Article citation information:

Kycko, M., Zabłocki, W. Certification in control command and signalling system investment processes. Scientific Journal of Silesian University of Technology. Series Transport. 2018, 101, 119-130. ISSN: 0209-3324. DOI:



Magdalena KYCKO[1], Wiesław ZABŁOCKI[2]






Summary. Railway system infrastructure, including control subsystems, is subject to continuous normative technical and legal regulations as defined by EU directives and European Commission regulations, as well as national railway administrations decrees. The aim of regulation is the optimization, harmonization and pursuit of the full interoperability, among others, of control subsystems, through the Control Command and Signalling Technical Specifications for Interoperability (CCS TSI), thereby providing consistency in terms of safety assurance level improvements. Regardless of TSI and baseline specification sets, it is crucial that certification processes function according to specific rules and procedures. In this publication, certification issues concerning a control subsystem and its elements will be discussed. It is assumed that the certification process should include a complex approach to CCS, starting from the project phase and finishing at the adaptation and trial exploitation phase. It is critical that CCS system adaptation is intensified in the PKP PLK.

Keywords: railway investments; European Commission certification; interoperability



Currently, the railway business is experiencing dynamic growth. In the coming years, a series of infrastructural railway investments is planned in line with strategies for railway transport growth in Poland. A fundamental factor related to the investment process is certification. Without a certification process, investment will not be given placed-in-service authorization. Taking into consideration the safety of railway investment, the certification of the control subsystem and/or its components, which are responsible directly for control command safety, is crucial.

The duty of pursuing European Commission (EC) certification processes is, among others, the result of acceptance of a directive on the interoperability of the rail system within the EU (2008/57/EC) [6]. In the foregoing directive, subsystems for the creation of a railway system are defined, as well as fundamental requirements, which are described in Attachment III to the directive [6].



Fig. 1. Structural and functional subsystems division
(developed on the basis of [6])


Detailed requirements for individual subsystems have been defined in the so-called Technical Specifications for Interoperability (TSI). These documents set out the requirements regarding individual subsystems, as well as requirements related to cooperating subsystems’ interfaces and interoperability component requirements. This article is dedicated to control subsystems.

Aside from European law requirements, there are also national ones, which are included in the “List of National Technical Specification and Normalization Documents, Which Enable Meeting the Fundamental Requirements Regarding the Interoperability of the Railway System” [11], published by the President of the Office of Railway Transport (UTK).

Currently, there are many crucial and complicated infrastructural investments being pursued, which require compliance on the part of contractors with a great deal of European and national legislation. The certification process is aimed at confirming that specific investment is pursued according to the law. When the evaluation is positive, a contractor seeking to invest will receive EC validation certificates, and, the in following stage, will be able to receive placed-in-service authorization from the UTK President. Due to the PKP PLK pursuing many tenders, it is more common that new projects or even whole investments are pursued by newly established companies, which do not have sufficient knowledge about railway investment implementation or the certification process.

Certification process implementation, as well as attaining European certificates, is both complicated and time-consuming. However, it is a necessity that ensures transport network integrity in Europe. This article is aimed at underlining the importance of certification and bringing its meaning closer to investment processes.





The certification process is mainly based on European law requirements, which have been stated in the relevant directive [6] and the TSI. In addition, some national law requirements are in effect. They need to be applied when issues not included in the TSI (indicated them as open points or not specified at all) are under evaluation. One of the main areas outside the scope of the TSI is the Control Command and Signalling (CSS) System [13].

The CCS system is trifold [13] and comprises: CCS system interlocking, the trackside part of automatic train protection (ATP) and the on-board side of ATP. Interlocking is defined as the control of track and turnout vacancies, systems using them as well as equipment protecting railway crossings. Interlocking is evaluated according to national law. The requirements are included in an EC implementing regulation [3], which refers to the UTK President’s list [11] as an applying document. The ATP is based on safe digital data transfer. The data are uploaded from the interlocking and passed to the vehicles. In the EU, ATP has been presented as an interoperative solution fully defined under European law. The solution is labelled as the European Rail Transport Management System (ERTMS).

The EC certification process is carried out by notified bodies in reference to the Railway Directive [6]. There are several units in Poland, which can be found on the New Approach Notified and Designated Organisations (NANDO) [12] database, including information about their accreditation area. The notified body should be engaged in pursuing an investment process from the very start, i.e., project evaluation. The certification process is presented in Figure 2.

