1

A Train Integrity Solution based on GNSS Double-Difference Approach

A. Neri1, F. Rispoli2, P. Salvatori1, and A.M. Vegni1 1 RADIOLABS, Rome Italy, {alessandro.neri, pietro.salvatori, annamaria.vegni}@radiolabs.it

2 Ansaldo STS, Genoa Italy, francesco.rispoli@ansaldo-sts.com

BIOGRAPHIES Alessandro NERI is Full Professor in Telecommunications at the Engineering Department of the ROMA TRE University. In 1977 he received the Doctoral Degree in Electronic Engineering from “Sapienza” University of Rome. In 1978 he joined the Research and Development Department of Contraves Italiana S.p.A. where he gained a specific expertise in the field of radar signal processing and in applied detection and estimation theory, becoming the chief of the advanced systems group. In 1987 he joined the INFOCOM Department of “Sapienza” University of Rome as Associate Professor in Signal and Information Theory. In November 1992 he joined the Electronic Engineering Department of ROMA TRE University as Associate Professor in Electrical Communications, and became full professor in Telecommunications in September 2001. His research activity has mainly been focused on information theory, signal theory, and signal and image processing and their applications to both telecommunications systems and remote sensing. Since December 2008, Prof. Neri is the President of the RadioLabs Consortium, a non-profit Consortium created in 2001 to promote tight cooperation on applied research programs between universities and industries. Francesco RISPOLI has joined Ansaldo STS in 2011 as responsible for the Satellite and Telecommunication technologies. He is Vice president of Radiolabs and Director of Galileo Services board. Previously, he has been with Telespazio (2005-2011) as Chief of New Initiatives and by 1983 to 2005 with Alenia Spazio (now Thales Alenia Space) where he served various positions as responsible for R&D and Institutional programs, Vice president of Multimedia business unit and General manager of EuroSkyWay. He started his carrier in 1980 with Contraves Italiana as technical engineer in the antenna department. In 1978 he received the Doctoral Degree in Electronic Engineering from the Polytechnic of Turin and in 1980 a post-graduate Master in Applied Electromagnetism from the University of Roma La Sapienza. He is currently involved into the Pilot project ERSAT (ERTMS over SATELLITE) in Sardinia Region and other related projects such as 3InSat and NGTC. He is also contributing to EGNOS-R (railways) interface with

Local Augmentation networks and the certification process.   Pietro SALVATORI is a PhD student at ROMA TRE University, Rome, Italy. He received the 1st level Laurea Degree in Electronics Engineering and the Laurea magistralis cum laude in Information and Communication Technology Engineering from ROMA TRE University, in October 2010 and May 2013, respectively. Since May 2013 to December 2013 he was researcher in RadioLabs consortium focusing on satellite navigation systems, taking part of 3inSat project co-funded by European Space Agency. His research interests are in the area of satellite navigation and communication systems, mobile communications, virtual networking and security of telecommunications. Anna Maria VEGNI is Assistant Professor in Telecommunications at the Department of Engineering of ROMA TRE University, Rome, Italy. She received the Ph.D. degree in Biomedical Engineering, Electromagnetics and Telecommunications from ROMA TRE University in 2010, and the Laurea Degree cum laude in Electronics Engineering in 2006. From May to October 2009, she was a visiting scholar in the Multimedia Communication Laboratory, at the Department of Electrical and Computer Engineering, Boston University, Boston, MA. Her research activity is focusing on vehicular networking, indoor and outdoor localization, GNSS, and Visible Light Communications. Since 2011, she is in charge of Telecommunications Networks Laboratory course at ROMA TRE University.

2

ABSTRACT Nowadays, the train integrity function is assured by track circuits deployed along the line. This approach is safe but has several limitations since if any part of a track is occupied, that entire track circuit must be assumed as occupied and if the track circuits are made shorter to increase the traffic capacity, additional costs are incurred. In the European Rail Track Management System (ERTMS-ETCS) Level 3 trains must be able to localize and to monitor their integrity by themselves without the track circuits. This scenario makes it possible to optimize the capacity of the lines and to further reduce the operational costs by eliminating most of the track circuits. In this paper, we investigate the capability of the Global Navigation Satellite Systems (GNSS) to perform the integrity function in the perspective of the deployment of the ERTMS-ETCS L3 platform. The reference architecture is based on a pair of GNSS train Location Determination Systems (LDS) respectively located at the rear and the front-side of the train and connected each other by a radio link. A novel train integrity estimation solution that exploits a GNSS Double-Difference approach, has been developed for its advantages to mitigate most of the iono, tropo, clocks hazards caused by the GNSS signals. The Protection level and the Hazard Misleading Informations rates are derived by taking into account the safety requirements SIL-4 (Safety Integrity Level 4) of the ERTMS-ETCS system. The simulations have been performed by assuming a 2500 m train length; they confirm the validity of the proposed approach and pave the way for a seamless introduction of the GNSS into the ERTMS-ETCS L3 by replacing the fixed track circuits with virtual track circuits of variable size, and without affecting the safety requirements. Keywords: train integrity, train control, GNSS, satellite based localization.

I. INTRODUCTION In the last century, the first block signaling systems were introduced to improve railway safety. They were based on the simple concept of partitioning a track into non-overlapping sections, named blocks, and imposing the constraint that the same block cannot be used by two trains at the same time. In practice, before allowing a train to enter a block section, a check that the previous train has already cleared the block section without leaving any vehicles behind has to be successfully performed. Initially, this control was performed by visual inspection of the train at each block section exit, verifying that the last vehicle carried an end of train marker (often a red lamp) [1]. Since then, automatic systems detecting the presence of a train inside a block (train detection systems) have been progressively introduced, using track circuits or axle counters. These technologies provide an automated report when a block section is clear of vehicles.

Figure 1. ERTM-ETCS L1functional level concept.

Figure 2. ERTM-ETCS L2 functional level concept.

Several train safety systems are currently in operation around the world. Among them, the European Railway Traffic Management System/European Train Control System (ERTMS/ETCS) is the most advanced and successful even outside the European Countries [2]. Mainly for high-speed lines, the deployment of ERTMS-ETCS is contributing to a global standard in terms of both interoperability among different national systems, and highest safety level achieved. In ERTMS three functional levels of automated control are foreseen. The first level (L1) uses train integrity and position by track circuits and signaling on the trackside. Those signals, providing the information about train location and where it is allowed to travel safely, also known as movement authorities, are reported inside the locomotive by means of a short-range wireless communication system, making use of balises deployed along the track at regular intervals, as depicted in Figure 1. The balises also provide additional self-localization functionality to the train. As illustrated in Figure 2, ERTMS level 2 (L2) is more advanced, since the signal information is moved from the track to the locomotive, so that the trackside signals are not necessary anymore. The train position and speed are computed on board by the odometer, which relies on the balises deployed along the track, as reference points, to periodically reset the accumulated errors. In particular the balises determine the train absolute position and the odometer estimate the relative distance from the Last Relevant Balise Group (LRBG). Movement authorities are generated trackside by the Radio Block Center (RBC) and transmitted to the train via the dedicated GSM-R network. In ETCS L2, as well as in ETCS L3, communications between train and RBC use the Euroradio secure protocol.

3

Figure 3. ERTMS-ETCS L3 functional concept.

Figure 4. Future evolution of the train control system.

While ETCS L1 and L2 are already operational in Europe and in the World, many infrastructure managers stick to the vision of next ETCS level 3 (L3) as the ultimate solution of an interoperable train control system. Indeed, as illustrated in Figure 3, the train detection system is based on virtual tracks circuits of variable size (moving block) that replace the track circuits without impacting the safety requirements. [3]. As a result, the train reports its location and its actual length (train integrity) to the control center where the required safe distance to the next (preceding and following) trains is continuously updated. Thus, all the train protection system functionalities are moved to the locomotives and to the RBC, then keeping to a minimum the amount of trackside equipments. Nevertheless, the need to ensure also the rail integrity to prevent the risk of train derailment still remains. In this respect, in the USA, the Federal Railroad Administration (FRA) is amending the Federal Track Safety Standards to promote research on safety of railroad operations by enhancing rail flaw detection processes [4], focused on the improvement of railroad safety by reducing rail failures, and the associated risks of train derailments. For the time being some track circuits will have to be installed as a broken track detector. The availability of the GNSS system and IP-based wireless communications are expected to play an important role for making the train control system more competitive as shown in Figure 4. The most challenging innovation of the GNSS consists of the on-board train integrity function that provides the information on the actual train length. For the trains with a pre-assembled configuration, the integrity function can be realized by monitoring the electrical continuity of a cable connecting all the

carriages. Instead, for regional and freight trains, which are assembled each time, the integrity function must be provided by ad hoc devices. Several solutions and patents have been proposed even if there is not a consolidated architecture to be certified for the SIL-4 requirements of the ERTMS-ETCS [1]. They can be classified into two classes: (i) those relying on an end of train device (e.g., brake air pipe pressure reduction detector, acoustic waves transmitter, radio transmitter, GNSS localizer), (ii) those needing no train end device (e.g., ultrasonic signals fed into the rail across the wheels of the leading vehicle, detection of spacing and number of wheels by analyzing the reflections provided by the wheels of the subsequent cars, injection of acoustic signals into the brake air pipe on the leading car, and monitoring of parameters on the leading car). In [5] Scholten et al. present an approach to cargo train integrity, aimed at determining the train composition, by means of a distributed Wireless Sensor Network (WSN). The WSN is comprised of two components i.e., (i) a communication systems that allows determining the train composition, thanks to the sequence of hops needed to send a packet from the Head-of-Train (HoT) node to the End-of-Train (EoT) node, and (ii) a set of acceleration sensors, whose output correlation allows distinguishing carriages of different trains. If the WSN infers from its data that an unexpected change in composition, with a potential hazardous loss of carriages, has occurred, an alarm is raised. In [6] Oh et al. propose a Train Integrity Monitoring System (TIMS), based on TIMS modules installed in each carriage, interconnected through wired serial links. If a separation occurs, the link is broken, the HoT TIMS module does not succeed in communicating with the TIMS modules on the departed component, and an alarm is raised. This technique can be coupled with the monitoring of the air-pressure in the pneumatic braking system. A sudden loss of pressure generates an impulse that may be caused by the disconnection of the train carriages. One of the drawbacks of the mentioned techniques is that the train control system does not have knowledge of the portion of the track where the train spreads out. This issue can be overcome when detection of the train head and tail position is performed by means of GNSS receivers. In general, products relying on end of train devices and GPS are today commercially available and are used as part of an onboard signaling system on freight railways running mostly in dark territory i.e., areas without trackside signaling infrastructure. Recently, a Positive Train Location system (PTL) has been presented by Leidos in the USA for meeting the requirements of the Positive Train Control (PTC) [8]. This product is based on the data fusion between different sensors including GNSS. Nevertheless, none of the mentioned solutions have given the demonstration of meeting the Tolerable Hazard Rate (THR) specified by the CENELC norms (i.e., THR < 10–9/1hour).

Train Integrity

ETCS trainborne

DRIVER

Interlocking and Radio Block Center

Balise (fixed message)

4

Figure 5. Schematic model of the train equipped with two OBU GNSS receivers. The train has a variable number of cargos (not

shown in the picture). The lack of this evidence and the potential opportunity of the GNSS are the main drivers behind our research. In this perspective, the development of the GALILEO system in Europe has also contributed to the study of safety-of-life applications for railways [8], [10]. A synergy between EGNOS-GALILEO and ERTMS-ETCS has been recognized by the railways stake-holders in the Memorandum of Understanding (MoU) signed in 2012 for the ERTMS-ETCS evolution [2]. Until now, the priority has been given to the GNSS localization functionality in order to replace the fixed balises with virtual balises. In this respect, the probability that the magnitude of the position error exceeds the Alert Limit, representing the highest error magnitude still adequate to support train operation, and no timely warning is provided, has to be compatible with the THR (i.e. 10 –9/1 hour) guaranteed by the ERTMS-ETCS system. Although this requirement is quite challenging to be achieved in the rail environment, the ERTMS-ETCS system incorporates mechanisms to mitigate some of the typical hazards due to the GNSS signals [12]. In this paper, we make a step forward respect to the GNSS localization to focus our contribution on the design of a GNSS based train integrity monitoring system compliant with the SIL-4 requirement. As illustrated in Figure 5, the system employs two GNSS receivers deployed on the head and on the end of the train, connected through a wireless link to a processing unit. To this purpose we introduce the double-difference approach, and we make use of a track database to constrain the trajectory of the train lying on the rail. As a result, it is possible to reduce the 3D positioning problem to a 1D case, with the improvement of train integrity functionality performance, expressed in terms of Misleading Hazard Information Rate. The short baseline between the two receivers implied by the length of the trains in operation (i.e., < 4 km), combined with the double difference approach allows to compensate most of the iono, tropo and clock hazards due to the GNSS Signals In Space (SIS) that represent a severe threat to exploit the GNSS technology in meeting the challenging requirements of the ERTMS-ETCS system. For sake of compactness in the description of the mathematical framework, here only the single constellation version of the algorithms is presented. Nevertheless, extension to multiple constellation systems is straightforward and is part of the current authors' research for exploiting the GNSS capabilities in meeting the challenging railways requirements.

Further analyses to estimate the multipath affecting the train localizers are needed but the mitigation techniques are well known and for this reasons they are not reported in this paper. Instead, the availability and continuity requirements of the SIS are more stringent for the train integrity respect to the virtual balise application and to this aim a multi-sensor multi-constellation architecture offers enough flexibility for the future implementations. This paper is organized as follows. In Section II, we describe the basic reference architecture for assessment of the train integrity through GNSS technology. Section III illustrates the algorithms employed for estimation of the train length. In Section IV the mathematical model for the computation of the Protection Levels is described. Performances of the proposed algorithms are illustrated in Section V. Finally, conclusions are drawn at the end of the paper.

II. SYSTEM ARCHITECTURE In the design of the reference architecture for the GNSS based train integrity evaluation, we considered that this function is just one of several train control functionalities that can benefit from GNSS technology. In practice, this functionality is coupled, at least, with the train location determination system [9], and the track detection when the train is moving in a region covered by multiple parallel tracks (as in a railway station), [11]. Thus, the design of the system architecture is driven by the whole set of requirements concerning them. As in avionics we assume that an augmentation network for integrity monitoring and differential corrections is mandatory to fulfill the SIL-4 requirement. As a matter of fact, track discrimination at the start of mission appears to be the most demanding functionality in terms of location accuracy and to this purpose some Virtual Reference Station (VRS) supporting the use of the RTK or PPP mode on board of the train should be deployed. Since the effectiveness of the method is strictly related to the baseline between the VRS and the train, the SIL-4 and high accuracy navigation modes require a far denser spatial distribution of Reference Stations employed for Wide Area Augmentation networks. In this respect a functional integration between Wide Area Augmentation systems like WAAS and EGNOS, and local augmentation networks deployed along the railway tracks, may allow a cost effective solution for meeting the SIL-4 requirement. Thus, the reference architecture comprises a ranging and integrity monitoring network that provides the augmentation data to the train on board units equipped with multi-constellation satellite receivers, through the Radio Block Center interface. We remark that joint use of multiple constellations is a viable approach to fulfill the stringent SIL-4 requirements [12]. As already mentioned, this architecture can be largely extended by interfacing the ranging and integrity monitoring network with a Wide Area Augmentation System.

END-OF-TRAIN

OBU GNSS RX

HEAD-OF-TRAIN

OBU GNSS RX

5

Figure 6. System Reference Architecture.

Joint processing of local and wide area information can then be used to monitor the healthiness of the local system. The system is complemented with a communication network interconnecting the trains with the radio block centers. As depicted in Figure 6, the system can be subdivided into the following main subsystems:

1. On Board Unit (OBU): consisting of two GNSS receiver chains (i.e., located on the head and on the end of the train respectively) and one processing unit;

2. Augmentation Network: consisting of several Reference Stations (RSs) deployed trackside and one coordinator server denominated TALS (Track Area Location Safety server), which collects and elaborates the data from Reference Stations, and provides augmentation and integrity message to the OBUs.

The Augmentation Network has a star topology with the Server (TALS) that can be used either as forwarding node through the OBU and as data central to jointly process data retrieved by the RSs. In this second configuration the TALS can perform also an Integrity Monitoring feature. This feature has been described in [13]. Notice that, concerning the train integrity issue, the nearest RS, by means of TALS, sends the observed raw data (i.e., code pseudoranges or carrier phase) to both OBU GNSS receivers.

