GNSS Integrity for Railway Transportation

This article contains an analysis of GNSS (Global Navigation Satellite System) integrity from a viewpoint of railway transportation. The integrity concept of functional EGNOS (European Geostationary Navigation Overlay Service) system is explained in detail and also the integrity mechanism of the future Galileo system is briefly outlined. In order to verify the theoretical conclusions, static measurements by means of EGNOS receiver in a safety mode have been performed. Selected experimental results are discussed.


MOTIVATION
Before a satellite navigation system such as EGNOS or Galileo can be used in railway safetyrelated applications, it is necessary to perform a risk analysis of the whole railway safetyrelated system and specify its safety integrity and dependability requirements.It is mandatory to perform the risk analysis according to the railway safety standards (EN 50126,EN 50129,etc.).For this reason, EGNOS dependability attributes as quality measures of one of subsystems must be determined -according to the railway safety concept.

DESCRIPTION OF GNSS INTEGRITY AND AVAILABILITY FOR RAILWAY ENVIRONMENT
It is well known that conditions for the application of GNSS in aviation and on railway are very different.This is mainly due to SIS (Signal-In-Space) shadowing by different objects along the railway line or by a landscape profile, and also due to the more demanding requirements for safety and dependability on railway.The total integrity of GNSS positioning can be influenced by errors in a space segment, errors due to SIS propagation effects in the atmosphere, errors due to multipath effects and finally by errors due to potential failures in the user receiver.The error sources with a potential impact on SIS integrity and effects of railway environment are depicted in Fig. 1.

SIS integrity
This means the integrity of SIS transmitted by satellites.Integrity is a measure of the trust which can be placed in the correctness of the information supplied by the system.Integrity includes the ability of the system to alert the user when the system should not be used for the intended operation.At this time, the system EGNOS has been certified for use in avionic safety critical applications since December 2010 (Safety of Life Service).The conditions for GNSS signal reception are different in each of these cases.The position can be determined only in a 1D domain at a single line.This leads to the use of simpler algorithms for integrity verification.At a single line there are often worse conditions for GNSS signal reception, due to bridges, nearby buildings, trees and forests along the line.The position is determined in a 2D domain to distinguish on which of the two or more parallel lines the train is situated in case of a double or multiple line.There will be significantly better conditions for GNSS signal reception.In the case of a railway station, where there are usually many parallel lines, there are frequently the best conditions for GNSS signal reception.On the other hand, it will be hardest to decide on which of the many parallel lines the train is situated.During the GNSS signal reception on earth ground there is also disturbing by multipath.

Position integrity
Position integrity is a measure of the trust which can be placed in the correctness of the estimated position.Position integrity is effected by SIS availability and multipath.Position integrity can be improved by adding inertial sensors (INS) such as an odometer, accelerometer, gyroscope and microwave Doppler speedometer.Data from INS can be fused by a Kalman filter and projected to the map of railway lines.It is thereby possible to check the position integrity by means of using maps.The mathematical equations which can be used were presented in [7].Also autonomous integrity monitoring can be used to increase position integrity; this means that the system compares the estimated positional error (represented by horizontal standard deviation estimated by the receiver) with the current level of the horizontal protection level (HPL) which will be explained further.

CURRENT EGNOS INTEGRITY CONCEPT
The EGNOS integrity concept is described in standard DO-229D.The EGNOS system has three satellites which provide information about system integrity.The EGNOS system signal is available throughout the whole of the European territory.The EGNOS signal is partially available even in Asia and Africa, as is depicted in figure 2. The dots in the graph represent ionospheric grid points (points where ionospheric corrections are available).The dots which are marked by red circles represent the territory where signal is theoretically available.This graph was generated by Pegasus software, which is being developed by Eurocontrol for EGNOS and Galileo validation tests.In both these modes a safety-related ground receiver computes the horizontal and vertical protection levels (HPL, VPL) from the data obtained in each epoch.For computing protection levels the system uses only data from satellites which are considered to be healthy (fault-free case).The current level of HPL indicates the area (a circle around the current user position) in which the above-mentioned failure rates are fulfilled.From the point of view of railway transportation HPL is important, because we predetermine the position in the horizontal plane [1,2].
The essential input quantities for HPL computation are: geometry between GPS satellites and the user (elevation i El and azimuth The accuracy of these parameters can be reduced by an ephemeris error (the difference between the expected and actual orbital position of a GPS satellite) and a satellite clock error.

