Designing onboard backup for train control is dominated by two unforgiving conditions: the supply and temperature extremes written into EN 50155, and the safety consequence of an uncontrolled reset of the vital computer. This paper turns the load profile of the first paper into a sealed nickel-metal hydride backup design for an ETCS onboard assembly - European Vital Computer, BTM and antenna electronics, DMI, Juridical Recording Unit and GSM-R radio. It works through the bus architecture first, because the nominal 24, 36, 48, 72 or 110 V train battery and its defined interruptions and surges determine where isolation, hold-up and the backup module sit; then through the energy and power sizing for the ride-through, controlled-shutdown and extended-support tiers; and then through the cold-start margin that EN 50155 makes non-negotiable, with equipment required to start across -40 to +85 degrees C and operate at the chosen OT class. It addresses the mechanical and fire construction demanded by EN 61373 vibration and EN 45545, the charge and float regime that keeps a sealed pack healthy over years of mostly-idle service, and the supervision that reports state of health to the train management system. Throughout, it compares sealed NiMH candidly with the railway's traditional vented nickel-cadmium (IEC 62973-2), lead-acid (Part 3) and lithium-ion (Part 5), showing where the sealed, maintenance-reduced, cadmium-free NiMH module - now explicitly covered by IEC 62973-4 - is the strongest fit for distributed onboard backup and where the other chemistries retain legitimate roles.
The train battery feeds the auxiliary bus at the nominal voltage of the stock (110 V and 72 V are common on mainline vehicles, 24/48 V on metros and trams), and EN 50155 defines the interruptions, dips, ripples and surges that connected equipment must survive. A robust architecture places input protection and isolation at the cubicle, bulk hold-up at the converter, and a sealed NiMH backup module local to the vital electronics, charged from the bus through a current-limited, temperature-aware stage and isolated by a diode or MOSFET OR-ing arrangement so it can only support, never back-feed or be overcharged.
The module is sized to the local logic rail rather than the whole vehicle, which keeps it compact and lets it be co-located with the EVC or BTM it protects. The charger must maintain readiness during normal running without imposing a continuous overcharge that would dry sealed cells; a temperature-compensated top-up or pulse regime, combined with low-self-discharge cells, allows years of float with the pack still able to deliver full hold-up after a long idle period.
Ride-through for seconds-scale interruptions is often met by capacitors plus a small battery contribution and is power-limited - the question is whether the rail can be held through the deepest dip, not how much energy is stored. The controlled-shutdown tier is energy-limited and calculable: finish the JRU write, flush logs, save authority and odometry context, park the DMI and radio in a defined state. Extended support for emergency communication or vigilance adds a separately specified energy budget.
The first animated figure builds the energy budget tier by tier. Power capability is checked independently at the cold extreme, because the simultaneous GSM-R transmit burst and a relay/valve load at -40 degrees C sets the worst voltage sag; the cell count is chosen so the rail stays above the electronics' cut-off even at that point, which often governs the design more than the total energy.
EN 50155's start-up requirement - operation from -40 to +85 degrees C for at least ten minutes during start - and the chosen operating class (OT4/OT6 reach -40, OT5/OT6 reach +85) mean the backup cannot be specified at room temperature. Electrochemical capacity and power fall in the cold while internal resistance rises; the designer sizes cells and conductor cross-sections for the cold power event and verifies the pack by cold soak and cold discharge, then checks high-temperature float life to bound calendar ageing in hot cubicles.
Sealed NiMH performs comparatively well at low temperature relative to lead-acid and does not freeze and crack like a flooded or gelled lead cell, while avoiding the thermal-management complexity of lithium at the extremes. Thermal design still matters: locating the module away from heat sinks and traction converters, and allowing the pack's own charge heat to dissipate, keeps it within the class. The second animated figure compares usable cold power across chemistries qualitatively, illustrating why lead-acid's nominal advantage in cheap ampere-hours evaporates at -40.
EN 61373 assigns vibration and shock spectra by mounting location (body-mounted, bogie-mounted or axle-mounted); a cubicle backup module typically faces Category 1 body-mounted levels but long-duration random vibration that can fatigue cell tabs, welds and connectors. Construction uses restrained cells, anti-vibration retention, welded or robustly braced interconnections, and strain-relieved cables rather than loose consumer battery holders.
EN 45545 governs fire behaviour on rolling stock, with hazard levels and requirement sets by vehicle category and location; the module's enclosure, insulation, labels and any potting use low-flame-spread, low-smoke/toxicity materials, and the sealed chemistry avoids free electrolyte and minimises gas emission. These construction rules are as much a part of qualification as the electrical tests.
A backup that silently ages is a latent safety failure, so the module is supervised: voltage, temperature, charge/discharge current and a periodic automated self-test or capacity check feed the train control and management system, which raises maintenance alarms if hold-up capability falls below the requirement. Event logging records every mains/bus interruption and the duration supported, correlating with the JRU record.
Integration respects the safety architecture: the backup is treated as an element supporting a safety function, with defined behaviour on cell failure (fail to a safe state, alarm, no fire), isolation under external short circuit, and no possibility of corrupting the vital bus. This evidence feeds the EN 50126/50128/50129-style safety argument for the onboard train-control system even though EN 50155 is the equipment-level environmental standard.
Vented NiCd (IEC 62973-2) remains the benchmark for extreme temperature and abuse tolerance in large auxiliary banks, but needs watering, vents gas and carries cadmium; for small distributed backup modules its maintenance burden and environmental burden are unattractive. Lead-acid is inexpensive but heavy, weak in the cold, limited in float life at high temperature and contains acid, making it a poor fit for a compact, cold-rated, long-life electronic module.
Lithium-ion (IEC 62973-5) is energy-dense but requires a battery management system for balancing and protection and a stronger thermal/fire safety case under EN 45545. Sealed NiMH (IEC 62973-4) occupies a pragmatic middle: sealed and maintenance-reduced, cadmium-free, cold-capable, tolerant of shallow float duty and intrinsically less thermal-runaway-prone than lithium. For local, long-life, cold-rated onboard backup it is frequently the lowest-risk, lowest-lifecycle-cost choice; the qualification paper that follows sets out the evidence required to prove it.
Weijiang Power designs and manufactures sealed nickel-metal hydride cells and matched industrial packs for remote, off-grid and safety-related equipment, and supports OEM partners with IEC 61951-2 performance files, IEC 62133-2 safety evidence, pulse-load characterisation, wide-temperature testing and charger/pack co-validation. Tell us your duty cycle, peak current, temperature envelope, autonomy target and the standards your product must meet, and our engineers will specify a cell-and-pack combination that protects runtime, reliability and service life. Review the range on the products page.
