DATO as a System-of-Systems: Building the Next European Railway Architecture

by Bastian

DATO is often introduced through its most visible technologies: Automatic Train Operation, Moving Block, Remote Driving, GoA4, advanced Traffic Management Systems, FRMCS, train integrity or autonomous decision-making.

This is understandable. Technologies are tangible. They can be specified, procured, tested and demonstrated. Yet DATO is not only a collection of automation technologies. It is the framework through which the railway system starts to reorganise itself as a digital, automated and interoperable system-of-systems.

This is why DATO cannot be understood as a single product, a single subsystem or a single target configuration. It is not only about making trains run automatically. It is about redesigning how functions, data, responsibilities, safety assumptions, performance objectives and migration paths are distributed across the whole railway system.

From an architecture perspective, DATO is therefore not the next railway subsystem. It is a new way of structuring the railway system itself.

Executive summary

DATO is often described through its technologies: Automatic Train Operation, Moving Block, Remote Driving, GoA4, FRMCS, advanced Traffic Management Systems, train integrity or digital rolling stock. This view is useful, but insufficient. From an architecture and business transformation perspective, DATO should be understood as the next European railway operating architecture: a system-of-systems that will determine how functions, data, responsibilities, safety principles and performance objectives are distributed across rolling stock, infrastructure, control-command, operations and digital platforms.

The strategic challenge is not only to define the future target system. It is to control the transition from today’s brownfield railways towards that target architecture without creating another layer of fragmentation, stranded investments or proprietary lock-in. This requires disciplined architecture governance: clear capability mapping, controlled configuration variability, version and compatibility management, migration rules, lifecycle ownership, data interoperability and a distinction between the harmonised core and the adapters needed for transition.

DATO also changes the investment logic of railway automation. Future performance gains will depend less on isolated technologies and more on the ability to make onboard systems, trackside systems, traffic management, telecoms, cybersecurity, operational rules and rolling stock data work together. The key question is therefore not only whether a technology can be deployed, but whether its residual performance after integration still solves the business problem that justified the investment: capacity, cost reduction, resilience, staff productivity, degraded operation or modal shift.

This creates a central executive trade-off between stability and innovation. Railways need stable specifications and long asset lifecycles to protect investment confidence. At the same time, the sector cannot freeze innovation while facing capacity constraints, climate vulnerability, obsolescence, cybersecurity risks, demographic pressure and freight competitiveness challenges. DATO must therefore be designed as an evolvable architecture: stable enough to invest in, modular enough to evolve, open enough to avoid dependency, and governed enough to preserve interoperability.

For infrastructure managers, railway undertakings, suppliers and public authorities, the implication is clear: DATO is not a technology programme to be delegated only to engineering teams. It is a strategic architecture programme. It will shape future CAPEX/OPEX allocation, access conditions to the network, supplier strategies, software and hardware lifecycle models, cybersecurity obligations, data governance and the long-term competitiveness of rail.

This is why DATO must be built as a European railway common good. Proprietary solutions may appear faster locally, but they cannot solve the system-level challenge. The future automated railway requires shared specifications, open interfaces, controlled variability and collective governance. Like ERTMS, DATO should provide a common foundation on which industry can innovate, operators can invest, and Europe can strengthen the competitiveness, resilience and sovereignty of its railway system.

Last modified: 2026-06

Reading time: 35 min

This article by Bastian Simoni is licensed under CC BY-NC-SA 4.0

Written by Bastian Simoni

Bastian Simoni is a railway system architect working at the intersection of signalling, automation and digital railway operations. Voie Libre is his personal blog on the system architecture behind the future European railway: ERTMS, DATO, automation, migration and interoperability.

Content

Introduction
Railways have always been migrating systems
A technically integrated system in an institutionally separated sector
DATO as a target system-of-systems
Technology infusion in a brownfield railway
Stability, innovation and lifecycle responsibility
From equipment interoperability to data interoperability
When capabilities cross subsystem boundaries
DATO as a European railway common good
What comes next: crossing the innovation valley of death
Conclusion
Documentation and further reading

1. Introduction

Railway automation is often described as a technological progression. First, trains are protected by automatic train protection systems. Then, they are driven automatically by ATO. Later, they may operate without staff onboard, under GoA4 conditions. This narrative is convenient because it gives a simple direction of travel. It suggests that automation is mainly about adding more advanced functions to trains and signalling systems.

