Appendix D1 of Commission Implementing Regulation (EU) 2019/773 ( 12 ).

▼B

5. INTEROPERABILITY CONSTITUENTS

▼M1

5.1. Definition

In accordance with Article 2(7) of Directive (EU) 2016/797, interoperability constituents means any elementary component, group of components, subassembly or complete assembly of equipment incorporated or intended to be incorporated into a subsystem, upon which the interoperability of the rail system depends directly or indirectly, including both tangible objects and intangible objects.

▼B

5.2. List of interoperability constituents

5.2.1. Basic interoperability constituents

The basic interoperability constituents in the Control-Command and Signalling Subsystems are defined in:

(1) Table 5.1.a for the Control-Command and Signalling On-board Subsystem;

(2) Table 5.2.a for the Control-Command and Signalling Trackside Subsystem.

5.2.2. Grouping of interoperability constituents

The functions of basic interoperability constituents may be combined to form a group. This group is then defined by those functions and by its remaining external interfaces. If a group is formed in this way, it shall be considered as an interoperability constituent.

(1) Table 5.1.b lists the groups of interoperability constituents of the Control-Command and Signalling On-board Subsystem.

(2) Table 5.2.b lists the groups of interoperability constituents of the Control-Command and Signalling Trackside Subsystem.

▼M1

Compliance of interfaces internal to the group of ICs to basic parameters of Chapter 4 does not have to be verified. Compliance of interfaces external to the group of ICs has to be verified to demonstrate conformity with the basic parameters related to the requirements of these external interfaces.

▼B

5.3. Constituents’ performance and specifications

For each basic interoperability constituent or group of interoperability constituents, the tables in Chapter 5 describe:

(1) in column 3, the functions and interfaces. Note that some interoperability constituents have functions and/or interfaces that are optional;

(2) in column 4, the mandatory specifications for the conformity assessment of each function or interface (where applicable) by reference to the relevant point of Chapter 4.

▼M1







Table 5.1.a Basic interoperability constituents in the Control-Command and Signalling On-board Subsystem 1 2 3 4 No Interoperability constituent IC Characteristics Specific requirements to be assessed by reference to Chapter 4 1 ETCS on-board Reliability, Availability, Maintainability, Safety (RAMS) 4.2.1 4.5.1 On-board ETCS functionality (excluding odometry) 4.2.2 ETCS and GSM-R air gap interfaces — RBC (Radio data transmission optional) — Radio in-fill unit (functionality optional) — Eurobalise air gap — Euroloop air gap (functionality optional) 4.2.5 4.2.5.1 4.2.5.1 4.2.5.2 4.2.5.3 Interfaces — STM (implementation of interface K optional) — GSM-R ETCS Data Only Radio — Odometry — Key management system — ETCS ID Management — ETCS Driver-Machine Interface — Train interface — On-board recording device 4.2.6.1 4.2.6.2 4.2.6.3 4.2.8 4.2.9 4.2.12 4.2.2 4.2.14 Construction of equipment 4.2.16 2 Odometry equipment Reliability, Availability, Maintainability, Safety (RAMS) 4.2.1 4.5.1 On-board ETCS functionality: only Odometry 4.2.2 Interfaces — On-board ETCS 4.2.6.3 Construction of equipment 4.2.16 3 Interface of External STM Interfaces — On-board ETCS 4.2.6.1 4 GSM-R voice cab radio Note: SIM card, antenna, connecting cables and filters are not part of this interoperability constituent Reliability, Availability, Maintainability, (RAM) 4.2.1.2 4.5.1 Basic communication functions 4.2.4.1 Voice and operational communication applications 4.2.4.2 Interfaces — GSM-R air gap — GSM-R Driver-Machine Interface 4.2.5.1 4.2.13 Construction of equipment 4.2.16 5 GSM-R ETCS Data only Radio Note: SIM card, antenna, connecting cables and filters are not part of this interoperability constituent Reliability, Availability, Maintainability (RAM) 4.2.1.2 4.5.1 Basic communication functions 4.2.4.1 ETCS data communication applications 4.2.4.3 Interfaces — On-board ETCS — GSM-R air gap 4.2.6.2 4.2.5.1 Construction of equipment 4.2.16 6 GSM-R SIM card Note: it is the responsibility of the GSM-R network operator to deliver to railway undertakings the SIM cards to be inserted in GSM-R terminal equipment Basic communication functions 4.2.4.1 Construction of equipment 4.2.16







Table 5.1.b Groups of interoperability constituents in the Control-Command and Signalling On-board Subsystem (This table is an example to show the structure. Other groups are allowed.) 1 2 3 4 No Group of Interoperability constituents Characteristics Specific requirements to be assessed by reference to Chapter 4 1 ETCS on-board Odometry equipment Reliability, Availability, Maintainability, Safety (RAMS) 4.2.1 4.5.1 On-board ETCS functionality 4.2.2 ETCS and GSM-R air gap interfaces — RBC (Radio data transmission optional) — Radio in-fill unit (functionality optional) — Eurobalise air gap — Euroloop air gap (functionality optional) 4.2.5 4.2.5.1 4.2.5.1 4.2.5.2 4.2.5.3 Interfaces — STM (implementation of interface K optional) — GSM-R ETCS Data Only Radio — Key management system — ETCS-ID Management — ETCS Driver Machine Interface — Train interface — On-board recording device 4.2.6.1 4.2.6.2 4.2.8 4.2.9 4.2.12 4.2.2 4.2.14 Construction of equipment 4.2.16







Table 5.2.a Basic interoperability constituents in the Control-Command and Signalling Trackside Subsystem 1 2 3 4 No Interoperability constituent IC Characteristics Specific requirements to be assessed by reference to Chapter 4 1 RBC Reliability, Availability, Maintainability, Safety (RAMS) 4.2.1 4.5.1 Trackside ETCS functionality (excluding communication via Eurobalises, radio in-fill and Euroloop) 4.2.3 ETCS and GSM-R air gap interfaces: only radio communication with train 4.2.5.1 Interfaces — Neighbouring RBC — Data radio communication — Key management system — ETCS-ID Management 4.2.7.1, 4.2.7.2 4.2.7.3 4.2.8 4.2.9 Construction of equipment 4.2.16 2 Radio in-fill unit Reliability, Availability, Maintainability, Safety (RAMS) 4.2.1 4.5.1 Trackside ETCS functionality (excluding communication via Eurobalises, Euroloop and level 2 and level 3 functionality) 4.2.3 ETCS and GSM-R air gap interfaces: only radio communication with train 4.2.5.1 Interfaces — Data radio communication — Key management system — ETCS-ID Management — Interlocking and LEU 4.2.7.3 4.2.8 4.2.9 4.2.3 Construction of equipment 4.2.16 3 Eurobalise Reliability, Availability, Maintainability, Safety (RAMS) 4.2.1 4.5.1 ETCS and GSM-R air gap interfaces: only Eurobalise communication with train 4.2.5.2 Interfaces — LEU — Eurobalise 4.2.7.4 Construction of equipment 4.2.16 4 Euroloop Reliability, Availability, Maintainability, Safety (RAMS) 4.2.1 4.5.1 ETCS and GSM-R air gap interfaces: only Euroloop communication with train 4.2.5.3 Interfaces — LEU – Euroloop 4.2.7.5 Construction of equipment 4.2.16 5 LEU Eurobalise Reliability, Availability, Maintainability, Safety (RAMS) 4.2.1 4.5.1 Trackside ETCS functionality (excluding communication via radio in-fill, Euroloop and level 2 and level 3 functionality) 4.2.3 Interfaces — LEU — Eurobalise 4.2.7.4 Construction of equipment 4.2.16 6 LEU Euroloop Reliability, Availability, Maintainability, Safety (RAMS) 4.2.1 4.5.1 Trackside ETCS functionality (excluding communication via radio in-fill, Eurobalise and level 2 and level 3 functionality) 4.2.3 Interfaces — LEU – Euroloop 4.2.7.5 Construction of equipment 4.2.16 7 Axle Counter Trackside train detection systems (only parameters relevant for axle counters) 4.2.10 Electromagnetic compatibility (only parameters relevant for axle counters) 4.2.11 Construction of equipment 4.2.16

▼B







Table 5.2.b Groups of interoperability constituents in the Control-Command and Signalling Trackside Subsystem 1 2 3 4 N Group of interoperability constituents Characteristics Specific requirements to be assessed by reference to Chapter 4 1 Eurobalise LEU Eurobalise Reliability, Availability, Maintainability, Safety (RAMS) 4.2.1 4.5.1 Trackside ETCS functionality (excluding communication via Euroloop and level 2 and level 3 functionality) 4.2.3 ETCS and GSM-R air gap interfaces: only Eurobalise communication with train 4.2.5.2 Construction of equipment 4.2.16 2 Euroloop LEU Euroloop Reliability, Availability, Maintainability, Safety (RAMS) 4.2.1 4.5.1 Trackside ETCS functionality, (excluding communication via Eurobalise and level 2 and level 3 functionality) 4.2.3 ETCS and GSM-R air gap interfaces: only Euroloop communication with train 4.2.5.3 Construction of equipment 4.2.16

6. ASSESSING THE CONFORMITY AND/OR SUITABILITY FOR USE OF THE CONSTITUENTS AND VERIFYING THE SUBSYSTEMS

▼M1

6.1. Introduction

6.1.1. General principles

6.1.1.1. Compliance with basic parameters

Fulfilment of the essential requirements set out in Chapter 3 of this TSI shall be ensured through compliance with the basic parameters specified in Chapter 4.

This compliance shall be demonstrated by:

(1) assessing the conformity of the interoperability constituents specified in Chapter 5 (see point 6.2.1, 6.2.2, 6.2.3, 6.2.4);

(2) verifying the subsystems (see point 6.3 and point 6.4).

6.1.1.2. Essential requirements fulfilled by National Rules

In certain cases, some of the essential requirements may be met by national rules, because of:

(1) the use of Class B systems;

(2) open points in the TSI;

(3) non-application of TSIs (derogations) under Article 7 of Directive (EU) 2016/797;

(4) specific cases described in point 7.6.

In such cases, assessment of conformity with those rules shall be carried out under the responsibility of the Member States concerned according to notified procedures. See point 6.4.2.

6.1.1.3. Partial fulfilment of TSI requirements

With regard to checking if essential requirements are fulfilled through compliance with the basic parameters, and without prejudice to the obligations set out in Chapter 7 of this TSI, control-command and signalling interoperability constituents and subsystems that do not implement all functions, performance and interfaces as specified in Chapter 4 (including the specifications referred to in Annex A), can obtain EC certificates of conformity or, respectively, certificates of verification, under the following conditions for issuing and using the certificates:

(1) The applicant for EC verification of a trackside control-command and signalling subsystem is responsible for deciding which functions, performance and interfaces need to be implemented to meet the objectives for the service and to ensure that no requirements contradicting or exceeding the TSIs are exported to the on-board control-command and signalling subsystems.

(2) The operation of an on-board control-command and signalling subsystem, that does not implement all functions, performance and interfaces specified in this TSI, may be subject to conditions and limits of use due to compatibility and/or safe integration with trackside control-command and signalling subsystems. Without prejudice to the tasks of a Notified Body described in respective Union legislation and related documents the applicant for EC verification is responsible for ensuring that the technical file provides all the information ( 13 ) that an operator needs to identify such conditions and limits of use.

(3) The authorising entity may refuse for duly justified reasons the authorisation for placing in service or on the market, or place conditions and limits of use on the operation, of control-command and signalling subsystems that do not implement all functions, performance and interfaces specified in this TSI.

If a control-command and signalling interoperability constituent or subsystem does not implement all functions, performance and interfaces specified in this TSI, the provisions of point 6.4.3 shall apply.

6.1.2. Principles for testing ETCS and GSM-R

6.1.2.1. Principle

The principle is that a Control-Command and Signalling On-board Subsystem covered by an ‘EC’ declaration of verification is able to run on every Control-Command and Signalling Trackside Subsystem covered by an ‘EC’ Declaration of verification, under the conditions specified in this TSI, with no additional verifications.

Achievement of this principle is facilitated by:

(1) rules for the design and installation of the Control-Command and Signalling On-board and the Trackside subsystems;

(2) test specifications to prove that the Control-Command and Signalling On-board and Trackside Subsystems comply with the requirements of this TSI and are mutually compatible.

6.1.2.2. Operational test scenarios

For the purpose of this TSI, an ‘operational test scenario’ means a sequence of trackside and on-board events related to or influencing the Control-command and Signalling subsystems (e.g. sending/receiving messages, exceeding a speed limit, actions of operators) and the specified timing between them in order to test the intended railway system operation in situations relevant for ETCS and GSM-R (e.g. entry of a train into an equipped area, awakening of a train, overriding a signal at stop).

The operational tests scenarios are based on the engineering rules adopted for the project.

Check of compliance of a real implementation with an operational tests scenario shall be possible gathering information through easily accessible interfaces (preferably the standard interfaces specified in this TSI).

6.1.2.3. Requirements for Operational test scenarios

The set of engineering rules for the trackside parts of ETCS and GSM-R and related operational test scenarios for the Trackside Control-command and Signalling Subsystem shall be sufficient to describe all intended system operations relevant for the Trackside Control-command and Signalling Subsystem in normal and identified degraded situations, and:

(1) shall be consistent with the specifications referenced in this TSI;

(2) shall assume that functions, interfaces and performance of the Control-command and Signalling On-board Subsystems interacting with the Trackside Subsystem are compliant with the requirements of this TSI;

(3) shall be the ones used in the EC Verification of the Trackside Control-command and Signalling Subsystem, to check that the implemented functions, interfaces and performance are able to ensure that the intended system operation in combination with the relevant modes and transitions between levels and modes of the Control-command and Signalling On-board Subsystems are respected.

6.1.2.4. Requirements for ETCS System Compatibility

The Agency shall set up and manage in a technical document the set of checks to demonstrate the technical compatibility of an on-board subsystem with the trackside subsystem.

Infrastructure Managers, with the support of the ETCS suppliers for their network, shall submit to the Agency the definition of the necessary checks (as defined in 4.2.17) on their network by 16 January 2020 at the latest.

Infrastructure Managers shall classify the ETCS lines according to ESC types in RINF.

Infrastructure Managers shall submit to the Agency any changes on the referred checks for their network. The Agency shall update the technical document within 5 working days.

6.1.2.5. Requirements for Radio System Compatibility

The Agency shall set up and manage in a technical document the set of checks to demonstrate the technical compatibility of an on-board subsystem with the trackside subsystem.

Infrastructure Managers, with the support of the GSM-R suppliers for their network, shall submit to the Agency the definition of the necessary checks (as defined in 4.2.17) on their network by 16 January 2020 at the latest.

Infrastructure Managers shall classify their lines according to RSC types for voice and, if applicable, ETCS data in RINF.

Infrastructure Managers shall submit to the Agency any changes on the referred checks for their network. The Agency shall update the technical document within 5 working days.

▼B

6.2. Interoperability constituents

6.2.1. Assessment procedures for Control-Command and Signalling Interoperability Constituents

Before placing on the market an interoperability constituent and/or groups of interoperability constituents the manufacturer or his authorised representative established within the European Union shall draw up an ‘EC’ declaration of conformity in accordance with ►M1 Article 10(1) and Article 9(2) of Directive (EU) 2016/797 ◄ .

The assessment procedure shall be carried out using one of the modules specified in point 6.2.2 (Modules for Control-Command and Signalling Interoperability Constituents).

An ‘EC’ declaration of suitability for use is not required for Control-Command and Signalling interoperability constituents. Compliance with relevant basic parameters, as demonstrated by the ‘EC’ Declaration of conformity, is sufficient for placing the interoperability constituents on the market ( 14 ).

6.2.2. Modules for Control-Command and Signalling Interoperability Constituents

For assessing interoperability constituents within the Control-Command and Signalling Subsystems, the manufacturer or his authorised representative established within the European Union, may choose:

(1) either the type-examination procedure (Module CB) for the design and development phase in combination with the production quality management system procedure (Module CD) for the production phase; or

(2) the type-examination procedure (Module CB) for the design and development phase in combination with the product verification procedure (Module CF); or

(3) the full quality management system with design examination procedure (Module CH1).

In addition, for checking the SIM card Interoperability Constituent, the manufacturer or his representative may choose module CA.

The modules are described in detail in the Commission Decision 2010/713/EU ( 15 ).

The following clarifications apply to the use of some of the modules:

(1) with reference to Chapter 2 of the ‘Module CB’, ‘EC’-type examination shall be carried out through a combination of production type and design type;

(2) with reference to Chapter 3 of the ‘Module CF’ (product verification) statistical verification is not allowed, i.e. all interoperability constituents shall be individually examined.

6.2.3. Assessment requirements

Independently of the selected module:

(1) the requirements stated in point 6.2.4.1 of this TSI shall be respected for the ‘On-board ETCS’ interoperability constituent,

(2) the activities shown in Table 6.1 shall be carried out when assessing the conformity of an interoperability constituent or a group of interoperability constituents as defined in Chapter 5 of this TSI. All verifications shall be carried out by reference to the applicable table in Chapter 5 and the basic parameters indicated there.

▼M1







Table 6.1 Conformity assessment requirements of an interoperability constituent or a group of interoperability constituents No Aspect What to assess Supporting evidence 1 Functions, interfaces and performances Check that all mandatory functions, interfaces and performances as described in the basic parameters referenced in the relevant table of Chapter 5 are implemented and that they comply with the requirements of this TSI Design documentation and running of test cases and test sequences, as described in the basic parameters referenced in the relevant table of Chapter 5 Check which optional functions and interfaces as described in the basic parameters referenced in the relevant table of Chapter 5 are implemented and that they comply with the requirements of this TSI Design documentation and running of test cases and test sequences, as described in the basic parameters referenced in the relevant table of Chapter 5 Check which additional functions and interfaces (not specified in this TSI) are implemented and that they do not lead to conflicts with implemented functions specified in this TSI Impact analysis 2 Construction of equipment Check compliance with mandatory conditions, where specified in the basic parameters referenced in the relevant table of Chapter 5 Documentation on material used and, where necessary, tests to ensure that the requirements of the basic parameters referenced in the relevant table of Chapter 5 are satisfied In addition, check that the interoperability constituent functions correctly in the environmental conditions for which it is designed Tests according to the applicant's specifications 3 Reliability, Availability, Maintainability, Safety (RAMS) Check compliance with the safety requirements described in the basic parameters referenced in the relevant table of Chapter 5, i.e. 1. respect for quantitative Tolerable Hazard Rates (THRs) caused by random failures 2. the development process is able to detect and eliminate systematic failures 1. Calculations for the THRs caused by random failures, supported by reliability data. 2.1. The manufacturer's quality and safety management throughout design, manufacturing and testing conforms to a recognised standard (see note) 2.2. The software development life-cycle, the hardware development life-cycle and the integration of hardware and software have each been undertaken in accordance with a recognised standard (see note) 2.3. The safety verification and validation process has been undertaken in accordance with a recognised standard (see Note) and respects the safety requirements described in the basic parameters referenced in the relevant table of Chapter 5 2.4. The functional and technical safety requirements (correct operation under fault-free conditions, effects of faults and of external influences) are verified in accordance with a recognised standard (see Note) Note: The standard shall satisfy at least the following requirements: 1. be compliant with the requirements for code of practice, as stated in Annex I, point 2.3.2, of Regulation (EU) No 402/2013 2. be widely acknowledged in the railway domain. If this is not the case, the standard will have to be justified and be acceptable to the Notified Body; 3. be relevant for the control of the considered hazards in the system under assessment; 4. be publicly available for all actors who want to use it. 4 Check that the quantitative reliability target (related to random failures) indicated by the applicant is met Calculations 5 Elimination of systematic failures Tests of equipment (full Interoperability Constituent or separately for subassemblies) in operational conditions, with repair when defects are detected. Documentation accompanying the certificate which indicates which kind of verifications have been performed, which standards have been applied and criteria adopted to consider these tests completed (according to decisions of the applicant). 6 Check compliance with maintenance requirements – point 4.5.1 Document check

▼B

6.2.4. Special issues

6.2.4.1. Mandatory tests for the on-board ETCS

Particular attention shall be given to assessing the conformity of the on-board ETCS interoperability constituent, since it is complex and plays a key role in achieving interoperability.

Regardless of whether module CB or CH1 is chosen, the Notified Body shall check that

(1) a representative specimen of the interoperability constituent has been submitted to a full set of test sequences including all test cases necessary to check the functions referenced in point 4.2.2 (on-board ETCS functionality). The applicant is responsible to define the test cases and their organisation in sequences, if this is not included in specifications referenced in this TSI;

▼M1

(2) these tests were carried out in a laboratory accredited in accordance with Regulation (EC) No 765/2008 of the European Parliament and of the Council ( 16 ) and the standards referred to in Annex A, Table A 4 to carry out tests with the use of the test architecture and the procedures specified in Annex A 4.2.2.c.

▼B

The laboratory shall provide a full report clearly indicating the results of the tests cases and sequences used. The Notified Body is responsible to assess the suitability of test cases and sequences to check compliance with all relevant requirements and to evaluate the results of tests in view of the certification of the Interoperability Constituent.

6.2.4.2. The Specific Transmission Module (STM)

Each Member State shall be responsible for verifying that STMs conform to its national requirements.

Verification of the STM interface to the on-board ETCS requires a conformity assessment carried out by a Notified Body.

▼M1 —————

▼B

6.3. Control-Command and Signalling Subsystems

▼M1

6.3.1. Assessment procedures for Control-Command and Signalling Subsystems

This Chapter deals with the ‘EC’ declaration of verification for the Control-Command and Signalling On-board Subsystem and the ‘EC’ declaration of verification for the Control-Command and Signalling Trackside Subsystem.

At the request of the applicant the Notified Body shall carry out an ‘EC’ verification of a Control-Command and Signalling On-board or Trackside Subsystem in accordance with Annex IV to Directive (EU) 2016/797.

The applicant shall draw up the ‘EC’ declaration of verification for the Control-Command and Signalling On-board or Trackside Subsystem in accordance with Article 15(1) and Article 15(9) of Directive (EU) 2016/797.

The content of the ‘EC’ declaration of verification shall conform to Article 15(9) of Directive (EU) 2016/797.

The assessment procedure shall be carried out using the modules specified in point 6.3.2 (Modules for Control-Command and Signalling Subsystems).

The ‘EC’ declarations of verification for a Control-Command and Signalling On-board Subsystem and of a Control-Command and Signalling Trackside Subsystem, together with the certificates of conformity, shall be deemed sufficient to ensure that the subsystems are compatible under the conditions specified in this TSI.

▼B

6.3.2. Modules for Control-Command and Signalling Subsystems

All modules indicated below are specified in the Commission Decision 2010/713/EU.

6.3.2.1. On-board Subsystem

For verifying the Control-Command and Signalling On-board Subsystem, the applicant may choose either:

(1) the type-examination procedure (Module SB) for the design and development phase in combination with the production quality management system procedure (Module SD) for the production phase; or

(2) the type-examination procedure (Module SB) for the design and development phase in combination with the product verification procedure (Module SF); or

(3) the full quality management system with design examination procedure (Module SH1).

6.3.2.2. Trackside Subsystem

For verifying the Control-Command and Signalling Trackside Subsystem, the applicant may choose either:

(1) the unit verification procedure (Module SG); or

(2) the type-examination procedure (Module SB) for the design and development phase in combination with the production quality management system procedure (Module SD) for the production phase; or

(3) the type-examination procedure (Module SB) for the design and development phase in combination with the product verification procedure (Module SF); or

(4) the full quality management system with design examination procedure (Module SH1).

▼M1

6.3.2.3. Conditions for using modules for On-board and Trackside Subsystems

With reference to point 4.2 of Module SB (type-examination), design review is requested.

With reference to point 4.2 of Module SH1 (full quality management system with design examination), an additional type test is required.

▼B

6.3.3. Assessment requirements for an On-board Subsystem

Table 6.2 shows the checks that must be carried out when verifying a Control-Command and Signalling On-board Subsystem and the basic parameters that must be respected.

Independently of the module chosen:

(1) verification shall demonstrate that the Control-Command and Signalling On-board Subsystem complies with basic parameters when it is integrated into the vehicle;

(2) the functionality and performances of interoperability constituents already covered by their EC Declaration of conformity do not require additional verifications,

▼M1







Table 6.2 Conformity assessment requirements for an On-board Subsystem No Aspect What to assess Supporting evidence 1 Use of interoperability constituents Check whether the interoperability constituents to be integrated into the subsystem are all covered by an ‘EC’ Declaration of conformity and a corresponding certificate. The Subsystem needs to be checked with a SIM card compliant with the requirements of this TSI. Changing the SIM card with another one compliant with the TSI is not a modification of the Subsystem. Existence and content of documents Check conditions and limits of use on the use of Interoperability Constituents against the characteristics of the subsystem and of the environment Analysis by document check For interoperability constituents that have been certified against a version of the CCS TSI, which is different from the version applied for the ‘EC’ Verification of the subsystem and/or against a set of specifications which is different from the set of specifications applied for the ‘EC’ Verification of the subsystem, check that the c