The Finnish Digirail program is introducing EULYNX based signalling solutions in its EKA project, the first commercial ERTMS/ETCS track section in Finland covering the Tampere–Rauma/Pori line. Mipro Oy is supplying the Object Controller System (OCS) and a CTC (Centralised Traffic Control) system with ATO-TS functionality. The project is one of the first large-scale implementations of a multi-vendor EULYNX-based signalling system, where the Centralised Safety System (CSS) and Object Controllers are being delivered under separate contracts and integrated into a single operating system.
The project phases
The project started in November 2024. The work commenced with a specification phase, during which the customer’s requirements were reviewed. Interface Control Documents (ICDs) were prepared for the technical interfaces in cooperation with the CSS system supplier and the customer. The ICDs define, amongst other things, the RaSTA and SCI-XX protocol communication parameters, as well as the national adaptations. The first unofficial integration tests were conducted in the spring of 2025. The purpose of the tests was to identify any potential compatibility issues at the earliest possible stage. The tests were initially performed without any TLS encryption (Transport Layer Security) using UDP/RaSTA. Third-party EULYNX tests were carried out in February 2026 in accordance with the EULYNX test library. The Generic IO tests were executed using a “Hardware-in-the-Loop” model, where the IO interface of the Object Controller was also included as part of the test setup. Currently, the project is transitioning from laboratory testing to Site Integration Testing (SIT). According to the current schedule, operational readiness for the entire EKA project is expected to be achieved by end of 2027.
The key challenges and lessons learned
Aligning requirements
The ongoing project is one of the first large-scale railway signalling projects to implement EULYNX-compliant equipment extensively in a multi-vendor environment. The alignment of the EULYNX and national functional requirements for the different types of Object Controllers has required more time than originally allocated. One example involves the integration of Finnish level crossing systems into the new ETCS railway environment using EULYNX-compliant interfaces. This adaptation requires consideration of the technical and functional implementations of three different system suppliers, while ensuring that the architecture complies with the high cybersecurity requirements.
The importance of common configuration
As all the parties involved are carrying out their own product development activities simultaneously, the coordination of the joint system tests and alignment of the system configurations have proven to be challenging. The lack of common configuration management tools and practices can easily lead to compatibility issues in joint test phases. A common base for the configuration items is crucial for compatibility and safety.
High level cybersecurity
The project’s high cybersecurity requirements, as well as the required protection of all the critical communication interfaces using built-in TLS encryption, have significantly increased the complexity of the system implementation. TLS is a widely used encryption method in internet-based communication protocols. However, there is limited practical experience in use cases where the communication has to be continuously operational without any interruptions, even during TLS certificate renewal procedures. Public Key Infrastructure (PKI) architecture and certificate management have been further clarified during the project implementation by the Europe’s Rail System Pillar organisation.
Evolving specifications
One of the project’s challenges has been the maturity of the EULYNX specifications that were still evolving during the project execution phase. The initial system design and development activities were started using the EULYNX Baseline 4, Release 2 specifications. The SDI and SMI interfaces (Standardised Diagnostics Interface / Standardised Maintenance Interface) in particular are insufficiently mature for implementation. Both SDI and SMI functionalities are heavily linked to the Object Controller’s hardware solution. For example, a multi-type, multi-element controller SMI solution is not defined in the current specifications.
The changing threat landscape in the European operating environment is creating new demands for the evolution of railway system architectures. The prevailing trend has been towards solutions that rely heavily on mobile communication networks and centralised system architectures. While these technologies provide significant benefits in terms of efficiency, maintainability and interoperability, they also increase the dependency on a shared communication and control infrastructure. At the same time, there is also a growing need to improve system resilience and ensure that the loss of a single technical component or communication link does not lead to the complete disruption of railway operations. Future architectures should therefore provide appropriate fallback mechanisms, including local control capabilities for critical field elements such as points, when any centralised control functions are unavailable. These emerging resilience and security requirements may require the reassessment of some of the fundamental assumptions underlying current railway signalling architectures and specifications.
Missing software simulation
Most future EULYNX-based Object Controller projects are expected to be implemented in so-called brownfield environments, where existing interlocking systems are gradually replaced. In typical brownfield projects, the new system and its associated field elements can be installed in parallel with the existing operating system. This enables System Integration Testing (SIT) and Site Acceptance Testing (SAT) activities to be carried out while the legacy system remains in operation.