Yet this view is too narrow.

Digital and Automated up to Autonomous Train Operation, or DATO, is not simply the next layer of railway automation. It is not only Automatic Train Operation. It is not only Moving Block. It is not only GoA4. It is not only Remote Driving. And it is certainly not only the removal of the driver from the cab.

DATO is a deeper transformation. It is the point at which the railway system has to be understood as a system-of-systems: a distributed architecture made of rolling stock, infrastructure, signalling, traffic management, telecommunications, onboard software, operational rules, cybersecurity, maintenance, supervision, human responsibilities, safety principles and migration constraints.

This is why DATO is difficult to grasp. It is not one system that can be specified, procured and deployed in isolation. It is a way of organising many railway systems so that they can exchange data, share functions, allocate responsibilities and deliver performance together.

In that sense, DATO is not only about automating trains. It is about redesigning how information, decisions and responsibilities circulate across the railway.

Figure 1 — DATO as a system-of-systems: harmonised core, connected capabilities and infrastructure areas.

2. Railways have always been migrating systems

The railway system has never been static. Since its origins, it has evolved through successive waves of technical migration. Steam traction gave way to diesel and electric traction. Electrification through catenary transformed the performance and economics of many networks. Today, battery and hydrogen trains are being considered for lines where full electrification may not be economically justified.

The same is true for communications. Railway operation began with direct human interaction, visual signals and local procedures. It then evolved through telegraph links, fixed telephony, radio communication, analogue systems, digital radio and GSM-R. The sector is now preparing another major transition with FRMCS, which will progressively replace GSM-R and support the future digital railway.

Signalling and control-command have followed a similar path. Local signalling principles evolved into national signalling systems, then into national automatic train protection systems, and finally into ERTMS/ETCS as the European interoperable train control system. Each of these transformations has created new technical possibilities, but also new migration challenges.

This permanent migration is one of the intrinsic characteristics of railways. However, railways have a specific constraint that makes migration particularly complex: the train operates inside the infrastructure. A train is not an isolated machine. It is a mobile subsystem operating within a fixed infrastructure, under signalling constraints, operational rules, safety responsibilities, energy systems and communication systems. Every major railway migration therefore raises the same question: how can the onboard world and the trackside world remain compatible?

In a national railway, this compatibility was already difficult to manage. In Europe, it becomes an interoperability challenge. This is why ERTMS has become so central. It is not only a signalling programme; it is a European attempt to create a common control-command and signalling framework across historically fragmented national railway systems.

DATO must be understood in this continuity. It is not a disruption outside railway history, nor a sudden break with everything that came before. It is the next layer in the long history of railway migration. But this time, the migration goes deeper. It does not only concern traction, communication or signalling equipment. It concerns the way operational responsibilities are distributed, the way data circulates, the way functions are allocated between train and infrastructure, and the way decisions are made across the railway system.

3. A technically integrated system in an institutionally separated sector

Railways are technically integrated systems. A train movement depends on rolling stock, infrastructure, signalling, energy, communications, timetables, traffic management, operational rules and human decisions. The performance of the railway is never the performance of a single component. It is the performance of the whole system.

At the same time, the European railway sector is no longer institutionally integrated in the same way as it was during the era of national railway companies. Since the European railway reforms initiated in the 1990s, and especially through the progressive separation between infrastructure management and railway undertakings, the sector has moved towards a model based on market opening, non-discriminatory access and clearer separation of responsibilities. This transformation was essential for the construction of the Single European Railway Area, but it also changed the way system-level decisions are made.

In an integrated national railway, decisions between onboard and trackside functions could be made inside one organisation. The same institutional entity could decide whether to invest in infrastructure equipment, rolling stock equipment, signalling logic or operational processes. The cost could be located in one part of the system, while the benefit could appear elsewhere. This did not make the system simple, and it did not guarantee optimal decisions, but it allowed certain trade-offs to be made at system level.