HPL equations:
is the semi-major axis of error ellipse and is calculated as:   Matrix W is modeled under the assumption of uncorrelated measurements characterized by the variance for the observed satellite as follows: A more detailed view on the computation of integrity parameters is available in self standard DO-229D [1].
The key thing is the derivation of constant NPA H K , , it was originally chosen to be consistent with certain assumptions on the distribution of position error and on correlation time error.It is related to the probability of missed detection ( Pmd ) of misleading information (MI), where MI means that horizontal position error (HPE) is larger than HPL.The number of independent samples per time unit in EGNOS, based on ionospheric corrections, 360 s was adopted as a reasonable assumption to ensure independence [5].In the case of HPL, since the protection has to be bi-dimensional, K is determined from a Rayleigh distribution.
Factor K is directly calculated from the knowledge of the cumulative distribution function (cdf) of the relevant statistical law: was set as 6.18 based on the assumption that the decorrelation time of EGNOS errors is 360 s.However, an analysis of this assumption was done in [3].It therefore seems that presently this assumption has not been fulfilled by the EGNOS system [1,3,4].

GALILEO INTEGRITY CONCEPT
In the upcoming satellite navigation system Galileo, all satellites will broadcast integrity information, so it will be available worldwide.However the Galileo integrity mechanism will be different from EGNOS integrity one.Unlike the EGNOS concept, where the system computes horizontal and vertical limits for a given fixed integrity risk, a Galileo receiver will compute integrity risk for the user defining horizontal and vertical level (HAL -horizontal alert limit, VAL -vertical alert limit).Thus a Galileo integrity risk depends on the user specified alarm limit of interest [5].The relation between both integrity concepts and possibilities of using information from both integrity concepts was analyzed for example in [6].

PRACTICAL EXPERIMENTS
The EGNOS system is certificated for use in avionic safety critical applications, but in railway applications it is necessary to analyze the real performance of the system on the earth ground and to validate the fulfillment of EGNOS parameters on earth ground, and so to verify the theoretical properties of the system.Data collection was carried out with the ground safety-related GNSS receiver PolaRx3.Data collection was performed by means of the current available EGNOS system over three days, from 10 to 13 May 2011 in Pardubice in Czech Republic.Fig. 3 displays the position error (HPE) and HPL.HPL is computed by the receiver according to the above-mentioned equations.In the graph it seems that there are some relatively big jumps in the time behavior of HPL, while the level of HPE is approximately constant.The radius of the smaller blue circle is the distance root mean squared (dRMS), and the larger blue circle had a radius 2dRMS.It is computed per equations: Parameters CEP, dRMS, and 2dRMS express 2D accuracy of GNSS receiver.The number of available GPS satellites during data collection was between 5 and 12.The curve of numbers of satellites in time is periodic with the period of approximately 24 hours.Fig. 5 displays the histogram of HPE.It shows that the highest number of occurrences has a value of about 0.8 meters.Fig. 6 shows the histogram of HPL.From the graph it is evident that the highest number of occurrences has a value of about 8.3 meters.

CONCLUSION
The integrity mechanism of EGNOS system was analyzed in the article.The complex question of GNSS integrity in a railway environment was described.Equations for the computation of a horizontal protection level were shown.Real measured EGNOS data were presented at the end.According to the real data it seems that the level of HPL is too high at times.There are some unexpected high jumps in HPL time behavior, at times tens of meters.Therefore there are relatively frequent occurrences of false alarms.For the future capability of using EGNOS in safety-related railway applications, it is necessary to determine a methodology for finding the real failure rates of the EGNOS system at the earth ground.It is also necessary to find new methods of processing data from the EGNOS system with accordance to strict railway standards.More detailed analysis of real measured EGNOS data will be done in future work by means of statistical and time series analysis.
Especially the time series analysis of HPE and HPL may be fundamental for finding the real failure rates of the EGNOS system on earth ground.

Figure 1 :
Figure 1: Effects on GNSS integrity and SIS availability.

2. 2
SIS availability SIS availability is affected by different conditions along the railway lines.This part can be divided into three basic subparts:  single line,  double or multiple line,  railway station (many rails).

i
Az of the th i observed satellite), user differential range error (variance 2 , flt i  ), grid ionospheric vertical error (the error of airborne receiver (variance 2 ,air i  ).
model distribution that overbounds the true error distribution in the vertical axis and th i row of the geometry matrix G is defined with elevation El and the azimuth Az of the th i observed satellite as: the integrity requirement for this operation (in our case failure rate NPA  ), and n is the number of independent samples per operation.
the variance to a level compatible with the integrity requirement.

Figure3:
Figure3: Horizontal position error and horizontal protection level.

Fig. 4 N
Fig.4shows the measured position points (green points) and the true position of the antenna, which is marked by the red triangle.From the graph it seems that the variance in horizontal and vertical direction is approximately 3 meters.The mean value of measured points is marked by the red star.The red circle with the center at the antenna position means circular error probability (CEP).CEP means the radius of a circle which contains 50% of position points.It is computed according to the equation: