LIST OF FIGURES

INTRODUCTION

EXECUTIVE SUMMARY

The objective of STARS task 5.1 is to review the existing navigation augmentation systems and services in terms of performances achieved and application environments, and to analyse the experimentations and projects already performed in railway applications related to the use of these systems and services.

This report aims to draw the state of the art of existing monitoring system (as used in aeronautics) and past experiences of railways when using such concepts. The focus only concerns GNSS-based positioning systems and do not pretend to present the global systems developed to insure the complete safety level of railway signalling.

This report is composed of three main sections: after a short presentation of these augmentation systems, the second part aims to highlight the levels of performance achieved, the existing limitations and their applicability in the railway context and constraints. The last section will address the suitability of the concept of integrity monitoring (developed for aviation) in the railway environment. This first task of WP5 shall be a basis for discussions of solutions to be defined for railways.

As a state of the art, this deliverable relies on published articles, past projects deliverables, and information given by the STARS partners about the past projects through a questionnaire.

DEFINITIONS AND ACRONYMS

GNSS AUGMENTATION SYSTEMS

This section aims to present the basics of GNSS augmentation systems as a background for a good understanding of the following results and issues.

GENERAL PRINCIPLES

Development of GNSS augmentation systems characteristics has been driven by the requirements of civil aviation safety procedures. Indeed, the augmentation systems are intended primarily to support precision approach operations before the landing phase. For such operations, the user requires to be warned in real-time in case the positioning error exceeds the requirements or in case of a failure.

Thus, the main idea of GNSS augmentation system is to compensate part of the positioning errors, often called "common mode errors", as it is experienced by a GNSS user on the ground (typically a GNSS receiver) similarly to a GNSS antenna/receiver belonging to an augmentation system.

GBAS assumes that two receivers situated in close vicinity will face some close errors caused by ionospheric propagation, satellite position or clock errors, etc. SBAS system relies in a separation of the different error causes (clock, ephemeris & ionosphere). For SBAS, these error contributions and the associated UDRE&GIVE are recombined by user receiver according to the user geographical position hence obtain the capability to offer differential corrections on a wide area.

The first function of GNSS augmentation systems, whatever they are, is to transmit the pseudorange correction to the user for him/her to benefit of a better accuracy. A second service is integrity monitoring.

The transmission can be performed by terrestrial or satellite links and will offer respectively local or wide area services. This will be the main difference between GBAS and SBAS presented above. Moreover, the media used for broadcast will condition the targeted area.

ACCURACY ENHANCEMENT

Accuracy is the degree of conformance of the estimated position with the true position. Accuracy is a statistical measure of performance and indicates trueness and precision in terms of confidence level with respect to a confidence interval.

As every augmentation system, the system relies on a network of monitoring stations (with very well-known positions). Each station receives GNSS signals that are processed in order to estimate the pseudo-range corrections by comparison with the known monitoring station position.

Once the pseudo-range corrections have been computed, they are transmitted in the form of "differential corrections" by means of either a terrestrial radio link either a GEO satellite.

INTEGRITY MONITORING

The second function of an augmentation system is to offer guarantees to the user about the position confidence level. The system shall detect system and propagation failures (as a satellite failure or message error, or ionospheric failure) and alert the user in a dedicated time (TTA -Time To Alert).

Integrity is a measure of trust that can be placed in the correctness of the information supplied by a navigation system and it includes the ability of the system to provide timely warnings to users when a satellite or the entire system should not be used for navigation. This definition can be clarified thanks to four main parameters: Alert Limit (AL), Integrity Risk, Time to Alert (TTA) and Protection Level (PL).

 Alert Limit represents the largest position error allowable for safe operation.

 Integrity Risk is the probability of providing a signal leading to a position that is out of tolerance without warning the user in a given period of time. It defines the maximum probability with which a fault free receiver is allowed to provide position failures not detected by the integrity monitoring system.

 Time to Alert (TTA) is the maximum allowable elapsed time from the onset of a positioning failure until the equipment announces the alert.

 The PL is a statistical error bound computed so as to guarantee that the probability of the absolute position error exceeding the alert limit is smaller than or equal to the target integrity risk.

For terrestrial transport, the HPL (Horizontal PL) is of main interest and bounds the horizontal position error with a confidence level derived from the integrity risk requirement. As the true HPE (Horizontal Position Error) is never known, except in test or evaluation conditions with reference measurements, HPL is the indicator of accuracy and is compared to HAL, defined by the application requirements. As summarized in figure 1, the system is declared available when HPL<HAL and unavailable when HPL>HAL. If correctly estimated, HPE should always be smaller than HPL as presented in the two first cases of figure 1. Then, we can consider that the integrity monitoring process correctly protect the system from being unsafe. First case is the nominal case where the integrity monitoring process correctly works and the position information can be used with confidence. In the second case, the system is declared unavailable, i.e. it cannot guarantee the safety of the position. The train shall be located by another system or stopped (for safety procedure). The third and fourth cases represent situations where HPE is not correctly bounded by HPL. In the third case, as the true error remains below the requirements (HPE<HAL), it is not critical for safety (false detection). Some operational constraints can occur but the system remains safe. However, due to non-detected failures HPE can sometimes exceed HAL as illustrated in the fourth case. Staying below the requirements (HPL<HAL) the alert will not be activated.. But in case HPE exceeds HAL, a risk on integrity occurs. The occurrence of this last event has to be strongly minimized.

D5.1 State of the art of EGNSS system for the rail application Page 11 of 61

GBAS

Ground-Based Augmentation System (GBAS) is a local GNSS augmentation system based on terrestrial radio links that provides differential corrections and integrity monitoring of Global Navigation Satellite Systems (GNSS). Main application of GBAS is to provide navigation and precision approach service in the vicinity of the host airport (approximately a 23 nautical mile radius or 42.6km) in order to yield the extremely high accuracy, availability, and integrity necessary for some of the approaches defined in aviation.

In the past, the FAA referred to GBAS as the Local Area Augmentation System (LAAS). Its architecture is presented in figure 2. The system relies of a ground infrastructure composed of a network of monitoring stations that collect GNSS pseudo ranges measurements. The precise positions of the monitoring stations being known, the comparison between measurements and expected observations make the system capable of sending differential corrections to the users approaching the monitored area. Messages are broadcasted via a very high frequency (VHF) radio data link from a ground-based transmitter. [START_REF]EGNOS Safety of Life (SoL) Service Definition Document[END_REF]. Version three will feature new capabilities, including dual frequency and dual-constellation with both GPS and Galileo, EGNOS is composed of two main segments: the ground segment (composed of both the control and user segments) and the space segment.

SBAS

THE GROUND SEGMENT

The ground segment is a network of Ranging Integrity Monitoring Stations (RIMS) and Earth Stations (NLES) linked with the EGNOS Wide Area Network (EWAN), as the MCC (Master Control Centres). Two additional facilities (the Performance Assessment and Checkout Facility (PACF) and the Application Specific Qualification Facility (ASQF)) are also deployed to support system operations and service provision.

The RIMS are located all over Europe and abroad and collect continuously GPS measurements. Raw data are sent to the Central Processing Facility (CPF) of each Mission Control Centre (MCC) that will estimate the corrections to improve the accuracy of the users inside the service area (called ECAC). The corrections include clock errors, orbital positions and ionospheric delays.

Moreover, the CPF estimates the residual errors, i.e. an over bound of residual errors expected after having applied corrections broadcasted by EGNOS. The errors are characterised by two parameters:

 User Differential Range Error (UDRE).

The UDRE estimates the residual range error after the application of SV clock and ephemeris error correction for a given GNSS satellite.

 Grid Ionospheric Vertical Error (GIVE). GIVE estimates the vertical residual error at predefined Ionospheric Grid points after application of the ionospheric corrections for a given geographical grid point.

These parameters will be of main importance to bound the user positioning error in the safetycritical applications.

Table I presents positioning error in a conservative approach, i.e. for a "worst user location" and is then considered as worse than the classical experience measurements. The Satellite Residual Error for the Worst User Location (SREW) represents the residual range error due to the SV ephemeris and clock errors once EGNOS corrections are applied.

Table I. Typical EGNOS and GPS stand-alone SIS UERE [START_REF]EGNOS Safety of Life (SoL) Service Definition Document[END_REF] D5.1 State of the art of EGNSS system for the rail application Page 14 of 61

Note 1: As of GPS Standard Positioning Service Performance Standard [GPS SPS 2008]. Note 2: This is the typical range of ionospheric residual errors after application of the baseline Klobuchar model broadcast by GPS for mid-latitude regions

The CPF also monitors and detect GNSS anomalies if necessary and is required to specify the user of any dysfunction within a time 𝑡 < 𝑇𝑇𝐴 (Time To Alert).

Messages are then transmitted to the NLEs in charge of up linking it to the GEO satellites; Every satellite of an SBAS provides both differential corrections on the wide area and the parameters required to guarantee the integrity of the GNSS user.

EXPECTED ACCURACY PERFORMANCES

With access to the Open Service, EGNOS allows the user to position with a better accuracy than GPS alone, although with a worse accuracy if compared to GBAS performance 1m accuracy with 1-sigma confidence level in both horizontal and vertical axis as mentioned in section 2.2. Horizontal position is expected below 3m as specified in table II.

Table II. OS Horizontal and Vertical Accuracy [START_REF]EGNOS Safety of Life (SoL) Service Definition Document[END_REF] EXPECTED INTEGRITY PERFORMANCES For the integrity in the range domain, the range error is partially bounded by a threshold based on the UDRE and GIVE parameters. For each pseudo range, it is supposed that the total range error D5.1 State of the art of EGNSS system for the rail application Page 16 of 61 shall be less than 5.33 times the estimated standard deviation (ε ≤ 5.33σ where ε is total true Range error and σ is the computed SBAS Range error estimate standard deviation). This assumption may almost always be true for aviation but NOT in railway applications where the local environment is much more challenging.

UDRE and GIVE bound properly the true range error in the measurements if 5.33xUDRE > SREW and 5.33xGIVE > GIVD with the adequate level of probability determined by the integrity risk. The EGNOS SoL safety level of probability is 99.99999%. In aviation applications, the observed maximum values for SREW/UDRE and GIVD / GIVE are both around 3 (Extracted from [START_REF]EGNOS Safety of Life (SoL) Service Definition Document[END_REF]).

EGNSS USE IN RAIL APPLICATIONS -PREVIOUS INITIATIVES AND RESULTS

EGNSS is in the heart of European projects since the beginning of the 2000s, in the context of the ERTMS deployment also. The aim of this chapter is to summarize previous initiatives and results with a focus on their use of the EGNOS signals and data when studied. This chapter is composed of the following sections: first, the presentation of the European context of ERTMS which is the application context of most of the projects. The second section summarize the project objectives, the GNSS performances, specified and reached, and the use (or not) of integrity monitoring solutions. The last section presents a review of solutions.

THE APPLICATION CONTEXT IN EUROPE

Historically, in Europe, each country developed its own railway infrastructure, equipment and operational rules. The consequences are heterogeneity of electrification, rolling stock, maintenance and exploitation rules, signalling… Europe has defined the ERTMS (European Rail Traffic Management System) to harmonize this. ETCS is the ERTMS sub-system dedicated to control and to protect trains. Migration is progressive and performed by stages from level 0 to 3. The goal is first to let coexist current external systems and new balises and to progressively move some of the trackside equipment to transpose intelligence on-board.

In the levels 1 and 2 of ETCS, the train position knowledge is based on an odometer and a beacon reader, interfaced with the EVC (European Vital Computer) train-borne sub-system (cf. figure 5). Such sensors are well-known and controlled by the railway community, which has a certain confidence in them. However, the global ETCS infrastructure is costly and this cost slows down its deployment. It is then necessary for future systems to think about alternative solutions [START_REF] Hosse | Market analysis for satellite train localisation for train control systems[END_REF]. GNSS is envisaged in the highest level of ETCS or its declination to regional lines, namely ETCS L3 and ETCS Regional. In level 3, no line side signals will be required for delivering movement authorities. A train shall be able to locate itself [START_REF] Neri | An analytical assessment of a GNSS-based train integrity solution in typical ERTMS level 3 scenarios[END_REF]. All information will be exchanged between the ETCS on-board system and the RBC trackside system (Radio Block Centre) through mobile network. Trains will communicate their location and integrity (safety information guaranteeing that the train did not lose any wagon and that train true position is not outside train position confidence interval with a certain probability determined by the confidence level i.e. SIL4). This level shall also improve line capacity by making possible to manage circulations with moving blocks. In this context, GNSS is investigated to be the basis for the embedded train locator.

The use of GNSS in order to provide a low cost solution for signalling and in particular in the highest levels of ETCS (level 3) and the ERTMS Regional has been an issue since the beginning of the 2000's [START_REF] Raymond | Innovations Bring Satellite Control within Reach[END_REF]. With several projects, the European Commission, through the successive Framework Programs funded researches in order to explore and promote the use of satellites for such solutions. First main projects were APOLO [START_REF] Filip | Architecture of GNSS aided signalling: Analysis and experiments[END_REF], GADEROS [START_REF] Urech | GADEROS, a GAlileo Demonstrator for Railway Operation System[END_REF] and LOCOPROL [START_REF] Mertens | Low-cost signalling on Low density lines[END_REF] but one can mention tens of others in the past decade until the recent GaLoROI [START_REF] Manz | Approach to Certification of Satellite Based Localisation Unit in Railways[END_REF] or 3inSat [START_REF] Rispoli | Innovative train control systems based on ERTMS and satellite-public TLC networks[END_REF] projects. All these projects, if they did not lead to operational commercialized products, surely helped GNSS to be introduced in railway mentalities.

MAIN PROJECT OBJECTIVES, PERFORMANCES AND CHARACTERISTICS

In this section, we aim to present the main objectives and characteristics of the previous mentioned projects, their use of GNSS and, if used, how EGNSS contributes to the railway applications. Table IV make the synthesis of these different aspects based on answers brought by the different STARS partners involved in these projects. -Availability and continuity requirements: system availability / continuity > 99,99999% (i.e. unavailability < 10

-7

) for every 20 sec. or 2 km travelled -Accuracy obtained mostly less than 3m if no multi--characterization of the environment: reception was analysed in post processing -Tests:

¤ Lab test with a GNSS simulator ¤ Field test using DGPS to provide a position reference (some field tests had available highly accurate track maps). ¤Safety target for the overall system is 10 -9

/h but for the positioning sub system 6.10 -11 /h to comply with a SIL4. (achievable according to the preliminary safety case)

The solution computed intervals, with accuracy most of the time around +/-150m at 10-11/h with GPS only ( +/-75m with 2 independent constellations)

Use of multiconstellation receiver prototype for railways

The project focused on the receiver development (not on a railway function). From [START_REF] Girasole | Galileo Safety of Life Receivers Development[END_REF]: -Accuracy requirements: 4m horizontal accuracy, vertical 8m with 95% confidence at least once every second, without any other aids -Velocity accuracy requirement: 0.5m/s with 95% confidence level -Local precision differential code position accuracy: 0.8m horizontal and 1.5 vertical with 95% confidence ) shall not exceed the specified value of 8.0E-5 (TBC) assuming an integrity requirement (without receiver contribution) of 8.0E-6 on 15 sec. -Integrity requirement: the time-to-alert shall be better than 5 sec. (use of EGNOS for providing integrity) -The continuity results were below the 5x10 -4 bound. -The accuracy in position is less than 2m when comparing the navigation solution with the real position of the receiver -No integrity failures were detected. The HPL global behaviour is <12m and the VPL<22m. These two values assure the availability of the service in terms of APV-1 alarm limits (40m in horizontal component and 50m in the vertical one) that are the ones fixed as goal to be achieved by the EGNOS System at 99% level of confidence and, consequently, fulfil the aeronautical requirements.

-In conclusion, EGNOS user performances obtained during the trials are:

-Operational scenarios: ¤ 1. Train awakening and cold Movement detection: when a train is starting a mission with stored position data qualified as invalid or unknown, the GNSS system can qualify them as valid ¤ 2. Absolute positioning: in order to provide a way to have a direct access on the positioning without integration of the speed. It gives the possibility to have a confidence interval on the travelled distance, independent of the travelled distance. ¤ 3. Train Integrity: by placing a GNSS antenna at the rear of the train. The train integrity can be derived by comparing the distance 'rear-front end' with the length of the train -Tests: Lab environment with simulation tools and on-site tests (rural and urban environments) between Madrid, Lleida, and Barcelona HS line. A total number of 30 GPS satellites were available during the trials with no EGNOS SIS occurred (some RIMS unavailability).

- ¤ the identification of the parameters of the developed localisation system allowing its RAMS evaluation, ¤ the fault tree analysis of the localisation system, ¤ the evaluation of the occurrence probability of hazards, compliance with SIL 3 has been proven according to the legal framework. -The safety case has been carried out with an accompanying and concluding assessment. The approach enabled the project assessor to be aware of the status and safety relevant aspects during the whole time of the project. Experimental tests performed along a regional line in Romania (one tunnel, otherwise relatively free of obstacles area).

SATLOC GNSS receiver + EGNOS + Odometer

EGNOS is used for its integrity flag (Use/don't use) but no integrity monitoring tested.

System

4-Availability requirements:

 The expected Delivered vs. planned Virtual Balises per train run is: more than 99%.  The expected correct sequence of provided Virtual Balises per train run is: 100%.

5-Safety requirements:

For each train run, the actual safe front end (based on the Ground Truth) must be never outside the train confidence interval for every measured distance from the applicable LRBGs.

REVIEW OF SOLUTIONS

LOCALISATION UNITS VERSUS GLOBAL SYSTEMS

Two approaches can be found in the past projects. Some of the projects decided to develop an OBU (On Board Unit) with a very high level of integrity. This is the case of GaloROI (SIL3) or 3inSat (SIL4). In some others, the safety is ensured by the global operational system. The pressure is then lower on the localization unit as in Satloc where the SIL is reached thanks to a double check of position coherence between the train and the track control centre.

GNSS AS A FIRST SENSOR

If GNSS is never a stand-alone solution, a GNSS receiver is included in all the experiences recalled in this document. Several declination of GNSS receiver can however be used.

The simplest configuration is a simple GPS receiver. Such a receiver only receives GPS signals, i.e. signals sent by satellites of the US constellation.

In the European projects, funded by European programs, EGNOS has been at least tested, so the receiver employed were most of the time EGNOS/GPS receivers. But due to visibility difficulties (GADEROS), technical constraints (GRAIL2), some of these projects only used the GPS data of such receivers… But when received, EGNOS shows its interest on accuracy as demonstrated in Locoprol figure 6 [START_REF] Bortolotto | EGNOS trials on Italian high-speed tilting trains[END_REF] where a bias of 1m exists in the measured position error in both cases of EGNOS and no EGNOS monitoring. Error here is computed by comparison of the estimation with a reference track database.

Figure 6: Estimated positioning accuracy with and without EGNOS along an Italian High speed railway line [START_REF] Bortolotto | EGNOS trials on Italian high-speed tilting trains[END_REF].

EGNOS No EGNOS

GPS RTK has been mentioned in some projects. RTK provides very accurate positions thanks to real-time kinematic corrections. The RTK requires a fixed receiver (base) that provides phase correction via a communication link. Because of its high cost, the need for initialization period, and continuous communication link, RTK is more used as an evaluation tool (for reference trajectory) than as an embedded long-term solution.

More recent projects are exploring the potential of multi frequency and multi constellation systems available today because of the multiplicity of the systems (Glonass, Galileo, Beidou…) and the new signals embedded in new generation of satellites. In 3inSat, multi constellation receivers are used in order to increase accuracy and satellite visibility. Integrity monitoring of all constellation is achieved by a track augmentation network [START_REF] Neri | An analytical evaluation for hazardous failure rate in a satellite-based train positioning system with reference to the ERTMS train control systems[END_REF].

In 2005, the GIRASOLE project proposed the development of a dedicated receiver for safety of life applications and in particular one for the rail. This receiver has been tested in the GRAIL project.

LOCOPROL relied on GNSS also but without exploiting the classical output of a GNSS receiver. The original LOCOPROL algorithm exploits, in the one hand, the 1D characteristic of a track and, in the other hand, pseudo ranges from pairs of GPS satellites assumed. Based on TDOA (Time Difference of Arrival), the algorithm computes positioning by intersecting hyperboloids with the track data base. Each pair and its intersection provide a position interval on the track. The merge of all the intervals computed is the choice made to ensure a high confidence to the final interval (PCI -Position Confidence Interval [START_REF] Marais | A new satellitebased fail-safe train control and command for low density railway lines[END_REF]). For more robustness, the solution has been hybridized with an odometer as most of the following solutions.

MULTI SENSOR LOCALISATION SOLUTIONS

Even if not necessarily quantified, most of the solutions adopted in projects aim at ensuring a maximal availability and accuracy and/or integrity. The "or" are used here because of the different targets defined in the projects. LOCOPROL for example, highlighted the need for integrity more than accuracy on the targeted low traffic lines. In this section, the presentation is classified into availability and accuracy-related solutions first and safety-related solutions then but keeping in mind that accuracy and availability performance contribute to integrity and safety.

Everybody knows today that GNSS-alone cannot reach availability and high accuracy in constraining environments, neither a high level of safety integrity as expected for railways. Indeed, unlike a plane, a train travels close to various obstacles for the signals: buildings, trees, cuttings or even tunnels, etc. that create multipaths or blockages of satellite signals. Thus, different solutions have been developed from classical to more original ones to counter these effects.

GBAS or SBAS can be used for their accuracy and specially integrity enhancement capabilities. Their use will be discussed in section 4 of this document.

In the first projects like GADEROS [START_REF] Urech | GADEROS, a GAlileo Demonstrator for Railway Operation System[END_REF] or APOLO [START_REF] Filip | Architecture of GNSS aided signalling: Analysis and experiments[END_REF] the systems developed combined multi sensor inputs to allow the system to benefit from absolute localization solutions with GPS as well as with continuous and high frequency localization thanks to inertial measurements (as for the classical road or robotics solutions). Usual sensors are odometers and gyroscope, i.e. in APOLO and GADEROS, or Inertial Measurement Units (IMU), i.e. in Integrail but one can also find Eddy current sensors like in the papers of [13] [14] and in the GaloRoi project [START_REF] Manz | GaLoROI: Satellite based localization in railways[END_REF]. In these projects, an OBU is developed where sensors inputs are fusioned by the way of a Kalman Filter.