In the separated railway, these trade-offs become more complex. The infrastructure manager may benefit from lighter trackside equipment, while railway undertakings may have to invest in more capable rolling stock. The network may gain capacity, but the cost may fall on vehicle owners. A new signalling or automation architecture may reduce infrastructure maintenance, but require onboard train integrity, safe positioning, enhanced TCMS interfaces, new cybersecurity capabilities or advanced software maintenance.

The railway therefore remains technically interdependent while being institutionally distributed. DATO will make this tension impossible to ignore. A more train-centric architecture may make sense from a network perspective because it can reduce trackside equipment, improve resilience, support Moving Block or simplify future infrastructure. But if it requires significant onboard investment, the question immediately becomes economic and institutional: who pays, who benefits, who carries the risk, and how is the business case shared between infrastructure managers, railway undertakings, rolling stock owners and public authorities?

This question is particularly sensitive for freight. Freight operators often operate with low margins, heterogeneous fleets and long asset lifecycles. If the future digital railway requires advanced onboard capabilities such as train integrity, safe positioning, FRMCS, cybersecurity, digital train data, DAC or mission fitness functions, then the cost of accessing the future network may increase.

This raises a systemic question: could the future automated railway unintentionally create new barriers to entry for smaller operators?

This is not an argument against automation. It is an argument for thinking about automation as a system. DATO cannot be reduced to technology readiness. It also requires economic, institutional and regulatory readiness.

4. DATO as a target system-of-systems

The notion of a target system is essential. Without a target architecture, the railway sector risks reproducing the fragmentation it is trying to overcome: national specificities, incompatible solutions, local optimisations and proprietary architectures. A European target system gives direction. It helps structure the future, supports harmonisation and allows the sector to converge.

However, for DATO, the target system should not be understood as a single technical configuration that will be deployed everywhere in the same way. The future European railway will not be uniform. Some lines may operate with ETCS Level 2 fixed block. Others may use Hybrid Train Detection. Others may evolve towards Moving Block. Some areas may support GoA2, while others may be prepared for GoA4. Some trains may be ATO-fitted, while others may not. A GoA2 train may run through an infrastructure area that is technically GoA4-ready, while still operating only at its own maximum automation capability.

This means that interoperability will not be enough. DATO will also require compatibility management. Each infrastructure area may need to be described through properties: signalling capability, automation capability, communication capability, train detection principle, operational mode, fallback mode, performance regime and degraded operation capability. Each train may also need to be described through its own properties: ETCS capability, ATO capability, GoA capability, safe positioning capability, train integrity capability, FRMCS or GSM-R capability, TCMS interfaces, Remote Driving capability and health monitoring capability.

The operational question then becomes: can this train, with this onboard configuration, operate in this infrastructure area, under this operational mode, with this performance level?

This is not a simple binary question. It is not only a matter of being compatible or not compatible. It is about controlled variability.

This variability is also visible in performance regimes. The same DATO capability may support very different railway needs. A dense suburban line and a low-density regional line could both use Moving Block and GoA4, but not for the same reason. On the suburban line, the objective may be maximum capacity, short headways, high frequency and high resilience during peak hours. On the low-density line, the objective may be to reduce trackside equipment, lower operating costs, compensate for staff shortages and preserve a useful rail service where conventional operating economics are difficult.

The same family of capabilities can therefore support different operational and economic models. This is why the future European railway does not need one single configuration. It needs controlled variability. DATO should be understood less as a uniform target system and more as a target system-of-systems: a structured set of capabilities, interfaces, configurations and performance regimes that remain harmonised while allowing different deployment contexts.

There is another difficulty: the target system itself may evolve. Any target system defined today is the sector’s best understanding of the future at a given point in time. It is necessary because it gives direction, but it cannot freeze the evolution of a railway system that will continue to face new constraints, new technologies and new operational needs.