The EC verification of “control: trackside device” and “control: on-board device” subsystems is pursued separately. In the case of on-board devices, EC verification applies to on-board ERTMS/ETCS and ERTMS/GSM-R devices. In Poland, on-board devices related to control is limited to the SHP system, as well as 1,500-MHz radio including a RADIOSTOP function. Those systems are evaluated separately from ETCS and GSMR verification.

Regarding trackside devices, interlocking [13] is crucial. Essential, safe data, based on which movement authorities (MAs) are generated, are uploaded from the interlocking. Control subsystem compliance verification does not have to include the whole subsystem as defined by the law. For example, a railway line might be equipped with a GMS-R system and not equipped with ETCS, or vice versa. In such a situation, intermediate certification is issued.

The EC certification process is pursued according to the chosen conformity assessment module. Conformity assessment modules are defined in Commission Decision 2010/713/EU [1]. There are modules specified in the TSI, the use of which is authorized in the certification process for the respective subsystem or interoperability constituent. Conformity assessment modules, which are permitted in the control subsystem certification process, are presented below. The main ones used are in bold.



Fig. 2. Certification process (own elaboration)
(the meaning of each module will be explained in Figure 3)



Fig. 3. Interoperability constituent and control subsystem assessment modules
(own elaboration based on [4])



Interoperability constituents, as described in Figure 3, have been separated from the control subsystem in accordance with the relevant EC regulation [4].

The EC certification process depends on the specific assessment module, while each certification process needs to confirm that the respective system or device is compliant with relevant TSI requirements. Based on what is chosen by the notified body for EC certificates, the subsystem or interoperability constituent producer is able to issue an EC certificate of conformity, and, subsequently, with appropriate documentation, apply for placed-in-service authorization of the subsystem or interoperability constituent at the office of the UTK President.

The certification process may have indirect or direct effects on the whole railway investment, but it mostly affects safety. That is why the certification stage is significant for any investment process. Therefore, it is very important that the certification process is carried out by a complete notified body.



Fig. 4. List of control subsystem constituents
(own elaboration based on [4])





Over the past few years, the growth in the number of railway investments has become noticeable. The size of the projects in such a short period is connected to strong growth in the level of railway investment risks.

Among the main factors responsible for railway transport’s safety are CCS systems, which have developed considerably over the past few years. New CCS systems made by various producers have appeared on the market, while there has also been an increase in the level of railway investment risks. In the CCS sector itself, more and more investments linked to the introduction of new, interoperable systems have appeared. According to [9], submitted in July 2017 to European Commission, it is predicted that by 2023, 2,667 km of railway lines will be equipped with an ETCS system; by 2030, that figure will double, exceeding 6,700 km. Simultaneously, GSM-R system implementation on the majority of railway lines in Poland is planned.

In the course of railway investments that include CCS systems, contractors are obliged to comply with many legal documents, such as norms, Commission regulations and the TSI. All the requirements are indirectly or directly aimed at increasing system safety levels in relation to the investment.

The investment process itself can affect the safety of a CCS system, causing a potential risk. In order to better visualize such a risk, an example of a situation that took place in the context of a railway investment is described below.

The example involves the installation of ECTS 1 [8] system devices on Line E-65 CMK. After the installation, reception and implementation of a system, during the trial exploitation period, LEU coder failures, caused by lightning discharges, have become commonplace on account of repeatability. Other exploitation issues may include:

-    CCS system diversity, which creates difficulties with interface implementation

-    connecting cables with balise manufacturing technology

-    beacon signal light bulb socket connection conductivity


The relevant issue in this example can be expressed by the question concerning what might have caused the damage, despite the fact installation was carried out by an experienced company, which carries a European certificate authorizing it to install ETCS systems. Additionally, the system was examined after installation and subject to certification. Preliminary analysis of the cause might indicate the following defect factors:

-    low LEU coder resistance of overvoltages caused by atmospheric discharges (susceptible electronic components or lack of an overvoltage protective system)

-    installation causes resulting from return wire issues


LEU damage and other ETCS 1 installation issues cause, or might cause, the absolute phase-out of authorizing signals, ruling out their display until service repair. Consequently, “STOP” signals are displayed. During that time, the human factor is decisive regarding the train journey, in terms of whether to implement the journey on “Sz” or special order “S”, which in turn becomes the cause of the safety hazard.

The aim of the above example is to emphasize how the investment process has a direct or indirect effect on a CCS system’s safety. The foregoing example explains that emergency situations involving a safe CCS system, in order to provide movement sustainability, implicate human factor interference, which is a safety hazard.

