What is Automatic Train Operation – ATO in railways?

On 1 September 1967, Victoria line construction was sufficiently advanced for London Underground to begin testing its new automatic train operation system. The line opened to passengers in 1969 as the world’s first automatic underground railway — each train driven by an ATO computer, with a driver present only to close the doors and press two enabling buttons before each departure. The travelling public barely noticed the change. The Victoria line ran more punctually, more efficiently, and with shorter headways than any previous London Underground line. It carried the same number of passengers it would have carried with human drivers — but did so with 20–25% less energy, because the ATO system could precisely optimise the driving profile in a way no human could consistently replicate.

More than fifty years later, that same fundamental concept — a computer driving the train, a human supervising — has evolved through four standardised grades of automation and now underpins the operation of metro systems carrying hundreds of millions of passengers annually. Understanding ATO means understanding both the technology and the regulatory framework that governs how much of train operation a computer is permitted to control.

What Is ATO — and What It Is Not

ATO is specifically the subsystem that drives the train — it controls traction (throttle) and braking to follow a commanded speed profile between stations and stop precisely at the platform. It is not a signalling system. It does not determine whether the train is safe to move — that is the role of Automatic Train Protection (ATP). It does not manage train movements across the network — that is the role of Automatic Train Supervision (ATS). Together, ATO, ATP, and ATS form the Automatic Train Control (ATC) system that governs modern automated rail operations.

The Four Grades of Automation (GoA1–GoA4)

The IEC 62290 standard (and its European equivalent EN 62290) defines four Grades of Automation that specify the division of responsibility between human staff and automated systems:

How ATO Works: The Technical Principle

ATO operates by continuously computing and executing an optimal speed profile between the current position and the next required stopping point. The computation combines several inputs:

Static line data: The ATO computer holds a permanent map of the line — every gradient, every curve, every speed restriction, and the precise position of every platform stopping marker. This data defines the physical constraints within which the speed profile must be calculated.

Movement authority: The ATP system provides the ATO with a dynamic movement authority — the maximum distance the train is permitted to travel and the speed profile it must respect, based on the positions of preceding trains and signal states. ATO operates within this authority envelope; it cannot command movement beyond what ATP has authorised.

Schedule data: ATS provides the ATO with the required arrival time at the next station. ATO optimises its driving profile to meet this time, choosing between faster driving (arriving early, waiting at station), slower driving (arriving on time but less efficient), or optimised coasting (arriving on time with minimum energy).

Real-time position: Tachometers (odometry), track transponders (balises), and in CBTC systems continuous radio-based positioning provide the ATO with continuous precise train position, enabling the accuracy needed for platform stopping to within ±15–30 cm.

Energy Efficiency: How ATO Saves 15–30%

The energy advantage of ATO over manual driving comes from the precision and consistency of its coasting optimisation. A human driver, even a well-trained one, cannot optimally calculate and execute the exact coasting point — the precise location at which to cut traction power and allow the train to coast under its own momentum — for every journey, under all conditions, with perfect repeatability. ATO can.

The coasting profile that minimises energy consumption for a given journey time is a mathematical optimisation problem: given the train’s mass, the gradient profile, the speed limits, and the required arrival time, find the throttle/coast/brake sequence that uses minimum energy. This is solvable in real time by onboard computers, and the resulting profile is executed with far greater precision than manual driving allows.

ATO vs CBTC vs ETCS: Understanding the Relationships

ATO on Mainline Railways: ATO over ETCS

ATO was developed primarily for closed metro systems — fixed routes, known environments, platform screen doors, controlled access. Extending it to mainline railways — open systems with variable environments, mixed traffic, level crossings, and external hazards — requires adaptation. The European standard for this is ATO over ETCS (ATO-OB), specified in ERA/ERTMS documents and now entering operational deployment.

ATO over ETCS operates at GoA2 on mainlines — the driver remains responsible for safety-critical decisions and emergency response, but the system handles the optimised driving profile between stations. The benefits on mainline are similar to metro: energy savings from optimised coasting, headway reduction from consistent braking profiles, and improved timetable adherence. Several European high-speed corridors — including sections of the Belgian HSL and the Dutch HSL-Zuid — have operational ATO over ETCS deployments, with wider rollout planned under the European Commission’s ERTMS deployment plan.

GoA4 in Practice: What Happens Without a Driver?

GoA4 — Unattended Train Operation — requires that the system handle every situation a driver would previously have managed. This includes:

• Obstacle detection: Cameras and LiDAR sensors at the train front detect obstructions on the track. The system initiates emergency braking automatically.
• Passenger safety: Platform screen doors (PSDs) are mandatory on GoA4 systems — they prevent passengers from being on the trackside when trains arrive and depart, and their opening/closing is controlled by the ATO system in coordination with door sensors.
• Emergency response: Passengers can communicate with a remote operations centre via onboard intercoms. In an emergency, operators can intervene remotely, and trains are designed to proceed to the nearest station (rather than stopping in tunnel) to allow passenger evacuation.
• Degraded mode operation: If the ATO system fails, the train can be controlled remotely from the operations centre at reduced speed, or staff can board at the nearest station to drive manually in override mode.

Real-World GoA4 Deployments

Editor’s Analysis

Frequently Asked Questions

Q: Is ATO the same as CBTC?

No — they are complementary but distinct technologies. CBTC (Communications-Based Train Control) is a signalling and train protection system that uses continuous radio communication to provide precise train positions and dynamic movement authorities. It answers the question: “where is the train and how far can it safely travel?” ATO is the onboard subsystem that uses the position and authority information CBTC provides to actually drive the train — controlling throttle, coasting, and braking. CBTC can operate without ATO (with a human driver receiving the movement authorities), and ATO requires some form of train protection (ATP/CBTC/ETCS) to provide the movement authority envelope within which it operates. On modern metro systems, CBTC and ATO are typically deployed together as an integrated system.

Q: Are driverless trains (GoA4) safer than human-driven trains?

Operational data from GoA4 systems consistently shows lower accident and incident rates than equivalent human-driven systems. The primary reason is the elimination of human error — fatigue, distraction, and misjudgement — which is the leading factor in the majority of train operating incidents on conventional railways. GoA4 systems are also required to pass extremely rigorous safety certification under EN 50126/50128/50129, demonstrating failure rates far below those achievable with human operators for routine driving tasks. The residual safety risks in GoA4 systems are different from human-driven systems — they relate to software reliability, sensor performance, and cybersecurity rather than human performance — and are addressed through redundancy, safety-integrity-level (SIL) certification of software, and continuous monitoring. The overall safety record of operational GoA4 systems (Copenhagen Metro, Dubai Metro) supports the conclusion that GoA4 is at least as safe as, and generally safer than, equivalent human-operated systems.

Q: Why do some GoA2 trains still have a driver if the system drives itself?

At GoA2 (Semi-Automatic Train Operation), the ATO system controls speed and stopping but the driver retains specific responsibilities that cannot yet be fully automated safely in an open mainline environment: initiating each departure (pressing the start button after confirming it is safe to depart), supervising the platform departure (confirming door closure and clear platform), and managing emergencies that require human judgement — such as unusual obstructions, communication with passengers, or incidents that fall outside the scenarios the automated system has been designed to handle. The driver also provides a psychological comfort factor for regulators and passengers that is not trivial during the transition period for new technology. GoA2 delivers most of ATO’s energy and punctuality benefits while retaining a human safety net, making it the preferred step before committing to GoA4 on any given line.

Q: What is the minimum headway achievable with GoA4 ATO?

The minimum headway is determined by the signalling system’s moving block capability (the braking distance required between trains at line speed) and the station dwell time (the time needed for passengers to board and alight plus door operation). With CBTC moving block signalling and platform screen doors coordinating passenger flow, headways of 90 seconds are operationally proven (Dubai Metro, Paris Line 1 during peak). Theoretical minimum headways with current technology are approximately 75–80 seconds. Reducing below 90 seconds in practice requires very high station throughput efficiency — the bottleneck shifts from the signalling system to passenger boarding and alighting time, particularly at busy interchange stations.

Q: Can ATO handle emergency situations — what happens if something goes wrong?

ATO and ATP systems are designed with multiple layers of response to abnormal situations. If a sensor detects an obstacle, the system initiates emergency braking automatically. If a system failure occurs, fail-safe design principles ensure the train defaults to a safe state — typically stationary with brakes applied. GoA4 trains are designed to proceed to the nearest station rather than stopping in a tunnel when possible, enabling passenger evacuation without trackside access. Operations centre staff can intervene remotely through direct communication with passengers and remote speed control of the train. For situations beyond remote management, a response team with mobile device capability can board at a station and operate the train in manual override mode at restricted speed. The complete failure of a GoA4 train in a tunnel, requiring trackside evacuation, is a designed-for scenario that appears in emergency response plans — it is the same scenario that human-driven trains face, but with the added complexity of no onboard staff to coordinate the response.