The railway system of 2050 may not exactly correspond to the target system as it is understood in the 2030s. Climate resilience, energy constraints, cybersecurity threats, demographic change, freight competitiveness, artificial intelligence, satellite communication, new maintenance models or new operational needs may change the way the sector understands the target architecture. This does not make the target system useless. On the contrary, it makes it even more important, provided that it is seen as a direction for controlled evolution rather than a final configuration outside history.

The target system gives the direction. Technology infusion provides the trajectory. Each local project must solve a local problem, but it should also keep the European target architecture in mind. Otherwise, automation may become another layer of fragmentation rather than a path towards convergence.

Controlled variability across infrastructure areas

Figure 2 — Controlled variability: different infrastructure areas may expose different properties while remaining part of the same target system-of-systems.

5. Technology infusion in a brownfield railway

DATO will not be deployed on a blank sheet of paper. Greenfield railway automation projects exist, but they are rare. Most railway automation will take place in brownfield environments: existing infrastructure, existing rolling stock, existing signalling systems, existing operational rules, existing responsibilities, existing safety assumptions and existing organisations.

This is what makes railway automation fundamentally different from many technology projects. The new function does not arrive alone. It connects to adjacent systems, and those adjacent systems define part of its real performance.

ATO Trackside depends on the operational quality and responsiveness of the Traffic Management System. If the TMS cannot generate, update or distribute operational data dynamically enough, the ATO function may not deliver its expected operational value. An RBC may inherit constraints from an existing interlocking. It may enable ETCS Level 2 operation, but still carry part of the route-centric logic and complexity of the previous signalling architecture. Remote Driving depends on TCMS interfaces, video systems, communication performance, cybersecurity, operational rules, degraded modes and human factors. ETCS retrofit depends on train adapters, legacy rolling stock architecture, available space, power supply, wiring, software integration and maintenance constraints.

In all these cases, the new technology is not only integrated into the railway; it is also constrained by the railway. This creates a strategic choice between additive complexity and architectural rationalisation.

The first option consists of adding the new technology on top of the existing architecture. This approach is often easier in the short term because it preserves existing assets, reduces disruption and may be more acceptable politically and financially. However, it can also create a layered architecture made of national signalling, existing interlockings, RBCs, ATO Trackside systems, TMS gateways, rolling stock adapters, remote driving interfaces, cybersecurity overlays and operational workarounds. Each layer may be justified individually, but together they can create a system that becomes increasingly costly, fragile and difficult to maintain.

The second option consists of using the migration to simplify the system. Instead of adding another layer, the sector removes obsolete layers, reduces dependencies, standardises interfaces and prepares the architecture for future capabilities. This approach may require more CAPEX at the beginning and may be more difficult to justify project by project, but it can reduce long-term OPEX, improve maintainability, simplify safety cases and increase system performance.

Moving Block illustrates this tension. One can deploy ETCS Level 2 as a layer on top of existing interlocking principles. This may be a valid migration step. But one can also use the opportunity to rethink the architecture more deeply, reduce trackside equipment, remove lineside signalling where possible, and move towards a more train-centric system.

The point is not that one approach is always better than the other. The point is that DATO forces the sector to choose consciously between adding layers to the existing system and redesigning parts of the system to reduce long-term complexity. A retrofit project is never only a compliance project. It is also an architectural decision about the future capability of the train, the infrastructure and the network.

A technology is therefore not successfully infused simply because it has been installed. It is successfully infused when its residual performance still solves the original problem. If ATO depends on a TMS that cannot update operational plans dynamically enough, ATO may be technically present but operationally underperforming. If Moving Block depends on train integrity and safe positioning capabilities that are available only for part of the fleet, the theoretical capacity gain may be limited. If Remote Driving is restricted by insufficient communication performance, limited TCMS access or very narrow operating conditions, it may become too marginal to deliver the expected operational benefit.

Technology infusion must preserve the performance promise. The infused technology should export as little disruption as possible to the existing railway system, but the existing railway system must also avoid exporting so many constraints to the new technology that its residual performance becomes too low. Otherwise, the railway has not automated the system. It has merely added another layer of complexity.

Figure 3 — Technology infusion: migration adapters connect the harmonised DATO core to existing brownfield systems.