III. PROPOSED ALGORITHM Under the hypotheses described in Section II, we designed a two-step algorithm, based on (i) a coarse head and tail receiver’s position estimation, and (ii) a fine estimate of the baseline between the two receivers followed by the estimate of the mileage between the two receivers based on the track database. In the first step, the estimate of the location of both head and tail GNSS receivers may benefit from the availability of the Augmentation Network. In particular, in the following the constrained double differences approach that combines traditional double difference scheme with the track constraint has been adopted [14]. In this way, it

is possible to mitigate most of the iono, tropo and clock errors of GNSS SIS. If the positioning estimation process employs carrier phase pseudoranges, then the fractional part of the phase ambiguity is cancelled out as well. Then, the remaining ambiguities are integer number of wavelengths. In the second step, the train length is estimated by “geometrically projecting” on the track the baseline between receivers. Once again, the double-difference algorithm is combined with the track constraint. The estimated train length is then computed as the difference between the mileage of the head and tail receivers, based on the track database relating train mileage to the geographical coordinates. The detection of an eventual gap between a couple of neighboring carriages is then performed by thresholding the difference between the current estimated train length, and the one estimated at the start of train mission. In order to keep constant the probability of providing a false alarm with respect to train integrity, such a threshold is dynamically adapted to the train length estimation confidence interval, which depends, among others, on the geometry and the number of the satellites in view. As an additional means for autonomous (safety) integrity monitoring, to detect Signal In Space (SIS) failures and remove outliers (due for instance, to ephemerides errors, cycle slips, etc.), a check of the consistency of the observed double-differences with the track constraint is also performed. To derive the train length estimation algorithms, let us recall that, denoting respectively with [ ]HRx kX and

[ ]ERx kX the ECEF coordinates of the positions of the antennas of the Head-of-the-Train (HoT), and the End-of-the-Train (EoT) GNSS receivers at the k-th epoch, they have to satisfy the track constraint, represented by the parametric equations that relate those coordinates to the track mileage s:

1 3 3( ) ( ) ( ) ( ) .TTrack Track Track Tracks X s X s X s⎡ ⎤= ⎣ ⎦X

(1)

Thus, the receiver location in terms of ECEF coordinates is perfectly known as soon as its mileage is known. We assume that an initial track survey has been performed during the deployment phase and a digital version, named in the following track database, is available on board of the train. Thus, denoting respectively with [ ]Hs k and [ ]Es k the mileages of the head and end receivers at the k-th epoch, we have

[ ]( ) ( )HRx TrackHk s k=X X , (2)

[ ]( ) ( )ERx TrackEk s k=X X , (3)

Then, let ( )HRxi kρ and ( )ERx

i kρ be the code pseudo-ranges of the i-th satellite measured, respectively, by the HoT and EoT receivers. They can be expressed respectively as:

6

Figure 7. Geometrical scheme of baseline in the railway scenario. RxH and RxE are the locations of the head-of-the-train

and end-of-the-train OBU GNSS receivers, respectively.

( ) ( ) ( )( )( ) ( )

( ) ( ) ( )

, ,

,

h h

h h

h h

Rx RxSat Sat Tracki i i h i

ion Rx trop Rxi i

Rx Rx Sati i

k T k s T k

c k c k

c t k n k c t k

ρ

τ τ

δ δ

⎡ ⎤⎡ ⎤= − +⎣ ⎦ ⎣ ⎦+ Δ + Δ +

+ + −

X X

(4)

with h = {H, E}, where: • ( )Sat

iT k is the time instant on which the signal of the k-th epoch is transmitted from the i-th satellite;

• ( )hRxiT k is the time instant on which the signal

transmitted from the i-th satellite at the k-th epoch is received by the the h-th GNSS receiver;

• ( )Sat Sati iT k⎡ ⎤⎣ ⎦X is the coordinate vector of the i-th

satellite at time instant ( )SatiT k ;

• ( )( )hRxTrackh is T k⎡ ⎤⎣ ⎦X is the coordinate vector at the

time instant ( )hRxiT k , of the h-th receiver.

• ( ), hion Rxi kτΔ is the ionospheric incremental delay,

along the paths from the i-th satellite to the h-th GNSS receiver for the k-th epoch w.r.t. the neutral atmosphere;

• , ( )htrop Rxi kτΔ is the tropospheric incremental delay,

along the paths from the i-th satellite to the h-th GNSS receivers for the k-th epoch w.r.t. the neutral atmosphere;

• ( )Satit kδ is the offset of the i-th satellite clock for the

k-th epoch; • ( )hRxt kδ is the clock offsets of the h-th GNSS

receiver; • ( )hRx

in k is the error of the time of arrival estimation algorithm, generated by multipath, GNSS receiver thermal noise, and eventual radio frequency interference, at the h-th GNSS receiver.

Let us denote with b (k) the baseline vector between the HoT and EoT receivers, computed at the k-th epoch, as

[ ] [ ]( ) ( ) ( )Track TrackH Ek s k s k= −b X X , (5)

which can be rewritten in terms of its magnitude b, and the unit vector ˆ ( )b ke

( )ˆ ( )( )bkkk

= beb

, (6)

as ˆ( ) ( ) ( )bk b k k=b e . (7)

Equation (5) represents the track constraint applied to the receivers’ baseline, which is defined following the orientation of the train. Let us denote with ˆ

h

iRxe (with h = [H, E]) the unit vectors

corresponding to the lines-of-sight of the i-th satellite with respect to the HoT and EoT receiver, respectively:

{ }ˆ , ,h

h h

RxSati iRx RxSat

i

h H E−= ∈−

X XeX X

(8)

with respect to the ECEF coordinate system. Then, we can write the single difference SDi between the geometric distances of the i-th satellite from the two receivers, as:

( )( )( ) ( )( )( )

ˆ ˆ ˆ1 , , ,

h

h

H H E E

RxSat Sat Tracki i i H i

RxSat Sat Tracki i E i

i i i iRx Rx Rx Rx

SD T k s T k

T k s T k

r

⎡ ⎤⎡ ⎤= − −⎣ ⎦ ⎣ ⎦

⎡ ⎤⎡ ⎤+ − =⎣ ⎦ ⎣ ⎦⎡ ⎤= − −⎣ ⎦

X X

X X

e e b e

(9)

where H

iRxr is the geometric distance from the head-of-the-

train OBU GNSS receiver and the i-th satellite, and is the scalar product operator. Figure 7 describes the geometrical scheme adopted to evaluate the single difference in (7). From (7), we can derive the double-difference equation relating the double difference

H E

ijRx RxDD between the

single differences of i-th and j-th satellite, to the receivers’ baseline, then obtaining:

H E

ijRx Rx i jDD SD SD= − =

ˆ ˆ ˆ1 , ,H H E E

i i i iRx Rx Rx Rxr ⎡ ⎤= − − −⎣ ⎦e e b e

ˆ ˆ ˆ1 , ,H H E E

j j j jRx Rx Rx Rxr⎡ ⎤⎡ ⎤+ − − =⎣ ⎦⎣ ⎦e e b e

ˆ ˆ ˆ ˆ1 , 1 ,H H E H H E

i i i j j jRx Rx Rx Rx Rx Rxr r⎡ ⎤ ⎡ ⎤= − − − +⎣ ⎦ ⎣ ⎦e e e e

ˆ ˆ, .E E

i jRx Rx− −b e e (10)

Without loss of the generality, let us assume the first satellite is used as pivot to compute the double-difference equation system. Then, for sake of compactness, by dropping the epoch index k, (10) can be arranged in a matrix form as follows:

,= +DD Hb u (11)

where u is the residual vector, which needs to be minimized according to the Weighted Least Square Estimation (WLSE) criterion, and H is defined as

⋅

7

H =

eRxE1

1 − eRxE1

2( ) eRxE2

1 − eRxE2

2( ) eRxE3

1 − eRxE3

2( )eRxE1

1 − eRxE1

3( ) eRxE2

1 − eRxE2

3( ) eRxE3

1 − eRxE3

3( )! ! !

eRxE1

1 − eRxE1

j( ) eRxE2

1 − eRxE2

j( ) eRxE3

1 − eRxE3

j( )!

eRxE1

1 − eRxE1

Nsat( )!

eRxE2

1 − eRxE2

Nsat( )!

eRxE3

1 − eRxE3

Nsat( )

"

#

$$$$$$$$$$$$

%

&

''''''''''''

, (12)

where 1 2 3

ˆ ˆ ˆ ˆE E E E

Ti i i iRx Rx Rx Rx

⎡ ⎤= ⎣ ⎦e e e e are the unit vectors of

the line of sigth of the visible satellites. From (6), the first term is

,= + ΔDD DD DD (13)

where DD represents the vector of double-differences between the raw data, as measured by the j-th satellite and the pivot, from the HoT and EoT receivers,