Another significant conclusion is that an investment process cannot be managed without a certain organization of cooperation between the ordering institution and the contractor (contractors). This undoubtedly requires the selection of adequate, qualified staff and infrastructure resources.

Below is a list of other risks that might occur during an investment process, which affect safety levels and the certification process itself.


                                                                                                                                Table 1

Investment process risks (own elaboration).


Risk category

Risk factor


Risks related to projects

-    Insufficient on-site verification and stocktaking (project cost underestimation)

-    Mistakes in projects


Operation risks

-    Increase in assumed operation costs

-    Climate risks (frosts, floods etc.)


Administrative/legal risks

-    Delays in receiving investment realization authorization (e.g., construction), delays in receiving environmental approval

-    Law ambiguity (e.g., mistakes in TSI translation)

-    Changes in law and requirements during investment processes

-    Ignoring certification obligation in investment processes


Risks related to construction/technical risks

-    Capital expenditure budget exceeded

-    Geological risks (unexpected detrimental land conditions, landslides etc.)

-    Climate risks (frosts, floods etc.), archaeological risks (excavation)

-    Risks related to constructors (bankruptcy, lack of sufficient resources etc.)

-    Choice of inappropriate control systems

-    Failure to comply with high safety level

-    Necessity to create interfaces between various systems

-    Systems/application errors

-    New technologies (lack of experience)


Financial risks

-    Availability of national funds for capital expenditure financing

-    Increase of installation and maintenance financing costs

-    Investment financing, e.g., financing withdrawal

-    Necessity to maintain two systems during the transition period

-    Investment delays, frequent lack of timeliness,

-    Costs of interfaces between systems are not considered, they frequently exceed the system costs


Human factor risks

-    Contractor’s lack of knowledge and experience

-    External pressure/lack of neutrality

-    Lack of risk awareness

-    Lack of CCS specialists

-    Fatigue/labour in stress





According to the requirements specified in tender documentation, the contractor involved in an investment is responsible for obtaining control subsystem EC verification certificates. The contractor choses both the notified body and the assessment modules, according to which the whole certification process is realized. Moreover, the EC certified contractor issues an EC verification declaration, when simultaneously taking over responsibility for the specified subsystem.

Based on the above-presented safety hazard situation, the importance of pursuing the right investment process, as well as carrying out the certification process, has been shown. While pursuing the certification process, several errors may occur: during the project, the construction stage or even final inspection. Such a situation, ultimately, has an effect on whether the certification process is extended. It leads to delays in agreement implementation as well as resulting in the imposition of additional costs, which have not been included in the investment estimated budget. In a railway investment process, which is aimed at creating a safe subsystem, the certification process is essential and often confirms compliance with mandatory document requirements, as well as safety requirements. During the certification process itself, noticing potential system faults or errors is not always possible. Defects are detectable only during subsystem exploitation. Moreover, it is important that such a certification process is carried out by qualified notified bodies, which increases the probability of detecting potential errors that might threaten subsystem safety.

In the course of the investment process, the contractor, independent of the evaluation conducted by the notified body, is responsible for seeking specific investment, in particular, in subsystem safety.




During investment processes, the certification process is not treated by the contractors with adequate seriousness. The meaning of certification in an investment process is beyond question. There are some investment contractors that have come across certification many times; nevertheless, the lack of sufficient knowledge on legal requirements and certification itself still occurs. One of the most common mistakes made by investment contractors is a late application to the notified body, which causes the construction stage to start without the certificate at the project stage having been issued. It significantly impedes the implementation of changes detected by the notified body at the project evaluation stage. Such situations may result in non-certification and the need for project implementation changes, and, worse still, changes to the already constructed subsystem, which will also affect investment costs.

In the railway sector, specialists need to know both technical and legal requirements, which, unfortunately, change frequently. In recent times, many norms and EC regulations have been modified, resulting in common issues related to changes in approach or in the production process. Frequent changes in legal documents are associated with legal ambiguities or mistakes in document translation, which ultimately leads to issues in the interpretation of requirements. Currently, work is taking place on issuing new CSS TSI, with an announcement planned for the second half of 2019. The new specifications will introduce a few essential changes; among other, a train detection system is going to be a new interoperability constituent of the control subsystem. The changes are crucial and will introduce additional “confusion” in terms of investment.

Another issue frequently occurring the during certification process is the incorrect definition of subsystem borders, which is especially difficult in the case of the control subsystem. The control subsystem not only contains devices subject to the investment, but also interfaces with the existing infrastructure. Even ordering units themselves forget about interface construction and the necessity of evaluation, instead preferring to “pin” these issues on investment contractors; meanwhile,  the costs of the interface exceed the costs of the system. That is why it is important that the ordering unit cooperates with the contractor from an early stage, which is increasing less common nowadays.

During the certification process, the lack of awareness on the part of the contractor about used interoperability constituents can be encountered. During subsystem evaluation, it may transpire that used interoperability constituents have not obtained appropriate certification and EC certificates of conformity. In such situations, subsystems cannot be evaluated positively, which in turn causes investment realization delays as well as financial loses.

An additional issue related to the evaluation of “control: trackside device” and “control: on-board device” subsystems is the system version update. ERTMS/ETCS and ERTMS/GSM-R systems are programmable by electronic means [13]. Those systems are subject to technical development; hence, software updates are created, but maintaining consistency in terms of the solutions applied to the railway system scale, in respect of the railway network and the rolling stock, remains an issue. In order to supervise system version changes, so-called version management (of collected versions, which are specified as standards) is used. In the case of the ETCS system, Baseline 2 and Baseline 3 are currently used. They are defined in Appendix A of the CCS TSI [4]. Each railway line is equipped with one specified system version. On the Polish railway, Baseline 2 (Version 2.3.0d) is commonly used, with traction units in Poland are currently equipped or being equipped according to Baseline 2. However, vehicles to be released into exploitation after 1 January 2019 will need to comply with Baseline 3 (Version 3.4.0). On-board devices that are compliant with Baseline 3 will need to demonstrate complete compliance with Baseline 2 as well.

For new projects regarding “control: on-board device” subsystems, assumptions regarding the choice of the baseline according to Subset 026 are made. Under EU 2014-2020, the finance-specific System Requirement Specification (SRS) 2.3.0d will be used, followed by SRS 3.4.0 after 2020.

In order to compensate for the foregoing situations, risk analysis strategies, which should be pursued at every stage of an investment [7,10,16], might be helpful. Such approaches are required under the pertinent directive [5] and EC regulation (402/20130) [2]; nevertheless, these documents do not specify the methods that should be used to carry out risk analysis. Therefore, it is necessary that any analysis is carried out by qualified and experienced specialists.

In terms of control subsystem certification, risk-generating issues will occur during an investment process. The most important risks have already been presented above. However, it cannot be ignored that the CCS construction process might only be initiated after finishing other subsystems, thus frequent infrastructure construction delays affect the timeline of control subsystem construction. Such a situation, ultimately, results in work being rushed and a lack of labour accuracy, which increases the risk level.

Referring to issues and risks connected to the CCS system investment certification process, as presented above, it is necessary to increase the level of awareness and qualifications amongst contractors. Investments pursued nowadays, as well as the frequency of delays, indicate that the railway industry needs time to increase the level of qualifications and adaptation to legal requirements.





The subsystem or interoperability constituent certification process is unavoidable. However, many contractors are aware of that fact it can be still neglected or that the process can be treated as unnecessary, in turn delaying the investment. The certification process is practically the last stage at which project documentation is verified and its compliance is confirmed. That is why the certification stage is highly important during any investment process and should be carried out by reliable, qualified bodies. Additionally, subsystem verification is an essential component in the assurance of conformity with basic parameters and essential requirements, which provide the interoperability of railway systems in the EU.





1.        Commission Decision of 9 November 2010 on Modules for the Procedures for Assessment of Conformity, Suitability for Use and EC Verification to Be Used in the Technical Specifications for Interoperability Adopted Under Directive 2008/57/EC of the European Parliament and of the Council.

2.        Commission Implementing Regulation (EU) No 402/2013 of 30 April 2013 on the Common Safety Method for Risk Evaluation and Assessment and Repealing Regulation (EC) No 352/2009.

3.        Commission Implementing Regulation (EU) 2015/1136 of 13 July 2015 Amending Implementing Regulation (EU) No 402/2013 on the Common Safety Method for Risk Evaluation and Assessment.

4.        Commission Regulation (EU) 2016/919 of 27 May 2016 on the Technical Specification for Interoperability Relating to the ‘Control Command and Signalling’ Subsystems of the Rail System in the European Union.

