ATP / ATO / ATC
Automatic Train Protection (ATP) enforces speed and movement limits and is safety-critical. Automatic Train Operation (ATO) drives the train: acceleration, braking and station stops. Automatic Train Control (ATC) is the umbrella term combining both with Automatic Train Supervision (ATS).
How it works
ATP is the safety layer: it supervises the train's speed against the permitted profile and applies the brakes if the limit is exceeded, regardless of driver or ATO input. ATO is the performance layer: it drives the train within the envelope ATP allows, optimizing for energy, punctuality and ride comfort. ATS is the supervision layer in the control center, managing timetable, regulation and dispatching.
The three layers are deliberately separated so that a fault in ATO or ATS cannot bypass ATP.
Why it matters for security
ATP is designed and certified as fail-safe, but ATO and ATS are increasingly software-defined, networked and integrated with IT systems. Attacks that degrade ATO or ATS can disrupt service even when ATP keeps trains safe, and the interfaces between layers are points where segmentation and monitoring matter.
Related solution
Securing CBTC systems without disrupting automation
Monitoring the interfaces between protection, operation and supervision layers without touching certified systems.
See the solution →