DD =

DDRxH ,RxE2,1

DDRxH ,RxE3,1

!DDRxH ,RxE

j ,1

!DDRxH ,RxE

NSat ,1

⎡

⎣

⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢

⎤

⎦

⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥

, (14)

and 2 2 2 1 1 1

3 3 3 1 1 1

1 1 1

1 1

ˆ ˆ ˆ ˆ1 , 1 ,

ˆ ˆ ˆ ˆ1 , 1 ,

ˆ ˆ ˆ ˆ1 , 1 ,

ˆ ˆ ˆ1 , 1

H H E H H E

H H E H H E

H H E H H E

sat sat sat

H H E H H

Rx Rx Rx Rx Rx Rx

Rx Rx Rx Rx Rx Rx

j j jRx Rx Rx Rx Rx Rx

N N NRx Rx Rx Rx Rx

r r

r r

r r

r r

⎡ ⎤ ⎡ ⎤− − −⎣ ⎦ ⎣ ⎦⎡ ⎤ ⎡ ⎤− − −⎣ ⎦ ⎣ ⎦

Δ =⎡ ⎤ ⎡ ⎤− − −⎣ ⎦ ⎣ ⎦

⎡ ⎤− − −⎣ ⎦

e e e e

e e e e

DDe e e e

e e e

M

M1

,

ˆ,ERx

⎡ ⎤⎢ ⎥⎢ ⎥⎢ ⎥⎢ ⎥⎢ ⎥⎢ ⎥⎢ ⎥⎢ ⎥⎢ ⎥

⎡ ⎤⎢ ⎥⎣ ⎦⎣ ⎦e

(15)

is the vector of double-differences between the geometric distances between the j-th satellite and the pivot, from HoT and EoT receivers. Finally, the i-th component of the equivalent noise at the first and second OBU GNSS receiver, computed with respect to the pivot satellite, is:

( ) ( )( ) ( )( ) ( )( ) ( )

( ) ( ) ( ) ( )

, ,,1

, ,1 1

, ,

, ,1 1

1 1 .

H E

H E

H E

H E

H E H E

ion Rx ion Rxi i i

ion Rx ion Rx

trop Rx trop Rxi i

trop Rx trop Rx

Rx Rx Rx Rxi i

u c k c k

c k c k

c k c k

c k c k

n k n k n k n k

τ τ

τ τ

τ τ

τ τ

= Δ − Δ +

− Δ + Δ +

+ Δ − Δ +

− Δ + Δ +

+ − − +

(16)

The baseline between receivers can then be estimated with the following iterative procedure that explicitly accounts for the track constraint.

Let us denote with , and the estimated mileages of the GNSS receivers at the m-th iteration and with

!X(m)

RxH (k) = XTrack !sH(m) (k)!

"#$

and !X(m)

RxE (k) = XTrack !sE(m) (k)!

"#$

the corresponding Cartesian coordinates. Then, tacking into account the track constraint we have

b ≈ !b(m) + ΔbE(m)ebE

(m) − ΔbH(m)ebH

(m) , (17)

where ( ) ( )ˆE

m mE bbΔ e and ( ) ( )ˆ

H

m mH bbΔ e are the baseline increments

when the HoT and EoT receivers move along the track, respectively. Considering that the iterative procedure is initialized using as initial estimates of the receiver locations, the positions provided by the independent processing of the measured pseudoranges, with the support of the augmentation network, the initial estimation error can be considered small (i.e. <10 m). Thus, (17) can be approximated by its Taylor’s expansion, so that the unit vectors ( )ˆ

E

mbe and ( )ˆ

H

mbe can be approximated by the unit

vectors corresponding to the tangents of the track curve on

!X(m)

RxH (k) and

!X(m)

RxE (k) respectively, given by:

ebH

(m) =∂XRxH

∂s

"

#$$

%

&''

s=!sH( m ) (k )

ebE

(m) =∂XRxE

∂s

"

#$$

%

&''

s=!sE( m ) (k )

(

)

***

+

***

(18)

Therefore, by replacing (18) into (11) the double-difference equation system at the m-th iteration step specifies as follows:

( ) ( ) ( ) ( ),ˆm m m m− = Δ +DD Hb HG b u (19)

where

( )

( )( )

mm H

mE

bb

⎡ ⎤ΔΔ = ⎢ ⎥Δ⎣ ⎦b , (20)

( )mG is the partitioned matrix ( ) ( ) ( )

,ˆ ˆH E

m m mb b

⎡ ⎤= ⎣ ⎦G e e (21)

and

( ) ( ) ,m m= +ΔDD DD DD (22) with

ΔDD m( ) =

rRxH2,m 1− eRxH

2,m , eRxE2,m⎡

⎣⎤⎦ − rRxH

1,m 1− eRxH1,m , eRxE

1,m⎡⎣

⎤⎦

rRxH3,m 1− eRxH

3,m , eRxE3,m⎡

⎣⎤⎦ − rRxH

1,m 1− eRxH1,m , eRxE

1,m⎡⎣

⎤⎦

!

rRxHj ,m 1− eRxH

j ,m , eRxEj ,m⎡

⎣⎤⎦ − rRxH

1,m 1− eRxH1,m , eRxE

1,m⎡⎣

⎤⎦

!

rRxHNsat ,m 1− eRxH

Nsat ,m , eRxENsat ,m⎡

⎣⎤⎦ − rRxH

1,m 1− eRxH1,m , eRxE

1,m⎡⎣

⎤⎦

⎡

⎣

⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢

⎤

⎦

⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥

,

(23)

where

!sH(m)

!sE(m)

8

eRxh

j ,m =X j

Sat −XRxh !b(m)"#

$%

X jSat −XRxh !b(m)"

#$%

, h∈ H , E{ } (24)

and

rRxh

j ,m = X jSat −XRxh !b m( )"

#$%&' . (25)

Thus the baseline correction ( )mΔb is evaluated as follows:

( ) ( )( ) ( ) ˆ ,m mm m ⎡ ⎤Δ = −⎢ ⎥⎣ ⎦

b K DD Hb (26)

where the gain ( )mK is computed in accordance to the WLSE metric as

( ) ( ) ( )( ) ( )11 1.m m T m m TT TR Rν ν

−− −=K G H HG G H (27)

Once the baseline correction ( )mΔb has been computed, the mileage and the Cartesian coordinates of the two receivers are updated by projecting the two points

X(m+1)

RxH = !X(m)RxH !sH

(m) (k)!"

#$+ΔbH

(m)ebH

(m) (28)

X(m+1)

RxE = !X(m)RxE !sE

(m) (k)!"

#$+ΔbE

(m)ebE

(m) (29)

into the track as illustrated in Figure 8, then obtaining

!X(m+1)

RxH

and

!X(m+1)

RxE . The baseline estimate at iteration (m+1) is updated as follows

!b(m+1) = !X(m+1)

RxH − !X(m+1)RxE . (30)

Finally, the train length at the k-th epoch is computed as follows:

!L(m+1) (k) = !sH

(m+1) (k)− !sE(m+1) (k) . (31)

IV. PROTECTION LEVEL COMPUTATION In the evaluation of the protection level, we could model train integrity as a Boolean function providing a TRUE value if the train is integral and FALSE otherwise. Following this approach, we could consider as misleading information the event associated to declaring the train as integral in presence of a train split, while the event associated to declaring the train as not integral, when no split occurs could be simply considered a false alarm, impacting on system availability and not on the hazard. On the other hand, with the introduction of moving block in ERTMS/ETCS L3, an error on the estimate of the track portion actually occupied by the train should be considered as misleading. Thus, here we prefer the last approach, and analyze the protection level computation by modeling the train integrity as a functionality providing an estimate of the extension of the interval actually occupied by the train and not just as a Hypothesis verification test. This approach is more conservative, because in this case declaring the train as not complete when no split occurs is considered misleading, and not just a false alarm. Nevertheless, the methodology adopted for evaluating the protection level associated to the train length estimation, can be immediately extended to the Boolean case.

Figure 8. Projection into the track curve of the estimated

receiver position. Let us consider first the case of train operating under nominal conditions, i.e., the case of healthy satellites and known initial train length. Denoting with

HbεΔ and

EbεΔ the estimation errors on

EbΔ and HbΔ , and with ε !L

the estimation error on the distance along track (i.e. mileages’ difference) of the two receivers, we have:

ε !L(k ) =∂s

∂ΔbH

$

%&

'

()

s=!sH

εΔbH−

∂s∂ΔbE

$

%&

'

()

s=!sE

εΔbE.

(32)

Introducing the row vector

∂s∂Δb

=∂s

∂ΔbH

#

$%

&

'(

s=!sH

−∂s∂ΔbE

#

$%

&

'(

s=!sE

#

$

%%

&

'

((

s=!sH

,

(33)

the previous relation can be rewritten in matrix form as follows

( )H

E

bL k

b

s εε ε

Δ

Δ

⎡ ⎤∂= ⎢ ⎥∂Δ ⎣ ⎦b% ,

(34)

where we denoted with !sH

and !sE

the final estimate of the receivers mileage at the last iteration. Based on (19), considering that

HbεΔ and

εΔbE

can be modeled as zero mean Gaussian random variable with covariance matrix

( ) 11T T Rν−−

Δ =bR G H HG ,

(35) the covariance of

ε !Lcan be computed as

2L

Ts s

εσ Δ⎡ ⎤∂ ∂= ⎢ ⎥∂Δ ∂Δ⎣ ⎦

bRb b

. (36)

Thus, the probability L L

Pε δ>that the error on the along

track distance between the two receivers exceeds a threshold Lδ is

2L L

L

LP erfcε δε

δσ>

⎞⎛⎟= ⎜⎜ ⎟⎝ ⎠

,

(37)

where erfc() is the complementary error function i.e., 22( ) e t

xerfc x dt

π∞ −= ∫ . (38)

9

Figure 9. Faulty satellite geometry. Thus, denoting with

0H

TrainIntegrityTHR the THR allocated to

nominal conditions, the Protection Level under nominal conditions 0HPL computes as follows:

0 0 LH HPL k εσ= , (39) with

010 2 H

TrainIntegrityTH

HDec

Rk erfc

N− ⎞⎛

= ⎟⎜⎜ ⎟⎝ ⎠, (40)

where NDec is the number of independent estimates in 1 hour of operation. Let us know consider the case of SIS faults. Let us recall that the rather short baseline between the EoT and HeT receivers (i.e., < 4 km) implies that the satellite clocks errors and incremental tropospheric and ionospheric delays experimented by the two receivers are highly correlated, and therefore, completely mitigated by the double difference operation at the basis of the train length estimate. The threat to be accounted for when considering the event of a failure of the SIS of the i-th satellite essentially reduces to the ephemeris error, whose effect can be modeled by a satellite position error iβ . In this case, w.r.t. Figure 9, it can be easily verified that

{ }( ) , ,h

h h

h h h h

i iRxi i i

Rx Rx i i i i i iRx Rx Rx Rx

rh H E

r r= + ∈

+ +βe β e

e β e β% ,

(41) Thus, the single difference of the i-th satellite is affected by the error

( ) ( ), ( ) ,H H E H E

i i i i i i i i iSD Rx Rx Rx Rx RxrεΔ

⎡ ⎤= − +⎣ ⎦β e β e β e e% %%

( ) 1 , , ( ) .H H E E E

i i i i i i iRx Rx Rx Rx Rxr ⎡ ⎤+Δ − + −⎣ ⎦β e e b e β e%

(42)

The above expression can be usefully written as follows (see [17], Eq. (19)):

( ) ,E H

i i i i iSD Rx RxεΔ = − −β e e β

,pRxE

E

i i

iRxr

⊥−

eb β

;

(43) where i

RxE

i⊥eb is the component of the baseline orthogonal

to the line of sight E

iRxe :

,i E ERxE

i i iRx Rx⊥

= −e

b b e b e .

(44)

Incidentally, we observe that the following bound holds:

( )E

ii iSD i

RxrεΔ ≤

β bβ .

(45)

Then, from (42) we have that if the faulty satellite is not the pivot one (i.e., in our case 1i ≠ ), the estimate of the along track distance is affected by the additional error

( 1)( ) ( ), 2,...,SF i i ii i col SD sat

sL i Nε− Δ∂Δ = =∂Δ

β K βb

(46) where n colK denotes the n-th column of gain matrix K ,

while, if the faulty satellite is the pivot one (i.e., in our case i = 1), then we have:

11 1 1

11

( ) ( )satN

SFq col SD

q

sL ε−

Δ=

⎡ ⎤∂Δ = − ⎢ ⎥∂Δ ⎣ ⎦∑β K β

b.

(47)

Denoting with γ(i) the function 1

( ) 1

( 1)

1

2,...,

satN

q coli q

i col sat

s i

s i N

γ

−

=

−

⎧ ⎡ ⎤∂− =⎪ ⎢ ⎥⎪ ∂Δ ⎣ ⎦= ⎨∂⎪ =⎪ ∂Δ⎩

∑ Kb

Kb

(48)

the conditional probability that the position error magnitude will exceed the protection level, when the i-th satellite is faulty, becomes

( )

/( )1

2 2i

L

i i iSF SDMI MA

PLP erfcε

εσ

Δ⎞⎛ − ⎟= +⎜⎜ ⎟⎝ ⎠

βg

( ) ( )12 2

L

i i iSDPLerfc

ε

εσ

Δ⎞⎛ + ⎟+ ⎜⎜ ⎟⎝ ⎠

βg . (49)

However, the computation of the HMI probability requires the evaluation of the probability that the Integrity Monitoring and Augmentation subsystem deployed along the track will not detect the satellite fault. At this aim, we may employ the approach described in [17] that, for each satellite, monitors the Differential Pseudorange Residuals (DPR) and the Double Difference Residuals (DDR) of the pseudoranges observed by the reference stations, located in known position. DPR monitoring allows detecting ephemeris error components parallel to the satellite line of sights, while DDR monitoring allows detecting those components orthogonal to the line of sights. Let , ( )

iraw j kρΔ be the raw reduced pseudorange residual

of the i-th satellite w.r.t. the receiver of the j-th RS, at the k-th epoch, defined as the difference between the measured pseudorange and its counterpart predicted on the basis of the navigation data, and ionospheric and tropospheric models. In addition let us denote with ,

ijn mdd

the DDR of the pseudoranges of the i-th and j-th satellite measured by the n-th and the m-th reference stations:

, , , , ,( ) ( ) ( ) ( ).ij i j i jn m raw n raw n raw m raw mdd k k k kρ ρ ρ ρ=Δ −Δ −Δ +Δ

(50) We note that when a Wide Area Augmentation System is available the raw reduced pseudorange residuals can be

True p-th satellite location

RxE RxH

Nominal p-th satellite location

b

βp

!rRxEp !eRxE

p!rRxHp !eRxH

p

rRxH

p eRxH

p

rRxE

p eRxE

p

10

computed by resorting to actual ephemerides and satellite clock corrections provided by the Wide Area Augmentation System. Same approach applies to ionospheric and tropospheric corrections. When the SIS of each satellite is healthy, ,

ijn mdd can be

modeled as a zero mean, Gaussian random variable with variance

, , , , ,

2 2 2 2 2ij i j i jn m raw n raw n raw m raw mdd ρ ρ ρ ρσ σ σ σ σ

Δ Δ Δ Δ= + + + . (51)

When the i-th SIS is affected by a satellite position erroriβ , ,

ijn mdd can be modeled as a Gaussian random variable

with variance ,

2ijn mdd

σ and expectation equal to (see [17],

Eq. (19)): { }, ,

n m

ij i i in m RIM RIME dd = − −e e β , (52)

where

n

iRIMe is the unit vector of the line of sight of the i-

th satellite with respect to the receiver of the n-th RS.

Let ,in mdd be the average DDR of the i-th satellite:

, ,1 .1

i ijn m n m

j isat

dd ddN ≠

=− ∑ (53)

When all the satellites are healthy, ,in mdd can be modeled

as a zero mean, Gaussian random variable with variance

,

2in mdd

σ given by:

( ), , , ,,

2 2 2 2 21 .1i i i j j

raw n raw m raw n raw mn mddj iSatNρ ρ ρ ρσ σ σ σ σ

Δ Δ Δ Δ≠

= + + +− ∑

(54)

Then, for the i-th satellite the squared weighted L2 norm2iξ of ,

in mdd

is computed as follows:

ξi2 !

ddm,ni 2

σddm ,ni

2n=1n≠m

NRIM

∑ , (55)

where the m-th RS is supposed to be the pivot one, and where NRIM denotes the number of RSs employed. If 2

iξ exceeds a threshold EL, named Exclusion Level, the satellite is marked as faulty and excluded from PVT computation. When the SIS is healthy, 2

iξ is a random variable with a central chi-square distribution with (NRIM -2) degrees of freedom. Thus, the probability Pfe of excluding a healthy satellite, declared as faulty, is given by:

( )22NRIM

feP D ELχ −= , (56)

where ( )2n

Dχ g is the cumulative central chi-square

distribution with n degrees of freedom. Therefore, the Exclusion Level is pre-computed in accordance to the Neyman–Pearson criterion by inverting the distribution function:

( )22

1 1NRIM

feEL D Pχ −

−= − . (57)

If the i-th SIS is faulty, 2iξ is a random variable with non-

central chi square distribution with non-centrality parameter

( ),

2

21

,RIMm n

im n

i i iNRIM RIMi

n ddn m

λσ=

≠

−= ∑

e e ββ . (58)

Therefore, the probability that a fault event will not be detected (i.e., probability of Missed Exclusion of a faulty satellite) equals the probability that a random variable with non-central chi square distribution with non-centrality parameter ( )iλ β will not exceed the EL threshold:

( )22

,NRIM

SF nc iMAP D ELχ λ

−⎡ ⎤= ⎣ ⎦β , (59)

that can be rewritten as

( ) ( )2 22 1

1 1 ,N NRIM RIM

SF nc iMA feP D D Pχ χ λ

− −

−⎡ ⎤= −⎢ ⎥⎣ ⎦β , (60)

where ( )2 ,n

ncDχ λg is the cumulative noncentral chi-square

distribution with n degrees of freedom and non-centrality parameter λ. Let us observe that, when the local Track Area Augmentation and Monitoring system is complemented with a Wide Area Augmentation System, the capability of detecting satellite faults increase, not only because of the alarms provided by the Wide Area Augmentation System, but also because of the lower variance σ

Δρ ji

2 of the

reduced pseudorange residual appearing in (54), thanks to the ephemerides and satellite clock corrections, and ionospheric incremental delay estimates provided by the Wide Area Augmentation System. Based on (60), the conditional probability of a Misleading Information (MI) event conditioned to the failure of the i-th satellite can be evaluated as follows

( ) ( )( )2 21 1

11 1 ,2

i

N NRIM RIM

iSF ncMI feP D D Pχ χ λ

− −

−⎡ ⎤= − ×⎢ ⎥⎣ ⎦β

( ) ( )( ) ( ) .2 2

L L

i i i i i iSD SDPL PLerfc erfc

ε ε

ε εσ σ

Δ Δ⎧ ⎫⎞ ⎞⎛ ⎛− +⎪ ⎪⎟ ⎟× +⎜ ⎜⎨ ⎬⎜ ⎟ ⎜ ⎟⎪ ⎪⎝ ⎝⎠ ⎠⎩ ⎭

β βg g

(61)

Denoting with PSSF the probability of fault of a single satellite and with NSat number of visible satellites, the probability PSH that none of them is affected by a fault is bounded by the probability that none of them is affected by an independent fault, i.e.:

(1 ) SatNSH SSFP P≤ − . (62)

Considering that, according to the GPS SPS Performance Standard, for the GPS constellation 510 /SSFP h−≤ , PSH can be approximated as follows:

1SH Sat SSFP N P≤ − . (63) On the other hand, the probability of having a failed satellite out of NSat satellites is

, 1SF Sat SSF SSFP N P P≅ = ,

(64)

while for 510 /SSFP h−≤ the probability of having more than one failed satellite can be considered negligible, [9]. Denoting with SLOPEi the ratio between the magnitude of

the train length error ( ) ( )i i iSDεΔ βg , and ( )iλ β :

11

( )( ) ( )i i i

SDi i

SLOPE ελΔ= β

β

g, (65)

and with SLOPEMax its maximum value w.r.t. all the satellites,

( )( ) ( )i i i

SDMAX i i

SLOPE Max ελΔ= β

β

g, (66)

the THR conditioned to ephemeris faults RTHeTrainIntegrity can

be bound as follows

( ){ 2 21 1

111 1 1 ,2e N NRIM RIM

TrainIntegrity ncTH feR Max D D Pχ χλ

λ− −

−⎧ ⎡ ⎤≤ − − − ×⎨ ⎢ ⎥⎣ ⎦⎩

2

L

e MAXPL SLOPEerfcε

λσ

⎧ ⎞⎛ −⎪ ⎟× +⎜⎨ ⎜ ⎟⎪ ⎝ ⎠⎩

2

Dec

L

N

e MAXSF

PL SLOPEerfc Pε

λσ

⎫⎫⎫⎫⎞⎛ + ⎪⎪⎪ ⎪⎟+ ⎜ ⎬⎬⎬ ⎬⎜ ⎟⎪⎪⎪ ⎪⎝ ⎠⎭⎭⎭ ⎭. (67)

On the other hand, as demonstrated in Appendix A, when a Track Area Augmentation System surrounding the rail track, with RSs deployed at nodes of a regular grid, is employed. We have

( )( ) 2 ii i iSD dd

bB

ε σ λΔ ≤β β ,

(68)

where 2idd

σ is the variance of the DDR of the i-th satellite,

b is the length of the baseline between the EoT and the HoT receivers, and B is the length of the baseline between adjacent RSs, with b = B, and B small enough so that ionospheric and tropospheric incremental delays observed by adjacent RSs can be considered highly correlated (typically B < 50 km). Therefore, denoting with γ

Max the maximum of γ(i ) ,

i.e., γMax

= Maxiγ(i ) , (69)

we can write

SLOPEMAX ≤ 2 bBσddMaxγMax

. (70)

Therefore e

TrainIntegrityTHR can be bounded as follows

( ){ 2 21 1

111 1 1 ,2e N NRIM RIM

TrainIntegrity ncTH feR Max D D Pχ χλ

λ− −

−⎧ ⎡ ⎤≤ − − − ×⎨ ⎢ ⎥⎣ ⎦⎩

2

2Max

L

e Maxdd

bPLBerfc

ε

σ λ

σ

⎧ ⎞⎛ −⎪ ⎟⎜⎪× +⎨ ⎟⎜⎪ ⎟⎜⎪ ⎝ ⎠⎩

g

2

2

dec

Max

L

N

e MaxddSF

bPLBerfc P

ε

σ λ

σ

⎫⎫⎫⎞⎛ + ⎪⎪⎪⎟⎜ ⎪⎪ ⎪+ ⎬⎬ ⎬⎟⎜⎪⎪ ⎪⎟⎜⎪⎝ ⎪⎠ ⎪⎭⎭ ⎭

g. (71)

Thus, for a given THR the above bound can be employed for computing the Protection Level. In particular, denoting with Maxλ the value of λmaximizing the quantity:

( ){{ 2 21 1

1 1 ,N NRIM RIM

ncMax feArg Max D D Pχ χλ

λ λ− −

−⎡ ⎤= − ×⎢ ⎥⎣ ⎦

2

2Max

L

e Maxdd

bPLBerfc

ε

σ λ

σ

⎧ ⎞⎛ −⎪ ⎟⎜⎪× +⎨ ⎟⎜⎪ ⎟⎜⎪ ⎝ ⎠⎩

g

2

2Max

L

e Maxdd

bPLBerfc

ε

σ λ

σ

⎫⎫⎫⎞⎛ + ⎪⎪⎪⎟⎜ ⎪⎪⎪+ ⎬⎬⎬⎟⎜⎪⎪⎪⎟⎜⎪⎝ ⎪⎠ ⎪⎭⎭⎭

g (72)

the Protection Level ePL , for a single ephemeris fault can be written as follows:

PLe ! 2 bBσddMaxγMax

λMax + keσεL, (73)

with

( )2 21 1

1

12

1 ,e

N NRIM RIM

TrainIntegrityTH

enc

Dec fe Max SF

Rk erfc

N D D P Pχ χ λ− −

−

−

⎞⎛⎟⎜= ⎟⎜ ⎡ ⎤−⎜ ⎟⎢ ⎥⎣ ⎦⎝ ⎠

.

(74) In Figure 10 the plot of the Protection Level for single ephemeris fault versus the THR for several values of the SLOPE factor is reported. The SLOPE range has been selected in accordance to those values experimented in the simulations. Numerical examples on PL computation are presented in the next section devoted to simulation results.

Figure 10. Protection Level versus THR, single satellite fault

case (NRIM=6, Pfe=10-5, PSF=10-4, NDec=3600).

V. SIMULATION RESULTS For the assessment of the performance of the proposed algorithm, a Monte Carlo simulation making use of a GNSS simulator developed and validated for the rail environment has been employed.

12

Figure 11. Simulator overall architecture.

The overall architecture of the simulator is depicted in Figure 11. In essence: a) The Satellite Orbit Generator provides precision

ephemeris to support evaluation of accurate propagation delays and Doppler effects. For GPS and GLONASS constellations even real data (raw and filtered data) periodically published by International Research Institutes (e.g. IGS, EGNOS) may be employed; The Propagation module evaluates the transformations affecting the satellite signals received at a specific location. At this aim, ionospheric and tropospheric conditions recorded in the GNSS records DataBase are employed. Additional random delays may be added to account for residual errors filtered out by the processing procedures used for generate the data stored in the GNSS records DataBase;

b) The RIM RU module emulates the RS behavior with respect to GNSS data processing;

c) The TALS Server module emulates the behavior of the TALS Server. In particular starting from the raw measurements supplied by the RIM RUs and eventually available Wide Area Augmentation Systems in evaluates the SIS integrity and all those augmentation data provided to the on board receivers. A Virtual Reference Station emulation functionality is also included;

d) The Train motion generator evaluates the Kinematic data (i.e., position, velocity, and acceleration) of a set of Points of Interest (POI) on board of the train (e.g., head and end receivers’ location);

e) The OBU GNSS Rx emulates the behavior of the GNSS receiver;

f) The GNSS Localization module emulates the behavior of the Location Determination System Functional unit. In particular it estimates: • the Kinematics of specific POIs,

• the accuracy and integrity of the estimates themselves,

• eventual sensor failures, • GNSS Rx internal clocks offsets.

g) The Train Integrity module evaluates the train integrity emulating the algorithms described in this contribution.

