The Ghost in the Machine: Mastering Driverless Train Levels (GoA)

The investigation that the Paris RATP conducted following the signal-passed-at-danger (SPAD) incident on Ligne 13 of the Paris Métro on 4 September 1979 produced a finding that was, in retrospect, the intellectual foundation of the entire modern automated metro industry: the SPAD had been caused not by a system failure but by driver fatigue — the driver of a late-evening service had been on duty for 9 hours and 47 minutes and had failed to respond to a caution signal at the approach to a platform where a train was already standing. The ATP system had applied the emergency brake, preventing collision, but the RATP investigation found that on Ligne 13 — which had been operating without ATP protection at all — a similar event six months earlier had resulted in a rear-end collision injuring 11 passengers. The RATP engineers’ conclusion, stated explicitly in the investigation report, was not that drivers were unreliable or that ATP was insufficient — it was that the fundamental source of variance in the entire signalling system was the human being in the cab, whose reaction time, attention level, and situational awareness could not be guaranteed constant over a 10-hour duty cycle. The appropriate engineering response, they concluded, was not to build better ATP systems (though those were needed) but to eliminate the need for driver attention by making the train drive itself. The RATP’s response was to commission the development of what became Ligne 14 — a new automated metro line on which a train would operate under computer control at GoA 4 from the moment it left the depot to the moment it returned, with no driver in the cab and no dependency on any human’s attention level or reaction time. Météor (Ligne 14) opened on 15 October 1998. It has operated without a single SPAD in its entire history. This is not a coincidence. It is what the GoA framework, properly implemented, actually delivers.

What Are the Grades of Automation?

The Grades of Automation (GoA) are a four-level classification system defined in IEC 62290-1 (Railway applications — Urban guided transport management and command/control systems — Part 1: System principles and fundamental concepts), which is the international standard governing urban mass transit automation. The GoA scale describes the allocation of operational responsibility between human operators and automated systems across six core operational functions: train movement starting, train movement stopping, door operation, obstacle and environment monitoring, response to operational irregularities, and emergency management.

The IEC 62290 standard was first published in 2006 (with substantial revision in 2014) and is the basis for automated metro system design across the European Union (implemented through ERA guidelines), as well as being adopted by reference in procurement specifications in Singapore, Hong Kong, Dubai, Doha, and numerous other cities with advanced automated metro systems. Complementary standards include EN 62290-2 (Functional requirements) and the broader safety framework of EN 50126 (RAMS — Reliability, Availability, Maintainability, and Safety) and EN 50128/50129 (Software and system safety).

The Four GoA Levels: Functions and Responsibilities

GoA 1: Non-Automated Train Operation (NTO)

At GoA 1, the driver has full responsibility for all train operation. The essential qualifier is that an Automatic Train Protection (ATP) system provides a safety backstop — applying brakes automatically if the driver would otherwise exceed speed limits or pass a signal at danger. The driver still physically drives the train; the ATP does not intervene in normal operation. Most of the world’s mainline and heavy rail networks operate at GoA 1 with ATP (ETCS Level 1 or 2 on high-speed routes; AWS/TPWS on UK conventional routes). The ATP system is safety-critical (SIL 2–4 depending on speed regime) but the operational responsibility — starting, stopping, door management, obstacle monitoring — remains entirely with the driver.

GoA 2: Semi-Automated Train Operation (STO)

At GoA 2, the ATO (Automatic Train Operation) system controls train speed and stopping — the train accelerates, maintains speed, and decelerates to platform stopping precision under computer control. The driver’s role is reduced to: verifying platform alignment (checking the train has stopped correctly), confirming it is safe to open doors (platform obstacle check), initiating door open, confirming all clear, initiating door close, and initiating departure by pressing a “ready to go” button that confirms the driver’s authorisation for the system to depart. The driver remains in the cab, remains responsible for emergency observation, and retains override capability. The Paris Métro (most lines pre-Ligne 14), the London Underground (DLR is GoA 4; Tube is GoA 1–2 depending on line), and the vast majority of the world’s metro networks operate at GoA 2.