6. Stability, innovation and lifecycle responsibility

Technology infusion raises another paradox. The railway sector needs innovation, but it also needs stability. This tension is particularly visible around ERTMS, where many stakeholders insist on the need for stable specifications, stable functionalities and long-term visibility before investing in trackside and onboard equipment.

This demand for stability is legitimate. Railway assets are expensive, safety-critical and deployed over long lifecycles. Once equipment has been installed, authorised and integrated into operations, infrastructure managers and railway undertakings need confidence that their investment will remain usable for many years. A system that changes too quickly can create uncertainty, increase retrofit costs and weaken the business case for deployment.

At the same time, innovation cannot simply be paused. New ideas do not emerge only because the sector enjoys complexity. They usually emerge because real problems remain unsolved: capacity constraints, high operating costs, climate vulnerability, staff shortages, freight competitiveness, cybersecurity, obsolescence, energy efficiency and the need to reduce trackside complexity. If the railway freezes too early, it risks stabilising today’s limitations.

The real question is therefore not whether the sector needs stability or innovation. It needs both. The challenge is to organise innovation in a way that does not destroy investment stability.

This is one of the lessons that DATO should take from ERTMS deployment. Version management, configuration management, compatibility and backward compatibility cannot be treated as secondary issues. They are central to the credibility of the future system. If a new baseline, function or software release makes previous investments unusable too quickly, the sector will naturally become resistant to innovation. Stability is not conservatism; it is a condition for trust.

DATO should therefore be designed as an evolvable architecture. Its harmonised core should allow capabilities to improve over time, but within a controlled configuration space. New functions should be introduced with clear compatibility rules, migration paths, lifecycle commitments and contractual responsibilities. The objective is not to prevent evolution, but to avoid turning every evolution into a new wave of stranded investments.

This question may also lead to new business models. As more railway functions become software-defined, the sector may progressively move away from a purely linear model based on buying, owning and replacing dedicated equipment. For some functions, lifecycle-based models, software licences, update services or pay-per-use approaches may become more relevant, especially when updates, cybersecurity patches and version upgrades are part of the value delivered.

Such models are not automatically better. They can create new dependencies if they are poorly designed. But they may also help align incentives differently. Operators could gain more predictable access to updated functions. Suppliers could move from one-off project revenues towards long-term service relationships. The sector could reduce unnecessary hardware replacement if software and hardware lifecycles are properly decoupled.

This will only work if the architecture remains open, interoperable and governed. A software-defined railway must not become a subscription-based proprietary lock-in. The purpose of new business models should be to support lifecycle stability, circularity and continuous improvement, not to recreate dependency in another form.

7. From equipment interoperability to data interoperability

DATO also changes the nature of the railway system. The railway is moving from electromechanical and hardware-centric systems towards distributed digital systems. This evolution has already been underway for decades. Relay-based logic has been replaced by computer-based systems, and software is already central to modern control-command systems. Yet much of this evolution has remained built around integrated, proprietary and hardware-coupled solutions.

DATO requires something different. It requires data to circulate between infrastructure managers, railway undertakings, onboard systems, traffic management systems, ATO, ETCS, TCMS, remote supervision, maintenance environments and potentially external digital systems. This is not only a question of interfaces. It is a question of shared meaning.

In an automated railway, systems must not only exchange data. They must understand what the data means, how fresh it is, how reliable it is, what operational context it belongs to, and whether it can be used for a decision. This is where ontology and data harmonisation become central.

What is a train? What is a mission? What is a safe position? What is train health? What is mission fitness? What is a degraded mode? What is an infrastructure area? What does it mean for a train to be capable of continuing its mission?

These questions may sound abstract, but they are not. In GoA4, train health is no longer only a maintenance topic. It becomes an operational and system-level input. If a train stops on the network, the infrastructure manager may need to know whether it can move, brake, communicate, open doors, recover, be remotely driven or require rescue. A remote supervisor may need access to data that today may be fragmented across rolling stock subsystems: braking, traction, doors, energy, air conditioning, diagnostics, TCMS or supplier-specific systems.

Many of these data sources are currently proprietary, fragmented or not standardised in a way that supports system-level automation. This is a major challenge because DATO will only work as a system-of-systems if the railway sector moves from equipment interoperability to data interoperability. Formats matter and interfaces matter, but semantics matter even more. The future railway system will need harmonised data models, ontologies, configuration management and cybersecurity principles to ensure that distributed systems can exchange not only data, but meaning.

8. Software-defined railways, obsolescence and cybersecurity

The more the railway becomes digital, the more it faces another paradox: a digital railway does not age like a traditional railway asset. Tracks, signalling principles, rolling stock and infrastructure are designed for long lifecycles. They are maintained, renewed and operated over decades. Software, processors, operating systems, communication components, cybersecurity dependencies and semiconductor technologies evolve much faster.

This is one of the central tensions of DATO. The more the railway becomes software-defined, the more it must manage short technology cycles inside a long-life railway system. Obsolescence is no longer only a spare parts issue. It becomes an architectural issue.

This is why modularity matters. Modularity is not only a design preference; in a digital railway, it becomes an obsolescence management strategy. If software, hardware, communications, cybersecurity and safety-critical functions are too tightly coupled, then the obsolescence of one component may force the replacement or revalidation of a much larger system. If the architecture is modular, the sector has a better chance of replacing only what needs to be replaced while preserving the integrity of the certified system.

This also applies to onboard computing. A fully digital train cannot simply become a cabinet full of dedicated computers. If every new function brings its own hardware, the train may face constraints in space, weight, power consumption, heat dissipation, maintenance, wiring, obsolescence and cybersecurity management. Onboard computing itself becomes a scarce railway resource. This raises the question of software-hardware decoupling, shared safety-certified computing platforms, secure partitioning, modular applications and long-term configuration management.

Cybersecurity follows the same logic. In a DATO system-of-systems, cybersecurity is not a perimeter around the system. It is a property of every interface, every data flow, every software update and every operational dependency.

The railway sector is entering a world where more functions rely on connected systems, standard IT technologies, software components, open-source dependencies, remote access, digital maintenance and communication networks. These technologies create flexibility, but they also create attack surfaces. In a geopolitical context where critical infrastructure is increasingly exposed to cyber threats, this cannot be treated as an afterthought. Cybersecurity becomes a system-level railway issue.

This also raises an economic and organisational question. Large railway organisations may be able to develop the required cybersecurity, software maintenance and vulnerability management capabilities. Smaller railway undertakings, especially in freight, may face a much greater challenge. If digital and cyber requirements become a condition for accessing the future railway network, they must be considered as part of the overall migration strategy. Otherwise, the digital railway could unintentionally become less accessible to the very actors it is supposed to support.

9. When capabilities cross subsystem boundaries

The European railway framework has historically been structured around subsystems. Rolling stock, control-command and signalling, infrastructure, energy, operations and traffic management each have their own regulatory logic, technical specifications and assessment practices. This structure has been essential for interoperability, and it also reflects how the industrial world is organised. Rolling stock engineering and signalling engineering have often been treated as separate domains, with different cultures, methods, certification processes and business models.

DATO challenges these boundaries because the railway is regulated by subsystems, while DATO delivers capabilities across subsystems.

Remote Driving is a clear example. It is not only a rolling stock function, not only a CCS function, not only a telecom function and not only an operational procedure. It combines rolling stock control, train functions normally available from the cab, traction, braking, doors, diagnostics, TCMS, ETCS or national ATP, cab radio, mediated perception, video, communications, cybersecurity, human factors, operational rules, degraded modes and safety responsibilities.

This raises a difficult question: how should such a capability be authorised? Under which regulatory domain? With which safety case? Through which combination of TSIs, standards and assessment bodies?

GoA4 raises a similar question. An autonomous train must know whether it is fit to continue its mission. Mission fitness depends on rolling stock health, braking capability, traction availability, door status, energy, communication, diagnostics, operational context and recovery options. Yet the decision to continue, stop, recover, request assistance or enter a degraded mode is not only a rolling stock issue. It belongs to the wider automated railway system.

Who carries this function? The train, the ATO system, the control-command system, the traffic management system, a dedicated DATO function, or a combination of all of them? The answer may depend on architecture, but the question itself shows how DATO blurs historical boundaries.

In DATO, the train is no longer only an electromechanical asset. It becomes a digital node in the railway system-of-systems. Control-command becomes more dependent on rolling stock data. Operations become more dependent on software-defined capabilities. Cybersecurity becomes transversal. Safety cases become increasingly cross-domain.

This does not mean that the existing regulatory framework is irrelevant. It means that DATO capabilities will require stronger coordination between domains that were historically treated separately. The challenge is therefore not only to design cross-domain capabilities, but also to make organisations, standards and authorisation processes able to recognise them.

10. DATO as a European railway common good

The level of complexity described in this article leads to one simple conclusion: DATO cannot be built alone. No single railway undertaking, infrastructure manager, supplier or national programme can solve this system-of-systems complexity in isolation.

This is why European convergence matters. It may be slower than deploying a proprietary solution. It may require more discussions, more compromises and more difficult debates. It may feel frustrating when compared with a supplier-specific technical answer that appears to solve a local problem immediately. But the alternative would be worse: fragmented architectures, duplicated developments, incompatible solutions, closed systems, long-term dependency on proprietary technologies and another layer of complexity added to an already complex railway.

ERTMS has already shown both the difficulty and the importance of building a European railway common good. It is not easy, and it is not fast. Its deployment has been slower and more complex than expected. But it has created a shared European foundation for train control. It has allowed industry to innovate within a common framework, supported interoperability and given Europe a technology that is recognised far beyond its borders.

DATO should follow the same path. It should not become a collection of isolated automation products. It should become a European common good: a shared architecture of capabilities, interfaces, data models, safety principles, cybersecurity rules, compatibility conditions and migration paths.

This matters because railway automation is not an end in itself. Europe needs railways that are more affordable to operate, more resilient to climate disruption, less dependent on scarce human resources, more attractive for citizens, more efficient for freight, more capable of absorbing modal shift and more competitive against road and air transport.

Railway infrastructure is capital intensive. Railway operations are labour intensive. Climate change increases the vulnerability of fixed infrastructure. Demographic change will make skilled operational staff harder to find. Energy constraints and decarbonisation will increase the strategic importance of efficient collective mobility. If rail is to become one of the backbone systems of European mobility, it must become more productive, more flexible and more resilient.

DATO is not the only answer, but it is one of the architectural conditions for that future. This is why the system-of-systems perspective matters. DATO is not the automation of one railway function. It is the discipline of making many railway functions evolve together, ensuring that ATO, ETCS, TMS, Moving Block, Hybrid Train Detection, Remote Driving, train integrity, FRMCS, rolling stock intelligence, cybersecurity, data models and operational rules do not become separate islands of innovation.

The purpose of DATO is to make them converge. And this convergence can only be built collectively.

DATO should therefore be protected, specified and developed as a European common good, not because common approaches are easier, but because the complexity of the future railway system leaves no other credible path.

11. What comes next: crossing the innovation valley of death

Many of the automation topics discussed in this article are no longer purely research concepts. Hybrid Train Detection, Moving Block, ERTMS/ATO, Remote Driving and GoA4 have been investigated for several years through Shift2Rail and Europe’s Rail programmes. Technical feasibility is increasingly demonstrated, prototypes exist, and the sector has accumulated significant knowledge.

The challenge is therefore changing. The question is no longer only whether these technologies can work. The question is how to industrialise, standardise, certify and deploy them at scale.

This creates a potential innovation valley of death. Technology maturity is progressing, but the market, regulatory and standardisation environment is evolving more slowly. Operators still need visibility on future authorisation frameworks, operational concepts and deployment conditions. Suppliers need credible market signals before committing long-term industrial investments. Without this visibility, there is a risk that automation topics remain trapped between successful demonstrations and real deployment.

This challenge is particularly visible for advanced automation capabilities such as GoA3, GoA4 and Remote Driving. Current sector priorities understandably focus on ETCS operational harmonisation, Traffic Command and Control evolution, Hybrid Train Detection and Moving Block. These topics are essential building blocks for the future railway architecture.