Figure 12. Train’s track, from Roma Tuscolana to Zagarolo

station. The simulation scenario of the results reported here, refers to a freight train that runs on a track, from “Roma Tuscolana” station to “Zagarolo” station (Rome, Italy). The track has a length of about 30 km, and is mainly running on a flat terrain with a few bends. Figure 12, shows the path of the train. Two trains have been considered i.e., (i) a train, consisting of 35 carriages, each of them 14.5 m long, with a total nominal distance between the two GNSS receivers of 500 m, and (ii) a longer train with 173 carriages, and a total nominal distance between the two GNSS receivers of 2.500 m. The shorter train was moving at constant speed of 108 km/h (i.e., v0 = 30 m/s), while the longer train was moving at constant speed of 80 km/h. We assumed that the train control system is alerted when at least one carriage is decoupled from the rest of the train

13

(i.e., train gap). In the simulation setup a conservative approach has been adopted by assuming that the braking system of the wagons are not operating and the train is affected only by the rolling resistance FR, then omitting the air resistance. Rolling resistance arises due to friction between the wheel and the tracks. Two factors normally determine the rolling resistance of a vehicle i.e., (i) the weight, and (ii) the rolling resistance coefficient, fR, which depends on the type of train/wagon involved. For vehicles with stiff wheels, where wheels do not deform plastically, the general relation for rolling resistance FR with flat terrain is:

R RF f m g= ⋅ ⋅ (75)

where fR is the rolling resistance coefficient (dimensionless), m [kg] is the mass of the train, and g [m/s2] is the gravity acceleration. Notice that (64) expresses the maximum rolling resistance i.e., it is computed in absence of slip between the wheel and the rails. For wagons, slip is very rare, since the wheels are not driven; on the other hand, slip can more likely occur with locomotives, especially under starting condition. Thus, based on (64), the motion equation of the decoupled carriage on a flat terrain, implemented in the simulator is:

20

12

RFs t v tm

= − + , (76)

where v0 is the train speed when the decoupling occurs. In Table 1 the main parameters assumed in the simulation are reported. In the following two cases, which reflect the main railway operative situations have been considered:

1. Gap free plus receiver noise (GF+RN): the train is integer. Satellite errors, propagation effects and thermal receiver noise are accounted for. In particular the receiver noise is modeled as a sample from a Gaussian process with mean equal to 0.1 m and standard deviation equal to 0.8 m i.e.,

;

2. Gap affected plus receiver noise (GA+RN): during the path, at least one carriage is decoupled from the rest of the train. Same error sources as in case GF+RN have been considered (Satellite errors, propagation effects and Gaussian thermal receiver noise mean equal to 0.1 m, and standard deviation equal to 0.8 m).

Figure 13 depicts the histograms of the estimation error of the mileage between receivers for the GF+RN case. In Figure 14, the normal probability plot of the empirical Cumulative Distribution of the estimation error is reported. In this kind of graph, the Normal Cumulative Distribution corresponds to a straight line. We can observe the distribution is practically Gaussian. In addition, there is no significant difference between the results corresponding to different train lengths.

(a)

(b)

Figure 13. GF+RN case for (a) train length = 500 m, and (b) train length = 2500 m.

(a)

(b)

Figure 14. Normal probability plot in GF+RN case, for (a) train length = 500 m, (b) train length = 2500 m.

N 0.1,0.8( )

14

Figure 15. Mileage between receivers. Train length = 2500 m.

(a)

(b)

Figure 16. GA+RN case: (a) train length = 500 m, (b) train length = 2500 m.

Table 1. Simulation train dynamics parameters.

Train weight 1275 ×103 kg Carriage weight 35 t Locomotive weight 120 t fR 0.02 FR 24.9×104 N

The gap occurs after 3 km run. The deceleration profile follows (65) so that the lost carriage stops after 150 s from the decoupling event. As illustrated in Figure 15, where the mileage between the HoT and the EoT receiver for the longer train is reported, the simulation continues even after the lost carriage stops, so that the final distance between the receivers is about 25 km.

(a)

(b)

Figure 17. Normal Probability plot: GA+RN case; (a) train length = 500m, (b) train length = 2500 m.

(a)

(b)

Figure 18. Estimated mileage between receivers w.r.t. Ground Truth. (a) train length = 500 m, (b) train length = 2500 m.

95 97 99 101 103 105 107 109 111 113 115495

500

505

510

515

520

525

Elapsed time from beginning of simulation [s]

Mile

age

betw

een

rece

iver

s [m

]

Estimated mileage between receiversReal mileage between receivers

95 97 99 101 103 105 107 109 111 113 1152495

2500

2505

2510

2515

2520

2525

Elapsed time from beginning of simulation [m]

Mile

age

betw

een

rece

iver

s [m

]

Estimated mileage between receiversReal mileage between receivers

15

Thus, the simulated scenario allows verifying the effectiveness of the algorithm approximations even with baseline length one order of magnitude greater then expected. Same situation applies to the shorter train. The results on the train gap are shown in Figure 16 and Figure 17, which depict the histograms of the estimation error on the mileage between receivers, and Normal Probability Plots when a carriage is decoupled from the rest of the train. In Figure 18 we depicted the estimated mileage between receivers (i.e. blue line) w.r.t. the real one (i.e. green line) in correspondence of the decoupling event (i.e. t = 100 s). It can be easily verified that the output of the proposed approach follows the receivers as expected. The Normal Probability Plot of Figure 17 clearly indicated that the Gaussian model satisfactory fits the empirical distribution only in its central part, with the empirical distribution exhibiting heavy tails. In principle, the estimation error process, because its variance strictly depends on the number of visible satellites and on their position with respect to the receivers. The situation is evident from Figure 19 where the estimation error time-series of the longer train simulation is reported.

Figure 19. Estimation error time series. Train length = 2500 m.

Figure 20. Median filter estimation error empirical pdf. GA+RN

case, train length = 2500 m.

Figure 21. Median filter estimation error, Normal Probability

Plot. GA+RN case: train length = 2500 m.

Table 2. Statistics of simulation results. Metric Cases

GF+RN GA+RN L = 500 m L =

2500 m L = 500

m L = 2500

m Mean value [m]

- 0.002 0.002 0.08 0.07

Std [m]

0.82   0.84   0.93 0.94

In principle, the computation of the protection level accounts for the variations of the statistics of the estimation error. Nevertheless, a partial mitigation of the hazard associated to the outliers, at the expense of a slight increase on the time to alert, can be obtained by introducing a median filter. The effectiveness of this kind of mitigation can be appreciated from the plots of Figure 20 and 21 where the histograms of the estimation error on the mileage between receivers, and the Normal Probability Plots of its cumulative distribution when a median filter with 11 samples is introduced are shown. Considering that, in the simulation the GNSS receivers operate at 10 Hz, a median filter with 11 samples introduces an additional delay of 0.5 s that can be considered quite acceptable. As illustrated by the Normal Probability Plot, use of the median filter removes the heavy tails, and the actual error empirical error statistics is well fitted by the Gaussian distribution. Moreover, the variance of the error after the application of the median filter is reduced. Concerning statistics related to proposed scenarios, in Table 2 we reported the mean and the standard deviation of the estimation error. Concerning the protection level for single ephemeris fault, we observe that in the performed simulations we had

2Maxdd

σ = , 1Max ≤g , 50B km= . Therefore a

0 200 400 600 800 1000 1200-5

-4

-3

-2

-1

0

1

2

3

4

5

Elapsed time from beginning of simulation [s]Estim

atio

n er

ror o

n M

ileag

e be

twee

n re

ceiv

ers

[m]

Train length L=2500 m

-10 -5 0 5 100

0.1

0.2

0.3

0.4

0.5

Mileage estimation error [m]

Prob

abilit

y

-4 -3 -2 -1 0 1 2 3

0.0010.0030.010.020.050.10

0.25

0.50

0.75

0.900.950.980.99

0.9970.999

Data

Prob

abilit

y

Normal Probability Plot

16

SLOPE=0.14 can be employed for the numerical computation of PL.

VI. CONCLUSIONS In this paper an analytical model to evaluate the performance of the GNSS as a means to provide the train integrity function in the ERTMS-ETCS L3 system is presented. The protection level has been computed by starting with the formulation already known for the aviation safety of life application, and further characterized to take into account the railways environment. The use of two GNSS receivers coupled with a double-difference algorithm that explicitly accounts for the constrained train trajectory allow to mitigate most of the SIS hazards. However, the railways environment is more challenging than the aviation operational scenario, and the multipath effects that represent an important hazard, must be counteracted with already consolidated solutions. The achieved results represent a basis to evaluate the use of the GNSS for the train integrity function and to realize a robust and cost effective system by combining GNSS technologies, including multiple constellation receivers, with other sensors (e.g. INS), for improving the availability and continuity performance. The methodology described in the paper provides evidence of the analytical characterization of the safety related parameters in order to limit the amount of validation tests and to contribute to the certification process.

APPENDIX A SLOPE UPPER BOUND

Without loss of generality, let us consider Figure 22, depicting the case of a Track Area Augmentation System surrounding the rail track, with RSs deployed at nodes of a regular grid. Let B the distance between two adjacent RSs. For sake of simplicity let us assume that the track lies on a surface flat enough so that each track segment is coplanar with the surrounding RSs. This, in turn implies, that give a baseline b between the EoT and the HoT receivers, at least 3 RSs, let say m, p, q, exist so that, denoting with ,nmB between the m-th and the n-th RS we can write

, ,qcos sinm p mbB

γ γ⎡ ⎤= +⎣ ⎦b B B . (A-1)

Then, the component iRxE

i⊥eb of the baseline orthogonal to

the line of sight E

iRxe can be rewritten as

( ), ,cos ,i E ERxE

i i im p Rx m p Rx

bB

γ⊥

= − +e

b B e B e

( ), ,qsin ,E E

i im p Rx m Rx

bB

γ+ −B e B e . (A-2)

Figure 22. Track Area Augmentation System deployment

scheme (red dots denote RS locations).

Figure 23. Virtual Track Circuit vs Protection Level (red dots

denote RS locations). In Figure 23 we depict the Virtual Track Circuit length vs. the Protection Level according to the Track Area Network deployment and the receivers baseline. Denoting with , i

RIMm

im n⊥eB the component of the baseline

,nmB orthogonal to the line of sight n

iRIMe ,

, ,n ,n,i m mRIMm

i i i i im n m RIM m RIM⊥

= −e

B B e B e (A-3)

for a Track Area Augmentation System with RSs dense enough we can write

b⊥eRxE

ii !

bBcosγ Bm,p

i⊥eRIMm

i + sinγ Bm,qi⊥eRIMm

i⎛⎝⎜

⎞⎠⎟ (A-4)

Substituting the above equation in (43), we have

, ,q, ,( ) cos sin

i iRIM RIMm m

E E

i i i im p m

i iSD i i

Rx Rx

bB r r

ε γ γ⊥ ⊥

Δ

⎞⎛⎟⎜ + ⎟⎜

⎜ ⎟⎝ ⎠

e eB β B β

β ;

(A-5)

On the other hand,

( ) ( ) ( ) ( )2 22 22 ξ η ξ η ξ η ξ η+ = + + − ≥ + (A-6)

Therefore

B

VTC

b

PL

17

( )22 22( ) cos sinξ η ξ γ η γ+ ≥ + . (A-7) So that we can write

12 2 2

, ,q, ,( ) 2

i iRIM RIMm m

E E

i i i im p m

i iSD i i

Rx Rx

bB r r

ε⊥ ⊥

Δ

⎧ ⎫⎡ ⎤ ⎡ ⎤⎪ ⎪⎪ ⎪⎢ ⎥ ⎢ ⎥≤ +⎨ ⎬⎢ ⎥ ⎢ ⎥⎪ ⎪⎢ ⎥ ⎢ ⎥⎣ ⎦ ⎣ ⎦⎪ ⎪⎩ ⎭

e eB β B β

β

(A-8)

Considering that the RSs employ identical receivers and that the baseline among them are relatively short, for each satellite the DDR

,

2in mdd

σ can be consider practically equal

so that in the following we approximate ,

2in mdd

σ with its

average value 2idd

σ i.e.,

,

2 2i in mdd dd

σ σ; . (A-9)

In addition the following approximation holds

E m

i iRx RIMr r; , (A-10)

and we can restate the inequality (A-8) as follows

1

12 2

22

,( ) 2

RIMm

i

i

i i iNRIM RIMi i

SD ddi dd

bB

ε σσΔ

=

⎧ ⎫−⎪ ⎪≤ ⎨ ⎬⎪ ⎪⎩ ⎭∑

e e ββ (A-11)

or equivalently

( )( ) 2 ii i iSD dd

bB

ε σ λΔ ≤β β (A-12)

q.e.d. REFERENCES [1] I. Mitchell, “Train Integrity is the Responsibility of

the Railway Undertaking,” IRSE International Technical Committee. Available online.

[2] ERTMS (European Rail Traffic Management System): www.ec.europa.eu/transport/modes/rail/index

[3] ERTMS LEVELS, Different ERTMS/ETCS Application Levels to Match Customers’ Needs, Factsheets. Available online.

[4] Federal Railroad Administration, Dept. of Transportation, “Track Safety Standards; Improving Rail Integrity,” published in the Federal Register on 01/24/2014, and available online at http://federalregister.gov/a/2014-01387.

[5] H. Scholten, R. Westenberg, and M. Schoemaker, “Sensing train integrity,” in Proc. of IEEE Sensors, pages 669-674, Los Alamitos, Oct. 2009.

[6] S. Oh, Y. Yoon, K. Kim, and Y. Kim, “Design of Train Integrity Monitoring System for Radio based Train Control System,” in Proc. of 12th International

Conference on Control, Automation and Systems, Oct. 17-21, 2012, Jeju Island, Korea.

[7] R. Seiffert, “Train Integrity, making ETCS L3 happen,” IRSE International Technical Committee, 2010.

[8] K. M. Betts, T.J. Mitchell, D.L. Reed, S. Sloat, D.P. Stranghoener, and J.D. Wetherbee, “Development and Operational Testing of a Sub-meter Positive Train Localization System,” in Proc. of IEEE/ION PLANS 2014, Monterey, CA, May 2014, pp. 452-461.

[9] A. Neri, A. Filip, F. Rispoli, and A.M. Vegni, “An Analytical Evaluation for Hazardous Failure Rate in a Satellite-based Train Positioning System with Reference to the ERTMS Train Control Systems,” in Proc. of ION GNSS 2012, September 18-21, 2012, Nashville, TN, USA.

[10] A. Filip, J. Beugin, and J. Marais, “Safety Concept of Railway Signaling Based on Galileo Safety-of-Life Service,” COMPRAIL, Toledo, Spain, Sept 15-17, 2008, pp. 103-112.

[11] A. Neri, A.M. Vegni, and F. Rispoli, “A PVT Estimation for the ERTMS Train Control Systems in presence of Multiple Tracks,” in Proc. of ION GNSS 2013, September 16-20, 2013, Nashville, TN, USA.

[12] A. Filip, and F. Rispoli, “Safety concept of GNSS based train location determination system SIL 4 compliant for ERTMS/ETCS,” in Proc. of ENC-GNSS 2014, Rotterdam, Netherlands.

[13] V. Palma, P. Salvatori, C. Stallo, A. Coluccia, A. Neri, and F. Rispoli, “Performance Evaluation in terms of Accuracy Positioning of Local Augmentation and Integrity Monitoring Network for Railway Sector, in Proc. of IEEE Intl. Workshop of Metrology for Aerospace, Benevento, Italy, May 2014.

[14] A. Neri, V. Palma, F. Rispoli, and A.M. Vegni, “Track Constrained PVT Estimation based on the Double-Difference Technique for Railway Applications,” in Proc. of EUSIPCO 2013, September 9-13, 2013, Marrakech, Morocco.

[15] J. Marais, M. Berbineau, O. Frimat, and J.-P. Franckart, “A new Satellite-based Fail-safe Train Control and Command for Low Density Railway Lines,” in Proc. of TILT conference, Lille, France, 2003.

[16] M. Joerger, S. Stevanovic, S. Khanafseh, and B. Pervan, “Differential RAIM and relative RAIM for orbit ephemeris fault detection,” in Proc. of Position Location and Navigation Symposium (PLANS), 2012 IEEE/ION, vol., no., pp.174,187, 23-26 April 2012.

[17] S. Matsumoto, S. Pullen, M. Rotkowitz, and B. Pervan, “GPS Ephemeris Verification for Local Area Augmentation System (LAAS) Ground Stations”, in Proc. of ION GPS 2009, September 14-17, 2009, Nashville, TN, USA.