5.        Directive 2004/49/EC of the European Parliament and of the Council of 29 April 2004 on Safety on the Community’s Railways and Amending Council Directive 95/18/EC on the Licensing of Railway Undertakings and Directive 2001/14/EC on the Allocation of Railway Infrastructure Capacity and the Levying of Charges for the Use of Railway Infrastructure and Safety Certification (Railway Safety Directive).

6.        Directive 2008/57/EC of the European Parliament and of the Council of 17 June 2008 on the Interoperability of the Rail System within the Community (Recast with 2009/131/EC of 16 October 2009, 2011/18/EU of 1 March 2011, 2013/9/EU of 11 March 2011, 2014/38/EU of 10 March 2014 and 2014/106/EU of 5 December 2014).

7.        Ghaemi N., O. Cats, R.M.P. Goverde. 2017. Public Transport 9(1-2): 343-364. DOI:

8.        Jeziorski J.J. 2015. Analiza doświadczeń eksploatacyjnych systemu ETCS L1 na wybranym odcinku CMK. [In Polish: Analysis of the Operation of the ETCS L1 System Based on a Selected Section of the Central Rail Line”.] Master’s thesis. Warsaw: Faculty of Transport, Warsaw University of Technology.

9.        Krajowy Plan Wdrożenia Technicznej Specyfikacji Interoperacyjności “Sterowanie”. Ministerstwo Infrastruktury i Budownictwa Rzeczpospolitej Polskiej, Warszawa, czerwiec 2017. [In Polish: National Plan of “Control Command and Signalling” Technical Specification for Interoperability Implementation”. Ministry of Infrastructure and Construction, Warsaw, June 2017.]

10.    Kycko M., W. Zabłocki. 2016. “Problem ryzyka w inwestycjach systemów SRK”. Zeszyty Naukowo-Techniczne SITK RP, Oddział w Krakowie 3(110). ISSN 1231-9155. [In Polish: “Problem of Risk in Investments of Signalling Systems”. Research and Technical Papers of Polish Association for Transportation in Cracow.]

11.    “Lista Prezesa Urzędu Transportu Kolejowego w sprawie właściwych krajowych specyfikacji technicznych i dokumentów normalizacyjnych, których zastosowanie umożliwia spełnienie zasadniczych wymagań dotyczących interoperacyjności systemu kolei z 19 stycznia 2017 r.”. [In Polish: “UTK President’s List of National Technical Specification and Normalization Documents, Which Enable Meeting the Fundamental Requirements Regarding the Interoperability of the Railway System”, 19 January 2017.]

12.    Nando (New Approach Notified and Designated Organisations) Information System. Available at:

13.    Pawlik M. (ed.). 2017. Interoperacyjność systemu kolei Unii Europejskiej. Infrastruktura, sterowanie, energia, tabor. Kurier Kolejowy. Warsaw. ISBN: 978-83-949228-0-1. [In Polish: European Union Railway System Interoperability. Infrastructure, Control, Energy, Rolling Stock, Railway Courier.]

14.    PKP Polskie Linie Kolejowe S.A. [In Polish: PKP Polish Railway Lines S.A.]. Available at:

15.    Raport nr PKBWK/1/2013 z badania poważnego wypadku kat. A 01 zaistniałego w dniu 3 marca 2012 r. o godz. 20:55 na szlaku Sprowa - Starzyny w torze nr 1 w km 21,250 linii kolejowej nr 64 Kozłów - Koniecpol. [In Polish: Report No. PKBWK/1/2013 of the Major Accident Category A 01 Examination, Which Took Place on 3 March 2012, at 20:55 on the Sprowa-Starzyny Trail on Track 1, at the 21,250-km Point of Kozłów- Koniecpol Railway Line No. 64.]

16.    Singhal V., S.S. Jain, M. Parida. 2018. “Train Sound Level Detection System at Unmanned Railway Level Crossings”. European Transport \ Trasporti Europei. Issue 68. Paper no 3: 1-18.



Received 13.08.2018; accepted in revised form 03.11.2018



Scientific Journal of Silesian University of Technology. Series Transport is licensed under a Creative Commons Attribution 4.0 International License

[1] Railway Institute, Chłopickiego 50 Street, 04-275 Warsaw, Poland. Faculty of Transport, Warsaw University of Technology, Koszykowa 75 Street, 00-662 Warsaw, Poland. Email:

[2] Faculty of Transport, Warsaw University of Technology, Koszykowa 75 Street, 00-662 Warsaw, Poland. Email: