A PVT Estimationfor the ERTMS Train Control Systems

in presence of Multiple TracksA. Neri 1, A.M. Vegni 1, and F. Rispoli 2

1 RADIOLABS, Rome Italy, {alessandro.neri, annamaria.vegni}@radiolabs.it2 Ansaldo STS , Genoa Italy, francesco.rispoli@ansaldo-sts.com

BIOGRAPHIESAlessandro NERI is Full Professor inTelecommunications at the Engineering Department ofthe University of ROMA TRE. In 1977 he received theDoctoral Degree in Electronic Engineering from theUniversity of Rome “Sapienza”. In 1978 he joined theResearch and Development Department of ContravesItaliana S.p.A. where he gained a specific expertise in thefield of radar signal processing and in applied detectionand estimation theory, becoming the chief of theadvanced systems group. In 1987 he joined theINFOCOM Department of the University of Rome“Sapienza” as Associate Professor in Signal andInformation Theory. In November 1992 he joined theElectronic Engineering Department of the University ofRoma TRE as Associate Professor in ElectricalCommunications, and became full professor inTelecommunications in September 2001. His researchactivity has mainly been focused on information theory,signal theory, and signal and image processing and theirapplications to both telecommunications systems andremote sensing.Since December 2008, Prof. Neri is the President of theRadioLabs Consortium, a non-profit Consortium createdin 2001 to promote tight cooperation on applied researchprograms between universities and industries.

Anna Maria VEGNI is Assistant Professor inTelecommunications at the Department of Engineering ofUniversity of Roma Tre, Rome, Italy. She received thePh.D. degree in Biomedical Engineering,Electromagnetics and Telecommunications fromUniversity of Roma TRE in 2010.From May 2009 to October 2009, she was a visitingscholar in the Multimedia Communication Laboratory, atthe Department of Electrical and Computer Engineering,Boston University, Boston, MA. Her research activity isfocusing on vehicular networking, indoor and outdoorlocalization, GNSS and Visible Light Communications.Since 2011, she is in charge of TelecommunicationsNetworks Laboratory course at Roma Tre University.

Francesco RISPOLI is responsible for the Satellite andTelecommunication projects in Ansaldo STS since 2011.Previously, he has been with Telespazio (2005-2011) as

chief of the New Initiatives for strategic projectsontelemedicine, emergency telecommunications, broadbandinternet on trains and satellite-based train control systems.By 1983 to 2005 he was with Alenia Spazio (now ThalesAlenia Space) where he served various positions asresponsible for R&D and institutional programs, vicepresident of multimedia business unit, general manager ofthe EuroSkyWay newco for broadband serviceprovisioning. He has been a co-founder of the Telbioscompany for telemedicine services and member of the itsmanagement board. He started his carier in 1980 withContraves Italiana S.p.A. as technical engineer in theantenna department. In 1978 he received the DoctoralDegree in Electronic Engineering fromt the Polytechnicof Turin. In 1980 he has achieved a Master in AppliedElectromagnetism from the University La Sapienza inRoma.

ABSTRACT

GNSS has been recognized a strategic asset for favoringthe evolution of the modern railways signaling systemsthat play a major role to prevent accidents due to humanerrors. The European ERTMS-ETCS train control systemhas already envisaged the utilization of GNSS forsupporting the odometry function in its evolving path toprovide cost-effective solutions for the low traffic linesand, more in general, for those lines which are in semidesert areas where it is imperative to limit the waysideequipment along the line. ..The main challenge for the introduction of GNSS-basedlocalization systems on the train signaling systems is toguarantee the same safety levels of the current systemsbased on wayside equipment (balyse) to estimate theexact train position and the rail where the train istravelling. This latter requirement is at least one order ofmagnitude more stringent respect to the determination ofthe train position along the track and, for that reason itrequires today the support of the train driver who has toconfirm in which rail the train is located. Based on theserequirements and since the GNSS constellations arerapidly evolving towards a redundant and resilient globalinfrastructure, we have developed a novel multi-constellation PVT algorithm for train localization

determination, specifically designed to handle the case ofmultiple track scenarios. This solution is driven by therequirements of the ERTMS-ETCS train control systemand compliant with the SIL-4 safety requirements ofCENELEC railways norms i.e., Tolerable Hazard Rate(THR), 10-9 ≤ THR ≤10-8.To meet the SIL 4 requirements, we adopted a GNSSarchitecture comprising of a dedicated integritymonitoring and augmentation network, as well as the useof multi-constellation receivers.The PVT algorithm estimates the train location byexplicitly accounting for the fact that the train isconstrained to lie on a railway track. Basically, exploitingthis constraint allows to estimate train location even whenonly two satellites are in view. Effective reduction in thenumber of required satellites to make a fix, when trackconstraint is applied, depends on the track-satellitegeometry. In essence, satellites aligned along the trackgive more information than those at the cross-over. Byimplementing this technique, the satellites in excess aretaken into consideration for the elaboration of the PVTonly to achieve the desired accuracy, integrity andavailability specifically for the rail application.In this paper, we address the problem of PVT estimationof the train in presence of multiple tracks. This can beformulated as a combination of hypothesis testing (i.e.,which is the current track where the train lies on, or,better, which is the probability of a train lying on a giventrack?) and parameter estimation (i.e. given a track, whichis the curvilinear abscissa of the train receiver?).A detailed description of the overall PVT process isgiven. The performance of the track detector versus inter-track distance, observation time duration, signal-to-noiseratio and observables (i.e., pseudoranges and carrierphase) are discussed. Then, the impact of satellite failureson the PVT error magnitude and track detection isexploited. Finally, the assessment of the performance isalso provided by means of simulation results making useof both synthetic data (Monte Carlo simulations), andmeasures recorded on a railway test bed environment as apart of the 3InSat project co-funded by the EuropeanSpace Agency (ESA) in the framework of the ARTES 20programme.

I. INTRODUCTION

Modern signaling systems play a major role to provideautomatic train protection (ATP) to prevent accidents dueto human errors. The deployment of the European radio-based signaling train control system, ERTMS-ETCS,mainly for the high speed lines is contributing to a de-facto global standard in terms of both interoperabilityamong different national systems and for the highestsafety level achieved. On the other hands the developmentof the GALILEO system in Europe has also contributed tothe study of safety of life applications for rail [1].A synergy between GALILEO and ERTMS-ETCS is nowbecoming a reality since the signature of the newMemorandum of Understanding (MoU) for the evolutionof the ERTMS-ETCS that has envisaged the adoption ofthe GNSS to improve its competitiveness in the globalmarket and for the local and regional lines. However, themain challenge in the adoption of GNSS-based LocationDetermination Systems (LDS) is constituted by theinformation integrity imposed by the safety requirementsof the railways specifications that is generally differentand more stringent of the integrity requirement specifiedby the aeronautical scenario.In the ERTMS-ETCS system, the Hazardous Failure Rate(HFR) during 1 hour of operation shall be less than 10–9

for SIL-4 compliant systems. It implies that theprobability that the magnitude of the error of the positionprovided by the LDS shall not exceed the Alarm Level(AL), that is the maximum allowed error, while this eventis not detected by the Integrity Monitoring algorithm (e.g.protection Level PL<AL), has to be in principle less than2·10–13. However the ETCS platform can mitigate somerisks relevant to the detection of the virtual balyses thatrepresent the points along the line where the PVT isestimated.To reach the challenging SIL 4 target, we propose a LDSarchitecture, which considers (i) a multi-constellationcapability to manage both accuracy, availability andredundancy, (ii) the deployment of a Track AreaAugmentation and Integrity Monitoring Network withvery high availability, and (iii) an independent on-boardcapability to further mitigate GNSS errors, andautonomously assess the GNSS location integrity, whenaugmentation data are unavailable.The Augmentation Network includes a Ranging &Autonomous Integrity Monitoring (RAIM) referencestations, co-located with selected communications basestations for the purpose of integrity monitoring, accuracyimprovement of satellite-based position, and for providingcorrection to mobile receivers. Each reference station hasan LDS Safety Server, to elaborate the corrections and todetect systematic satellite faults. Finally, to enhance thesystematic satellite fault detection capabilities, the outputsfrom reference stations are jointly processed by a TrackArea LDS Safety (TALS) server.Railways applications are referred as safety-relatedsystems, a sub case of the well known safety-of-lifeGNSS application and they requires a higher performance

especially in terms of availability, continuity, integrityand accuracy. Conventional, stand-alone, GPS systemsare unable to provide the positioning information with anerror bounded by a protection level compliant with thesafety requirements of railways applications. On the otherhands, recent developments of GNSS prove to beinspiring for safety-of-life applications: for instance,modernized GNSS signals are broadcast with increasedpower and enhanced characteristics for multipathmitigation, while the presence of multiple constellationsmay potentially increase the overall availability along arail line.To meet the SIL-4 requirements, we believe that a GNSSsystem characterized by a dedicated integrity monitoringand augmentation network and by the use of multi-constellation receivers offers in perspective an higherdegree of flexibility. More in detail, in our system, thetrain is equipped with the GNSS Location DeterminationSystem On-Board Unit (LDS OBU), which provides thePVT estimate to the existing train odometry system. EachGNSS LDS OBU is equipped with (i) two GNSSreceivers, (ii) a local processor performing the PVTestimation starting from local measures, (iii) a track DataBase and the augmentation data received from a TrackArea LDS Safety (TALS) server, and (iv) acommunication module.The PVT algorithm estimates the train location byexplicitly accounting for the fact that the train isconstrained to lie on a railway track. Basically, byexploiting this constraint it is possible to estimate the trainlocation even when only two satellites are in view.Effective reduction in the number of required satellites tomake a fix, when track constraint is applied, depends onthe track-satellite geometry. In essence, satellites alignedalong the track give more information than those at thecross-over. Satellites in excess can then be employedeither to increase accuracy or to increase integrity andavailability. In [2], we presented a SIL-4 solution for PVTtrain estimation, for the single-track scenarios. However,in multiple-track scenarios, the ERTMS-ETCS alsorequires track discrimination. This is far more challengingthan PVT estimation alone, due to the fact that inter-trackseparation is rather smaller compared to the confidenceerror allowed for localizing the train along the sametrack. As a matter of fact, the cross-track protection level(i.e., 1.5 m) is one order of magnitude lower than thealong track protection level (i.e., 15 m). These aspectsconcerning the adoption of GNSS for railway signallingand train control for the migration from aviation risk tohazard rate and safety integrity level, and thedependability assessment of Satellite BasedAugmentation System for Signalling and Train Controlare discussed in detail in [3], [4]. While, respectively, in[6] and [7] the Galileo Integrity Concept and the GBASIntegrity for non-aviation users are provided.Here we present a novel algorithm that combines singletrack PVT estimate with track detection. In particular, foreach candidate track, we estimate the curvilinear abscissaof the receiver by means of a Weighted Least SquareEstimator (WLSE), assuming that the corresponding

hypothesis is true. Then, we compute the measurementresiduals conditioned to each hypothesis and from themthe a posteriori probability of each track.All those a posteriori probabilities can be combined in ageneralized log-likelihood ratio tests to detect the currenttrack. In fact, assuming that the hypotheses are uniformlydistributed, the Bayesian (optimal) track detection ruleselects the hypothesis corresponding to the largest ofthem. However, to reach track error probabilitiescompatible with the SIL 4 requirement, multipleobservations have to be combined. Since the generalizedlog-likelihood ratio magnitudes provide information aboutthe reliability of each hypothesis, their values arecompared to thresholds to verify that enough informationhas been acquired before a decision on which track thetrain is lying on is transmitted to the ATP processor.For each track, the conditional PVT estimate is computedby solving a set of non-linear equations relating theobservables (e.g. pseudoranges and carrier phases) to thereceiver curvilinear abscissa and clock offset, by means ofan iterative Weighted Least Square Error (WLSE)procedure, accounting for the different statistics of theequivalent measurement noise, due to both satelliteelevation and signal characteristics specific of eachconstellation.This paper is organized as follows. We briefly recall theLDS architecture used in our model, as previouslydescribed in [2]. The LDS algorithm for PVT trainestimation is then illustrated, first for the case of singletrack estimation, and then for the multi-track case.Simulation results are then shown in order to assess theeffectiveness of the PVT technique. Finally, conclusionsare drawn at the end of the paper.

II. LDS ARCHITECTURE

In order to fulfill the basic SIL 4 requirement four basiccriteria have been considered in designing the architectureof the GNSS based train LDS system:

1) exploitation of multiple constellations, in order toincrease both system integrity and availability;

2) use of wide area augmentation systems like WAASand EGNOS, where available, for accuracy andprecision increase, as well as integrity monitoring.These networks should be updated in future in orderto meet specific railway needs and assure theinteroperability with different localization systems;

3) deployment of a dedicated Augmentation andIntegrity Monitoring Network, co-located with a setof TLC base stations, in regions not served byaugmentation networks fulfilling the railwayrequirements;

4) independent on-board capability to mitigate GNSSerrors, and autonomously assess the GNSS locationintegrity.

Considering that satellite ephemerides and clock errors, aswell as anomalous propagation conditions in ionosphereand troposphere represent the most relevant sources ofhazard for the LDS, adoption of a Ranging and IntegrityMonitoring network plays a major role in preventing thatany Hazardous Misleading Information may be providedby the On Board LDS unit, without a timely warning.In fact, processing of satellite signals received at knownlocations allows to estimating the error sources, whichaffect train positioning, as well as to detecting eventualGNSS, and more in general Signal In Space (SIS) faults.Compared to actual EGNOS, supporting SIL 4 compliantrailway applications may require the deployment ofspatially denser RIM stations. On the other hand, toincrease SIS availability, the wireless network employedfor train signaling is also used for distributingaugmentation and integrity information to the LDS OBUs.Thus, since integrity should be assessed for any visibleconstellation, the RIMs shall adopt multi-constellationreceivers. As a matter of fact, the Dilution of Precision(DoP) associated to the estimation the current trainlocation strictly depends on the number of visiblesatellites, as well as on their line of sight geometry. Useof a multi-constellation receiver reduces the need ofhigher number of visible satellites that results highlyredundant. As a consequence, the DoP decreases.The on-board LDS comprises a dual-path GPS receiverintegrated with a SIL-4 processor board. The LDS on-board component is a self-contained unit that connects tothe ATP, the antennas, and the locomotive power supply.Each reference station has an LDS Safety Server based onthe same SIL-4 system, as the mobile LDS On Boardunits, but configured to provide correction services anddetect systemic satellite faults.In order to enhance the systemic satellite fault detectioncapabilities, as well as to detect eventual faults of theregional LDS Safety Servers, their outputs are jointlyprocessed by a Track Area LDS Safety (TALS) server.Such architecture allows improving the correctionfunction of classical differential GPS systems andmitigating the risk of failure relevant to the GPS referencestations.As depicted in Figure 1 the LDS system architecture isstructured in a modular way. The overall systemcomprises three sub-systems:

1) RIM Reference Stations (RS);2) TALS Server;3) On Board Unit (OBU).

In particular, the set of RSs with RIM functionalities,distributed along the railway, and TALS server constitutesthe Augmented and Integrity Monitoring Network(AIMN).The Augmentation and Integrity Monitoring Network(AIMN) is based on two sub-systems i.e., (i) the RIMStations, and (ii) TALS server. It provides the differentialcorrections to be applied to the GNSS LDS OBU forcompensating for the effects produced by satelliteephemerides and clock offset errors, as well as thevariation in the propagation delay introduced by

ionosphere and troposphere, and in addition AIMNmonitors SIS integrity.

Figure 1. LDS overall architecture. Legend: Signal In Space (redlines), RS to TALS application protocol (blue lines), and TALSto OBU application protocol (green line).

Finally, the GNSS LDS OBU provides PVT estimates, aswell as an indication of their accuracy. Each RIM RS isequipped with:

i. independent GNSS receiving chains;ii. a local processing facility, denoted in the

following as LDS Safety Server;iii. a communication module.

The pseudoranges provided by each RIM station arejointly processed by a central processing facility, namedin the following as TALS server, that (i) monitors theintegrity of the received SISs, then evaluating the healthstatus of each satellite, and providing an estimate of theerror sources statistics, and (ii) estimate the differentialcorrections to be applied by each GNSS LDS OBU.

Table 1. RIM RS, TALS, and OBU Functionalities.RIM RS TALS OBU

Signal-In-SpaceReceive andDecode

TALS ServerRIM RS DataExchange

Signal-In-SpaceReceive andDecode

PseudorangeResidualComputation

GNSSNavigation DataQualityMonitoring

PseudorangeResidualComputation

GNSSMeasurementConsistencyCheck

DifferentialCorrectionsComputation

GNSSMeasurementConsistencyCheck

PseudorangeResidualCombination

SIS FaultDetection &IntegrityAssessment

PVT Estimation

RIM RS TALSServer Data

TALS ServerGNSS LDS OBUData Exchange

AutonomousIntegrityMonitoring

Exchange

Finally, The GNSS LDS OBU will provide the PVTestimate and the confidence interval to the existinglocalization system.Each GNSS LDS OBU is equipped with (i) independentGNSS receivers, (ii) a local processor performing thePVT estimation starting from local measures, the TrackDB and augmentation data received from the TALSserver, and (iii) a track database (Track DB).

III. SINGLE TRACK PVT ESTIMATION

In this section, we present the weighted least square PVTestimation for train positioning, under the constraint oflying on a single railway track.From a mathematical point of view, track constraint canbe imposed by observing that the train location at a giventime t is completely determined by the knowledge of itsdistance from one head end, i.e., by the curvilinearabscissas defined on the geo referenced railway track. Lets(t) be the curvilinear abscissa of a train reference point,like the center of the antenna of the GNSS receiver, whenthe GNSS pseudoranges at time are is measured. Withoutloss of generality, we refer here the train reference pointto the ECEF frame. Thus subscripts 1, 2, 3 will identifythe corresponding coordinates. Incidentally, we observe,that since we are measuring ranges (or pseudo-ranges)and the Euclidean L2 norm is invariant with respect tochanges of orthonormal basis, the measurement equationscan be equivalently expressed in any orthonormal basis.Then, observing that the Cartesian coordinates) of thatpoint are described by the parametric equations

( ) ( )Train Traint s t X X

1 2 3( ) ( ) ( )TTrain Train Trainx s t x s t x s t (1)

the pseudoranges measured by the GNSS receiver can bedirectly expressed in term of the unknown curvilinearabscissa, also denote in the following as the train mileage.In fact, the pseudo-range i (k) of the i-th satellitemeasured by the OBU GNSS receiver can be written asfollows

( ) ( ) ( ( ))Sat Sat Train Traini i i ik T k s T k X X

( ) ( ) ( )ion trop Traini ic k c k c t k

( ) ( )Train Sati in k c t k (2)

where• ( )Sat

iT k is the time instant on which the signal ofthe k-th epoch is transmitted from the i-th satellite;

• ( )Sat Sati iT k X is the coordinate vector of the i-th

satellite at time ( )SatiT k ;

• ( )ioni k is the ionospheric incremental delay

along the path from the i-th satellite to the GNSS

receiver for the k-th epoch w.r.t. the neutralatmosphere;

• ( )tropi k is the tropospheric incremental delay

along the path from the i-th satellite to the GNSSreceiver for the k-th epoch w.r.t. the neutralatmosphere;

• ( )Satit k is the offset of the i-th satellite clock for

the k-th epoch;• ( )Train

iT k is the time instant of reception by theOBU GNSS receiver of the signal of the k-thepoch transmitted by the i-th satellite;

• ( )Traint k is the OBU receiver clock offset;• ( )Train

in k is the error of the time of arrivalestimation algorithm generated by multipath,GNSS receiver thermal noise and eventual radiofrequency interference.

For sake of compactness in the following we droptemporal dependence on the epoch index.A similar equation can be written for carrier phasetracking.Let:• ˆ Sat Sat

i iT X be the coordinate vector of the i-thsatellite estimated on the basis of the broadcastednavigation data and eventual SBAS data whereavailable;

• ˆ Sat Sati iT be the component of the differential

correction related to the ephemerides error of the i-th satellite provided by the TALS server (althoughTALS server may provide an overall correction, itcan always be modeled as the sum of individualcorrections);

•ˆ Sat

i

SatiT

be the residual estimation error of the

differential corrections of the ephemerides error ofthe i-th satellite provided by the TALS server;

so that we can write:

( ) ( )

ˆ ( ) ( )

Sat Sat Train Traini i i

Sat Sat Train Traini i i

T k s T k

T k s T k

X X

X X

ˆˆ Sat

i

Sat Sat Sati i iT T

(3)

In addition, let:• ˆ ( )ion

i k be the component of the differentialcorrection related to estimated ionosphericincremental delay along the path from the i-thsatellite to the GNSS receiver for the k-th epochw.r.t. the neutral atmosphere;

• ˆ ( )tropi k be the component of the differential

correction related to estimated troposphericincremental delay along the path from the i-thsatellite to the GNSS receiver for the k-th epochw.r.t. the neutral atmosphere;

• ioni be the estimation error of the ionospheric

incremental delay along the path from the i-thsatellite to the GNSS receiver for the k-th epochw.r.t. the neutral atmosphere;

• ˆtropi be the estimation error of the tropospheric

incremental delay along the path from the i-thsatellite to the GNSS receiver for the k-th epochw.r.t. the neutral atmosphere;

• ( )Trainin k be the measurement error of the OBU

GNSS receiver for the k-th epoch

, , ,( ) ( ) ( )Train Train Mp Train Rx Train RFIi i i in k n k n k n (4)

whereo , ( )Train Mp

in k is the measurement error due tomultipaths from the i-th satellite to theGNSS receiver for the k-th epoch;

o , ( )Train Rxin k is the measurement error due to

the thermal plus the internal receiver noiseaffecting the signal received from the i-thsatellite for the k-th epoch;

o ,Train RFIin is the measurement error due to the

radio frequency interference affecting thesignal received from the i-th satellite for thek-th epoch

o .• ˆSat

it be the component of the differentialcorrection related to estimated offset of the i-thsatellite clock provided by the TALS server;

• ˆSatit be estimation error of the offset of the i-th

satellite clock for the k-th epoch, so that we canwrite

ˆˆ .Sat

i

Sat Sati i t

t t

(5)

Therefore, for the pseudorange expression, we can writeˆ( ) ( )Sat Sat Train Train

i i i ik T s T X X

ˆˆ Sat

i

Sat Sat Sati i iT c T

ˆˆ ˆion trop Sat Traini i ic c c t c t

ˆˆ ˆion trop Sati i i

Trainit

c c c n

, (6)

Denoting with ˆ Diffi the overall differential correction

provided by the Augmentation and Integrity MonitoringNetwork as

ˆˆ ˆ ˆ ˆ ,Diff Sat ion trop Sati i i i ic c c t (7)

we finally obtainˆˆ ( )Diff Sat Sat Train Train Train

i i i i iT s T c t X X

,in (8)

with

ˆˆ ˆ ˆ .Sat ion trop Sati i i i

Traini it

n c c c c n

(9)

The pseudo-range equation system can be solved by aniterative procedure based on the first order Taylor’s seriesexpansion around an initial train curvilinear abscissaestimate s . Notice that the initial estimate of thecurvilinear abscissa is obtained by first computing thereceiver location without track constraint and selecting asinitial point for the iteration the position of the virtualreference station that is nearest to the train positionestimated at the previous step.

Let us denote with i the i-th pseudorangecorresponding to the site with mileage equal to s , i.e.,

ˆ Sat Sat Traini i iT s X X , (10)

so thatˆ Diff Train

i i i ic t n

ˆ ˆ( )Sat Sat Train Train Sat Sat Traini i i i iT s T T s X X X X

(11)

Then, denoting with

Trainis s T s , (12)

we expand the term

ˆ ( )Sat Sat Train Traini i iT s T X X (13)

in Taylor’s series w.r.t. s with initial point s , thenobtaining

ˆ Sat Sat Traini iT s X X

1 2 3

1 2 3

Train Train Traini i i

Train Train Trains s

x x x sx s x s x s

Taylorin (14)

where Taylorin accounts for the expansion truncation.

Then, we finally obtain:

ˆ Diffi i i

1 2 3

1 2 3

Train Train Traini i i

Train Train Trains s

x x x sx s x s x s

Train Taylori ic t n n , (15)

with 1, , Sati N , and NSat as the number of visiblesatellites.

Now, denoting with i the differential reduced pseudorange

ˆ Diffi i i i , (16)

the corresponding NSat scalar linear equations can bewritten in compact matrix notation as follows

HDz , (17)

where z is the array

Train

sc t

z , (18)

D is the matrix with elements given by the directionalcosines of the tangent to the railway track at the pointwith mileage equal to s :

1

2

3

0

0

0

0 1

Train

s s

Train

s s

Train

s s

xs

xs

xs

D , (19)

H is the classical NSat ×4 observation matrix:

SatN H P 1 , (20)

where P is the NSat ×3 Jacobian matrix of the pseudo-ranges,

Train TrainTrain

s

X X

ρPX

, (21)

whose elements are given by the directional cosines of thesatellite lines of sight:

, [ ],

[ ]Train Train

Sat Traini j ji

ij Train Sat Trainj is

x x sP

x s

X X

X X

(22)

with j = 1, 2, 3, andSatN1 is the NSat×1 vector:

11

1

SatN

1

, (23)

and, finally,Taylor

i i in n

ˆˆ ˆ ˆSat ion trop Sati i i i

Train Taylori it

c c c c n n

(24)

represents the equivalent observation noise (with i = 1, 2,…, NSat).A similar set of linear equations can be written whenpseudoranges derived from carrier phase tracking areemployed.The set of linear equations (17) may be solved w.r.t. thecurvilinear abscissa, and the receiver clock offset bymeans of a weighted least square, numerical procedurethat accounts for the different statistics of the error of thetime of arrival estimates related to satellites of differentconstellations.We remark that, with respect to ordinary least squaresolution, it accounts for different characteristics of errorsrelated to satellites of different generations anddependence of receiver noise from satellite elevation, as

in case of tropospheric incremental delay and multipathcomponents.Therefore the described algorithm can be directlyemployed when a mix of satellites from differentconstellations are used, as far as eventual differences intheir timing references are pre-compensated. Neverthelessit can be also applied to subsets of the visible satellitesbelonging to the same constellation.Recently, particle filters have been proposed in place ofextended Kalman filters to solve the pseudorangenonlinear equations. Nevertheless, their computationalcomplexity qualifies them as not mature for high integrityreceivers.At each iteration, the weighted least square estimate z iscomputed as

ˆ z K ρ (25)

where K is the gain matrix

11 1T T T T

K D H R HD D H R (26)

In addition, the variance of the estimate of the curvilinearabscissa s computes as follows

12 1ˆ 1,1

1,1

T Ts

zR D H R HD . (27)

Finally we set 11ˆs s z and the whole procedure isreiterated until a convergence criterion is met (e.g.,magnitude of the incremental mileage correction below apredefined value).

IV. MULTI TRACK WEIGHTED LEAST SQUAREPVT ESTIMATION

When the railway consists of multiple tracks, the singletrack PVT estimate is combined with track detection.Let us assume that the train can be located along one of Mtracks and let denote with Hk the hypothesiscorresponding to the k-th track.Then, denoting with ( )k ρ the generalized likelihoodratio given by the condition probability density functionof the observations ρ with respect to the k-th hypothesisHk divided by any arbitrary function that does not dependon Hk:

/ ( / )( ) ,

( )kH k

k

p Hw

ρ

ρρ

(28)

and assuming that the hypotheses are uniformlydistributed, the Bayesian (optimal) track detection ruleselects the hypothesis corresponding the largest ( )k ρ , orequivalently to the largest ln ( )k ρ .On the other hand, as illustrated in the previousparagraph, ρ is a function of the unknown traincurvilinear abscissa and receiver clock offset, and of theobservation noise . Thus for each hypothesis, i.e., foreach track, we have

ˆk k k k k

DiffH H H H H ρ ρ ρ H D z . (29)

Now, as in [8], we proceed by first estimating zk underthe hypothesis that Hk is true, and then we use theseestimates in a likelihood ratio test, as if they were correct.Thus for each hypothesis the generalized log-likelihoodfunctional ln ( )k ρ is computed, where

/ ˆ( / )ln ( ) ln

( )k k

Hk

H Hk

pMax

w

z

ρ zρ

ρ . (30)

Then the hypothesis corresponding to the largestgeneralized log-likelihood functional is selected.Since conditioned to the k-th hypothesis, ρ is a Gaussianrandom variable with (conditional) expectation

ˆˆ ˆ/ ,k k k k k k

DiffH k H H H H HE H ρ z ρ ρ H D z (31)

and covariance matrix ˆ/ ,

kH kCov H νρ z R (32)

then, by selecting

1( ) ,

(2 ) detsatNw ρR

(33)

we have

/

1/2

ˆ( / )ln ( ) ln

(2 ) detk k

H satk

H Hk

N

pMax

Ρ

zν

ρ zρ

R

11 ˆ ˆ2 k k k k k

Hk

TDiffH H H H HMax

νz

ρ ρ ρ H D z R

ˆ ˆk k k k k

DiffH H H H H ρ ρ ρ H D z . (34)

Incidentally we observer that the estimate of zk employedin track detection is the one for which

1ˆk k k k k

Hk

T

H H H H HArg Min νzz ρ H D z R

k k k kH H H H ρ H D z . (35)

Thus, denoting with•

kHρ the differential reduced pseudo range at thefinal iteration when the train is assumed to belocated along the k-th track;

•k kH HH D

the observation matrix at the final iterationwhen the train is assumed to be located along thek-th track;

• ˆkHz the estimate of train curvilinear abscissa and

receiver clock offset vector at the final iterationwhen the train is assumed to be located along thek-th track;

• ˆkHν the vector of the residuals corresponding to

the k-th hypothesis,ˆ ˆ

k k k k kkH H H H HH ν ρ - H D z (36)

• νC the matrix

1 1

1 1 1

NSat

diag

νC (37)

so that 1 T ν ν νR C C

• ˆk kH Hζ C ν the normalized vector of the residuals

corresponding to the k-th hypothesis,

and with2

kHζ the weighted squared L2 norm2 1ˆ ˆ ,

k k k

TH H H

νζ ν R ν (38)

we have21ln ( )

2 kk H ρ ζ (39)

Therefore the Bayesian detector will select the track with

the smallest weighted squared L2 norm2

kHζ .In addition the posterior probability of each hypothesis isapproximated as follows:

2

2

1exp2Prob .

1exp2

kH

k

Hmm

H

ζ

ζ(40)

V. PERFORMANCE ASSESSMENT

In presence of multiple tracks, in addition to theprobability that the mileage error will exceed the AlertLimit and no timely warning is provided, the relevantfigure of merit for the computation of the probability ofproviding an hazardous misleading information isconstituted by the track error probability, i.e. theprobability of declaring that a train is on a wrong track.Denoting with Pe the track error probability and with

ieP the conditional error probability conditioned to thevent that the i-th hypothesis is true, and assuming the apriori the M hypotheses are uniformly distributed we have

1

1i

M

e ei

P PM

(41)

Here, for sake of compactness of the mathematical model,let us examine the case of parallel tracks without split andmerge. The more general case is beyond the scope of thispaper. Nevertheless, the general results can be obtainedby extending the results reported here, with the aid of aMarkovian model.For the computation of

ieP we observer that two differentsituations have to be considered: either all the remainingtracks fall on the same side of the “true” track(corresponding to i=1 and i=M) or the remaining tracksfall on both sides of the “true” track corresponding to1<i<M).Based on the results of the previous paragraph, anddenoting with /k iH Hζ the normalized vector of theresiduals corresponding to the k-th hypothesis when the i-th hypothesis is the true one, we will have a track error as

soon as there exists at least one hypothesis, let say the h-th one for which the normalized squared L2 norm satisfiesthe condition

2 2

/ / ,h i i iH H H H h i ζ ζ (42)

Since the PVT estimation procedure operates on alinearized system, in order to compute the statistics of

kHζ conditioned to the Hypothesis Hi, let us denote with

ˆnfis the estimate of the train mileage for the i-th track in

absence of receiver noise and multipath (noise-free case),under the condition that the i-th hypothesis is true. InadditionLet us denote with bi,k the offset of the k-th track withrespect the i-th one. Then as demonstrated in Appendix A,the conditional probability of selecting one of the othertracks when the i-th track is the true one, can be written asfollows:

2,1

i 1,i i 1,i

1,

1 12 2 2

1 1 12 22 2 2 2

12 2 2

i

i

i ie

i M M

erfc i

P erfc erfc i M

erfc i M

Γ b

Γ b Γ b

Γ b

(43)

where( )i i νΓ C I HK P . (44)

Let us now specify the above results for the case of Mequispaced coplanar parallel tracks. Let e the unitvector orthogonal to the track tangent and lying on thetracks’ plane, al let b be the offset between to adjacenttracks, so that

, 0( ) ( )k i k i k i b b b e . (45)

Considering that in this case we have M-2 tracks (to1<i<M) for which the remaining tracks fall on both sidesof the “true” track while we have two tracks(corresponding to i=1 and i=M) for which the remainingtracks fall on the same side of the “true” track, for thetrack error probability we have:

112 2

ieP erfc b

M

Γ e. (46)

As expected, the track error probability decreases with thetrack separation.This expression applies to both code pseudorange basedand carrier phase tracking track discrimination. In fact, foreach satellite the projection of inter track distance on itsline of sight is normalized with respect to thepseudorange equivalent noise standard deviation (see Eqs.(37) and (44)). Thus the difference in achievableperformance with stand alone and differential receiversmaking use of C/A code pseudoranges and/or carrierphase tracking based pesudoranges, strictly depends on

the different error budgets associated to the relatedreceivers.As illustrated in the next section devoted to theexperimental results, for the Olbia-Cagliari railwayvalues in the range [0.75, 2.1] can be expected for thequantity i Γ e in presence of 2 parallel tracks with anoffset of 1.5 m and a pseudo range receiver equivalentnoise variance of 1 m2, that can be considered typical fordifferential GPS receivers making use of the A/C code.This in turn implies that the corresponding worst casetrack error probability will be about 0.29.On the other, the achievable equivalent pseudorangenoise standard deviation when real time tracking of thecarrier phase is employed (i.e. when the receiver operatesin RTK mode) can be at least one orders of magnitudesmaller than the one associated to the A/C code.This in turn implies that for the case at hand the worstcase track error probability drops to 10-8.To further illustrate the difference among the equivalentpseudorange noises affecting code and carrier phase basedpseudoranges, in Figure 2 a detail of the train receiverlocations estimated without imposing the track constraintfor both, code tracking Differential GNSS, and RTKmode, using GPS and GLONASS satellites, recordedduring the measurement campaign along the Roma-Salerno railway (see next section for further details) areshown.Difference in magnitude of the cross-track errorcomponent between code and carrier phase estimates israther evident. We further observe that selecting the tracknearest to the unconstrained estimate represents just asuboptimal solution.

Figure 2. Detail of the Roma-Salerno measurement campaign:RTK unconstrained estimate (green-line) and code basedDifferential GNSS (blue line) versus ground truth (red line).

In both cases, to improve the performance multipleindependent measures at different epochs can be used. Inthis case, two approaches can be applied.In the first case the overall generalized likelihood ratio iscomputed. Thus for NO independent observations we have

2

1

2

1

1exp ( )2

Prob .1exp ( )2

O

k

O

m

N

H hh

k N

H hm h

tH

t

ζ

ζ(47)

Performance can then be evaluated as straightforwardextension of the single epoch track detection. Thus byintroducing the partitioned vector

1 , 1

2 , 2,

,

( ) ( )( ) ( )

( ) ( )O O

i k i

i k ik i

i N k i N

t tt t

t t

Γ bΓ b

β

Γ b , (48)

we can write

2,1

i 1,i i 1,i( )

1,

1 12 2 2

1 1 12 22 2 2 2

12 2 2

o

i

Ne

M M

erfc i

P erfc erfc i M

erfc i M

β

β β

β

(49)

As particular case, we observe that for equispacedcoplanar tracks, and a slowly moving train (ideally a stilltrain) the track error probability, when NO epochs areemployed, is

( , ) 112 2

ON I ie OP erfc N b

M

Γ e(50)

In the second case, a rank order statistics test can beemployed. For instance, we decide that the train is lyingon the i-th track if at least for kO out of NO epochs the

norm2

( )iH htζ is the smallest one. Although the solution

devised in the first case is the optimal one in presence ofGaussian observation noise, use of rank order statisticsprovides a more robust outlier resilience and, therefore, itappears as a better candidate when strong multipath has tobe faced.Concerning performance, for equispaced coplanar tracks,and a slowly moving train, the single epoch track errorprobability can be considered constant during theobservation interval, and for the evaluation of the overalltrack error probability the Bernoulli distribution applies.Thus we can write

0

( , ) 1 1O O

O

NhON II N h

e e eh k

NP P P

h

. (51)

Considering track discrimination integrity, we observerthat undetected satellite faults and/or incrementalionospheric and tropospheric delays not fullycompensated by the augmentation system, maypotentially affect the track error probability.The loss in track error probability can be assessed usingEq. (69) of Appendix A.However, to reduce the impact on integrity we force inthe track discrimination algorithm the use of the same

gain and the same observation matrix for each hypothesis,so that due the isotropic behavior of the pdf of

iHζ

Eq.(46) and Eq. (50) are still valid.

VI. EXPERIMENTAL RESULTS

To verify the impact of the satellite geometry on the trackdiscrimination capabilities of the proposed algorithm, thetrack error probabilities have been computed for areference case of a set of 24 trains travelling along a 350km route, from Cagliari to Olbia (Italy), at a nominalspeed of 80 km/hour, and leaving from Cagliari every our,with the aid of the 3InSat GNSS simulator [5]. In theperformed evaluation the masked areas as tunnel andbridges have been neglected.The map of the selected railway is reported in Figure 3.In Figure 4 and Figure 5 the quantity

0 0/ ( )i i νΓ b b C I HK Pe versus the train mileage,when code tracking is used and the GPS-EGNOS receiverequivalent noise variance is 1 m2, is is reported for GPSconstellation based PVT and joint GPS-GLONASS-EGNOS PVT estimates. GLONASS receiver equivalentnoise is scaled w.r.t. to the GPS one based on thecharacteristics of waveforms and modulations of the twoconstellations. GLONASS augmentation data availabilityfor EGNOS services has been assumed.Based on the reported results it appears that when the GPSalone is employed, for that particular railway, the keyperformance indicator 0 0/iΓ b b presents a lowerbound of about 0.75, while when both GPS andGLONASS satellites are employed the over bound isabout 1.45.

Figure 3. The Olbia-Cagliari railway

Figure 4. Normalized key performance indicator

0 0/ ( )i i νΓ b b C I HK Pe versus train mileage – GPSonly.

By means of Eq.(46) and Eq. (50), it can be easilyverified that in presence of 2 parallel tracks with an offsetof 1.5 m, to achieve a track error probability of 10-11

(two orders of magnitude lower than the HMI probabilityof 10-9 in 1 hour) we need about 130 epochs when theGPS alone is employed, and about 40 epochs when bothconstellations GPS and GLONASS are used.To further verify the effectiveness of the GNSS basedtrain LDS, a measurement campaign has been performed,in the framework of the 3InSat research project, by meansof a diagnostic train CARONTE (CAR ON TEchnology)provided by the Italian Railway Operator RFI (ReteFerroviaria Italiana). The train was moving along theRome-Salerno route (around 300 km), in a sunny day,with minimal impact of local atmospheric disturbances(see Figure 6).

Figure 5. Normalized key performance indicator

0 0/ ( )i i νΓ b b C I HK Pe versus train mileage – GPS– GLONASS code tracking.

The train was equipped with a 3G Internet connectionbased on multi mobile carriers on the Italian territory (i.e.,Democrito system). For the test, an antenna with magneticmount (Tallysmann TW2410), of diameter less than 10cm, able to receive GPS, GLONASS and SBAS(EGNOS) signals of single frequency L1 and having anLNA gain equal to 25 dB min. on the band from 1575.42-1606 MHz has been installed on the roof of the train.

Figure 6.. Rome-Cassino railway (part of Rome-Salernorailway).

The antenna was positioned above the cab 1 of the train,with an offset of about 40 centimeters on the carriage’sleft side with respect to the central axis of the train; theTW2410 was connected via an RF cable of 5 m length toan evaluation-kit with on-board low-cost, singlefrequency, code and carrier phase, multi-constellationGNSS receiver (i.e., GPS, GLONASS, GALILEO,COMPASS, SBAS).As reference, collected data were also processed withRTKLIB software supporting both absolute positioningalgorithms (i.e., stand-alone) and precise positioningalgorithms (i.e., Differential GNSS Real Time Kinematic,and Precise Point Positioning), with corrections receivedfrom the ItalPos network in RTK Nearest mode (1 seccorrection-rate)..

Figure 7. RFI CARONTE diagnostics train.

The recorded data set has been post processed, to evaluatethe performance of the multiple track detector, in case of

0 50 100 150 200 250 3000

0.5

1

1.5

2

2.5

3

Travelled Distance [km]

|| ib0||/||b 0||

0 50 100 150 200 250 3000

0.5

1

1.5

2

2.5

3

Travelled distance [km]

|| ib 0||/

||b0||

two parallel tracks with an inter-track offset of 2 m. Sincethe measurement campaign has been made at an earlystage of the 3InSat project, the psudoranges provided bythe ItalPos network have been employed as input to theaugmentation and integrity monitoring network, in placeof those provided by RIMs’ receivers.Moreover, for similar reason the track data base has beenbuilt on the basis of the train location estimated by postprocessing the carrier phase with a Differential GNSSReal Time Kinematic algorithm. This in turn implies thatthe reported evaluation is also affected by track data baseinaccuracies, mostly due to multipath.

Figure 8. Posterior probability of the hypothesis correspondingto the true track based on single epoch observations.

In Figure 8 an excerpt of 1000 epochs (sampling intervalof 1 sec.), corresponding to about the first 25 km oftravelled distance, the posterior probability of thehypothesis corresponding to the true track (actually track#1), based on single epoch residuals, given by Eq. (40) isreported, together with the flag indicating the validity ofthe computed data.

Figure 9. Correct detection of the hypothesis corresponding tothe true track.

In Figure 9 the event corresponding to the correct trackdetection is also reported.

The experimental track error probability for the inter-track offset of 2 m. is about 0.15. This result is in goodaccordance with the value obtained from Eq. (46). In fact,for M=2, b=2 m, 0 0/ 0.75i Γ b b and 0.75m ,the track error probability equals 0.158.

Figure 10. Posterior probability of the hypothesis correspondingto the true track based on 10 epochs observations.

In Figure 10 the posterior track probability based on 10observations is also reported. Although at least 10 timesmore epochs should be employed to meet the requiredtrack error probability, statistical relevance of thereported results motivated the selection of a smallernumber of epochs to verify the applicability of Eq. (50).The reported results evidenced that, in presence of signaldegradations like those due to multipath, the errors arenot statistically independent. Instead some form ofclustering is present. The temporal correlation of thedecisions (and consequently of the errors) may reduce thegain obtained by temporal integration, especially when asmall number of epochs is employed.

VII. CONCLUSIONS

This paper has presented a novel solution to allow thediscrimination of the track where the train is located, as acontribution for the adoption of GNSS on the ERTMS-ETCS train control system. As confirmed by theexperimental activity, the joint use of a track database andGNSS measurements allow to discriminate the currenttrain track.To achieve track error probabilities compatible with SIL4 operational requirements, temporal integration has to beperformed when pseudoranges extracted from codetracking measurements are employed. Moreover,considering that track detector performance is driven bythe ratio between the track offset and the receiverequivalent noise, some kind of augmentation (e.g.WAAS, EGNOS) has to be adopted to reduce the impactof ephemerides errors, and ionospheric and troposphericincremental delays.

0 100 200 300 400 500 600 700 800 900 10000

0.2

0.4

0.6

0.8

1

1.2

Epoch

Track #1 single epoch posterior probabilityCaronte data set

Track #1 Posterior ProbabilityValidity of the estimate

0 100 200 300 400 500 600 700 800 900 10000

0.2

0.4

0.6

0.8

1

1.2

Epoch

Track #1 single epoch correct detectionCaronte data set

Track #1 correct detectionValidity of the detection

0 100 200 300 400 500 600 700 800 900 10000

0.2

0.4

0.6

0.8

1

1.2

Epoch

Track #1 Posterior Probability based on 10 epochs observationsCaronte data Set

Track #1 Posterior ProbabilityValidity of the Estimate

Since, based on Eq. (50), 0 0/iΓ b b increases with thesquare root of the number of epochs employed in thedecision, achievement of fast track discriminationrequires a consistent reduction of the receiver equivalentnoise, as the one achievable, for instance, by resorting tocarrier phase tracking. On the other hand, the alternativesolution based on the adoption of RTK mode requires alarger telecommunications bandwidth and a denseraugmentation network, compared to the one actuallydeployed by the EGNOS system

APPENDIX A. TRACK ERROR PROBABILITY

Since the PVT estimation procedure operates on alinearized system, in order to compute the statistics of

kHζ conditioned to the Hypothesis Hi, let us denote with

ˆnfis the estimate of the train mileage for the i-th track in

absence of receiver noise and multipath (noise-free case),under the condition that the i-th hypothesis is true. Inaddition let us denote with bi,k the offset of the k-th trackwith respect the i-th one.Using ˆnf

is as initial point for the mileage estimation forthe k-th hypothesis, with reference to Fig.2, the differencebetween the geometrical distance p

kr between the p-thsatellite and the point lying on the k-th track with mileageˆnf

is , can be written in terms of the analogous quantity pir

of the i-th track, as follows

, ,, , ,p p p p p p p p p p p pk k k i i i k k k i k k i i k kr r r e b e e e b e e e e e (52)

so that for their difference we have,p p p

k i k ir r r

,, 1 ,p p p pi i k k i kr e e b e , (53)

where pke and p

ie are the unit vectors corresponding to thelines-of-sights from the p-th satellite and the receiverlying on the i-th track and on the k-th track respectively.

Figure 11. Receivers geometry

On the other hand, with reference to Figure 11,considering that:

2

, ,,1 2 cosk i k ip p p

k i k ip pi i

b br r

r r

, (54)

and that for |bk,i|< 20 m, for the GPS constellation we have

, 610k ip

i

br

, (55)

the Taylor’s expansion

1 12 (56)

can be applied, so that for the single difference of thepseudoranges of the p-th satellite the followingapproximation holds

2,

, , , , ,1cos cos2

k ip p pk i l i k i l i k ip

i

br b b

r . (57)

Observing that , , ,, cosp p

k i i k i k ib b e (58)

we can finally write, ,k i i k i r P b . (59)

Therefore denoting with /ˆk iH Hz the output of the k-th

estimator when the true hypothesis is the i-th one, wehave

/ ,ˆ ˆk i iH H H i k iz z KPb . (60)

Therefore it follows that ,ˆ /

kH i i k iE H ν I HK Pb . (61)

Similarly, we have/ ,( )

k i iH H H i k i νζ ζ C I HK P b . (62)

For sake of compactness of notation let us pose( )i i νΓ C I HK P . (63)

Then, we observe that the magnitude ofkHζ will exceed

the magnitude of /k iH Hζ as soon as the magnitude of the

projection ofkHζ into the direction of ,i k iΓ b will be

greater than the half of the magnitude of ,i k iΓ b and itssign will be such that it will point in the opposite directionof ,i k iΓ b . Considering that

kHζ is a zero mean Gaussianvariable with independent components with unitaryvariance, i.e.,

(0, )iHζ I (64)

the projection ofkHζ into the direction of ,i k iΓ b will be

a zero mean Gaussian random variable with unitaryvariance too.

Rxk Rxi

p-thsatellitelocation

bk,i

k-th track i-th track

In presence of multiple hypotheses, an error event isgenerated each time the lower threshold (i.e., the oneassociated to the adjacent track) is exceeded. Thereforethe conditional probability of selecting one of the othertracks when the i-th track is the true one, given by Eq.(43) immediately follows.To evaluate the track error probability increase due toundetected satellite faults and/or incremental ionosphericand tropospheric delays not fully compensated by theaugmentation system, let us denote with p the erroraffecting the p-th pseudorange due to the cited errorsources. In this case the estimate ˆ

iHz will be affected bythe additional error K ξ so that:

ˆ /iH iE H ν I HK ξ , (65)

and ( , )

iH νζ C I HK ξ I (66)

On the other hand, we have/ ,( )

k i iH H H i k i νζ ζ C I HK P b(i) (i) ( ) ( )( )k k νC H K H K ξ . (67)

where the i and k superscripts have been introduced toremark that their values may be potentially different,being referred to different initial point for Taylor’sexpansion.Thus denoting with ( , )i kΨ the quantity

( , ) (i) (i) ( ) ( )( )i k k k νΨ C H K H K , (68)

the conditional probability of selecting one of the othertracks when the i-th track is the true one, is

(1,2)2,1

( ,k)1k,i

1

(M,M 1)1,

1 12 2 2

1 12 2 2

12 2 2

i

i

iii

ek ik i

i M M

erfc i

P erfc i M

erfc i M

Γ b Ψ ξ

Γ b Ψ ξ

Γ b Ψ ξ

. (69)

REFERENCES[1] Filip, A., Beugin, J., Marais, J. “Safety Concept of

Railway Signalling Based on Galileo Safety-of-LifeService,” COMPRAIL, Toledo, Spain, Sept 15-17,2008, pp. 103-112.

[2] A. Neri, A. Filip, F. Rispoli, and A.M. Vegni, “AnAnalytical Evaluation for Hazardous Failure Rate in aSatellite-based Train Positioning System withreference to the ERTMS Train Control Systems,” inProc. of ION GNSS 2012, September 17-21, 2012,Nashville, TN, USA.

[3] Filip, A., Neri, A. Rispoli, F. “GNSS for railwaysignalling and train control: migration from aviationrisk to hazard rate and safety integrity level,”EUROPEAN Transport Research Review (manuscriptsubmitted on June 10th, 2012).

[4] Filip, A. “Dependability Assessment of SatelliteBased Augmentation System for Signalling and TrainControl,” International Heavy Haul AssociationConference (IHHA 2011), Calgary, Canada, 19-22June 2011.

[5] Rispoli F., Filip, A. ; Castorina, M. ; Di Mambro, G. ;Neri, A. ; Senesi, F., “Recent progress in applicationof GNSS and advanced communications for railwaysignaling”, RADIOELEKTRONIKA, 2013 23rdInternational Conference, Pardubice, 16-17 April 201,Page(s):13 – 22, ISBN: 978-1-4673-5516-2, D.O.I.10.1109/RadioElek.2013.6530882.

[6] Galileo Integrity Concept, ESA document ESA-DEUI-NG-TN/01331, 2005.

[7] S. Pullen, T., Walter, and P. Enge, “SBAS and GBASIntegrity for Non-Aviation Users: Moving Away fromSpecific Risk,” Intl. Tech. Meeting of the Institute ofNavigation, San Diego, CA, USA, pp.533-543, 2011.

[8] Van Trees, Detection, Estimation, and ModulationTheory, Part III, John Wiley & Sons, 2001.