As an example, the solution developed in the RUNE project implemented a Navigation Kalman Filter (described in [START_REF] Marradi | RUNE (Railway User Navigation Equipment): Architecture & Tests[END_REF]) that integrates data from three main on-board sensors:

 GNSS Receiver: provides a GPS/EGNOS-based PVT solution in addition to EGNOS integrity data;

 Inertial Measurement Unit (IMU): provides three-axis accelerometer and three axis gyro data for propagation of the solution, especially in case of unavailability of GNSS signals;

 Train Odometer Unit: provides continuous along-track velocity information from two toothed wheels.

Fusion techniques are discussed in [START_REF] Gao | Application of improved particle filter to integrated train positioning system[END_REF][21] [START_REF] Acharya | Train localization and parting detection using data fusion[END_REF][13] as well as fusion levels (loosely-coupled or deeply-coupled integration) in [START_REF] Wang | Research on deeply integrated GPS/INS for autonomous train positioning[END_REF]. The level of fusion defines whether the raw GNSS data (like pseudoranges) are used as inputs in the navigation filter or the GNSS receiver output.

These fusion techniques are sometimes complemented with digital maps as frequently done in automotive applications [START_REF] Saab | A map matching approach for train positioning. I. Development and analysis[END_REF][21] [START_REF] Liu | A GNSS/trackmap cooperative train positioning method for satellite-based train control[END_REF][26] [START_REF] Zheng | Integrated GNSS with different accuracy of track database for safety-critical railway control systems[END_REF]. One shall notice, of course, that their use implies availability, accuracy, reliability, and consistency of the maps [START_REF] Gerlach | A precise digital map for GALILEO-based train positioning systems[END_REF]. [START_REF] Böhringer | Location in railway traffic: Generation of a digital map for secure applications[END_REF] proposed a modelling scheme for generating a digital map.

[28] explains a novel double difference algorithm for train location determination that explicitly accounts for the track constraint. Discussions about the required accuracy of the map for an efficient fusion are discussed by [START_REF] Zheng | Integrated GNSS with different accuracy of track database for safety-critical railway control systems[END_REF].

In [START_REF] Heirich | Probabilistic localization method for trains[END_REF], the track database is not used for map-matching but, instead of a classical PVT, the train position has to be placed on the track network by topological coordinates. The coordinates are a triplet composed of the track ID, the track length and the direction of the train. The objective in this study is the track selectivity.

Let's notice also that, for Virtual Balise2 concepts as in RUNE, 3inSat or ERSAT EAV, a map is mandatory in order to record Virtual Balises positions. The Virtual Balise is one of the topics of the NGTC project where operational scenarios with virtual balise applicable for ERTMS and the link Database have been defined. Moreover, NGTC proposes a preliminary functional architecture for ERTMS virtual balise concept presented figure 7. Safety concept and safety analysis have been started in the project [START_REF] Gurník | Next Generation Train Control (NGTC): More Effective Railways through the Convergence of Main-line and Urban Train Control Systems[END_REF] Figure 7: NGTC preliminary functional architecture for ERTMS virtual balise concept With a different approach, the EATS (ETCS Advanced Testing and Smart Train Positioning System) solution, instead of usual sensors, integrates GNSS with wireless communications technology (WCT) positioning. WCT relies on GSM-R (GSM for railway) and UMTS mobile communication systems [START_REF] Zheng | The hybrid GNSS/WCT multi-coach multi-constellation train positioning and integrity system[END_REF] and improves in particular availability.

SAFETY-FOCUSED STRATEGIES

Safety is ensured by specific strategies. In aeronautics, safety is linked to integrity monitoring. Integrity monitoring ensures the user GNSS solution can be used as a primary navigation system in safety conditions. This monitoring can be realized by three different systems having each their own monitoring methods: RAIM (Receiver Autonomous Integrity Monitoring), SBAS or GBAS. The difference between these methods is that SBAS and GBAS broadcast data usable by the receiver to compute in real time its integrity (with a protection level), although in RAIM, the receiver has to perform it alone. A posteriori, the integrity risk probability ensured using the monitoring method can also be computed.

As GBAS and SBAS have been introduced before, let's describe here the main principles of RAIM. A RAIM algorithm is contained within the receiver. It consists in performing a consistency check on the satellite measurements in order to detect a fault (important bias in a pseudo-range). This check requires the reception of 5 satellites simultaneously. FDE (Fault Detection and Exclusion) is an extension of RAIM and requires 6 satellites minimum. FDE excludes the faulty satellite after its detection and allows the system to continue to ensure integrity thanks to this exclusion. RAIM inputs are the measurement noise standard deviation 𝜎 𝑈𝐸𝑅𝐸 , the measurement geometry, and fixed probabilities of false alarm 𝑝 𝑓𝑎 and missed detection 𝑝 𝑚𝑑 . The output is either a fault detection, either a protection level 𝑃𝐿, (vertical and/or horizontal), that will assure that the true position is contained in a circle with the given 𝑝 𝑓𝑎 and 𝑝 𝑚𝑑 . The reader interested will find more details in [START_REF] Kaplan | Understanding GPS: Principles and Applications Second Edition[END_REF] or directly in the aeronautical specifications (RTCA). RAIM has been applied in RUNE.

In the railway-related literature, safety strategies can be classified into three families of techniques.

The first family relies on redundancy. Redundancy (often with a voter) allows the system to detect incoherent measurements. In this family, GaLoROI hybridizes GNSS with an eddy current sensor and uses architecture redundancy (with independent channels) [START_REF] Manz | GaLoROI: Satellite based localization in railways[END_REF] (figure 8). As in GRAIL2, the 2 channels are associated to a vote (in safe controllers) in order to check consistency between channels [START_REF] Marradi | GNSS for Enhanced Odometry: The GRAIL-2 results[END_REF]. The GRAIL2 architecture is represented in figure 9. Figure 9: SIL2 architecture of the GRAIL2 project [START_REF] Marradi | GNSS for Enhanced Odometry: The GRAIL-2 results[END_REF].

The second family is based on RAIM and/or fault detection and exclusion (FDE) algorithms introduced before. Since the early introduction of GNSS in railway, fault detection algorithms have been proposed. In 1998 [START_REF] Mirabadi | Fault detection and isolation in multisensor train navigation systems[END_REF] proposed a Fault Detection and Isolation in Multisensor Train Navigation Systems for new Automatic Train Control (ATC) and Automatic Train Protection (ATP) systems based on Chi-square test and residual test. Results of the fusion with real data have been presented in [START_REF] Mirabadi | Multisensor integration methods in the development of a fault-tolerant train navigation system[END_REF]. In the LOCOPROL project [START_REF] Nikiforov | Integrity Equations for Safe Train Positioning Using GNSS[END_REF] wrote into equations the RAIM application on the 1D positioning developed in the project with an FDE in order to preserve a high constant integrity level by excluding unbounded additional biases.

More recently, [START_REF] Jiang | A CKF based GNSS/INS train integrated positioning method[END_REF] implemented a fault detection and diagnosis (FDD) process for integrity insurance. Its architecture is represented figure 10. [64] Proposes an Autonomous Integrity Monitoring and Assurance (AIMA) scheme for a multisensory positioning system (accelerometer, gyroscope, odometer, GNSS). The fault detection and exclusion process is composed of three layers: before data fusion, before map-matching and before position report as summarized on figure 11.

Figure 11: Flowchart of AIMA-aided GNSS-based train integrated positioning [START_REF] Liu | Integrity assurance of GNSS-based train integrated positioning system[END_REF] [36] Published a method of positioning errors detection based on a comparison of the GNSS-based altitude determination and the planed altitude contained in a 3D track-map. Based on simulations, he shows that GNSS errors in horizontal plane can be detected by test of mean (T-test) and variance (F-test) applied on vectors in "altitude matrix".

Dealing with GNSS satellites only, [START_REF] Yamamoto | Satellite Based Train Positioning Using Three-dimensional Track Maps[END_REF] performs a series of checks in order to detect potential corrupted signals or positions: weak signals rejection, use of two antennas on a coach to compare pseudo ranges, verification of the pseudo ranges by signal Doppler frequency of the carrier… [START_REF] Marais | Satellite availability in a railway mountainous environment: Can we use satellite positioning for safety applications[END_REF] Develops a vision-based tool capable of detecting NLOS (Non-Line-of-Sight) signals. Indeed a camera placed over the roof of the train provides images of surroundings of the antenna. Early stages of this work were based on classical lenses [START_REF] Marais | Evaluation of GPS availability for train positioning along a railway line[END_REF]. Latest rely on fish-eye lens that provides images of the 360° surroundings of the antenna. Image processing techniques are then applied in order to classify areas in sky and non-sky areas and thus LOS or NLOS satellites as illustrated on figure 12.

Figure 12: Illustrations of the satellite state detection in a fisheye image on the original image and on classified regions [START_REF] Marais | Weighting with the pre-knowledge of GNSS signal state of reception in urban areas[END_REF].

As evoked in the perspectives of [START_REF] Marais | Galileo availability for urban buses[END_REF] in a guided-bus application, the fact that a train is guided on tracks with a prior knowledge of its trip can let us imagine that an embedded database could allow registering some pre-recorded GNSS-related data. In this study, the idea was to record GNSS satellite availability. More recently it has been show that a pre-knowledge of satellite-states of reception can increase accuracy of the GNSS-only solution [START_REF] Marais | Weighting with the pre-knowledge of GNSS signal state of reception in urban areas[END_REF]. In [START_REF] Liu | Estimating the Integrity of BDS-based Positioning for Rail Vehicles in Signaling Applications[END_REF], an off-line RAIM availability prediction is proposed to compensate RAIM unavailability along the line.

The third family is based on EGNOS. As an SBAS, EGNOS allows the receiver to compute a HPL based on error boundaries sent by the geostationary satellites. The use of EGNOS for safety services induces the use of its integrity monitoring service. This has been tested in RUNE, GRAIL and will be one of the integrity monitoring elements of RHINOS. This is the focus of section 4.

SYNTHESIS

This chapter reviewed the main previous initiatives aiming at introducing EGNSS in railway signalling systems. The table summarizes their objectives and the realization for the positioning unit. All of these projects worked in an ERTMS/ETCS context. In general, the added value of EGNSS in a train localization solution was shown to be of different natures:

• Ability to be integrated in an existing control/command system or in one to be conceived to substitute the current on-board odometry or, to replace trackside balises with virtual ones, • Being sufficiently performing to reach requirement defined for low-traffic lines, • To be combined with innovative technologies or low-cost technologies.

As no EGNSS solution on its own is able to provide sufficient accuracy and integrity especially in constrained environment settings (urban, woodland, etc. ...), the proposed solutions rely on GNSS first but always complemented with a variety of sensors (from Eddy Current to classical odometer) in order to offer both accuracy and a certain level of confidence in the position for safety purpose. The different architectures have been described in section 3.3.

They have shown that safety is a major issue since classical solution developed before in aeronautics do not always fit to railway constraints as RAIM that requires high satellite availability.

EGNOS, the European SBAS has been developed by Europe in order to ensure integrity of positioning. The next chapter will focus on its application in the railway context.

DISCUSSION ON THE SUITABILITY OF INTEGRITY CONCEPTS IN RAIL ENVIRONMENTS

As introduced in section 2, most of integrity monitoring solutions relies either on GBAS or SBAS. In this section, previous experiences on integrity monitoring with both systems are analysed.

IDENTIFIED EXPERIENCES

GBAS-based integrity concepts

POSITIVE TRAIN CONTROL (PTC) AND NATIONWIDE DGPS (NDGPS) IN THE US

If, at the beginning of its study, NDGPS was candidate as a support to PTC in the United States, it seems that this use is no more on the agenda since in 2013; the Federal Railroad Administration (FRA) eliminated an NDGPS requirement from its PTC program.

Augmentation shall be based on SBAS (the American WAAS) and a network of continuously operating reference stations (CORS) from the National Geodetic Survey3 .

3INSAT

The 3inSat project 4 developed an architecture based on the complementarity of both ground and satellite-based augmentation systems in order to develop the railway requirements related to a satellite-based train positioning system and meet the expected demand from both the international and European Community market evolutions. Five target areas have been identified to derive specific user requirements as guidelines to the definition of a standard configurable platform tailored for each of the five main areas. Project Objectives were:

• On the positioning domain: design and develop a satellite-based Location Determination System (LDS) prototype, integrated with ERTMS, that guarantees the ERTMS SIL4 Train Position function.

• On the telecommunication domain: design and develop an integrated radio telecommunication solution based on the combination of SatCom, Public Packet Switched Networks and TETRA to be used as the alternative solution to GSM-R.

• To validate both LDS and Telecom solutions by a Field Demonstrator tailored to a freight scenario derived by the Australian scenario in a Railway Trial Site developed in Sardinia on the Cagliari San Gavino 50km line.

3InSat developed an ERTMS Enhancement for introducing GNSS and SatCom Technologies to meet the following high level requirements:

• Backward compatibility

• SIL 4

• Cost Effective solution

• Limiting the impacts on ERTMS, hazard analysis, operations, and certification process.

Since meeting these requirements with the sole GNSS technology is very hard as demonstrated by previous projects, 3InSat investigated how to use GNSS technology with well-defined ERTMS mission profile and ERTMS operation concepts with reference to physical balises requirements: • Multi-constellation GNSS capability, exploiting existing constellations,

THR
• Deployment of a dedicated Track Area Augmentation and Integrity Monitoring Network with very high availability (GPS only solution selected for the Australian scenario) similar to GBAS architectures but much less expensive,

• Independent on-board capability to further mitigate GNSS errors and autonomously assess the GNSS location integrity.

In essence the Track Area Augmentation and Integrity Monitoring Network plays a role similar to the EGNOS Range and Integrity Monitoring subsystem. In fact, processing of satellite signals received at known locations allows to estimate the error sources affecting train positioning and to detect eventual GNSS faults. The major difference with respect to EGNOS consists in a denser spatial deployment of the RIM RSs, compensating for milder requirements (and lower cost) on the GNSS receiver clocks and in the use of the wireless network employed for train signalling for broadcasting augmentation data to the on-board LDS.

The LDS Safety Server monitors for each epoch the measured pseudo ranges and compares them with the nominal values corresponding to the known antennas locations.

To enhance the systemic satellite fault detection capabilities, as well as to detect eventual RIM RS faults, their outputs are jointly processed by a Track Area LDS Safety (TALS) server. Such architecture allows improving the correction function of classical differential GNSSs and mitigating the risk of failure relevant to the GNSS reference stations.

Correction factors and more in general augmentation data are supplied to the mobile LDS OBUs in the service region by means of a safety-critical protocol layered on the same radio communications network used for train control. This allows LDS to achieve a high degree of accuracy and integrity without depending on commercial off-the-shelf systems of unknown integrity.

RIM RSs are deployed in such a way that they share sources of systemic errors with the GNSS receivers on board of the locomotives operating in the regions, such as incremental delays caused by atmospheric conditions and ephemerides and clock errors of visible satellites.

SBAS-based integrity concepts

For the projects before 2005, due to the fact that a lot of satellites were not monitored at that moment by Egnos, it was not taken into account in the computations to avoid a problem of satellites availability. It is the case of GADEROS or LOCOPROL [61]. EGNOS has been declared fully operational in 2005 (and certified in 2010).

 Moreover, GADEROS faced availability difficulties due to instability of EGNOS at the period of the project and visibility difficulties along the track (bad orientation of the track compared to the GEO satellite positions)

 GRAIL used it for integrity provision on the basis of the APV 1 classification of aviation.

 GRAIL 2 was based on EGNOS by "adjusting" the Protection Level of aviation to a onedimensional scenario of the rail line. However in the GRAIL-2 the GNSS was considered as an additional sensor of the Odometer to replace the Doppler radar.

 RUNE was conceived to take advantage of the EGNOS integrity and wide area differential correction service and extend its availability through a hybrid navigation system based on a Navigation Kalman Filter that integrates data from other main on-board sensors.

 As explained in the previous section, the GBAS-like mode is the primary source of integrity monitoring developed in 3inSat for areas where SBAS systems are not available. Instead, when SBAS are available, 3InSat architecture can use it as a sort of back-up solution when the GBAS is not available either.

 ERSAT EAV objective is to verify the suitability of EGNSS (including EGNOS and Galileo early services) with a generic augmentation network based on EGNOS and local Augmentation networks deployed to support also applications in other SoL domains.

 SATLOC uses the integrity output computed by the receiver as implemented in the receiver (as tuned for aviation applications). Moreover only positions qualified by EGNOS have been used, thus as a satellite fault detection system ("use" flag).

We can find HPL values along tracks in some project deliverables or papers. RUNE showed a mean HPL value is in the order of 10m along Torino-Chivasso Route [START_REF] Marradi | RUNE (Railway User Navigation Equipment): Architecture & Tests[END_REF].

None of the projects, based on reusing the EGNOS certified receivers, compared the HPL as provided by the receiver for aviation application to the true HPE to observe if error estimation was correct.

Combination of SBAS and GBAS

To reach Integrity Monitoring target and ensure availability, 3inSat propose an LDS (Location Determination System) architecture, based on (i) a multi-constellation capability to increase both the accuracy and the number of satellites in visibility , (ii) the deployment of a Track Area Augmentation and Integrity Monitoring Network (AIMN) with very high availability, and (iii) an independent on-board capability to further mitigate GNSS errors and autonomously assess the GNSS location integrity when augmentation data are unavailable [START_REF] Neri | An analytical evaluation for hazardous failure rate in a satellite-based train positioning system with reference to the ERTMS train control systems[END_REF]. Its architecture is presented in figure 13.

The network includes Ranging & Integrity Monitoring Reference Stations (RIM RS), for the purpose of integrity monitoring and accuracy improvement of satellite-based position. Each reference station provides correction services and detects systematic satellite faults [START_REF] Rispoli | Innovative train control systems based on ERTMS and satellite-public TLC networks[END_REF].

The chosen modes are organized as follows:

-When a GBAS-like system with RIMs distributed along a track is deployed, the receiver will operates with it whenever the augmentation data provided by the TALS server are available.

-The SBAS system will be considered as a primary source of augmentation data when a GBAS system with RIMs distributed along a track is not deployed or unavailable.

-Due to the greater latency introduced by direct connections to the operational centres providing SBAS augmentation data over terrestrial links and redistribution over the Train Signalling Network, w.r.t. the use of SBAS SIS data, this mode will be activated whenever the two first modes are unavailable.

-Stand-alone GNSS is selected whenever the other modes are unavailable [START_REF] Salvatori | Augmentation and Integrity Monitoring Network and EGNOS performance comparison for train positioning[END_REF] shows, during a test campaign along an important highway in the city of Rome, that using EGNOS system, the position errors are, on average, lower than using AIMN system (figure 14), but conclude also that in presence of tunnels and overpasses, the proposed augmentation network has lower position errors due to a better (local) compensation of local effects, i.e. ionosphere errors and multipath.

RHINOS

This work will be consolidated in the RHINOS H2020 European project that aims to develop a Railway High Integrity Navigation Overlay System to be used by the rail community as a combination of GNSS, SBAS and ARAIM assets made available for the avionics applications world-wide [START_REF] Galoroi | Report on safety case including verification and validation report[END_REF].

The main objectives of the project are the following:

Objective 1: To define architecture of a train Location Detection System (LDS) and the supporting infrastructure based on the joint use of GPS and GALILEO. This will ensure:

• A standard interface for providing Safety of Life services for railways,

• Compliance with European railway requirements and regulations;

• Exploitation of existing GNSS infrastructure and on-board processing developed for aviation.

Objective 2: To assess the performance of the defined architecture by means of:

• A proof-of-concept integrating, in a virtual testbed, rich sets of data collected in a real railway environment and laboratories such as those at Stanford and Nottingham, • Appropriate analytical methods for the verification and safety evidence of the defined architecture according to relevant railway safety standards.

Objective 3: To contribute to the missing standard of integration of GNSS-based LDS, into ERTMS, by publishing a comprehensive guide on how to employ, in a cost-effective manner, GNSS, SBAS and other local infrastructures in safety related rail applications worldwide, and by defining a strategic roadmap for the adoption of an international standard based on the same guide.

The RHINOS project is at preliminary stage so no results are available.

IDENTIFIED OR KNOWN EGNOS LIMITATIONS [48]

Due to its system design and the geostationary of its satellites, EGNOS have some limitations, in particular in land transport applications. Main identified causes are referenced in EGNOS Open Service (OS) -Service Definition Document. Their table is reproduced here below.

Root Cause Most Likely Symptoms

Broadcasting Delays

One of the functions of EGNOS is to elaborate a model of the ionosphere and to broadcast this model to users so that they can correct the related errors. When using the SBAS standard, the reception of all the parameters that are necessary to build such a model may take up to 5 minutes to be received, depending on the receiver.

Therefore, the full positioning accuracy may not be reached as soon as the receiver is turned on.

EGNOS SoL Service Not Immediately Available

The receiver does not immediately use EGNOS to compute a navigation solution and therefore the position accuracy improvement is not available until a few minutes after the receiver is turned on.

GPS or EGNOS Signal Attenuation

The The position solution may demonstrate instability with higher error dispersion than usual. It may also be affected by sudden jumps when satellites are lost due to excessive attenuation. The performance of the receiver in such a difficult environment may be improved much degraded performance. with a high quality receiver and antenna design.

EGNOS Signal Blockage

The EGNOS signals are broadcast by two geostationary satellites. This ensures some level of redundancy in case a satellite link is lost due to shadowing by a close obstacle (e.g. local orography or buildings). In addition, when moving North to high latitudes, the geostationary satellites are seen lower on the user's horizon and therefore are more susceptible to masking.

At any latitude, it may happen that, in an urban environment, the EGNOS signals are not visible for some time.

Degraded Position Accuracy After Some Time

The effect of losing the EGNOS signal (on both GEOs) on the receiver will be equivalent to reverting to a GPS-only receiver. The navigation solution will still be available but will demonstrate a degraded accuracy since no clock ephemeris or ionospheric corrections will be available to the user receivers.

However, such degradation will not be instantaneous since the SBAS standard has been designed to cope with temporary signal blockages. The exact time the receiver can continue to provide good accuracy in case of the loss of signal depends on the receiver design.

Local Multipath

In urban environments, the GPS and EGNOS signals will be prone to reflections on nearby objects (building, vehicles…). This may cause significant errors which cannot be corrected by the EGNOS system due to their local nature.

Degraded Position Accuracy

The navigation solution will tend to meander around the true position and may demonstrate deviations of a few tens of metres. This effect will have a greater impact on static users or in those users moving at slow speed. High-quality receiver and antenna design is able to attenuate the effect of multipath in some specific conditions.

Local Interference

GPS and EGNOS use a frequency band that is protected by the International Telecommunication Union (ITU). However, it is possible that in some specific locations, spurious transmissions from services operating in adjacent or more remote frequency bands could cause harmful interference to the satellite navigation systems.

In most cases, national agencies are in charge of detecting and enforcing the lawful use of spectrum within their national boundaries.

Degraded position accuracy or complete loss of service.

Depending on the level of interference, the effect on the user receiver may be a degradation of the position accuracy (unusual noise level affecting the positioning) or a total loss of the navigation service in case the interfering signals preclude the tracking of navigation signals.

The detection, mitigation and control of potential spurious transmissions from services operating in frequency bands that could cause harmful interference and effects to the satellite navigation systems (degrading the nominal performances) is under the responsibility of local authorities.

Ionospheric Scintillation

Under some circumstances due to solar activity and in some specific regions in the world (especially for boreal and subtropical latitudes), ionospheric disturbances (called scintillation) will affect the GPS and EGNOS navigation signals and may cause the complete loss of these signals for a short period of time.

Degraded position accuracy

The position solution may be affected by sudden jumps when satellites are lost due to scintillation.

If the number of tracked satellites drops seriously, a 3-dimensional position may not be available. Eventually, the navigation service may be completely lost in case less than 3 satellites are still tracked by the user receiver.

In cases when only the EGNOS signal is lost, the impact will be similar to the one described for "EGNOS signal blockage" above

Degraded GPS Core Constellation

The GPS constellation is under continuous replenishment and evolution. On rare occasions, it may happen that the basic GPS constellation becomes temporarily depleted and that it does not meet the GPS SPS PS commitment.

Degraded EGNOS SoL Service performance

In such a case, the EGNOS OS performance can be degraded. The performance experienced by the receiver may be worse than the minimum performance indicated in section 6.2.1.

GEO Satellite Orbit inclination

The characteristic orbit of the GEO satellites may be degraded (e.g. high inclination).

Degraded availability performance

In this situation, some far North regions of the service area may be covered with only one GEO during some periods of the day and may experience some degradations in availability performance.

EGNOS LIMITATIONS IN THE RAIL ENVIRONMENT

In order to illustrate some of the events described above, the following paragraphs illustrate the experience mentioned by the past projects or papers.

EGNOS suitability to rail specifications

As already mentioned, EGNOS is capable of providing ranging and correction data for accuracy enhancement but also integrity data, i.e. data to estimate the residual errors that can be expected by the users after having applied the corrections. These last data are the User Differential Range Error (UDRE) and the Grid Ionospheric Vertical Error (GIVE), commonly called 'sigmas' [START_REF]EGNOS Safety of Life (SoL) Service Definition Document[END_REF].

These two parameters can be used to determine an aggregate error, i.e. a bounded estimation of the horizontal and vertical position error that serves to compute the Protection Level (PL).

EGNOS is obviously used in most of the projects, as the service is open and free. However, the EGNOS Precision Approach (PA) and Non-precision Approach (NPA) navigation modes for civil aviation were designed according to specific aeronautical requirements (Filip 2010).

As described in [START_REF] Filip | The experimental evaluation of the EGNOS safety-of-life services for railway signalling[END_REF], PA mode is very demanding in terms of SBAS data availability for example: PAs require that all satellites use SBAS corrections. NPA accepts that ionospheric corrections could be unavailable sometimes. NPA can also be used with longer degradation for fast corrections. This can cause larger error in HPE and HPL computation but one can propose to detect and manage it with diagnostics and multi sensor-based solutions. Thus [START_REF] Filip | The experimental evaluation of the EGNOS safety-of-life services for railway signalling[END_REF] notices that "this navigation mode seems more acceptable for railway safety-related applications than the PA mode". However, the conclusions says "The determination of the EGNOS dependability attributes in terms of failure modes, failure rates (on 1 hour basis), reliability and availability is needed for design, validation and certification of the land GNSS based safety-related systems"..

EGNOS availability

Due to the geostationary of the EGNOS satellites, its availability is not optimal along railway lines.

The tests performed in the LOCOPROL project, considering over 3000km of rail route in Italy, showed an overall measured availability of 66% for accuracy enhancement [START_REF] Bortolotto | EGNOS trials on Italian high-speed tilting trains[END_REF] and illustrated figure 15. EGNOS availability on other tracks has also been simulated in this project along the CFTA railway mountainous line between Nice and Digne in the south of France [START_REF] Marais | Satellite availability in a railway mountainous environment: Can we use satellite positioning for safety applications[END_REF]. Because of the very quick changes of the environment around the antenna, EGNOS state of reception can vary very quickly also. Simulation results showed that 60% of the reception durations were shorter than 10 seconds and 40% shorter than 5 seconds that do not allow the receiver to benefit from integrity data. But some long areas of reception are observed. The longest one has a duration of 275 seconds, which allows the receiver to benefit of some corrections for accuracy gain.

Figure 15: EGNOS availability along train routes in Italy, measured in the Locoprol project [START_REF] Bortolotto | EGNOS trials on Italian high-speed tilting trains[END_REF].

In RUNE, the EGNOS solutions along the line between Torino and Chivasso (and return) showed availability of around 45% of time (figure 16).

Figure 16: Distribution of the positioning mode measured along an Italian line in the RUNE project: no solution in blue, GNSS alone in green and GNSS/EGNOS in red [START_REF] Albanese | The RUNE project: navigation performance of GNSS-based railway user navigation equipment[END_REF].

Another example can be seen in [START_REF] Ali | Measured performance of the application of EGNOS in the road traffic sector[END_REF]. Even if the application is road-related in this article, reception conditions can be very close from railway ones. The paper shows that EGNOS was received 84% of the time along the highway against around 10% in the urban context.

An alternative of the use of the EGNOS signal is the broadcast of the EGNOS information via terrestrial transmitters or via internet as proposed by the EDAS service. The availability of this alternative link is then to be verified.

Moreover, let's mention that the availability of the SBAS may be required only in concrete locations (e.g. at place and surrounding where the virtual balise is placed) and not along the entire railway line. The global availability of the SBAS can then be reduced along the line and the requirements be concentrated locally.

Classical pseudo-range error models versus real models

Today, only the aviation domain has defined specific service requirements for EGNOS use, as well as certification and individual authorization procedures. EGNOS 'sigmas' estimate the residual error boundaries after common mode error corrections but without local error estimation.

With EGNOS, 𝝈 𝑼𝑫𝑹𝑬 & 𝝈 𝑮𝑰𝑽𝑬 are the bases for HPL/VPL computation, under the assumption that pseudo-range errors follow normal centered laws and are independent. As illustrated in figure 17 with the observation of the pseudo-range error distribution of one satellite in time, one can notice that this assumption is not always verified, in particular in case of NLOS reception [START_REF] Viandier | Modélisation et Utilisation des erreurs de pseudo-distances GNSS en environnement transport pour l'amélioration des performances de localisation[END_REF].

When based on ground-based infrastructure, residuals are estimated by the Ranging Integrity Monitoring Stations (RIMS), grounds stations that do not take either into account local errors, which cannot be ignored in land transport applications.

PL computation on the basis of LOS models

The receiver can statistically estimate the variance 𝜎 𝑖 2 on the residual pseudo-range errors (the initial pseudo-range errors being corrected with EGNOS data) function of 𝜎 𝑈𝐷𝑅𝐸 2 and 𝜎 𝐺𝐼𝑉𝐸 with X the horizontal or vertical component N number of pseudo-ranges used in the position estimation 2 i , X S is a parameter quantifying the geometrical impact of the satellites on the position, calculated on the basis of the same method than the dilution of precision GDOP.

Finally, the error distribution of the position follows a normal distribution 𝑁(0, 𝜎 𝑋𝑝𝑜𝑠𝑖𝑡𝑖𝑜𝑛 ) as it depends on the pseudo-range error combination that also follows a normal distribution. By inverting the cumulative density function of this distribution at the specified risk integrity probability LOS NLOS (i.e. 𝑐𝑑𝑓 -1 (𝑁) at the value of a specified missed probability 𝑃 𝑀𝐷 ), PL can be obtained. For example, 𝐻𝑃𝐿 = 6. 𝜎 𝐻𝑝𝑜𝑠𝑖𝑡𝑖𝑜𝑛 for an integrity risk of 0.5.10 -9 for the horizontal component, and 𝑉𝑃𝐿 = 5.33. 𝜎 𝑉𝑝𝑜𝑠𝑖𝑡𝑖𝑜𝑛 for an integrity risk of 0.5.10 -7 on the vertical component.

VALUES OF PL OBTAINED IN THE PROJECTS

Based on classical SBAS-based HPL computation, the RUNE project experimented HPL in the order of 10m along a railway line as illustrated in figure 18.

Figure 18: PL obtained in the RUNE project along a line considering that valid positions require that PDOP<6 [START_REF] Marradi | RUNE (Railway User Navigation Equipment): Architecture & Tests[END_REF].

In road domain, a HPL correctly bounding the errors (HPL<8m) has been measured by [START_REF] Ali | Measured performance of the application of EGNOS in the road traffic sector[END_REF] along highways but in the urban context, the authors illustrate that the receiver worked in safe operation mode only for 15% of the time.

In the 3inSat project, based on EGNOS and the AIMN presented above, PL also vary between 5 and 20m approximately, function of the AIMN availability as presented in figure 19.

Figure 19: Roma-Pisa railway line. Protection level versus travelled distance with GPS constellation alone. PL is computed without augmentation system in blue (RAIM) and with the support of trackside augmentation systems for the other curves [START_REF] Neri | An analytical evaluation for hazardous failure rate in a satellite-based train positioning system with reference to the ERTMS train control systems[END_REF].

SUITABILITY OF THESE PL COMPARED TO TRUE POSITIONING ERROR?

In this section, we have shown that the past projects computed PL on the basis of EGNOS or GBAS information, i.e. on the basis of LOS error models. As expressed, the role of the PL is to bind the positioning error (PE) with a given probability. The PL shall define the smallest position error that must be detected with the required probabilities of false alert and missed detection.

The comparison of PL, PE and Alert Limit can be drawn with a Stanford diagram as represented in figure 20. For a safe use of the position, the system shall provide PE < PL < AL. As soon as PL is lower than PE, the system is failing. So can we see the importance of a correct estimation of the PL. In the past projects, except in the 3inSat project and as far as we have seen, computed PL have not been compared to real PE in order to demonstrate the suitability of its computation in a railway environment. In 3inSat, the Augmented PVT performance has been assessed with respect to a Ground Truth developed by using an RTK Receiver installed on board and the RTK Networks available in the area of the demonstration [START_REF]Final Report of the ESA Artes IAP 3inSat project[END_REF] and has shown that the Phase 2 LDS System:

• does not provide a solution less than 2% of the epochs:

• is potentially intrusive (Protection Level > Application Threshold) less than 20% of the epochs

• is in MI/HMI less than 2% of the epochs.

EGNOS TIME TO ALERT

Finally, let's mention the fact, that the EGNOS TTA is 6s, and can be sometimes problematic in the railway domain because some railway systems may require faster safe reaction than 6s.

CONCLUSIONS

This deliverable aims at drawing the state of the art of the EGNSS use in the railway signalling applications and in particular of the use of EGNOS.

After a presentation of the basics of GNSS augmentation systems, chapter 3 has drawn the panorama of the past projects. Each mentioned project has brought new elements for future integration of EGNSS in rail control/command signalling, especially in ETCS level 3. Different architectures have been proposed in order to fulfil the positioning requirements. GNSS drawbacks are compensated by the use of additional sensors that differ depending on the project: inertial sensors, telecommunication network… that help reaching the required accuracy and availability. EGNOS use in railway environments faces difficulties such as visibility or technical constraints. Thus some of the projects only used the GPS data, but when received, EGNOS shows its interest on accuracy and integrity.

Safety requires supplementary systems or algorithms. Chapter 3 presented embedded monitoring solutions and chapter 4 focused on the use of EGNOS for integrity monitoring. Past experiences have been described and results have been presented. Several issues for EGNOS have been identified:

-EGNOS visibility in constrained environment is not guaranteed. This is one of the reasons of ground-based augmentation solutions developed as a complementary system in Sardinia.

-EGNOS integrity monitoring concept has been developed for aeronautics and relies on the definition of phases of flight or modes. Such phases do not exist in railways.

-EGNOS integrity monitoring concept relies on the comparison of Protection Levels with Alert Limits. Alert Limits bounds tolerable errors around the estimated position that are not defined in railways specifications.

-Propagation conditions in a railway environment differ from the open-sky environment encountered by a plane. Thus EGNOS error model (computed for open sky environment) have to be compared to real error model in order to evaluate their suitability to the application context. Moreover, it will be interesting to evaluate the consistency of PL values regarding the true errors in order to quantify the capacity of EGNOS to properly bound the rail positioning errors.

This deliverable is the first task of the STARS WP5. The open issues presented in this document deserve to be discussed in the following tasks/activities of the project.

Rhinos

In progress H2020

  OF CONTENTS CHANGE RECORDS ...................................................................................................................... TABLE OF CONTENTS .................................................................................................................. LIST OF FIGURES .......................................................................................................................... 1 INTRODUCTION ...................................................................................................................... 1.1 Executive summary ..........................................................................................................

Figure 1 : 11 Figure 2 : 12 Figure 3 : 14 Figure 4 : 15 Figure 5 :

 1112123144155 Figure 1: Possible situations obtained with GNSS integrity monitoring .......................................... 11 Figure 2: LAAS architecture (Source FAA.org) .............................................................................. 12 Figure 3: EGNOS v2 architecture (Source [48]) ............................................................................. 14 Figure 4: Existing and planned SBAS (Source [58]) ...................................................................... 15 Figure 5: ETCS Levels [4] ............................................................................................................. 17

Figure 6 : 33 Figure 7 : 36 Figure 8 : 37 Figure 9 : 37 Figure 10 : 38 Figure 11 : 38 Figure 12 : 39 Figure 13 : 45 Figure 14 : 45 Figure 15 : 49 Figure 16 : 50 Figure 17 : 51 Figure 18 : 52 Figure 19 : 53 Figure 20 :

 633736837937103811381239134514451549165017511852195320 Figure 6: Estimated positioning accuracy with and without EGNOS along an Italian High speed railway line [45]. ..................................................................................................................... 33 Figure 7: NGTC preliminary functional architecture for ERTMS virtual balise concept ................... 36 Figure 8: GaLoROI localization unit vehicle equipment [17]. .......................................................... 37 Figure 9: SIL2 architecture of the GRAIL2 project [31]................................................................... 37Figure 10: High integrity architecture of GNSS/INS positioning with Fault Detection and Diagnosis based on Principal Component Analysis [35]. CKF is a cubature Kalman filter, variation of the Kalman filter. .......................................................................................................................... 38 Figure 11: Flowchart of AIMA-aided GNSS-based train integrated positioning [64] ....................... 38 Figure 12: Illustrations of the satellite state detection in a fisheye image on the original image and on classified regions [40]. ....................................................................................................... 39 Figure 13: Overview of GNSS LDS System [43]. ........................................................................... 45 Figure 14: Histogram of position estimation error. Left: Only EGNOS mode, Right: Only TALS Mode [43]. .............................................................................................................................. 45 Figure 15: EGNOS availability along train routes in Italy, measured in the Locoprol project [45]. .. 49 Figure 16: Distribution of the positioning mode measured along an Italian line in the RUNE project: no solution in blue, GNSS alone in green and GNSS/EGNOS in red [62]. .............................. 50 Figure 17: Pseudo-range error distribution versus time for LOS and NLOS received satellites [44]. ............................................................................................................................................... 51 Figure 18: PL obtained in the RUNE project along a line considering that valid positions require that PDOP<6 [18]. .................................................................................................................. 52 Figure 19: Roma-Pisa railway line. Protection level versus travelled distance with GPS constellation alone. PL is computed without augmentation system in blue (RAIM) and with the support of trackside augmentation systems for the other curves [10]...................................... 53 Figure 20: Stanford diagram .......................................................................................................... 54

Figure 1 :

 1 Figure 1: Possible situations obtained with GNSS integrity monitoring

Figure 2 :

 2 Figure 2: LAAS architecture (Source FAA.org) GBAS demonstrated accuracy is less than one meter in both the horizontal and vertical axis (1 sigma confidence level (Source faa.gov)).

Figure 3 :

 3 Figure 3: EGNOS v2 architecture (Source [48])

Figure 4 :

 4 Figure 4: Existing and planned SBAS (Source [58]) At the date of the deliverable, the EGNOS GEO satellites that are transmitting the operational Signal-In-Space (SIS) to be used by EGNOS users are [58]: -INMARSAT 3F2 AOR-E (PRN 120) and SES-5 (PRN 136) are part of the EGNOS operational platform -ASTRA-5B (PRN 123) and INMARSAT 4F2 EMEA (PRN 126) are part of the EGNOS TEST Platform.

Figure 5 :

 5 Figure 5: ETCS Levels [4]

-

  Integrity requirements: ¤ Alert limit: 2.5 x accuracy ¤ Time-to-Alarm: 1sec. (maximum 6 sec.) ¤ Alarm limit: 10 σ (at 95% confidence) -Accuracy error obtained: ¤ GPS only (X error: 2.23m, Y error: 2.68m) ¤ GPS + EGNOS: errors at 4.11m ¤ GPS + hybridisation solutions (odometer + gyrometer) with and without noise of the train odometer. With noise: location accuracy errors are increased due to speed errors (20-30m), without noise: errors are at 3-4m -Some unavailability of GPS L1 observed (availability: 96%) , rapid recovery of GNSS fix after bridge (only 2 or 3 seconds) -Unavailability observed of EGNOS -Velocity requirements: ¤ unknown coordinate values of several LRK precision surveys of the test line ¤ The EGNOS IOR satellite was sometimes tracked, but there was very modest visibility. The Ionospheric corrections seemed more difficult to track consistently. Only for the 3 GPS satellites being surveyed from West Europe, corrections were computed but they were not sufficient for a complete evaluation of benefits of EGNOS. Accuracy requirements: ¤ discrimination between parallel tracks and track change at switches ¤ compatible to ETCS specifications (accuracy along-track < 5 m + 5% of distance travelled, accuracy cross-track < 1 m) -Integrity requirements: ¤ alarm limit < 20 m (terminals), < 50 m (busy lines), < 125 m (rural lines) ¤ time-to-alert < 6 sec (target < 1 sec in critical areas), integrity risk < 3 x 10 -3

  shadowing. According to the results of the INTEGRAIL prototype system test campaigns, the accuracy of GNSS positioning with EGNOS will be satisfactory for train control applications at low traffic density lines : ¤ Static tests proved that the quality of the ionospheric data provided through EGNOS is comparable to direct measurements but the scattering was slightly higher. The overall static performance gave residual horizontal position accuracies in the 2-3 m range (3 to 5 m in height) ¤ Dynamic test residuals were in all cases below 1 m in horizontal position and 0.5 m/s in velocity. In height, residuals were below 2 m (position) and 0.5 m/s (velocity) the recorded reference station data. Each INTEGRAIL mobile unit was shown to be able to provide reliable, high-rate, integrity-checked train position, velocity, time (PVT) and heading data on a continuous basis. ¤ Static tests with different set-ups for the GNSS receiver (with/without EGNOS, various masking, shadowing) ¤ Dynamic test residuals measured.

  Constant vel 20 m/s, curve radius 1-5 Km Constant radius 2.5 Km, vel = 10 -70 m/s Constant vel 20 m/s, constant radius 1 Km, rotation angle 45°-360° Results: Along-track position err = 1m for each rad/sec of angular vel Error immediately recovered at end of curve Absolute ECEF pos err < 1.5m LIVE TESTS ON TO-CHIVASSO Route: Accuracy: Comparison with physical balise: Balise-Rune err < 1.5m (2sigma) along-track Some sensors time stamp errors induced larger along track errors Absolute position error with EGNOS availability: <10m (2sigma) Availability during live tests: GPS no solution 20% time GPS-only solution 35% time EGNOS solution 45% time Integrity calculation during live tests: PDOP <6, HPL < 15m (peaks up to 27m)

-

  at least once every second -Integrity: the receiver shall provide a protected position error of 50m in every operating condition GRAIL GPSAvailability requirement: the specified accuracies shall be met for 95% of the time, in any place within the service volume, when operating in the Nominal SIS Constellation state -Continuity requirement: the probability of service discontinuity predicted over the next critical operation period (15 sec TBC 1

--

  Accuracy requirement of the system: 1 m in standstill and it shall be dynamical in longitudinal direction according to the driven train speed (it does not exceed 25 m with the maximum velocity of 160 -Tests ¤ Lab tests for the components ¤ Test drive to collect data and check the operability of all components. Safety km/h) -Availability requirement : the localisation system output must be available 99.98% of all cases and will identify the states when the system is not operational -Safety requirement: ¤ if 3 or less satellites are detected, a safety relevant reaction shall occur within 1 second in accordance of localisation accuracy, driven velocity, track topology (driving through switches) and danger points (clearance, level crossings, tunnels). ¤ The digital map functionality and the odometry solution are relevant to the safety behaviour of the global system in case of standstill and when bringing the train back to operation, e.g. after a night standing in the depot. ¤ The tolerable hazard rate for the localisation system is set between 10 -7 and 10 -8 (dangerous hazard per hour) in accordance to the SIL 3 objective.Track-selectivity was obtained during these tests in most of the cases after 20-30 meters behind a switch (except once, when the algorithm was undecided between neighbouring tracks) ¤ Tests of the new localization platform in real environment on a track in Czech Republic (line Opava východ to Hradec n.Moravicí) performed and includes:

  Accuracy requirements: ¤ « along the track » ~5-15m [60], worst=10m (D1.1 Part 3) ¤ No GNSS-based track discrimination

  Grey colored elements (Train control center and transfer of digital trackmap) are not part of the actual project but could be realized possibly in a subsequent phase of the project by implementation within an ETCS concept.

Figure 8 :

 8 Figure 8: GaLoROI localization unit vehicle equipment [17].

Figure 10 :

 10 Figure 10: High integrity architecture of GNSS/INS positioning with Fault Detection and Diagnosis based on Principal Component Analysis [35]. CKF is a cubature Kalman filter, variation of the Kalman filter.

D5. 1

 1 State of the art of EGNSS system for the rail application Page 40 of 61

for failure of balise group detection (at least 2 balises) 1 .

 1 0E-7 dangerous failures / hour (on-board) 1.0E-9 dangerous failures / hour (trackside) THR for cross-talk of balise group 1.0E-9 dangerous failures / hour Balise detection accuracy ±1m Virtual balise concept has been exploited: a) to provide data for localisation of the train, b) to reset the train confidence interval and c) to provide information under Application Conditions that reduces Integrity and Accuracy requirements on GNSS. The generic GNSS architecture is based on:

Figure 13 :

 13 Figure 13: Overview of GNSS LDS System [43].

Figure 14 :

 14 Figure 14: Histogram of position estimation error. Left: Only EGNOS mode, Right: Only TALS Mode [43].

  receiver power level of GPS and EGNOS signals is extremely low. Using satellite navigation under heavy foliage or in an indoor environment will weaken further the signals up to a point where the receiver will either lose lock of such signals or have a Degraded Position Accuracy

  Indeed, HPL computed by EGNOS makes the assumption that the local errors are bounded by the values defined in MOPS. These values have been established for airplane and are not at all representative of local environment of railway users. Such formulas that bound local error of railway applications indeed need to be established. This work will be performed in the STARS H2020 European project (2016-2018).

Figure 17 :

 17 Figure 17: Pseudo-range error distribution versus time for LOS and NLOS received satellites [44].

2

 2

2 and 𝜎 𝑉𝑝𝑜𝑠𝑖𝑡𝑖𝑜𝑛 2 )

 22 . The variance related to the position errors according to the horizontal and vertical components (𝜎 𝐻𝑝𝑜𝑠𝑖𝑡𝑖𝑜𝑛 is deduced from 𝜎 𝑖 2 as indicated in equation 1. The terms of the equation are obtained from a least square residual algorithm in which it is admitted that the position error is a linear combination of the pseudo-range errors.

D5. 1

 1 State of the art of EGNSS system for the rail application Page 54 of 61

Figure 20 :

 20 Figure 20: Stanford diagram

D5. 1

 1 State of the art of EGNSS system for the rail application Page 56

TABLE

Table

  III recall the main projects aiming at introducing GNSS in rail (list non exhaustive however).

	Project name	Start	End	Funding program
	APOLO	1998	2001
	GADEROS	2001	2004	5 th FP
	INTEGRAIL	2001	2004
	LOCOPROL/LOCOLOC 2001	2004	5 th FP/ESA
	ECORAIL	2001	2005	ESA
	RUNE	2001	2006
	GIRASOLE	2005	2007	6 th FP/GJU
	GRAIL	2005	2007	6 th FP/GJU
	GRAIL 2	2010	2013	7 th FP
	GALOROI	2012	2014	7 th FP
	SATLOC	2012	2014	7 th FP
	3inSat		2016	ESA, ARTES 20 IAP
	RHINOS	2016	2018	H2020
	ERSAT EAV	2015	2017	H2020
	Most of these projects included the intention to use EGNOS.

D5.1 State of the art of EGNSS system for the rail application Page 19 of 61

Table IV Synthesis about previous GNSS projects Legend: EGNSS highlighted in red System architecture Objective Positioning-related Performances, specified and obtained Model / characterization of the environment of reception and scenarios / tests considered in this environment Integrity monitoring implementations and general safety aspects APOLO GPS receiver in various operating modes (standalone, DGPS, EGNOS) + Odometer + Gyroscope + Accelerometer + Doppler Radar

 IV

	1 st test of the	-No performances specified	-Operational scenarios: multipath was	-Integrity monitoring
	ability of the	-Accuracy obtained:	eliminated by means of appropriate	was ensured using first
	GPS to be	¤ Accuracy in GPS C/A mode was in the range of 3-	selection of test tracks (e.g. the choice of	EGNOS signals
	used in railway	4 m (2 drms, 95% of time)	the smallest possible shadowing), using	-No safety analysis
	application	¤ Accuracy of DGPS was better than 1 m (2 drms,	RTK mode and with fusion of sensor data
		95% of time)	-Tests:
		¤ Accuracy with EGNOS corrections is in the range	¤ tests of potential influence of
		of 1.0-1.5 m (2 drms, 95% of time)	electromagnetic interference
			¤ The accuracy of the train locator was
			evaluated according to the selected
			operating mode and using a reference
			trajectory generated by means of RTK
			(144 tests drives).

GADEROS GPS + EGNOS + digital track map (some configuration with virtual balise database, some configuration hybridizing GNSS and an odometer and a gyrometer)

	Tests of	-Accuracy requirements:	-Operational scenarios: Four scenarios	Safety Analysis was
	prototypes for	¤ for GNSS : 1 m for singular points (crossings,	were described and tested:	carried out from the
	conventional	stations), 25 m between stations (areas of plain line)	¤ S1: GPS only	point of view of the
	and low	¤ Position accuracy along track: ±2.6 m for virtual	¤ S2: GPS + hybridization	user, identifying a
	density railway	balise tracking purposes	¤ S3: GPS off + hybridization	Tolerable Hazard Rate
	lines equipped	¤ Position accuracy across track: 1m (if used for	¤ S4: GPS degraded + hybridization	(THR) for the function
	with	parallel track identification)	-Tests:	to be performed by the
	ERTMS/ETCS	¤ Speed accuracy: 2 Km/h for speed lower than 30	¤ Laboratory test (for demonstration of	GNSS Location
		Km/h, then increasing linearly up to 12 Km/h at 500	the VB interoperability concept)	Subsystem. From the
		Km/h	¤ Integration on board test (integration	point of view of the
		-Availability requirements:	of locator prototype)	provider, a SIL was
		¤ 99.8% (% of mission time) for GNSS	¤ Field tests (evaluation of GNSS	allocated to the
		¤ 99.99999% within the period needed to capture a	performances, VB simulation)	different sub-functions
		virtual balise group and >99,98 % of mission time in	performed on commercial track in	and components,
		the rest of the line	Spain in a 30-40 Km stretch within a	analysing causes of
		-Continuity requirements: 99.99999% within the	commercial timetable	failure for each of them
		period needed to capture a virtual balise group and	¤ The reference track data was	and proposing
		>99,98 % of mission time in the rest of the line	generated through averaging the	mitigation strategies.

related Performances, specified and obtained Model / characterization of the environment of reception and scenarios / tests considered in this environment

	System architecture	Objective	Positioning-Integrity monitoring implementations and general safety
					aspects
			(60km/h) <20m
			¤Maximum confidence interval with a:
			-10m-long EGNOS loss <18m
			-100m-long EGNOS loss <21m
			-1000m-long EGNOS loss <48m
	RUNE	Use of GNSS
	GPS receiver +	as a virtual
	EGNOS +	balise
	Odometer + IMU
				3 test lines with similar results:	No classical integrity
				¤Gembloux (Belgium): rural and	monitoring.
				wooded	Use of redundant pairs
				¤ Nice-Digne (France): Mountainous &	of satellites to compute
				tunnels	merged confidence
					intervals in order to
				PREDISSAT tool developed to predict	ensure a high level of
				satellite availability based on image	safety.
				processing knowledge of the	Safety preliminary
				environment.	assessment performed
					in the frame of the
					project.
	ECORAIL	Use of GNSS	-Requirements based on the recommendation of the	Test along a line in Upper Austria	Out of scope
	GPS receiver +	for railway	GNSS user forum 2000	operated by Stern & Hafferl with a good
	EGNOS +	level crossing		GNSS visibility
	Odometer + Map		Results:
			¤Accuracy of the position <3m
			¤Additional radio delay 16m at 60km/h
			¤Minimum confidence interval at max speed

-Accuracy requirements:

¤ position: 5m + 5% of travelled distance ¤ position objective: 3m, 95% ¤ velocity: 2 km/h for v < 30km/h, 12km/h for v < 500 km/h ¤ velocity objective: 2 km/h 95% -Integrity requirements:

¤ position confidence objective: > 99.9% for a 50m protected distance -Availability requirements: > 99%

Obtained Performance HW in the loop Lab tests: CRUISE & ACCELERATION scenarios

	Lab tests	Integrity monitoring
	HW in the loop laboratory tests	performed at several
	performed with Spirent simulator and	levels
	simulator of IMU.
	Field tests	Level 1: SENSORS
	Live tests on train performed on the	PRE-PROCESSING
	Torino-Chivasso line	Measurement
		diagnostics (exclusion
		or correction)
		Checks	with	train
		dynamic constraints
		EGNOS HPL
		RAIM
	Km/h	Level		2:	DATA
	Results:	FUSION	FILTER
	Velocity err = 0.02 m/s 1sigma	MODULE
	Position err = 0.7m 1sigma	Information
	TUNNEL scenarios:	redundancy:	Multi-
	Conditions:	sensors cross-checks
	Constant vel = 144 Km/h, tunnel duration 1 -11	Measurement
	min.	residuals
	Constant tunnel duration 5 min, vel = 252 Km/h	Filter covariance
	Result: Along track err < 25m after 1000 sec in	Virtual Balise matching
	tunnel	for	divergence	on
	CURVE scenarios:	travelled distance
	Conditions:

: Conditions: ¤ 10 m/s -70 m/s constant velocity, 36 min run ¤ Accel. 0.01 -0.06 g leading to Cruise of 36 to 252

related Performances, specified and obtained Model / characterization of the environment of reception and scenarios / tests considered in this environment

	System architecture	Objective	Positioning-Integrity monitoring implementations and general safety
					aspects
			¤ 100% Availability in APV-1
			¤ Accuracy below 2m
			¤ Integrity is ensured
			¤ Good stability of position and velocity		Safety requirements:
			determination		¤ at user level and
	GRAIL 2	Developing an	-Accuracy requirements:	-An initial environmental	system level for -Error considered:
	(cf. GRAIL)	improved	¤ Travelled distance accuracy required of ±(5m±5%	characterization took place with	ETCS: Preliminary multipath rejection and
		odometry	S) (of travelled distance) independently of the speed	analysis 2 GNSS equipment installed on	Hazard Log, Risk mitigation techniques
		subsystem	and operational conditions	the testing train. This enables a	Analysis and (e.g. antenna design,
		based on	¤ Confidence interval related to the "safe front-end"	comparison of performance between two	quantification of design of the receiver
		GNSS for	position of the train of ±(5m±5% s). This confidence	receiver types	safety requirements signal processing
		ERTMS/ETCS high speed	interval shall be given with a 4.891638*sigma = 1x10 -6	-Tests: in the rural and urban environments with:	¤ at the subsystem level: Enhanced function) were implemented in the
		lines ; based	¤ Speed accuracy of ±2 km/h for speed <30 km/h,	¤ GPS Single frequency without SBAS	Odometry GNSS receiver,
		on GRAIL,	then increasing linearly up to ±12 km/h at 500 km/h	Integrity	-Safety analysis : interference mitigation
		progress in the	¤ Speed confidence interval given with a 5σ proba.	¤ GPS + EGNOS with Integrity	¤ Safety techniques were also
		implementation	(1e-5)	-The main conclusions of the test	requirements and implemented.
		and testing to	-Availability requirement: available 95% of the time	results were the no compliancy for:	Safety integrity Level -Safety analysis:
		have user	-Continuity requirements: the probability of service	¤ Travelled distance accuracy	allocation for the ¤ Safety Plan
		validation of	discontinuity predicted over the next critical operation	¤ Confidence interval	User Terminal and ¤ Preliminary Hazard
		the	period (15 s) shall not exceed the specified value of	¤ Speed accuracy	other components. Analysis Report
		applications	8.0E-5 assuming an integrity requirement (without	¤ Speed confidence interval	¤ Proposal for the ¤ Safety task related
			receiver contribution) of 8.0E-6 on 15s.	¤ Availability	relevant test and to life cycle
			-Integrity requirements:	¤ Continuity	analysis to ¤ SIL Allocations
			¤ The final GNSS UT integrity shall be > 99.9999 %	¤ Integrity and time-to-Alert	demonstrate the and Hazard Rate
			¤ The GNSS UT time-to-alert shall be less than 5s	-EGNOS use and testing was planned	validity of the safety Apportionment
				but due to technical drawbacks actual	design ¤ User Terminal
				trials were never carried out.	Safety Analysis
					¤ Approach to GNSS
					UT Integrity Analysis
	GALOROI
	-Galileo receiver +
	Eddy Current
	Sensors + map

architecture Objective Positioning-related Performances, specified and obtained Model / characterization of the environment of reception and scenarios / tests considered in this environment

  Coverage of the track 99%-essential at the stationary points and « MA enforcement » areas.

					Integrity monitoring
	System architecture	Objective	Positioning-		implementations and general safety
					aspects
		GNSS Safety in live rail application for the train	¤ Safety requirements	Simulation test performed in "critical points" in terms of masking effects with a combination of masking angles extracted
		control, speed	¤ Tolerable missing positions	from image processing and a signal
		supervision,	¤ IR<2.5 10-7 for accuracy of 4m,	simulator.
		traffic control	¤ TTA 6s,
		and traffic	¤ AL<20m (EGNOS is sufficient)
		management	¤ OBU SIL2
		of low traffic
		lines (LTL)
	3inSat	Development	LDS related requirements:	-Operational scenarios:	Safety aspects
	Multi-constellation	of a multi-	1-Accuracy requirements:	UNKNOW/ VALID/ INVALID L2 SOM, -	The aim of the safety
	GNSS receiver +	constellation	a)Position accuracy:	>SR mode transition-> FS mode	analysis was to
	EGNOS +	system	 The expected Average Position Error per train	transition	provide the relevant
	Odometer + IMU	compatible	run is less than +/-3 meters->80% PASSED	In three different IP based TLC	safety evidence of the
		with	with the KPI average value of is -1,46 meters,	scenarios:	GNSS based train
		ERTMS/ETCS	 The acceptable related Mean Squared	 Private TETRA network	LDS which would
		through the	Position Error or Standard Deviation per train	 3G public bearer	support its future
		virtual balise	run is less than 4 meters.-> less than 4	 SATCOM+3G multibearer	verification, validation,
		concept.	meters for about 99% of train runs		elaboration of safety
			b)Speed accuracy:	-Tests:	case and certification
			 The expected Average Speed Error per train	a) Lab tests, with simulation tools	according to
			run is less than +/-5 km/h.-> PASSED for	b) On-site tests on the RFI Line Cagliari	CENELEC railway
			99% train runs	-S. Gavino line, 50 km length, with one	safety standards (EN
			 The acceptable related Mean Squared Speed Error or Standard Deviation per train run is less than 6 km/h->all PASSED	train running in commercial service (7500km train runs equipped with LDS system, performing measurements).	50126, EN 50128, EN 50129, etc.). The safety analysis was mainly focused
			2-VB accuracy requirements:  The expected Virtual Balise Groups detected inside expectation window per train run is: >99%.->100% train runs PASSED	The analyses of KPIs including position errors with respect to a ground truth have confirmed the applicability of the GNSS technology in the railway domain for the	on: 1) derivation of LDS safety requirements for ETCS Level 2

related Performances, specified and obtained Model / characterization of the environment of reception and scenarios / tests considered in this environment Integrity monitoring implementations and general safety aspects 

  The expected Average Position Error of estimated Virtual Balises location per train run is less than +/-4 meters%.->87% train runs PASSED  The acceptable related Mean Squared Position Error of estimated Virtual Balises location or Standard Deviation per train run is less than 5 meters. ->98% train runs PASSED

	3-Integrity requirements:
	 % of epochs for which the Phase 2 LDS
	System does not provide a solution: less than
	2%
	 % of epochs for which the Phase 2 LDS
	System is potentially intrusive (Protection
	Level > Application Threshold)): less than
	20%
	 % of epochs for which the Phase 2 LDS
	System is in MI/HMI: less than 2%.
	 PASSED for 99% train runs

related Performances, specified and obtained Model / characterization of the environment of reception and scenarios / tests considered in this environment

	System architecture System architecture	Objective Objective	Positioning-Integrity monitoring implementations and general safety Positioning-
					aspects
	receiver (GPS,	increasing the		implementation of the Virtual Balise environments to derive model of sky view	platform, and refining of integrity
	Galileo, EGNOS,	use of EGNSS		concept. and elevation masks relevant to	2) development of monitoring parameters
	WAAS) +	to support the		obscuration and multipath effect on	ETCS LDS with sensitivity
	Advanced-RAIM	safety-critical		GNSS signals	analysis in function of
		train		-Operational scenarios: nominal and	Integrity monitoring. the environment
		localization		extreme train scenarios including track	A new safety concept impacts and potential
		function with a		geometry, train speeds, tracks changes,	of the multi-intentional
		combination of		etc.	constellation EGNOS-interferences
		GNSS, SBAS		-Tests: Virtual test bed to test GPS SIS	R/ SBAS-R was -General safety
		and ARAIM		fault events (satellite malfunctions and	proposed. aspects: evaluation of
		inspired from		atmosphere anomalous behaviour), no	hazards (e.g.
		avionics and		field measurement campaigns	Dangerous Detected,
		adapted to the			The Wayside LDS Dangerous
		difficult railway			Augmentation and Undetected) during the
		environments			Integrity Monitoring tests with rates
					Network includes the statistics
	ERSAT EAV	To develop a	The tests are in progress	High fidelity simulation of the full signal	LDS subsystem Integrity monitoring
	EGNOS and	system		and data processing chain. The simulator	components installed networks consisting of
	Galileo early	solution for the		allows the joint use of recorded data, as	wayside (i.e. two fixed ground
	services	train		those acquired during a measuring	Reference Stations, reference stations
		localization,		campaign in a real railway environment	Track Area LDS networks, integrated
		verifying the		or during infield tests, with data	Server and with + EGNOS SBAS
		suitability of		synthetized by signal generators	communication
		EGNSS		providing ordinary as well as hazardous	network).
		(including		signal patterns.
		EGNOS and		The simulator considers the relevant
		Galileo early		aspects of the surrounding environment,
		services) for		including satellite motion, SIS generation,
		safety		GNSS signal propagation from satellites
		application in		to ground receivers, navigation data
		regional		generation, reception and interpretation,
	RHINOS Multi-constellation	railway lines This project aims at scenarios	-> 100% of train runs PASSED (Project at preliminary stage, started in 2016)	and train motion. -Model linked to the environment: Modelling of different railway Measurement campaign and infield	-Integrity monitoring implementations:

related Performances, specified and obtained Model / characterization of the environment of reception and scenarios / tests considered in this environment

					Integrity monitoring
	System architecture	Objective	Positioning-		implementations and general safety
					aspects
				tests in the Sardinia trial site along the
				regional railway line of RFI between
				Cagliari and S. Gavino stations are in
				progress
	NGTC	The NGTC	-Neither specification of positioning related		-Investigation of the
		WP7 has been	performances nor the performance of measurement	-Specification of the GNSS receiver	physical phenomena
		focusing on	campaign was in the scope of NGTC.	parameters (and accompanying test	that can affect the
		application of	-Regarding the GNSS performances, a number of	methods) that is relevant for an	GNSS signals
		the satellite	previous EU-funded rail research projects have	interoperable signalling application	(qualitative analysis);
		positioning	been analysed. The conclusion made by the project	such as ERTMS.
		functionality in	was that the publicly available data/results don't	-Specification of GNSS performance	-Analysis of the
		the frame of	allow to proceed with the full virtual balise System	assessment methods in the scope of	impact of the
		ERTMS/ETCS	Requirements Specifications for ERTMS. The	railway environment. Defined	physical phenomena
		(virtual balise	recommendation from the NGTC was to perform an	procedures based on a simulation of	that can affect the
		concept).	extensive GNSS test campaign focused on the	the key GNSS effects relevant for the	GNSS signals
		Activities have	positioning performance aspects in a follow-up	Virtual Balise application.	(resulting from
		been based on	research program.	-Considerations relevant for ERTMS	previous) on VBR
		the pervious	-For the analyses performed within the project,	operational scenarios using virtual	function has been
		results of the	NGTC experts have been working with an	balise.	investigated
		UNISIG	assumption of 50 meters GNSS based position		(qualitative analysis);
		Satellite	accuracy.
		Positioning			-Definition of a set of
		Workgroup.			relevant operating
					scenarios in which
					VB is applied;
					-Analysis of the case
					studies taking into
					account the physical
					phenomena that can
					affect GNSS signals;
					-Development of a
					preliminary VBR

related Performances, specified and obtained Model / characterization of the environment of reception and scenarios / tests considered in this environment

	Integrity monitoring
	implementations and
	general safety
	aspects
	architecture
	independence
	evaluation
	(quantitative
	analysis):
	-Development of a
	VBR preliminary
	FMEA and functional
	apportionment
	(quantitative
	analysis);
	-Specification of
	definitions for
	parameters for
	system performance,
	addressing
	incongruences
	across GNSS,
	aviation and railway
	disciplines;
	-Considerations on
	EGNOS Service
	Provision;

D5.1 State of the art of EGNSS system for the rail application Page 33 of 61

TBC: To be confirmed

Virtual Balise concept consists in the abstraction of all or part of physical ETCS balises along the track.Their position has to be referenced in a map so that the train could detect when it is travelling over a balise

http://gpsworld.com/ndgps-destined-for-the-technological-boneyard/

Final Presentation-ECSAT, Harwell, 25 February 2016