GE/GN8578. Guidance on the Use of Satellite Navigation. Railway Group Guidance Note

Transcription

1 GN Published by Rail Safety and Standards Board Evergreen House 160 Euston Road London NW1 2DX Copyright 2008 Rail Safety and Standards Board Limited GE/GN8578 Issue One December 2008 Railway Group Guidance Note

2 Issue record Issue Date Comments One December 2008 Original document Superseded documents Supply This Railway Group Guidance Note does not supersede any other Railway Group documents. The authoritative version of this document is available at Uncontrolled copies of this document can be obtained from Communications, Rail Safety and Standards Board, Evergreen House, 160 Euston Road, London NW1 2DX, telephone or Railway Group Standards and associated documents can also be viewed at Page 2 of 86 RAIL SAFETY AND STANDARDS BOARD

3 Contents Section Description Page Part 1 Introduction Purpose of this document Copyright Approval and authorisation of this document Advice for readers 5 Part 2 Overview Scope System boundary Structure of this document Related documents Technology overview The railway context Locator architecture and interfaces in the railway environment Onboard architecture Onboard interfaces Physical architectures Providing for locator upgrading Existing standards in satellite navigation services 16 Part 3 Guidance on the Use of GPS The Global Positioning System (GPS) Matters requiring attention when implementing GPS Augmentation techniques Locator quality of service The quality of service parameters The future GNSS improvements and developments 29 Part 4 Guidance on Classes of Locator Requirements Quality of service parameters Service class guidance The three classes of locator Functional architecture 33 Part 5 Choice of Equipment Introduction Augmentation choices summary Achieving application quality of service 40 Part 6 Design and Installation Good Practice Guide Introduction Implementation process System integration Equipment installation EMC System approval 50 RAIL SAFETY AND STANDARDS BOARD Page 3 of 86

4 Appendix A Technology Overview 52 A.1 Overview of positioning technologies 52 A.2 Augmentation services 62 Appendix B Interface to a Train Data Bus 75 B.1 Interface C : Position and speed reporting 75 Appendix C Summaries of Some Applications of GNSS 76 Definitions and Explanations 78 Abbreviations and Acronyms 82 References 86 Tables Table 1 Summary of GPS augmentations performance 25 Table 2 Summary of classes of locator requirements 31 Table 3 Indicative characteristics of various combinations of GNSS components 40 Table 4 Equipment location options 49 Table 5 RGSs relevant to system approval 51 Table 6 Quality and performance of gyro sensors 72 Table 7 Summary of some GNSS applications 77 Figures Figure 1 Satellite navigation related interfaces to onshore and onboard applications 8 Figure 2 Satellite navigation applications and benefits 12 Figure 3 Satellite navigation equipment sub-functions 13 Figure 4 Onboard locator interfaces and communications architecture 14 Figure 5 Effect of railway environment upon GPS performance 20 Figure 6 Examples of locator augmentation options 26 Figure 7 Statistical nature of accuracy 28 Figure 8 Illustration of Class C functional architecture 34 Figure 9 Illustration of Class B functional architecture 35 Figure 10 Illustration of Class A functional architecture 36 Figure 11 Typical installation of a GPS antenna 47 Figure 12 Typical installation of a GPS receiver for OTMR function 49 Figure 13 Generic view of satellite navigation services: standalone 52 Figure 14 Generic view of satellite navigation services: external augmentation 53 Figure 15 Figure 16 Generic view of satellite navigation services: on-board augmentation (hybridisation) 53 Generic view of satellite navigation services: complementary radionavigation 54 Figure 17 Galileo institutional arrangements 59 Figure 18 Horizontal accuracy of IMU following GNSS failure 72 Page 4 of 86 RAIL SAFETY AND STANDARDS BOARD

5 Part 1 Introduction 1.1 Purpose of this document This document gives guidance on good practice for the specification, purchase, implementation and installation of satellite navigation technology in support of applications requiring train position and speed. The guidance is provided for train operators, train builders and service providers. 1.2 Copyright Copyright in the Railway Group documents is owned by Rail Safety and Standards Board Limited. All rights are hereby reserved. No Railway Group document (in whole or in part) may be reproduced, stored in a retrieval system, or transmitted, in any form or means, without the prior written permission of Rail Safety and Standards Board Limited, or as expressly permitted by law. Rail Safety and Standards Board (RSSB) members are granted copyright licence in accordance with the Constitution Agreement relating to Rail Safety and Standards Board Limited. In circumstances where Rail Safety and Standards Board Limited has granted a particular person or organisation permission to copy extracts from Railway Group documents, Rail Safety and Standards Board Limited accepts no responsibility for, and excludes all liability in connection with, the use of such extracts, or any claims arising therefrom. This disclaimer applies to all forms of media in which extracts from Railway Group Standards may be reproduced. 1.3 Approval and authorisation of this document The content of this document was approved by: Control Command and Signalling Standards Committee on 2 October 2008 This document was authorised by RSSB on 23 October Advice for readers This guidance note enables suppliers of positioning systems to understand the railway s use of these technologies, in order to serve the rail market more effectively The railway industry has identified a number of location based services, based on the ready availability of navigation data. These services can improve operating efficiency and later may improve safety, and can enable such diverse applications as on-board Passenger Information Services (PIS), Selective Door Operation (SDO) and vehicle tracking. Once sufficiently accurate and reliable services are available, this application set expands to include train control applications This guidance note is intended to indicate best practice. In order to make best use of the information, readers should consider how they intend to use satellite navigation, and for what applications, and then apply their initial ideas to the outlined framework of deployment Alternatively, readers can use this guidance note to gain an overview of the technologies involved, and how equipment may be selected to achieve different levels of service, and then assess what is most practical for their circumstances Since this guidance note is not intended to set mandatory standards, readers should consider it to be a framework which enables better judgement of what can be expected from satellite navigation systems and how this can be effectively achieved. RAIL SAFETY AND STANDARDS BOARD Page 5 of 86

6 1.4.6 There are already several separate initiatives aimed at providing satellite navigation facilities for operational applications on trains and, while there is a need to give each of these initiatives the freedom to innovate, there is also the risk that, in the absence of any co-ordinating initiatives, unnecessary incompatibilities could develop. Such a step would thereby limit the value of these initiatives A common approach to satellite navigation should better enable the development of applications that use navigation information. If standard communications services are available, both on-train and between a train and its operator, application designers should be free to focus on the applications themselves and justify those applications on the marginal benefits of each application, rather than the application having to bear separately the full costs of a supporting infrastructure. Page 6 of 86 RAIL SAFETY AND STANDARDS BOARD

7 Part 2 Overview 2.1 Scope The scope of this document is the on-train arrangements that support the use of satellite-based positioning technologies. It includes onboard augmentation and external augmentation techniques (introduced in 2.5) and supporting data Although the technology presented is Global Positioning System (GPS) based, the guidance will be applicable to other Global Navigation Satellite Systems (GNSS) such as GLONASS (the system of the Russian Federation) and Galileo (the future European system) Digital technologies, specifically satellite navigation, satellite communications and broadband are increasingly available for implementing train systems. They are expected to be key enablers for the modernisation of the British railway system. Applications include vehicle positioning and speed measurement to support customer information, customer services, internet and entertainment services. The precision is capable of exceeding that traditionally available to railway traffic management, and may over time lead to improved network capacity when applied to traffic control This document provides guidance to duty holders to facilitate the achievement of a level of system performance in these applications commensurate with their needs. It provides the foundation for duty holders to establish best practice; hence using these positioning technologies to meet the needs of the rail market more effectively The goal of the successful integration into railway traffic management and control of commercially available navigation and positioning technologies is to provide cost benefit to the railway. To support this goal, this guidance note addresses use and fitment within the railway environment This guidance note does not mandate or recommend any particular arrangement for the provision of positioning technologies, but sets out the issues and criteria which direct the choices to be made. It provides a framework within which innovation may be undertaken, yet avoiding the risk of unnecessary incompatibilities To facilitate installation and effective life-cycle management of the equipment, the guidance provides for: a) One antenna being shared between as many radio frequency applications as is reasonably practicable b) One positioning unit (termed a locator) accommodating the requirements for as many applications as is reasonably practicable, with a definition of the common interfaces. This provides for upgrading of the locator by straightforward replacement, with minimum impact on the applications This approach limits the proliferation of multiple equipments providing similar functions with the potential to compromise one another s performance Guidance on the use of data communication technologies is set out in GE/GN8579: Guidance on Digital Wireless Technology for Train Operators. This is relevant where the locator output is communicated to the trackside The installation of these systems is subject to the requirements of Railway Group Standards. RAIL SAFETY AND STANDARDS BOARD Page 7 of 86

8 2.2 System boundary The boundary to the guidance that is the subject of this document is set out in Figure 1. Key: Interface guidance in the scope of this document Not in the scope of this document Covered by GE/GN8579 Guidance on requirements and implementation in the scope of this document Guidance on implementation in this document Not in the scope of this document Data communications between train and trackside Signals from satellite navigation systems Onshore applications 1 Aerial (as far as practicable) Antenna Splitter Satellite navigation unit 1 Locator Unit Onboard applications Figure 1 Satellite navigation related interfaces to onshore and onboard applications Section 2.9 sets out guidance applicable to the following data interfaces across the boundary: a) The signals from GPS and augmentation service providers. Augmentation is introduced in 2.5 b) The interfaces between the locator unit and train systems. Page 8 of 86 RAIL SAFETY AND STANDARDS BOARD

9 2.3 Structure of this document The structure of this guidance note is top-down. The earlier parts address the system issues concerning the implementation of satellite navigation technology, and the later parts set out guidance on the equipment. It is comprised of six parts and three appendices The guidance includes a classification of locator requirements. This supports the management of life-cycle issues that are typical of these technologies, such as the adoption of commercial non-bespoke products, upgrading and mid-life replacement of equipment This guidance note is structured as follows: Part 1 General information This part sets out the background and purpose of this document and to whom it applies. Part 2 Introduction to satellite navigation on the railways This part explains the scope of the guidance. It introduces the concept of a locator. Part 3 Guidance on the application of satellite navigation With the support of Appendix A, this part sets out the technologies and their use. The system options available for use in a locator based upon satellite navigation are also set out. Part 4 Classes of service This part sets out a framework to categorise the performance requirements to facilitate the specification of standard products for the railway. Part 5 Equipment selection This part outlines how equipment should be selected for different applications. Part 6 Practical issues This part sets out the practical issues of implementation and installation The appendices comprise: a) Appendix A, which sets out an overview of satellite navigation and the supporting technologies and services b) Appendix B, which sets out guidance on the interface to a train data bus c) Appendix C, which sets out a summary of some applications Set out at the end of the document are: a) Definitions and explanations b) Abbreviations and acronyms c) References. 2.4 Related documents RSSB research project T671 provided the source material for this guidance note. RSSB research report T510 (expected mid-2009). The performance of GPS data in the railway environment. This investigates the variation of GPS data over time. RAIL SAFETY AND STANDARDS BOARD Page 9 of 86