However, many GoA3/GoA4-related capabilities still appear further away on the standardisation horizon. If these topics are perceived as distant and monolithic objectives, the risk is that operators postpone preparation efforts while suppliers redirect resources towards more immediate opportunities.

A more credible approach may be to focus on progressive industrialisation rather than waiting for a fully harmonised end-state. Instead of asking how to deploy GoA4 everywhere, the sector could first identify priority use cases, bounded operational domains and realistic performance objectives.

The key questions are pragmatic. Where does automation create the most immediate value? In depots? In shunting yards? On low-density lines? For degraded operation? For remote assistance? For specific technical movements?

Such an approach would provide a clearer trajectory for operators, infrastructure managers, suppliers and regulators. It would also allow future standardisation activities to evolve through successive, manageable steps rather than through a single large transformation.

From an architecture perspective, this is essential. Complex systems are rarely deployed through a single leap. They evolve through controlled technology infusion, where each step delivers value while preparing the next one.

For DATO, the next challenge is therefore not only technical maturity. It is the creation of a credible industrialisation pathway connecting research results, operational needs, standardisation, regulation and market adoption. Without such a pathway, Europe risks continuing to demonstrate railway automation without creating the conditions to deploy it. With one, DATO can progressively move from research maturity to operational reality.

Conclusion

DATO is often associated with the most visible symbols of railway automation: automatic driving, autonomous trains, remote supervision, advanced signalling and digital traffic management. But these visible functions are only the surface of the transformation.

The deeper transformation is architectural.

DATO forces the railway sector to think again about the whole system: how trains interact with infrastructure, how data is exchanged, how functions are allocated, how performance is delivered, how safety is demonstrated, how cybersecurity is maintained, how investments are protected, how operators access the network and how European interoperability can be preserved while technology continues to evolve.

This is why DATO should not be reduced to GoA4, ATO, Moving Block or any single subsystem. It is a system-of-systems challenge. It requires controlled variability rather than uniformity, technology infusion rather than greenfield replacement, data interoperability rather than only equipment interoperability, and lifecycle thinking rather than one-off deployment.

The success of DATO will not depend only on whether the technologies work. It will depend on whether they can be infused into existing railways without destroying their performance promise, whether they can evolve without creating stranded investments, whether they can be governed without proprietary lock-in, and whether they can be made accessible to the diversity of European railway actors.

This is a difficult path. It will require specifications, system architecture, governance, industrial maturity, regulatory adaptation, cybersecurity discipline and long-term cooperation. It will also require accepting that convergence is slower than isolated innovation, but far more valuable for a railway system that must remain open, interoperable and resilient.

DATO is not the next railway subsystem.

It is the next railway architecture.

Documentation and further reading

European framework and ERTMS deployment

European Commission, Directorate-General for Mobility and Transport — ERTMS Third Work Plan of the European Coordinator, 2026.
European Union Agency for Railways — ERTMS technical framework and system authority activities.
Europe’s Rail Joint Undertaking — System Pillar and target system activities.
Technical Specification for Interoperability — Control-Command and Signalling.
Technical Specification for Interoperability — Locomotives and Passenger Rolling Stock.
Technical Specification for Interoperability — Operation and Traffic Management.

DATO and automation programmes

FP2-R2DATO — Stepping towards digital and automatic rail operation with FP2-R2DATO: a systemic approach.
FP2-R2DATO — Use cases, system specifications and demonstrators related to Digital and Automatic Train Operation.
Shift2Rail X2RAIL-4 — ATO up to GoA4 specification and test reports.
TAURO project — Technologies supporting the migration to ERTMS/ATO.

ERTMS/ATO specifications

SUBSET-125 — ERTMS/ATO System Requirements Specification.
SUBSET-126 — ATO Onboard / ATO Trackside interface.
SUBSET-130 — ATO Onboard / ETCS Onboard interface.
SUBSET-139 — ATO Onboard / Rolling Stock interface.
ERTMS/ATO Glossary.

Credits and licence

Article written by Bastian Simoni for Voie Libre.

This article is licensed under CC BY-NC-SA 4.0.