However, overall system testing and integration activities would be significantly easier if the Object Controllers included a software-based field element simulation capability. This is particularly important for elements such as points, which cannot normally be connected simultaneously to two different control systems during live operations.
At present, such simulation functionality is not explicitly considered within the EULYNX architecture. Furthermore, the current specifications do not provide a standardised method for notifying the interlocking that a field element is being simulated. This creates additional challenges for testing, validation and phased migration activities in brownfield deployment scenarios.
Key success factors
The importance of a common test laboratory
One of the project’s key success factors has been the establishment of a common test laboratory environment, where the interoperability and compatibility of different systems can be validated together in a controlled environment. The shared laboratory setup has enabled early integration testing between the CSS, Object Controllers and field elements before their deployment in the operational railway environment.
The availability of real field elements as part of the laboratory setup has proven particularly important when validating the interface behaviour, timing characteristics, fail-safe functionality and end-to-end communication scenarios. The shared laboratory environment has also enabled the faster identification of interoperability issues and supported efficient cooperation between different suppliers and stakeholders during system development and testing activities.
Third party testing for interfaces
Certification testing performed by an independent third party has played a key role in validating the compliance of the system interfaces against the EULYNX specifications. The certification tests have been carried out as part of the Generic Application FAT (Factory Acceptance Test) testing activities, where all the element types were tested against real field equipment in a laboratory environment. The tests were executed based on the official test libraries published by EULYNX. These tests provide objective verification as to the fact that the implemented technical interfaces, communication protocols and interoperability mechanisms operate according to the standardised EULYNX requirements.
Independent certification testing is especially important in a multi-vendor environment, where interoperability between the systems supplied by different manufacturers must be ensured in a predictable and standardised manner. The certification activities have also helped identify specification ambiguities, implementation deviations and compatibility issues at an early stage, thereby reducing any integration risks during the later project phases and supporting long-term interoperability between future EULYNX-compliant systems.
The importance of machine-readable input data
The quality and availability of the input data have a major impact on the efficiency and reliability of system engineering, configuration and testing activities. In modern EULYNX-based signalling systems, it is particularly important that the input data and infrastructure definitions are available in a machine-readable format.
Machine-readable input data enables the use of automated verification and validation processes throughout the project lifecycle. This supports consistency checks, automated configuration generation, interface validation and regression testing activities while reducing the risk of human errors in manual engineering tasks. In large-scale multi-vendor projects, standardised and structured data formats also improve interoperability between the engineering tools, test systems and operating environments.
The advantages of a centralised Object Controller architecture
The selected centralised Object Controller architecture, at the station level, provides several advantages allowing the infrastructure owner to reduce investment (CapEx) and lifecycle (OpEx) costs in particular. A centralised solution enables more efficient system management, simplified maintenance activities and improved overall lifecycle cost efficiency compared to highly distributed architectures.
The architecture is particularly well suited to the Finnish railway operating environment, where harsh weather conditions and significant temperature variations can be managed more effectively through a centralised equipment room solution.
Cybersecurity management is significantly easier to implement in a centralised architecture. Physical protection, software updates, monitoring and access control can be managed in a more consistent and controlled manner from centralised locations. These advantages become increasingly important over the long operating lifecycle of railway signalling systems, where cybersecurity requirements, software maintenance and system upgrades must be managed continuously over decades of operation.
Conclusion and summary
Close cooperation between all the stakeholders has been one of the key prerequisites for the success of the project. Effective collaboration between the customer, the CSS supplier, the Object Controller supplier, the test organisations, the independent inspection bodies and the other stakeholders is essential in a complex, multi-vendor environment with evolving specifications, new technologies and simultaneous product development activities so as to achieve interoperability and resolving technical challenges efficiently.
The project has highlighted the importance of contract models that support iterative system development and enable technical requirements to evolve during the project lifecycle. In addition, flexible project schedules are also critical in large-scale EULYNX-based projects, where integration activities, certification testing, cybersecurity implementation and specification clarifications may require significantly more time than in traditional signalling projects.
RELATED CONTENT
This article was originally published in Signal + Draht, issue 9/2026, on September 11, 2026.
SIGNAL & DRAHT Experience Of EULYNX Object Controllers for modern modular signalling architecture
Authors
MIPRO OY
Sami Hyyryläinen
Product Line Manager