10 RSSB research report T740. The analysis of GPS data from the railway network. This sets out the quality of the reception of GPS signals over the British railway network as experienced on the Network Rail data recording trains. The Galileo project GRAIL deliverables (expected late-2008). This project investigates the use of GNSS to support applications related to ETCS. It includes a broader review of other applications in less detail. GE/GN8577 Guidance on the Application of Selective Door Operation Systems. Applicable digital communication and positioning technologies are addressed. GE/GN8579 Guidance on Digital Wireless Technology for Train Operators. The interface between a locator and communications is addressed. 2.5 Technology overview The use of satellite navigation Satellite navigation systems have been available for some time. Originally intended for military use, they are now available to the public and applied intensively in the aviation, maritime and road transport sectors. With a need for only limited terrestrial infrastructure they have the potential to be extremely cost effective for determining position, speed, heading and time The most well-known global satellite navigation system is GPS (see Appendix A, A.1.3). This is a ubiquitous navigation system with a consistent and predictable performance When used by the general public, GPS is apparently easy to use. However, there are a number of subjects where, in order to obtain satisfactory and consistent performance in a professional context, attention is required. Examples are the type of antenna, and the manner in which a locator behaves when satellites are obscured. A professional user should understand the behaviour of GPS signals in the railway environment and how to relate this to the needs of the application. A range of techniques, collectively known as augmentation, are available to limit the consequences of this behaviour The behaviour of the GPS signals and the augmentations is predictable. An informed approach to the specifications of requirements ensures that projects and their applications are not put at risk from unexpected GPS characteristics. This guidance note provides the foundations for this informed approach GPS, augmentation and quality of service Part 3, together with Appendix A, sets out guidance on satellite navigation technology, its behaviour and the consequences, and the augmentation choices available to mitigate the consequences when they are unacceptable. Part 3 concludes by defining a set of parameters that characterise this behaviour Part 4 sets out the use of these parameters to define three classes of locator requirements for general use within the railway. A safety-critical extension for future use is also provided for. 2.6 The railway context Satellite navigation technologies have developed at a very rapid pace over recent years and are offering higher performance and functionality with reducing costs. The railway industry is taking advantage of the development of satellite navigation and has introduced these technologies in a number of applications. The consequence is that trains are becoming equipped with more than one GPS system. Train systems integration is becoming problematic, as there are limitations of antenna location, data communication, data preparation and GPS performance that have to be taken into account to optimise installation and train maintenance through the life cycle. Page 10 of 86 RAIL SAFETY AND STANDARDS BOARD

11 2.6.2 Satellite navigation technology, augmented by other position determination methods, where appropriate, is seen as being suitable for a large range of the applications, many of which are already in service. This range includes (amongst others): a) The provision of time synchronisation for onboard systems b) Passenger Information Systems (PIS) c) Fleet / freight tracking d) On-Train Monitoring Recorder (OTMR) e) Passenger Load Determination (PLD) f) Automatic Passenger Counting (APC) g) Personal Digital Assistant (PDA) h) Traffic control and management i) Advisory speeds for energy management j) Energy metering k) Electronic ticketing l) Electronic seat reservations m) Closed Circuit Television (CCTV) time and position watermarks n) Selective Door Operation (SDO) o) Fault logging p) Engine efficiency q) Track monitoring r) Odometer calibration s) Odometer for European Rail Traffic Management System (ERTMS) Figure 2 sets out a schematic of the functional architecture that examples of applications (on the left side of the figure) and railway stakeholders (on the right side of the figure) can share. It is implicit in this figure that some applications require a data communications link with the trackside, for example, depots and control centres. GE/GN8579 sets out guidance on the implementation of shared data connections between the train and the trackside. RAIL SAFETY AND STANDARDS BOARD Page 11 of 86

12 S T A K E H O L D E R WLAN, GSM GPRS, 3G Entertainment/WiFi Figure 2 Satellite navigation applications and benefits The trend is for the future commercially available equipment to provide greater cost benefit for the railway. Guidance is therefore set out to indicate the standardisation and methodology needed for the future use and fitment of positioning technologies within the railway environment. 2.7 Locator architecture and interfaces in the railway environment A locator unit determines time, the train location, train speed and the heading at a predetermined rate. These are communicated to the dependent applications through one or more data interfaces. Page 12 of 86 RAIL SAFETY AND STANDARDS BOARD

13 Key: Not in the scope of this document Guidance on implementation in the scope of this document Guidance on data interface standards in the scope of this document Antenna(s) Splitter Signals to / from systems sharing antenna Interface B Cabling Power supply LOCATOR Power from train supply Interface C Satellite navigation outputs in standard format in the train data bus protocol Interface A Figure 3 Satellite navigation equipment sub-functions Figure 3 sets out the basic equipment required for an on-board satellite navigation based location. The basic equipment comprises: a) A combined omnidirectional (active) antenna, shared with other systems (for example, GSM-R) as far as practicable. It should be noted that some applications can use two GPS antennas b) A signal splitter for sharing radio signals with those other systems, with an appropriate amplifier c) A locator unit, fitted close to the antenna, giving a standardised output and taking standard inputs from train systems, where appropriate d) A power supply unit. RAIL SAFETY AND STANDARDS BOARD Page 13 of 86

14 2.7.3 Figure 4 develops Figure 3 with more detail. It shows the data communication arrangements in a generic architecture. This uses a single locator unit. This provides data to recipient functions over a data bus arrangement. For centralised applications, for example traffic regulation, the information is required at the trackside. The data communication to these trackside functions is shown through a communications gateway, for which the guidance is set out in GE/GN8579. Interface B Locator Unit Driver Information Interface A Data bus Comms Gateway Position and Event Reporting Passenger Information OTMR GE/GN8579 Notes: 1. Shaded boxes represent possible users of time and positioning data 2. An older train may not be fitted with a train data bus 3. Interface C, power supply, not shown Figure 4 Onboard locator interfaces and communications architecture 2.8 Onboard architecture This guidance addresses the functional components of a GPS-based locator. Figure 4 sets out example applications in their functional sense. The implementation of the applications requires the physical implementation of these functions to be allocated to physical units A design judgement should be made to support the modularity of the equipment, that gives preference to a single locator when this simplifies the integration of the onboard systems. The allocation of functions between the locator and an application should be decided by the user with the support of the designer authorities. Criteria which should be part of the decision are: a) The responsibilities for data preparation when in service b) The scopes of supply where more than one supplier is contracted c) The systems already on the train and their architectures. 2.9 Onboard interfaces Figure 4 sets out the locator unit having standardised interfaces. These are: Interface A: Interface B: Interface C: Train data bus Data from the antenna(s) Power supply. Page 14 of 86 RAIL SAFETY AND STANDARDS BOARD

15 2.9.2 The use of standard interfaces gives clarity and stability to application developers. With performance and functional requirements they provide a basis for interoperability over the network Clear guidance on antenna specifications and interfaces facilitates the integration of onboard systems Interface A is the subject of guidance set out in Appendix B Interface B is determined by the antenna characteristics. Criteria that determine this are the locator input requirements, the augmentation services chosen, if any, and the requirements on the splitter (see Figure 3) if any Interface C is dependent upon the train power supply arrangements, for which guidance is set out in On new build, the applications should share a common locator box and communicate over the train data bus, unless a case to implement more than one locator can be made. This also provides the interface to the communications facilities between the train and the trackside, which should conform to the guidance set out in GE/GN Bespoke interfaces may be required for particular applications, especially when retro-fitting to existing rolling-stock Physical architectures Physical architectures should be based on the guidance set out for interfaces and data communications. Part 5 and Appendix B contain the main guidance Effective application requires a considered choice of modules and their functions. These are determined in part by the specifications of the Commercial Off-The- Shelf (COTS) equipment available, and in part by the needs of the application(s) Physical architectures should support upgrading Providing for locator upgrading During the lifetime of a train, technology improvements to the provision of navigation data are ongoing, and the cost / performance ratio indicators of equipment can be expected to decrease well within the economic life of any rolling-stock. This enables the cost-effective provision of more demanding services. To facilitate the retro-fitting of such improved equipment to trains, the upgrade process should be reduced to box swapping, and possibly cards. Cables and antennas should be retained whenever possible Equipment should be scaleable to evolving application requirements, and a clear upgrade path supports the use of satellite navigation for increasing and more demanding applications through the life of the rolling-stock Figure 4 sets out a locator unit receiving GPS data from an antenna and providing positioning, speed and time data to a data bus. The data bus distributes this data to a number of users, for example: a) There could be a position and event reporting unit, which converts the locator output into reports as a service to other applications b) A communications gateway for transmitting the position, speed and event reports to the trackside c) Onboard applications, such as passenger information, on train monitoring recording and driver displays. RAIL SAFETY AND STANDARDS BOARD Page 15 of 86

