European Vital Computer (EVC)
The European Vital Computer is the safety computer at the heart of the ETCS onboard unit. It receives data from balises and the Radio Block Centre, calculates the train's position and permitted speed, supervises the driver's actions and applies the brakes if the train exceeds its movement authority.
How it works
The EVC connects to a set of onboard modules: the Balise Transmission Module that reads Eurobalises, odometry sensors that measure distance and speed, the Euroradio module for GSM-R or FRMCS communication, the Driver Machine Interface, the Juridical Recorder Unit and the Train Interface Unit that links to the train's brakes and traction. Using this data, it continuously compares the train's speed and position against the braking curves derived from the current movement authority.
If the driver fails to react to warnings, the EVC intervenes with a service or emergency brake. It also manages transitions between ETCS levels and national systems, and it is built as a redundant, fail-safe computer certified to SIL 4.
Why it matters for security
The EVC is the final safeguard against an unsafe train movement, so its integrity is paramount. Its external interfaces, above all the radio link and the balise reader, are where manipulated data would enter, and its connections to the TCMS and diagnostic systems are where an attacker inside the train network could attempt to reach it.
As a certified safety product, the EVC cannot host security agents or be modified by the operator. Protection relies on the Euroradio safety layer, on hardening the surrounding onboard network and on monitoring the traffic to and from the onboard unit for behaviour that does not match normal operation.
Related solution
Operating ERTMS across national rail networks
Monitoring the onboard unit's interfaces to the radio and the train network without touching certified equipment.
See the solution →