GoA 3: Driverless Train Operation (DTO)

At GoA 3, the cab is empty — no driver is required. The train operates fully under ATO control including departure initiation, without a driver confirming the sequence. A Train Captain or Passenger Service Agent (PSA) may be on board to handle passenger situations, assist with door irregularities, and manage on-train emergencies, but this person is not a certified driver and is not in the cab. The key technical challenge of GoA 3 versus GoA 2 is that door safety — previously confirmed visually by the driver — must now be confirmed by the automated system (platform obstacle detection cameras confirming no obstruction at door edge before door close command, platform alignment confirmation from ATP). GoA 3 is relatively rare; many operators prefer to go directly from GoA 2 to GoA 4 because the cost of maintaining on-board attendants (versus eliminating all on-train staff at GoA 4) reduces the economic advantage while retaining most of the technical complexity of full automation.

GoA 4: Unattended Train Operation (UTO)

At GoA 4, no staff is on the train. The Operations Control Centre (OCC) remotely monitors all train positions, handles all operational irregularities through remote commands, and manages the full range of emergency scenarios through pre-planned protocols executed by OCC staff using remote access to train cameras, intercom systems, and traction/door controls. The train itself executes its operational programme autonomously — departure, speed profile, stopping, door operation, obstacle monitoring — without any real-time human direction. In the event of a fault or irregularity the train cannot manage autonomously, it performs a safe stop and awaits OCC intervention, which may involve remote re-energisation, door re-cycle, or dispatch of a human rescue driver.

CBTC: The Signalling Foundation of High GoA Automation

GoA 3 and GoA 4 require a continuous, high-precision knowledge of every train’s position on the network, updated at a frequency and accuracy that fixed-block track circuit signalling cannot provide. The enabling technology is CBTC (Communications-Based Train Control) — a signalling architecture in which each train continuously broadcasts its position (from an onboard positioning system, typically combining odometry, transponder beacons, and radio triangulation) and receives from the wayside control system a movement authority — the precise distance the train is permitted to advance — updated every 100–500 ms.

SIL Requirements for CBTC at GoA 4

The safety integrity of the CBTC system at GoA 4 must be rated at SIL 4 (Safety Integrity Level 4, per IEC 62061) for the movement authority calculation and authorisation functions — the highest achievable level, requiring a probability of dangerous failure of less than 10⁻⁹ per hour. Achieving SIL 4 requires: fully redundant hardware (hot standby dual-processor architecture with cross-checking), rigorous software development to IEC 62279 (equivalent to EN 50128), independent safety validation by a certified safety assessor, and extensive failure mode and effects analysis (FMEA) of every system component and interface. The system must continue to operate safely even under simultaneous failure of any single component — requiring that no single point of failure can produce an unsafe train movement. The certification and validation cost for a CBTC system to SIL 4 is typically €10–30 million per line, representing a significant portion of the total CBTC procurement budget of €50–150 million for a typical new automated metro line.

Obstacle Detection: The Critical Safety Function of GoA 4

The removal of the driver eliminates the only human observer who could detect an obstacle — a person, a fallen item, track debris — in the path of the approaching train. At GoA 4, the automated system must perform this function with a reliability equivalent to or better than a driver’s visual observation capability, at all times, in all visibility conditions (darkness, rain, smoke, sun glare), across the full approach speed range from 0 to maximum service speed.