16 To provide for upgrading, open standards should be used in preference to proprietary standards or the development of bespoke solutions. This encourages the development of more cost-effective COTS equipment and standard upgrade paths When considering upgradeability, an architecture should be considered that can accept a choice of augmentations successively, for example the selected satellite navigation antenna installed for GPS could be chosen to receive Galileo and the European Geostationary Navigation Overlay Service (EGNOS) signals as well. Therefore, only a receiver upgrade would be required. As another example, an interface and software for a future Inertial Measurement Unit (IMU) could be included Upgrading can be accomplished either by swapping the locator unit, and the communications unit, as set out in GE/GN8579, if necessary, or by the swapping or addition of cards within a unit provided with the necessary internal interfaces The common locator unit should be specified to the most stringent requirements of the dependent applications and aligned with one of the classes set out in Part A form and fit envelope specification within which the common locator unit can be packaged should be considered When considering life-cycle costs, the contribution of data generation and its modification and assurance, should be included Existing standards in satellite navigation services The standards currently in place for satellite navigation open public services are highly unlikely to change without having backwards compatibility. There are longterm government commitments and international co-operation agreements between the US, EU and other political institutions to provide the necessary stability The standards for satellite navigation interfaces in place for current systems and in development for future systems are: a) The format of the GPS signal-in-space is a given, set out in the GPS ICD [1] b) Open standards are available for the formats and signal structures of the publicly available external augmentation systems (see Part 3); these standards include RTCM SC-104 versions 2.3 [2] and 3.0 [3], ITU-M823-3 [4] and the EGNOS ICD [5] c) Open standards for safety-critical applications are being updated by international organisations, such as the International Electrotechnical Commission (IEC) to take account of satellite positioning developments, such as Galileo d) The standards for non-public (commercial) augmentation systems (see Part 3) are proprietary and the signals are encrypted Other industries have adopted the following standards to define satellite receiver outputs: a) An open standard exists and is widely used receiver outputs are defined in NMEA 0183 [6] which is a serial communications one-talker-many-listeners protocol b) Manufacturer-specific proprietary standards also exist. Page 16 of 86 RAIL SAFETY AND STANDARDS BOARD

17 Part 3 Guidance on the Use of GPS This part sets out the satellite navigation services available and the behaviour of their signals. The performance of these services has particular characteristics, and these strongly influence the quality of service required from the augmentations used by a locator. These provide the means to control the variability of the satellite signals to obtain a desired level of quality of service from the locator. The section concludes by introducing and explaining the parameters chosen to describe quality of service. Because it is well-known, and is at the time of publication the only viable satellite navigation system, GPS is introduced first. The issues that affect a successful implementation of GPS are also set out. Augmentation (introduced in 2.5) and its consequences (for example, additional radio receivers, the use of inertial devices, or more complex data according to the option) are also set out. The enhancements foreseen to GPS and the introduction of other satellite systems are set out under the generic term GNSS. 3.1 The Global Positioning System (GPS) Appendix A, A.1.2 sets out the basic facts of the GPS system. GPS has a number of features and, for the railway user, the following statements are important: a) GPS is free at the point of delivery. There is no contract for the provision of service, nor are there guarantees on the navigation performance that can be obtained b) The performance of GPS is statistical in nature; therefore, the attainable accuracy varies with time for the reasons set out in To be meaningful, any statement of accuracy performance should be accompanied with a level of confidence usually related to the Gaussian distribution, for example 95% or a σ range. Unless otherwise stated, an accuracy statement assumes complete visibility of the sky and is usually given with a 95% confidence. This means that for an average of 5% of the time the accuracy is less than, and can for short periods of time be much less than, the accuracy quoted. When there is partial obscuration of the satellites, the confidence level degrades c) Although rare, the presence of system faults and control errors can induce errors of several hundred metres for a limited period of time. 3.2 Matters requiring attention when implementing GPS The effects of GPS signal interruptions At switch on, or after a long obscuration, the locator does not have all the information it needs to process the satellite messages. It takes several minutes to obtain this information from the routine messages. This is known as the Time To First Fix (TTFF). Assisted GPS has been developed to reduce this problem, mainly for the mobile phone market. Appendix A, A.2.1.1, sets out this augmentation Following a temporary loss of signal (for example, while in a tunnel) it may take several seconds to re-acquire the signals and obtain a new position this is known as the Time To Fix (TTF). This occurs even when a sufficient number of satellites are in view. The cause is the manner in which the receivers decode the data messages. Some trade-off with sensitivity is possible, and simulation can be used by suppliers to tune their receivers to the railway environment (see 6.2) Factors affecting accuracy The accuracy achievable varies continuously. The factors that contribute to this variation are set out in this section. RAIL SAFETY AND STANDARDS BOARD Page 17 of 86

18 Ionosphere and troposphere errors: The satellite signals have to traverse the ionosphere and troposphere. The electrical properties of these outer parts of the earth cause delay to the signals and these result in ranging errors. They are also continually varying. The use of dual frequency receivers is a means to reduce these errors. In future satellite systems (see Appendix A, A.1.3.2, A and A.2.2.1) this may be the routine processing mode. However, the use of the GPS L2 signal is limited to carrier phase and Doppler processing, as the codes are not available at present to the open service. This processing is available only in high-end commercial receivers Satellite clocks: Time is a fundamental parameter to GPS signal processing. Each satellite has an atomic clock on board which is extremely accurate. Even so, the variability between them, although small, results in errors that are a major source of the inaccuracies experienced Ephemeris: Part of the GPS navigation messages contains the ephemeris data that informs the locator of the position of each satellite for ranging purposes. This cannot be exact, and the errors can occasionally become significant, especially when control errors occur Satellites in view: A locator without augmentation requires a minimum of four satellites in view to provide a complete solution, providing position in three axes, plus speed, heading and time. The satellites are not geo-synchronous and therefore their position in the sky changes. They can be considered to be quasi-static for a period of about 10 minutes, as follows: a) The constellation of satellites is distributed evenly around the earth. The number in view from the UK at any one time is typically about six and, routinely, can be nine or more b) The number of satellites in view can be reduced by cuttings, foliage, buildings and in stations, either resulting in decreased accuracy or a loss of GPS service coverage altogether c) The signals are always lost in tunnels, resulting in a loss of service coverage d) With certain augmentations and applications (of which the railway has the potential to be one) the minimum requirement can reduce to two satellites in view, and one on its own could be useful Dilution of precision: a) The locator solutions are derived usually by applying ranging techniques to each satellite in view. The accuracy performance varies with the geometrical arrangement of the satellites in view with respect to the user. For example, high accuracy can be achieved if the satellites are evenly distributed around the user, whereas accuracy can be much lower if the visible satellites are in the same area of the sky. This happens, typically, for less than one hour per day. This effect is called the dilution of precision (DOP). The need for control of the effects of DOP is one of the reasons to employ augmentation b) For guidance, a value of DOP of three or lower is routine and considered acceptable. For short periods of time the DOP value can exceed 10 Page 18 of 86 RAIL SAFETY AND STANDARDS BOARD

19 c) When accuracy is quoted, it is prudent to assume, unless otherwise stated, that the applicable value of DOP is 1, and that the achievable accuracy at any moment (in the absence of other influences on inaccuracy) is given by the quoted accuracy multiplied by the prevailing value of DOP Multipath effects: The locator receives GPS signals direct from the satellites, and when tall buildings or other reflecting surfaces are nearby, also the reflected signals. These can lead to significant errors. To control them it is necessary to include in the locator specific processing. Two such techniques are Receiver Autonomous Integrity Monitoring (RAIM) (see b), and carrier phase measurements (see Appendix A, A.2.2.1) Satellite faults: Satellite faults, for example errors in the satellite clocks, are detectable by differential augmentation and receiver augmentation. These faults are rare, but not rare enough that safety-critical applications can be considered without employing such fault detection techniques Jamming and spoofing: The received signals are very low power and can be vulnerable to unintentional electromagnetic interference and deliberate jamming. The detection of this type of error, where seen to be a threat, can be controlled by the same techniques that detect other sources of inaccuracy and mitigate the effects Specifying accuracy requirements This section sets out a process that can be used to assess the accuracy requirements of an application It is necessary to assess whether accuracy is important to an application. Although accuracy is desirable, an understanding of what is necessary should be achieved In cases where a geographic database is accessed for information on widely separated locations, the accuracy of the location is often not critical because there is no scope for their confusion Where the location relates to a geographical feature, the accuracy is determined by the distances apart of such features to ensure that the correct one is identified, for example a railway route, or a road Consideration should be given to the frequency with which a wrong location could be acceptable. This in part is determined by the consequences of an error, the mitigations, and the possibility that errors are mitigated by a characteristic of the application. RAIL SAFETY AND STANDARDS BOARD Page 19 of 86

20 Dense foliage next to line High station platform gantry Tunnel LOCATION ACCURACY (m) 13 Reduced accuracy due to lower visibility (Dilution of Precision DOP) Loss of service coverage due to low visibility Reduced accuracy due to reflected signals (multipath effect) Continued loss of service coverage outside tunnel as signals are re-acquired (Time to First Fix TTFF) Expected accuracy performance under ideal open skies environment Complete loss of service coverage inside tunnel 0 Figure 5 Effect of railway environment upon GPS performance 3.3 Augmentation techniques The purpose of augmentation Figure 5 illustrates how the performance of an application based solely upon GPS location could be affected by the normal railway environment, and demonstrates the effects on both accuracy and service coverage Satellite signals on their own give sufficient service quality from the locator for some applications, but without augmentation do not support applications which require, for example, a high level of service coverage, or consistent high accuracy in the areas of satellite visibility GPS augmentation should be considered where: a) A quality of service coverage is required, or b) A consistent accuracy is required, or c) A level of confidence in the position and speed data provided by the locator is required. This is described as integrity. It reduces the probability that an unknown inaccuracy is present, and is applied to safety-related applications. The higher the integrity, the lower the probability of an unacceptable undetected error The main augmentation choices are: a) Differential augmentation. Ground stations are used to monitor the accuracy of the GPS signals being received and transmit to users corrections that improve the accuracy of their locators. The corrections can be broadcast from either: i) Satellites in space, or ii) Over terrestrial radio networks Appendix A, A.2.1 sets out these techniques Page 20 of 86 RAIL SAFETY AND STANDARDS BOARD

21 b) Hybridisation with other sensors in the locator c) More sophisticated processing of the GPS signal-in-space d) Map-matching techniques Accuracy: a) If an application does not require consistent accuracy, or if the consequence of inaccuracy is benign, then augmentation for accuracy should not be required. This could be the case of event reporting at spot locations, especially where the visibility of the sky is good. For guidance, acceptable inaccuracies of over 50 m may not require augmentation b) Where consistent accuracy is required over time and / or space, augmentation should be considered. For many applications it may be sufficient to know when an accuracy target is not being achieved, or to have an estimate of the likely prevailing error. Each case should be judged, but, for guidance, consistent target accuracies below 50 m could require augmentation, especially if required where the sky is only partially visible. Target accuracies below 5 m probably require sophisticated locators to obtain consistent performance. There will also be rogue values. The objective is to assess how important it is to be aware of them, how often they can be accepted and whether any mitigations are required c) To some extent, all augmentation methods contribute to improving accuracy and service coverage, but some are more appropriate than others according to the requirements. Advice should be obtained from a competent source when setting out the requirements. Section summarises the common augmentation techniques Integrity monitoring: Integrity is provided by two main techniques: a) The augmentation ground stations are able to estimate the achievable accuracy and transmit a warning when a defined threshold is exceeded. In addition, faulty satellites can be identified. This threshold is currently one specified by the aviation sector b) Locators can use the redundancy available when more than four satellites are in view and search for the best solution. This technique is called RAIM, and is set out in Appendix A, A The techniques can be extended to all sensors used by a locator Space-based augmentation GPS differential corrections from space are broadcast from other satellite systems. They provide good accuracy performance, but visibility of these other satellites is required. If the GPS satellites suffer obscuration at the locations of interest, then it is probable that these other satellites will also be frequently obscured. Hence, they are not usually a solution to the difficulties of service coverage. The details of space-based augmentation are set in Appendix A, A and A Terrestrial augmentation Terrestrial transmission of differential corrections do not suffer from the same difficulties as satellite visibility, and the signals should be capable of reception on a train. However, for dependable reception, as well as the signal strength along the railway, the susceptibility to the railway electro-magnetic environment should also be assessed. The details of terrestrial differential augmentation are set out in Appendix A, A and A RAIL SAFETY AND STANDARDS BOARD Page 21 of 86

22 3.3.4 Hybridisation with other sensors on a train Hybridisation with other sensors can, in principle, be implemented with almost any source of location, speed and acceleration data. For railway applications the most convenient devices are usually inertial devices and tachometers. They can be used individually or together. They are effective at extending the area of service coverage, the degree of effectiveness being determined by the size of the obscured area, the duration required for nominal operation and the accuracy requirement. For indeterminate periods of obscuration, if continuous operation of the locator is required, the accuracy requirement should allow for degradation over time. Appendix A, A.2.2.4, sets out the detail of the use of tachometers, and A sets out the detail of the use of inertial devices Other sensors are much better processed by the data fusion in the locator rather than the application. However, these sensors may already be used in the application. In this case it is necessary to ensure that errors are not accumulative in the final output. Although Figures 8, 9 and 10 allow for both possibilities, it is necessary to ensure that sensor errors are not accumulated within the locator output Processing of the GPS signals More sophisticated processing of the signal-in-space is becoming increasingly available in COTS equipment, as follows: a) The use of dual frequency receivers should become the standard in future GNSS equipment, with GPS providing this service as standard as the current satellites in the constellation are replaced b) Carrier phase processing is producing remarkable accuracies and, although it is sensitive to indirect transmission paths, the processing is becoming increasingly robust c) The use of Doppler information provides solutions that are independent of the ranging process. Appendix A, A.2.2.1, sets out more detail relating to these techniques Use of map-matching Map-matching techniques can also be employed. Because the train is on a train route, or a track, the use of coordinates in the solution reduces the dependence on the number of satellites in view and usefully contributes to the control of errors associated with hybridisation. The detail of the use of track coordinates is set out in Appendix A, A Although the use of only two dimensions in a map is a possibility, the solution is improved by the use of the three dimensions There are two types of map: a) A locations database. This contains data to support an application, for example where to make a particular announcement, which information to display or which doors to enable. This type of database is implicit in many applications and, even when confident that amendments and errors can be managed effectively, requires close management attention. In non-safetyrelated applications it is quite acceptable, but in safety-related applications the management of the data should meet the SIL required. b) Track coordinates. This data supports the data fusion process. As set out in Appendix A, A.2.2.3, there is confidence that the train is on a track. If available, map-matching with track coordinates is recommended because Page 22 of 86 RAIL SAFETY AND STANDARDS BOARD

23 there is a useful reduction in the minimum number of satellites required to make a fix, and the effectiveness of RAIM is improved. When using track coordinates: i) The procedure to create one currently is substantial it should become much easier in the future ii) iii) iv) It should be provided as a package, with a procedure that ensures amendments, error identification and correction are undertaken effectively An algorithm that ensures that the track is correctly identified at initialisation, and that afterwards the train s path is not normally lost, is desirable, but does not yet exist Standard formats for map data are not yet agreed Implementation of augmentation in COTS products Many COTS products include one or more augmentation methods. The procurement cost at the locator level is not usually significant in relation to its lifecycle costs. However, these do include costs such as, for example, antenna installation, data preparation and management, that can be significant Augmentation summary Table 1 sets out the main points of the principal augmentation techniques in terms of the locator quality of service parameters, service coverage, accuracy and integrity Augmentation and Appendix A Appendix A, A.2, sets out more detail on augmentation as follows: a) GPS information services external to the train: i) Assisted GPS (A-GPS) (see A.2.1.1) ii) Open Space-Based Augmentation Services (SBAS) (see A.2.1.2). In Europe the only open service is EGNOS (see A.2.1.3) iii) Commercial space-based augmentation services (see A ) iv) Terrestrial augmentation services (see A ) b) Onboard augmentation in the locator: i) Receiver autonomous integrity monitoring (RAIM), and its extension to all sensor requirements (see A.2.2.2) ii) Track coordinates map-matching techniques as an additional sensor, for prediction, and to support applications (see A.2.2.3) iii) Additional sensors in the on-board locator (see A and A.2.2.5). This is known as hybridisation iv) More complex GPS signal processing in the on-board locator (see A.2.2.1) c) Other radio-based positioning systems (see A ). RAIL SAFETY AND STANDARDS BOARD Page 23 of 86

24 Augmentation service (with GPS) No augmentation Open space-based augmentation system EGNOS Commercial Space- Based Augmentation Systems (SBAS) Terrestrial differential GPS (DGPS) Low-grade inertial systems Service coverage (with GPS) GPS signal not available in cuttings or stations where view of satellites is obscured GPS and EGNOS signal not available in tunnels, cuttings or stations where view of satellites is obscured At present, difficult to receive on trains via geostationary satellite. Data can alternatively be received via terrestrial communications (for example SISNeT), but no standard arrangement for the railway is yet in place Not available in tunnels, cuttings or stations where view of satellites is obscured. Communication arrangements with trains are undefined Not available in tunnels, cuttings or stations where view of satellites is obscured. The DGPS signal could be subject to interference on the railway An inertial measurement unit (IMU) gives a limited navigation availability when visibility of the satellites is lost. Low-grade systems only maintain the accuracy of the positioning up to approximately 20 seconds after the satellite signals are lost, before drift progressively degrades it. Precise performance not yet known in rail environment Accuracy and integrity (with GPS) 13 m accuracy at 95% confidence No integrity, unless RAIM is used The user needs visibility of the sky where the service is required. Subject to DOP variations 1 to 2 m accuracy at 95% confidence in clear skies. Actual accuracy is less in a rail environment A level of signal-in-space (SIS) integrity guaranteed The user needs visibility of the sky where the service is required. Subject to DOP variations 1 to 2 m accuracy at 95% confidence No integrity, although quality of service reports are available >99% availability, subject to satellites being visible 1 to 2 m accuracy at 95% confidence Integrity not quantified The user needs visibility of the sky where the service is required. Subject to larger DOP variations Maximum of 13 m accuracy at 95% confidence (as per GPS), but drift starts immediately No integrity unless RAIM is used Limited availability with rapidly degrading accuracy for a short period when satellites are obscured Subject to DOP variations Page 24 of 86 RAIL SAFETY AND STANDARDS BOARD

25 Augmentation service (with GPS) Medium- and high-grade inertial systems Service coverage (with GPS) Navigating by the IMU capability when satellites are not visible depends on the quality of the inertial system. Medium-grade systems can maintain the accuracy of the positioning for up to approximately one minute, whereas high-grade systems have equivalent performance over several hours Map-matching 5 to 10 m accuracy at 95% confidence (dependent on map accuracy and correctness) The user needs visibility of the sky where the service is required. Subject to DOP variations Accuracy and integrity (with GPS) Maximum of 13 m accuracy at 95% confidence (as per GPS), but drift starts immediately Integrity available by crosschecking GPS and IMU Better, but degrading accuracy, for longer periods (a few minutes) when satellites are obscured Limited navigating by the IMU available in tunnels, cuttings or stations when view of satellites is obscured Depends on use of prediction algorithms suitable for the railway RAIM RAIM provides some SIS integrity RAIM improves confidence in the signal regardless of the level of accuracy Not available in tunnels, cuttings or stations when number of satellites in view is limited May be of some help in detecting multipath Principle can be applied to all sensors Better than 10 m accuracy at 95% confidence Integrity subject to sufficient (>5) satellites being visible The user needs visibility of the sky where the service is required. Subject to larger DOP variations Table 1 Summary of GPS augmentations performance 3.4 Locator quality of service The term quality of service is used to describe the characteristics specified at the output of a locator. These characteristics describe the quality of the performance of the locator in the railway environment and in the areas of coverage required. Where service is needed, a defined minimum accuracy is usually required, and where the application is safety-related a guaranteed probability of undetected error or failure is also required (called integrity) Quality of service is set out by three principal parameters: service coverage, accuracy and integrity. Each of these parameters is statistical in nature, and there is no absolute guarantee of a particular level of performance, but rather a level of confidence that the equipment operates at or above the required performance. The parameters are interrelated. For example, specifying a high accuracy has a negative impact on integrity, and a low accuracy can make integrity more readily achievable. These are set out in more detail in The meanings of these terms in other transport sectors can be different. In official references, the definition of the performance of the GNSS signals-in-space conforms to aviation usage. Under the description of Required Navigation RAIL SAFETY AND STANDARDS BOARD Page 25 of 86

26 Parameters, the aviation sector defines quality of GNSS service parameters that are similar to, but not the same as, the use of the words availability, continuity and integrity in the railway sectors. The definitions in this document, and the use of the terms, conform to railway usage Although the GPS signals have a specified continuity property, this is completely masked by the variable coverage experienced in the railway environment. The first decision for a railway application should be to decide upon the service coverage required from the locator Different applications require different qualities of service. For example, the simplest applications (such as an on-board automatic passenger information system) only need a basic level of service, getting occasional input from the locator unit as a 'trigger' to indicate that the train is within a defined geographical range of a given point. Other applications may require a continuous stream of highly accurate position information to be available from the locator unit. This could be the case for trackside functions where the data needs to meet time delay requirements The augmentation techniques introduced above and set out in Appendix A, A.2, when combined correctly, provide a locator that meets the quality of service requirements of the application and its geographic area of use Often it is possible to achieve the same quality of service with different combinations of augmentation. Figure 6 sets out a typical set of alternatives. First, augmentations are added to improve service coverage where visibility of the satellites is obscured. This is followed by a subsequent step to add augmentation options to obtain improved and more consistent accuracy. The integrity performance of a basic GPS system can be obtained by augmentation to add the necessary integrity monitoring and / or redundancy. ILLUSTRATIVE Increasing performance Increase accuracy, integrity and availability GPS + IMU INS + SBAS One-step upgrade OR GPS GPS + basic + IMU INS + terrestrial augmentation GPS alone OR GPS + basic IMU INS OR Two-step upgrade Increase availability of position report GPS GPS + basic + IMU INS + RAIM Increase accuracy and integrity of position report OR GPS basic GPS + IMU + INS + map matching simple map matching Standardised interfaces allow plug & play Figure 6 Examples of locator augmentation options Page 26 of 86 RAIL SAFETY AND STANDARDS BOARD

27 3.5 The quality of service parameters Service coverage Service coverage provided by the locator refers to the proportion of the railway network on which a train s position can be determined at the required level of accuracy and integrity. Section sets out the need to consider the service coverage required by an application. It is the characterisation of a lack of service coverage that is the main factor in determining whether an application can operate with GNSS alone, or whether augmentation is required It is in the nature of the railway and GNSS processing that some temporary loss of service coverage should be accepted. The extent of the acceptability is defined by the application Depending upon the needs of the application, service coverage can be specified either: a) As the specific geographic area(s) where coverage is required b) The maximum distance that can be run before coverage is recovered c) The maximum time that can pass before coverage is recovered Accuracy Accuracy is the most commonly referenced performance parameter. Sections and set out guidance on assessing the accuracy needs that apply to all service classes. It is a meaningless parameter without an associated measure of acceptable statistical variation, as set out in Figure 7. The accuracy of GNSS and the supporting technologies vary continually in time. An indication of the instantaneous accuracy can be given by the DOP. The actual error present at any moment cannot be determined absolutely, for example, because of the presence of multipath effects, and varying durations of obscuration from the signals-in space. Accuracy requirements can also require the use of augmentation techniques It is the minimum accuracy required that should be specified. For most of the time, much better accuracy should be obtained. For a small amount of time it is inevitable that the required minimum accuracy may not be obtained. The application should be assessed to determine the consequences of inadequate accuracy and whether measures are required to compensate. In many applications the occasional operating inconvenience arising from inaccuracy should be acceptable. In others, an indication of marginal or inadequate accuracy could be required so that other measures can be put in place. Where, despite these measures, undetected inaccuracy could lead to safety concerns, a degree of integrity should be specified to limit the rate at which undetected inaccuracy or undetected lack of coverage can occur. RAIL SAFETY AND STANDARDS BOARD Page 27 of 86

28 Time series of position measurements Statistical distribution of accuracy ±2σ Measured position ±2σ 95% of measurements Time Measured position True position +2σ -2σ True position Measured position Figure 7 Statistical nature of accuracy Integrity Integrity describes the probability that a failure or error is present at the output of a locator, and it has not been detected. It is a measure that is applied when the application is safety related or safety critical. There are three components to integrity: a) Integrity risk (usually expressed as a probability of an undetected failure) that is to say, that a fault is present somewhere in the system and is not detected and, as a consequence, the data at the output of the locator is not trustworthy b) Alert limit (also known as the threshold value) is the maximum allowable error in the measured position before an alarm is triggered. The threshold value should be greater than the nominal accuracy of the locator unit in order to avoid excessive false alarms c) Time to alarm is the time elapsed between the occurrence of the failure in the system and its presentation to the user. The failure can be due to an excessive inaccuracy being detected (defined by the alert limit), or that a particular satellite or sensor is untrustworthy Where integrity is required, a form of augmentation is also required. In Europe, the GPS signals are monitored by EGNOS, as set out in A The integrity information is not readily available to trains at present. However, it is readily available to control centres, which can take appropriate action if an integrity failure is detected In the locator, integrity can be provided by RAIM, as set out in Appendix A, A The use of Doppler and carrier phase measurements can also be used, as set out in Appendix A, A These measures are necessary should errors due to multipath effects be considered to be unacceptable The monitoring of GNSS signals to confirm integrity is only acceptable for safetyrelated tasks if the monitoring itself meets a defined level of integrity. Page 28 of 86 RAIL SAFETY AND STANDARDS BOARD

29 3.5.4 Other quality of service parameters In addition to the main parameters set out in , there are other quality of service parameters. Applications should be considered on a case-by-case basis for: a) Availability / reliability: these terms are used in this guidance to describe the intrinsic performance of the on-board hardware b) Time To First Fix (TTFF): the time taken between switching the locator on, or resuming visibility of the satellites following a prolonged period of obscuration or being out of service, and obtaining the first reliable position and speed reports from the locator c) Time To Fix (TTF): the time taken between resuming visibility following a shorter period of obscuration (typically less than two hours) and obtaining the first reliable position and speed reports from the locator d) Fix rate: the frequency at which the locator unit is able to provide position solutions meeting accuracy and integrity requirements. 3.6 The future GNSS improvements and developments Standalone satellite navigation services are those that can be used to determine position, velocity and time, without recourse to any other system. The two systems planned, in addition to GPS, providing coverage in the UK are: a) The European Union s proposed system, Galileo see Appendix A, A.1.4 b) The Russian Federation s (GLObal NAvigation Satellite System) GLONASS not included in this document, due to uncertainty of its availability over the short-term Appendix A, A.1.2.1, sets out the use of multiple satellite systems. Other than GPS, these are not available for service at the time of publication. The use of multiple systems is attractive for applications which require integrity, because a number of sources of error become more easily detectable. The effects of DOP are also much reduced GLONASS is expected to be the first to become available, but the timetable is not known. Although the modulation scheme is not the same as GPS, there are combined GPS / GLONASS receivers on the market, particularly for high-end applications The European system Galileo is set out in Appendix A, A.1.4. The signals are similar to GPS, and are expected to provide a wider range of augmentation and integrity functions integrated within the system, rather than being additional as in the case of GPS. In particular, dual frequency receivers should become standard. This should enable ionosphere and troposphere induced errors to be reduced routinely. Dual GPS / Galileo receivers are already available on the market. However, this programme continues to suffer delay. In the meantime, the GPS constellation is being steadily improved by new satellites offering open dual frequency signals The third system could be Chinese. The details of the constellation and the technical details are uncertain, but the programme is going forward. The Indian government also intends to create an independent system In the longer term, beyond 2015, advances in atomic clocks and inter-satellite links should remove errors, due to the independent clocks currently in use. This should remove a principal source of error in GPS and, together with dual frequency receivers, enable sub-metric accuracies to be routinely available. RAIL SAFETY AND STANDARDS BOARD Page 29 of 86

30 Part 4 Guidance on Classes of Locator Requirements Classes of locator requirements are defined in this part, in order to provide a simple way of classifying types of locator based upon satellite navigation and augmentation technologies. These classes apply to the quality of the signal at the output from the locator, not the GPS signal alone. This part provides: a) The derivation of the service classes presented, using the quality of service parameters presented in Part 3 that describe the locator performance b) A functional view of generic functional architectures that provide the three classes, presented from C to A c) Reference to the technical solutions available. 4.1 Quality of service parameters General For the railway, Part 3 sets out three quality of service parameters: service coverage, accuracy and integrity. These parameters refer to the quality of the data at the output of the locator unit and are used here with the definitions set out in this document. The aviation and marine transport sectors have defined service levels derived from their navigation requirements. These are reflected in the required navigation parameters that are defined for locators in these domains, and that are part of the specifications for future GNSS systems The interrelationship between service coverage, accuracy and integrity A lack of service coverage at or above the threshold specified for the application has an immediate effect upon accuracy and integrity. It may be necessary for the locator to estimate when the accuracy has fallen below a specified threshold. There are two strategies: a) Suspend the applications and functions concerned b) Modify the confidence intervals for position and speed data, which enables some continued operation Accuracy specifications and integrity specifications have an inverse relationship. Excluding the hardware integrity performance, high accuracy and low integrity, and low accuracy and high integrity, have an equivalence in terms of locator performance. 4.2 Service class guidance This guidance note sets out three classes of locator requirements, each defined by a level of performance (service coverage, accuracy and integrity). The rationale for defining a small number of classes is: a) To encourage users to identify locator requirements according to the class appropriate for their applications b) To encourage the supply market to focus on locator products appropriate for the railway environment that align with these classes. A proliferation of bespoke products would be expected if a specific locator were to be designed for each application. This would result in higher costs The functional architecture of each class is derived from a generic functional architecture so that development from Class C to Class A can be seen as an upgrading exercise on a functional view. However, it is not the purpose to constrain innovation or the physical implementation. Page 30 of 86 RAIL SAFETY AND STANDARDS BOARD

31 4.2.3 The economics of these technologies are such that, if an application has requirements whose performance exceeds those provided by the standard class product, rather than modify the product, it could be preferable to adopt the COTS product of a higher class Table 2 sets out the relationship between the classes in terms of the quality of service parameters and augmentation options. Class Service coverage Accuracy Integrity C Limited to areas with an assured view of the satellites, with marginal improvement at the boundary if augmentation for accuracy or integrity is used Augmentation can be applied for accuracy purposes. Typical choices are differential augmentation and the use of speed measurement data, usually derived from a tachometer Integrity monitoring of the GPS and other data used can provide some integrity B Service coverage is increased by means of augmentation using inertial hybridisation The augmentation can be applied to obtain consistent accuracy. Track coordinates could be beneficial where satellites are obscured Integrity monitoring of the GPS and other data used can provide some integrity A Service coverage can be increased by means of augmentation using inertial hybridisation The augmentation can be applied to obtain consistent accuracy. Track coordinates could be beneficial where satellites are obscured Augmentation is applied for integrity purposes. Typical choices would be EGNOS to prove the signal-in-space, and RAIM or carrier phase techniques to control multipath. The locator itself may include integrity measures Table 2 Summary of classes of locator requirements Rationale and decision process The three classes of locator requirements are differentiated by the three quality of service parameters: service coverage, accuracy and integrity. From the simplest architecture, a GPS receiver with no augmentation, to the most elaborate, the classification presented provides a logical process to assess the augmentation that economically and practically supports the performance required from a locator. In and , a provision is made for a fourth Class A + to support safety-critical applications in due course. It is emphasised that the classes apply to the output of the locator The primary characteristic of the railway environment is the signal obscuration, due to tunnels, canyon effects, stations and foliage. Therefore, the first assessment of an application to be made defines the acceptable level of service coverage. Ideally, the application requirements would be defined such that no augmentation is required, but this is often not possible. Discontinuous applications would normally have the least demanding requirements, though there are exceptions. RAIL SAFETY AND STANDARDS BOARD Page 31 of 86

32 Having determined the need or not for augmentation, for reasons of service coverage, the next assessment to be made concerns the accuracy requirement. Beyond a certain threshold of accuracy, even if augmentation is not required for reasons of service coverage, a form of augmentation may be required to meet the accuracy requirement A persistent source of error in the railway environment is multipath. This is most likely to occur where there is partial obscuration of satellites or high-rise buildings border the railway, where it is more difficult to provide protection. The effect of multipath is also more severe when stationary or moving slowly. Where integrity is required, or accuracy requirements are high, the presence of multipath should be at least detectable and, if necessary, its effect limited The final assessment addresses integrity. The scope of this guidance note does not extend to SIL3 and SIL4 applications, as the use of GNSS-based locators to obtain these levels of integrity is in its infancy. There is confidence that GNSSbased locators are able to provide SIL1 and SIL2 levels of integrity, for which augmentation is usually necessary. Applications requiring an assured level of integrity are likely to be the most demanding on locator design. 4.3 The three classes of locator Class C Class C sets out the most basic type of satellite navigation receiver that excludes inertial hybridisation. Its distinguishing feature is that it suffers from obscuration and loss of service coverage. When based upon COTS products the accuracy performance is usually low, and integrity is not specified. Augmentation to obtain a desired accuracy requirement is provided for. There are occasional examples of applications that are managed such that the locator is required only in areas of open sky, but also requires an assured accuracy with integrity. Such an application is the Locoprol project, led by Alstom, Belgium Map-matching techniques are feasible, as is differential augmentation, subject to the guidance set out in Part 3 and Appendix A Although the hardware is usually COTS, the software modules need careful selection. Features such as the predictive modes, often implemented when signals are weak, may not be suitable for a railway application without modification or being disabled. Matters of concern should include the number of channels that can operate in parallel, TTF, and the treatment of weak signals Class B Class B includes augmentation, typically by hybridisation, to increase service coverage. Accuracy is provided to meet the needs of the application, but proof of integrity would not normally be possible unless the accuracy requirements are extremely undemanding. Based essentially on lower price COTS products, the performance in the absence of GNSS signals is limited in time. Map-matching techniques are feasible, as is differential augmentation, subject to the guidance set out in Part 3 and Appendix A Subject to the verification of features being suitable for the railway application, the software is usually that which is commercially available. This means that techniques to control multipath effects, such as carrier phase, dual frequency receivers and Doppler measurements are unlikely to be available as standard marketed features Class A Class A provides a specified safety integrity up to SIL2. The implications of integrity requirements on the software and the supporting functionality of the locator are such that the use of lower cost COTS products would have no purpose. In achieving integrity, there is a compromise to be made between the Page 32 of 86 RAIL SAFETY AND STANDARDS BOARD

33 4.3.4 Class A + functionality adopted to obtain the necessary diversity and fault detection, and the need to aim for simplicity to facilitate the proof of safety. The limitation to the achievable SIL is essentially due to single channel hardware whose SIL limit is SIL2, or at best low SIL3. SIL4 locator software is feasible, but not known to be commercially available outside of bespoke applications A Class A + is defined for integrity performance up to SIL4. This is, presently, futuristic. The necessary functionality is available, and in time should provide better service coverage, accuracy and integrity processing at less cost. The problem is to contain the cost of the safety platform on which these are implemented to enable such locators to be economic. To maintain an open market it is desirable to have techniques that make bespoke safety platforms from a given supplier unnecessary. The viability of these techniques as yet remains unproven Logically, the concept can also be applied to Classes C and B, to create C + and B + sub-classes. These would define higher integrity performance within the service coverage limits, as in the Locoprol example. Generally, the cost of providing specific software and perhaps hardware to do this for a restricted market, would be such that a Class A + product with a wider market is likely to be more cost effective. 4.4 Functional architecture The guidance on augmentation set out in Appendix A, A.2, should be understood before reading this section Class C locator The distinguishing feature of the Class C locator architecture is that it is dependent for positioning upon a GPS receiver. Figure 8 indicates that a range of augmentations are possible. These improve accuracy and could be used to support an integrity requirement, but do not significantly improve service coverage. As an example, the use of track coordinates would reduce the effect of obscuration, but it is not a solution to the areas of no coverage. The use of a tachometer could provide a limited extension of coverage. Assured accuracy where satellite visibility is inadequate would require the use of a Class B locator. RAIL SAFETY AND STANDARDS BOARD Page 33 of 86

34 Antenna Antenna Differential augmentation LOCATOR GPS receiver Track coordinates Train speed data Data fusion GPS (Note processor 2) Pseudorange for n Phase satellites. (Note 1) Time Position Position Speed Velocity Time Location database Application Notes: 1. May also include phase and Doppler information for each satellite (see Appendix A, A Kalman filtering is the usual technique, but others are used. 3. Dashed lines and boxes are optional augmentations to achieve the required quality of service. 4. The shaded boxes would normally be used unless the application has no need of them. Figure 8 Illustration of Class C functional architecture To enable the required quality of service to be obtained from the locator, the diagram includes GPS augmentation options, that is to say, differential corrections, use of phase and Doppler information and perhaps other sensors (a train always has a tachometer and therefore train speed data can be considered for use even in Class C architectures). However, these cannot be considered as usually within the capabilities included in low-value COTS locator products, and their use has cost implications. Page 34 of 86 RAIL SAFETY AND STANDARDS BOARD

35 4.4.3 Class B locator This class supports applications with a service coverage that includes areas with limited or no visibility of the sky. To improve service coverage beyond that achievable with Class C, the Class B locator architecture includes the Class C architecture and also a form of other augmentation options, usually an IMU. The quality of the IMU determines the accuracy versus service coverage performance of the locator. This, to a limited extent, can be traded against a low-integrity requirement. Figure 9 indicates the same range of augmentations as Figure 8 to obtain the required quality of service. Antenna Differential augmentation Track coordinates Train speed data LOCATOR Pseudorange for n satellites. (Note 1) Time GPS receiver Rate information Data fusion (Note 2) IMU Position Position Speed Velocity Time Calibration Location database Application Notes: 1. May also include phase and Doppler information for each satellite (see Appendix A, A.2.2.1). 2. Kalman filtering is the usual technique, but others are used. 3. Dashed lines and boxes are optional augmentations to achieve the required quality of service. 4. The shaded boxes would normally be used unless the application has no need of them. Figure 9 Illustration of Class B functional architecture RAIL SAFETY AND STANDARDS BOARD Page 35 of 86

36 4.4.4 Class A locator Based on the Class B locator architecture, Class A is able to deliver a SIL1 or a SIL2 integrity performance. To enable the required quality of service to be obtained, Figure 10 indicates the same augmentations options as Figures 8 and 9. Here, if used, these support the integrity requirement. The quality of the IMU determines the accuracy versus service coverage characteristic of the locator for the integrity requirement. Unjustifiably high accuracy should never be required. Antenna Differential augmentation Track coordinates Train speed data LOCATOR Integrity Pseudorange for n satellites. (Note 1) Time GPS receiver (Note 5) Rate information IMU Data fusion with RAIM (Note 2) Position Position Speed Velocity Time Integrity Calibration Location database Application Notes: 1. Should include phase and Doppler information for each satellite (see Appendix A, A Kalman filtering is the usual technique, but others are used. 3. Dashed lines and boxes are optional augmentations to achieve the required quality of service. 4. The shaded boxes would normally be used unless the application has no need of them. 5. Dual frequency receiver should be considered (see Appendix A, A ). Figure 10 Illustration of Class A functional architecture Page 36 of 86 RAIL SAFETY AND STANDARDS BOARD

37 The particular characteristics of Class A are: a) Integrity in the presence of multipath is demonstrated. Multipath is a significant source of risk in the railway environment to the extent that, if adequate controls and mitigation are in place in the receiver, the use of differential augmentation for integrity purposes contributes little to the attainment of the required integrity level. It does however contribute to attaining the accuracy requirement. A high-accuracy and service-coverage requirement requires an IMU of adequate performance, which cannot be considered as a usual offering included in lower value COTS products, and their attainment has cost implications b) The response to a fault in the signal-in-space is to detect it and isolate its consequence with a defined certainty. The use of RAIM and map-matching are probably the most effective means of doing this c) Because in the railway the locator needs to deal with regular obscuration, the absence of the satellite signals should not constitute a threat to safety. The tachometer and IMU combination provide integrity for a limited period of time, which is extended by the use of map-matching to track coordinates (preferably in three dimensions). Once this limit is reached, operating procedures should manage the continuing degradation d) Jamming and spoofing of GPS signals represent threats to the integrity of the locator. Measures to ensure integrity should be able to detect them in the same way as other threats are detected. Adequate measures should enable these to be treated as an inconvenience, rather than a threat to SIL1 and SIL2 applications. The use of RAIM (applicable to all sensors), mapmatching with IMU and other sensors, should provide adequate detection of erroneous signals, from whatever cause, as part of the data fusion process. RAIL SAFETY AND STANDARDS BOARD Page 37 of 86

38 Part 5 Choice of Equipment 5.1 Introduction Parts 3 and 4 set out the means to describe a quality of service, to provide a classification of the service required, and the supporting rationale This Part 5 provides guidance on a decision process to define the quality of service required, and therefore a class of locator, that meets the needs of the application(s). The use of a GPS-based locator is assumed This Part 5 also provides guidance for the user to understand the choices that can be made by a designer in meeting the quality of service requirement, because these can influence the integration of the on-board systems. For the decision-making process to be successful it is necessary for the user and the designer to be able to communicate and cooperate such that each can appreciate the problems the other is addressing. 5.2 Augmentation choices summary Once the application has been defined in terms of acceptable service coverage, accuracy and integrity, one of the following classes of architectures should be chosen: a) Class C: Gaps in service coverage. It is a GPS receiver with no inertial augmentation, usually a COTS-based product b) Class B: Higher service coverage. It is a Class C architecture that is augmented with inertial devices. Accuracy is assured within the specified obscuration limits, with no, or very low, levels of integrity c) Class A: High service coverage and with a specified integrity performance. Up to SIL2 integrity should be possible. Class A is more likely to require bespoke software because of the need to meet SIL standards The use of COTS products generally implies no intrinsic integrity of the output. In each case, however, the inclusion of bespoke software can provide integrity improvements by the use of algorithms processing a combination of differential augmentation, map-matching, inertial data and data from other devices In Table 3, brief descriptions of some combinations of techniques are summarised, with indicative performance and a rough order of magnitude cost figures. These are not intended to be definitive, as costs are changing all the time, with higher specification and / or lower cost equipment becoming available The figures exclude the cost of any certification that might be required for Class A. In addition, they exclude packaging and installation costs. These system combinations and levels of performance are currently feasible, with the exception that maps of sufficient quality are in development rather than available off-the-shelf. System combination GPS standalone Class C Performance Limitations Possible cost ranges unfitted 13 m accuracy at 95% confidence >70% service coverage Not available in tunnels, cuttings or stations when view of satellites is obscured ~ 100 per receiver Some SIS integrity assured with the use of RAIM Page 38 of 86 RAIL SAFETY AND STANDARDS BOARD

39 System combination GPS augmented by low- to mediumquality IMU Class B GPS augmented by EGNOS Class C, meeting a higher accuracy requirement GPS augmented by location database Class C. Class A is possible where the integrity of the location database is assured GPS augmented by map-matching Class C. Class A is possible where the integrity of the map database is assured GPS augmented by EGNOS and mapmatching Class C meeting a higher accuracy requirement. Class A is possible where the integrity of the map database is assured GPS augmented by commercial spacebased augmentation systems and mapmatching High accuracy Class C Performance Limitations Possible cost ranges unfitted 13 m accuracy at 95% confidence >90% service coverage, depending upon accuracy spread acceptable Some SIS integrity assured with the use of RAIM ~1 to 2 m accuracy at 95% confidence in open skies is less in an obscured environment Service coverage see Appendix A, A Higher integrity 5 to 10 m accuracy at 95% confidence >70% service coverage Medium integrity with RAIM 5 to 10 m accuracy at 95% confidence >70% service coverage Medium integrity with RAIM ~1 to 2 m accuracy at 95% confidence (best case see above) >60% service coverage High integrity ~0.1 m accuracy at 95% confidence <70% service coverage Unquantified integrity Navigating by the IMU alone is available when view of satellites is obscured for a limited period, the length of which depends on the quality of the IMU (ranging from tens of seconds for low quality to several minutes for medium quality) Not available in tunnels, cuttings or stations when view of satellites is obscured Quoted accuracy may not be achieved in conditions of poor DOP Not available in tunnels, cuttings or stations when view of satellites is obscured. Dependent on the creation and management of location databases Not available in tunnels, cuttings or stations when view of satellites is obscured. Dependent on the creation and management of digital route maps Not available in tunnels, cuttings or stations when view of satellites is obscured Quoted accuracy may not be achieved in conditions of poor DOP Not available in tunnels, cuttings or stations when view of satellites is obscured ~ 500 to 5,000 per locator, depending on grade of INS ~ 300 per receiver ~ 200 per receiver ~ 200 per receiver Route map costs influenced by the quality and level of accuracy required ~ 300 per receiver Route map costs influenced by the quality and level of accuracy required Not known, as equipment and services are provided by subscription on a commercial basis RAIL SAFETY AND STANDARDS BOARD Page 39 of 86

40 System combination GPS augmented by EGNOS, mapmatching and lowgrade inertial systems Class A is possible where the integrity of the map database is assured GPS augmented by space based augmentations and medium-grade inertial systems Class B and Class A Performance Limitations Possible cost ranges unfitted ~1 to 2 m accuracy at 95% confidence (best case see above) >90% service coverage depending upon accuracy spread acceptable An integrity level guaranteed ~1 to 2 m accuracy at 95% confidence >95% service coverage, depending upon accuracy spread acceptable Integrity possible Inertial system allows navigating by the IMU for short periods (tens of seconds) when GPS signal is obscured Inertial system allows navigating by the IMU for a few minutes when the GPS signal is obscured Table 3 Indicative characteristics of various combinations of GNSS components ~ 1,000 per unit depending on capability of IMU, service provided free of charge for EGNOS Route map costs influenced by the quality and level of accuracy ~ 1,000 to 10,000 per unit, depending on the capability of the IMU 5.3 Achieving application quality of service The choice of augmentation is not only for the designer, but also for the user. It can have a direct influence on the internal interfaces within a vehicle communication system; it affects the choice of antennas and their quantity, and it can affect the position of equipment within the vehicle. It also has implications for the responsibilities of the user during the system life cycle, especially where data management is concerned. The guidance set out in this section suggests a sequence of decisions that enable these issues to be reconciled with the needs of the application(s) GPS processing In accepting a design of a locator to meet service coverage, accuracy and integrity requirements, the user should ensure that the supporting design choices on the subjects below are made on sound arguments: a) The choice of single frequency or dual frequency receivers b) The use of phase and Doppler information c) The use of RAIM d) The use of differential augmentation e) The design of the data fusion The techniques a) to d) are expected to become increasingly common in COTS products. Their presence is always acceptable, although unnecessary complexity should be avoided. To understand whether they are required, the user should obtain from the locator designer the justification that demonstrates that the required quality of service is achievable with the choices made COTS products are likely to include features and characteristics that are not appropriate for the intended application. For example, dead reckoning when a locator is obscured from the satellites could be based on logic not applicable to a railway. Often, these features are not identified in the product specification. The purchase of these products requires a carefully managed process where the Page 40 of 86 RAIL SAFETY AND STANDARDS BOARD

41 product is shown to be fit for the application. Simulation, as set out in , should be considered The antenna is the subject of guidance set out in Part Decisions relevant to all Classes A, B and C Referring to the Figures 8, 9 and 10, the first choice concerns the use of a tachometer. Traction units invariably have a tachometric device, and the driver s speedometer has one almost by definition. Unless there are interface difficulties that are impractical to resolve, the data fusion should always include a train speed input. The reverse logic is also feasible, that is to say, the locator is able to monitor the wear of the wheels on the axle used to drive the tachometer (or speed unit) and maintain an estimate of a correction factor. Because of the uncertainties of the wheel / rail interface, there is a limit to which the prevailing diameter can be estimated, but it remains useful to do this The second choice concerns the use of an IMU, that is to say, to decide if Class C is sufficient. It can be used for: a) Service coverage. The output from the locator remains useful when in obscuration up to a defined maximum period and with a defined confidence b) Detecting track geometry with more certainty than with GPS, and can be used to match the location against an application database c) Improving accuracy and integrity The third choice concerns the use or not of differential augmentation. In the circumstances prevailing at the date of publication of this guidance note, there is yet no differential service suitable for the railway in real-time for most applications. If integrity is also required, then the actual performance of EGNOS (as the only choice available today) may be severely restricted depending upon reception of EGNOS information from the geostationary satellites and the level of GPS satellite obscuration. However, the guidance on differential augmentation set out in Appendix A, A.2.1, should be consulted before a definitive decision is made. When it becomes available to the railway, then it should certainly be used to achieve accuracy The fourth choice concerns the use or not of track coordinates. The criteria to apply here are: a) The availability of the data with sufficient quality. The quality should be proven to be acceptable by means of simulation b) The process to amend the data as it is modified over time. There could be a complete fleet of trains to update simultaneously Decision relevant to Classes A and B Classes A and B require a choice of IMU to be made. Appendix A, A.2.2.5, sets out guidance on the criteria that directs this choice Decisions relevant to Class A Class A requires that the integrity of the position and speed solutions be assured with a level of certainty. When available to the railway, the differential augmentation is able to contribute to the assurance of integrity. Its use requires a careful choice of locator architecture, including the manner in which the data fusion is implemented. This complex subject is for the designer, not the user; but the user should have at his disposal the evidence sufficient to support a claim by a supplier that his design meets the user s integrity requirements for the application. RAIL SAFETY AND STANDARDS BOARD Page 41 of 86

42 The same attention to the integration of the IMU within the data fusion is also required. There are several options, and the choice should be supported by a cogent rationale. The integrity of the IMUs data in the absence of GPS signals should be supported by a design concept. (One possibility is to use a tachometer, which can simplify the IMU required.) There are several ways to extract information from the GPS signals-in-space. The usual method of ranging can be complemented by using the Doppler information and phase information given by the carriers. There is also the option of using a dual frequency receiver (see Appendix A, A.1.3.2, A and A.2.2.1). Given the relatively low integrity requirements of SIL1 and SIL2, the user should avoid complexity and adopt the simplest solution possible. As these techniques become more common and available in COTS products their cost reduces. Where multipath is required to be effectively controlled their use is recommended, subject to the cost of supply being acceptable. Long Range Kinematic (LRK), Real-Time Kinematic (RTK) and phase techniques are unlikely to be essential but, if available in a competitively priced COTS unit, they should be considered. For SIL1 and SIL2 applications the precautions set out in BS EN :2002 should be sufficient to ensure the acceptability of the hardware and software Comment relevant to Class A The use of a safety platform to support a Class A + locator is unlikely to be economic. There is development of safety concepts to support SIL3 and SIL4 locators, but they are not yet in commercial use. Page 42 of 86 RAIL SAFETY AND STANDARDS BOARD