Why Platform Screen Doors Are Practically Mandatory

A person standing on an open platform who steps or falls in front of an approaching GoA 4 train represents the most demanding obstacle detection challenge: the target (a human body) is between 0.2–1.0 m above the track surface, can appear in any lateral position across the track width, can appear at any time from maximum approach speed downward, and must be detected in sufficient time for the train to stop. For a GoA 4 train approaching a platform at 60 km/h (16.7 m/s) with a deceleration capability of 1.3 m/s², the braking distance from emergency brake application is: d = v²/(2a) = 16.7²/(2×1.3) = **107 m**. The sensor system must therefore detect the obstacle at a minimum of 107 m before the platform edge — plus response latency of 300–500 ms (sensor processing + brake application time) = 5–8 m extra distance. Total detection range requirement: **115–115 m from the obstacle**. No current production sensor technology (camera, LiDAR, radar) can reliably detect a person lying on the track at 115 m range in all conditions — particularly under adverse lighting (direct sun along the track axis, nighttime with no ambient illumination) and in the presence of false-target clutter (ballast, litter, shadows). Platform screen doors eliminate this challenge by physically preventing persons from entering the track zone at the platform. The sensor challenge then reduces to inter-station section obstacle detection (a far less demanding requirement because the probability of a person in the inter-station section is orders of magnitude lower and the response time is greater).

Operational Benefits of Automation: What the Numbers Actually Show

Energy Efficiency: ATO vs Driver

An ATO system at GoA 2 or above uses a pre-computed optimal speed profile for each inter-station run, applying coasting phases (where the train runs at constant speed without traction power, using its kinetic energy to coast toward the braking zone) calculated to achieve the target stop time with minimum energy consumption. Human drivers, responding to operational time pressure and individual driving style, typically use shorter coasting phases and higher average power levels. The quantifiable energy saving from ATO over manual driving has been measured on multiple metro systems during comparative trials:

Punctuality and Passenger Capacity

A GoA 4 metro achieves near-perfect punctuality because the source of schedule variance — driver behaviour — is removed. Platform dwell times are precisely controlled (door open duration is a fixed programme, not a judgment call by a driver watching the platform). Departure timing is exact (the system does not hesitate at departure initiation, does not have to check mirrors or wait for a guard’s flag). Inter-station run time variation is eliminated (ATO runs each section to within ±2 seconds of schedule, versus ±10–20 seconds for a human driver). The accumulated effect of this schedule precision on a typical 20-station metro line (20 dwell plus 19 inter-station runs) is that GoA 4 achieves approximately 95–98% on-time performance (within 30 seconds of schedule) versus 80–88% for an equivalent GoA 2 line — measured at the terminal station where variances accumulate.

GoA 1 Through GoA 4: Full Operational Comparison

Global GoA Deployments: Key Systems

Upgrading Existing Lines: The GoA Migration Challenge

The vast majority of the world’s metro network was built as GoA 1 or GoA 2 with fixed-block signalling and no platform screen doors. Upgrading these systems to GoA 4 is technically possible but operationally and financially demanding, for three reasons:

First, CBTC installation on a running metro line requires either temporary line closure (weeks to months, unacceptable on busy urban systems) or a phased parallel installation approach where the new CBTC system is commissioned alongside the existing signalling and cut over progressively — typically one section at a time, at night during engineering hours. A complete CBTC migration on a busy 20-station metro line using the parallel installation approach typically takes 5–7 years from project award to full CBTC operation. Second, platform screen door installation requires each station to be closed for 4–8 weeks for the civil works (channel cutting in the platform edge, steel subframe installation, PSD mechanism installation, and commissioning) — multiplied by every station on the line. For a 30-station line, even if stations are worked in parallel batches of 3–4, the PSD installation programme takes 18–30 months of rolling station closures with associated service diversions. Third, the rolling stock must be compatible with GoA 4 operation — including the obstacle detection sensor systems, the autonomous departure logic, and the door interlocking with PSDs — which may require either software upgrades to existing fleet or fleet replacement. The London Underground’s GoA 4 migration programme (currently planned for the Piccadilly, Bakerloo, and other Tube lines as part of the Deep Tube Upgrade Programme) faces all three challenges simultaneously, and its projected completion dates have slipped by years from original estimates precisely because the sequential dependencies between fleet delivery, CBTC installation, and PSD installation mean that any single programme delay propagates through the entire schedule.

Frequently Asked Questions

1. Why is GoA 3 so rare in practice — if the train drives itself, why pay for an on-board attendant rather than going all the way to GoA 4?

GoA 3 occupies an economically awkward position between GoA 2 and GoA 4 that explains its rarity. The technical infrastructure required for GoA 3 is nearly identical to GoA 4 — CBTC with moving block, automatic departure logic, platform obstacle detection (because there is no driver to do a visual platform check before door closure). The difference is that GoA 3 retains a Train Attendant (TA) on board who handles passenger emergencies, manages disruptions, and provides a physical human presence that some operators and regulators require for passenger reassurance and emergency management. But the TA must be staffed for every train on every trip throughout the operating day — and with typical metro frequencies of 20–30 trains per hour, this represents almost the same staffing cost as drivers (drivers at GoA 2 also cover the train for the full operating day). The net staff saving from GoA 3 versus GoA 2 is the elimination of the certified driving qualification requirement for the on-board person — a modest difference in hiring cost and training time, but not a large operational cost saving. Meanwhile, GoA 3 requires nearly the same infrastructure investment as GoA 4 (CBTC, PSDs recommended). The economic case for GoA 3 is therefore very narrow: it makes sense for operators who are legally or institutionally unable to eliminate on-board staff entirely (perhaps due to union agreements or regulatory requirements for a human emergency responder on board) but who wish to capture the capacity and energy benefits of ATO. Where neither constraint applies, GoA 4 is almost always the better investment.

2. What does the Operations Control Centre actually do at GoA 4 — and how many people does it need?

The GoA 4 OCC is the nerve centre of the automated metro, performing functions that at lower GoA levels are distributed across individual train cabs. Its core functions are: real-time monitoring of all train positions, speeds, and system health indicators across the entire line network simultaneously; intervention in abnormal situations by issuing remote commands to trains (re-starting after a fault stop, re-cycling doors after a door anomaly, adjusting departure timing to manage schedule perturbations); passenger communication through the train’s intercom and public address systems; coordination with station staff for passenger management (overcrowding, medical emergencies, security incidents); and management of the line’s timetable and service pattern (inserting or withdrawing trains from service as demand changes). A typical GoA 4 metro OCC managing a 30-station, 40-train line in peak service is staffed by 8–15 controllers per shift — significantly fewer than the 40–60 drivers that a GoA 2 line of equivalent service frequency would employ, plus the same station and maintenance staff that both levels require. The OCC staff profile is different from drivers: OCC controllers require broader situational awareness across the whole network rather than deep single-train operational skill, and their training focuses on managing multiple concurrent incidents and coordinating between systems and teams rather than on safe train handling. The OCC building itself — typically a purpose-built control room with large SCADA display walls, redundant communication systems, and power backup — represents a capital cost of €5–15 million for a typical line-scale installation.

3. How does a GoA 4 train handle a medical emergency on board — what happens if a passenger collapses between stations?

Medical emergency management in GoA 4 is one of the most frequently raised public concerns about driverless metros and has been addressed through detailed protocol development by every major GoA 4 operator. The standard response sequence when a passenger activates the emergency intercom or when train-mounted cameras observe an apparent medical emergency is: the OCC controller receives the alarm and activates two-way voice communication with the affected car via the intercom system; the controller assesses the situation through the train’s CCTV cameras (which the OCC can pan and zoom remotely in modern systems); if the situation requires immediate stop, the controller or the train’s automated system stops the train at the next station; the OCC simultaneously alerts the destination station staff to provide first aid and emergency services access; and if the emergency warrants, the OCC contacts emergency services directly, who are given the precise station location and car number. The entire sequence from alarm to controlled station stop typically takes 60–90 seconds on a CBTC-equipped GoA 4 system. Paris Ligne 14’s 25-year operational data shows no evidence that medical emergencies have resulted in worse outcomes for passengers than on driver-operated lines — partly because the response is faster (direct OCC intervention within 30 seconds of alarm versus the driver needing to call the OCC via radio, receive instructions, and then communicate with passengers) and partly because the automated stopping at the nearest station is faster than a driver manually deciding to stop and choosing a location.

4. What is the Nuremberg mixed-operation model — how can GoA 4 and GoA 2 trains safely share the same tunnels?

Nuremberg’s U3 GoA 4 operation sharing infrastructure with GoA 2 U2 trains since 2008 is the proof of concept for a mixed-GoA operating model that could dramatically lower the migration barrier for existing metro networks. The technical solution involves three elements. First, the GoA 4 (U3) trains and GoA 2 (U2) trains have different operating zones: U3 trains operate on the GoA 4 sections with CBTC and PSDs; U2 trains operate on GoA 2 sections with conventional signalling. The shared sections — platform approach tracks and junctions where both train types must operate — use the more conservative GoA 2 rules (ATP protection, no reliance on automated obstacle detection). Second, the U3 trains carry a “safety host” — a non-driving crew member present in the GoA 4 zone who can intervene in emergency situations — during the periods when trains share infrastructure with U2 trains, effectively acting as GoA 3 in the shared zone. Third, the infrastructure provides physical separation at the GoA-level boundary: distinct stopping positions, platform zone marking, and interlocking prevent a GoA 4 train from entering a non-PSD platform zone without the correct GoA protocol active. The result is a system that is technically more complex to certify than a pure GoA 4 network but operationally feasible — Nuremberg’s mixed operation has accumulated over 15 years of data without a significant automation-related safety incident on the U3 line. For cities like London, where converting the entire Tube network to GoA 4 simultaneously is physically impossible, the Nuremberg model provides a credible path: convert one line at a time to GoA 4, maintaining safe mixed operation at the network boundary, until the full network reaches GoA 4 — a migration that could take 20–30 years but produces operational benefits incrementally rather than requiring a single enormous investment.

5. What is the global state of GoA 4 deployment in 2025 — which cities are operating, which are planning, and what are the main barriers to faster adoption?

As of March 2026, approximately 68 automated metro lines are operating at GoA 4 globally, covering approximately 1,100 route-kilometres. This represents approximately 12–15% of the world’s metro network. The leading cities by GoA 4 route-km include Singapore (approximately 130 km across multiple lines), Paris (approximately 110 km across Lignes 1, 4, and 14), Dubai (approximately 90 km on Red and Green Lines), Copenhagen (approximately 38 km across four metro lines), and Nuremberg (approximately 25 km on U3). Active construction or conversion programmes in 2025–2030 include London (Piccadilly Line Deep Tube Upgrade), Sydney (Metro Northwest extension), Delhi (Phase IV expansion), and Istanbul (several new metro lines). Cities with announced GoA 4 planning but no active construction as of 2026 include São Paulo, Mumbai, Cairo, and Lagos. The barriers to faster adoption are consistent across all contexts: capital cost (PSDs, CBTC, and OCC infrastructure add approximately €50–100 million per kilometre to new metro cost compared to conventional GoA 1 systems); regulatory approval timelines (SIL 4 certification and safety case approval typically adds 3–5 years to project duration); and industrial relations (driver union agreements have delayed or blocked GoA 4 migration in Athens, Buenos Aires, and several US cities). The fastest deployment rates are in cities building new metro lines from scratch (where GoA 4 infrastructure cost is a design choice rather than a retrofit cost) and in countries with less adversarial industrial relations frameworks around automation. The Gulf states and East Asia have achieved GoA 4 deployment at the fastest rate globally for exactly these reasons — new build projects and government-owned operators without established driver union agreements.