43 Part 6 Design and Installation Good Practice Guide 6.1 Introduction This part sets out some of the specific and practical aspects that should be considered when implementing satellite navigation technology. 6.2 Implementation process System performance definition It is the responsibility of the purchaser to map their own specific application requirements onto the classes of service defined in Part 3 of this guidance note. Particular attention should be paid to those operational environments in which the performance of GPS alone may not be sufficient to meet application requirements When specifying a satellite navigation system the full range of performance requirements should be specified. Parameters that should be considered are as follows: a) Accuracy, horizontal and vertical (if required) b) Service coverage c) Integrity d) The format and geodetic reference frame in which positional data is provided Communications and antenna requirements should be taken into account when determining the overall system performance requirements for the specific application(s) being considered Wherever practicable, the performance of different locator solutions should be simulated prior to any procurement. These simulations are available either via the purchase of COTS products or commercial consultancy services. This can provide a cost-effective alternative or complement to wide-area performance trials Cost and upgrade path As set out in 3.3, when different solutions are available, it is necessary to apply selection criteria to determine the most appropriate solution. In addition to quality of service, other criteria that should be applied are cost and upgradeability. The trade-off should be made considering longer-term strategy, as well as short-term drivers. For example, if future requirements call for a higher performance locator, then an easily upgradeable solution or even a higher performance option is generally preferable over a lower cost option When considering upgradeability, the solution selected should be such that the different augmentation services considered can be added successively, for example a satellite navigation antenna installed for GPS is likely to be able to receive Galileo and EGNOS signals as well, and would only require a receiver upgrade Life-cycle costs should include the data management arrangements. 6.3 System integration Responsibility When the implementation of a system is initiated, full consideration of the requirements of the integration with existing vehicle systems, such as speed RAIL SAFETY AND STANDARDS BOARD Page 43 of 86

44 measuring, should be made. The responsibility for the integration should be clearly stated within specification / contractual documentation System definition Existing vehicle interfaces should be clearly defined. If this information is not available it may be necessary to make on-vehicle measurements. The responsibility to define the interface should be clearly stated within specification / contractual documentation Risk assessment An assessment of the risks of installing the system should be carried out. It should include an assessment of the consequences of the failure of system interfaces, such as the possible false energisation of vehicle wiring; analysis tools, such as Failure Mode and Effects Analysis (FMEA) and Fault Tree Analysis (FTA) should be used, as appropriate. A demonstration that the risk to the existing vehicle systems is as low as reasonably practicable should be made The risk assessment should also be extended to the use of the system, on an application-by-application basis. This risk assessment should cover the various failures that might occur, and reflects the statistical nature of the performance of the locator unit. However, the risk assessment should also include explicit consideration of the potential impacts of the vulnerability of the satellite navigation system to unintentional electromagnetic interference, as well as the security threat of jamming and / or spoofing System support and maintenance The user s maintenance objectives for the system should be set out at the start of the project. Attention should be given to the management of all supporting data required Although the equipment should be maintained in line with manufacturers requirements, routine maintenance should not be required Role of design It is essential that maintenance and testing contribute to meeting reliability targets for a system in service. This is best achieved by placing maintainability at the heart of the design process The design of the locator unit should include built-in test equipment and autodiagnoses to the extent that this is compatible with the COTS and maintainability requirements. Where there is a conflict, a life-cycle cost model should be analysed to determine which should take precedence When a fault is detected, the unit concerned should be identified and a fault code assigned. This information should be made available to the staff responsible as part of the train s standard maintenance facilities Special attention should be paid to databases, in order to ensure that they are within their period of validity, and corruption should be detected with a high degree of confidence. Updating databases should be subject to verification to ensure that amendments are correct. Procedures should be commensurate with the level of safety required, and not more demanding, as this would lead to a waste of resources Guidance on the principal functional elements of maintainability are set out in Page 44 of 86 RAIL SAFETY AND STANDARDS BOARD

45 6.3.6 Built-in self-test Systems should include automatic self-testing. This should operate at switch-on and run continuously in the background. Examples are: a) Testing of system memory at start-up b) Verification that software versions are valid c) Verification that database versions are valid d) Verification that hardware interfaces are working. In particular there should be indications that confirm the train consist data, so that the interfaces and equipment present can be identified, and also indications that confirm the serviceability of the train communications In the event of failures, the system should provide notifications as follows: a) To the train maintenance system b) To the train crew, if any action is required to enable the train to continue in service Subsequent action, for example reporting failures to a central server, depends upon the train s maintenance system. 6.4 Equipment installation The following is based on principles used on successful installations. It may not be possible to comply with them completely, and the alternatives should be considered on a case-by-case basis Antenna selection Typical antennas provide near hemispherical coverage (that is to say, 160 degrees). Satellite signals are Right-Hand Circularly Polarised (RHCP) and therefore a conical helix antenna or variation is suitable. Antenna designs vary from helical coils to thin patch antennas In order to reduce multipath effects, a special type of antenna can be deployed known as a choke ring antenna. The antenna comprises vertically aligned concentric rings connected to the ground plane, whereby the multipath signals incident on the antenna at the horizon and negative elevation angles are attenuated. However, the cost of such an antenna may be prohibitive for many applications Antenna position It is preferable to share one antenna between all positioning applications, as far as is practicable. There should be one locator system on board, the requirements for which are determined from the applications. This avoids the proliferation of multiple equipments serving the same function and (potentially) compromising one another s performance, and which complicates the systems integration process. There are also limitations imposed on the number of antennas by the vehicle body construction Ideally, the antenna should be located on the vehicle longitudinal centre line, in order to maximise the line of sight of the satellites and should be as close to horizontal as practicable. Although this is not critical to successful operation, the antenna should be as close to the centre line as practicable To combat multipath effects, antenna positioning is of prime importance. The antenna should be placed above the highest reflector to prevent reflected waves from arriving from and above the horizon. Certain antennas require a ground plane to increase gain at low elevation angles. However, the ground plane itself RAIL SAFETY AND STANDARDS BOARD Page 45 of 86

46 may diffract signals incident on the antenna at low elevation angles (see also 6.4.3) The antenna should be positioned as far as practicable from all potential sources of Electromagnetic Interference (EMI). The minimum distances from particular sources for a receive-only GPS antenna should be: a) GSM / GSM-R Antenna 1 m b) CSR / SMA Antenna 1 m c) National Radio Network (NRN) Antenna 1 m These separation distances apply regardless of which service the antenna is receiving GPS, Galileo, EGNOS, other SBAS. An example is shown in Figure Pantograph and associated switchgear: due to the broad spectrum of noise that is generated during arcing, a minimum distance of 5 m is reasonable When the antenna position is being determined, consideration should be given to the position of the receiver in order that the cable length between the two is kept as short as is practicable Consideration of the future fitting of other antennas, for example GSM-R (both voice and data) should be made. These are usually required to be fitted at each cab-end of a multiple unit vehicle, and therefore fitting the satellite navigation antenna at the inner end of a vehicle fitted with a cab facilitates the future fitting of these other antennas. Equipment cupboards at the inner end tend to have more space available When multiple units are joined together as one train, the role of the intermediate antennas and systems should be assessed to determine whether they are required to be in service Antenna installation and maintenance Low-profile GNSS antennas are available that have a similar height to existing cab radio antennas and, therefore, if they are positioned in a similar longitudinal line, demonstrating that gauge is not infringed is straightforward. The choice of antenna should be made so that it can be classified as frangible, as set out in GE/GN8573: Guidance on Gauging Any ground plane requirements specified by the antenna supplier should be observed. If the antenna is mounted on a non-metallic roof it may be necessary to incorporate a ground plane within the mounting arrangement or apply a metallic film on the roof underside. Alternatively, an antenna that does not require a ground plane may be more practical To prevent the antenna and cabling from rising to an excessive potential, should the overhead catenary come into contact with the antenna, any exposed conductive part should be firmly bonded to the vehicle roof. This can be achieved by locally removing the existing insulating roof paint and replacing it with a conductive one, such as zinc primer The cable between the antenna and the receiver is a particular threat to Electromagnetic Compatibility (EMC) and should be routed separately to all other cables and not tied to them. Ideally, the minimum separation should be 150 mm and, if it is necessary to cross over other wiring, the cables should be aligned perpendicularly. The antenna cable should be as short as practicable Cable, compliant with manufacturers requirements and rolling stock requirements, not consumer co-axial, should be used. Page 46 of 86 RAIL SAFETY AND STANDARDS BOARD

47 The design of the installation should ensure that the level of sealing is still maintained Ideally, the design of the installation only requires roof access, in order to maintain or replace the antenna. If this is not practicable, then the ease of access to the underside of the roof should be considered The antennas should be maintained and cleaned in accordance with manufacturers instructions. Figure 11 Typical installation of a GPS antenna Receiver fitment standards To ensure a reliable performance, all electronic equipment should be compliant to BS EN 50155:2007 [7]. Included within this standard are the environmental conditions that the equipment can experience. These are usually more onerous than that are applied to standard commercial PC equipment and therefore should be carefully considered, together with the actual equipment installation to minimise equipment failure For retrofit applications, older vehicles usually have a control system based on relays that have unsuppressed coils. This means that supplies and battery volt connections can contain high-voltage direct transients and non-battery voltage connection indirect transients. To ensure reliable operation, experience has shown that, if electronic equipment is being retrospectively fitted to vehicles produced earlier than approximately 1995, then meeting the requirements of BRB/RIA Specification No 12 (1984) [8] should be considered, together with the standards identified by the train builder. Testing of older vehicles not built to BRB/RIA Specification No 12 should be considered Fitment requirements should include the general principles for on-train receiver (and general equipment) design. These include: a) The use of enclosures suitable for rolling stock b) The use of reverse polarity protection RAIL SAFETY AND STANDARDS BOARD Page 47 of 86

48 c) Maintenance and depot handling requirements, including electrical protection on test equipment d) Polarisation of connectors and use of different connector sizes e) Avoidance of gold plating on frequent use connectors f) Provision of spare cables within any looms Power supply The auxiliary supply on an Electric Multiple Unit (EMU) or electric locomotive is derived from the traction supply and is subject to interruptions when the train goes through neutral sections (25kV a.c. overhead) or 3rd rail gaps (750V d.c.). To prevent the frequent loss of operation when this happens, the system should be supplied from a vehicle battery-backed d.c. supply or its own Uninterruptible Power Supply (UPS). The voltage ranges for batteries are V d.c. and 18-28V d.c. The battery terminal voltage for an electrical multiple unit when not being charged is 96V; the battery terminal voltage for a diesel multiple unit when not being charged is 24V. There are exceptions. For example, the Class 66 and Class 67 freight locos and Eurostar passenger trains are 72V when not under charge, which is a European standard. London Underground vehicles vary from 60V d.c. to 110V d.c. depending upon build era These traction supply interruptions can at times cause the auxiliary supply to generate excessive surges, and therefore the effect on the equipment of those surges specified in BRB/RIA Specification No 12 (1984) should be considered, together with the standards identified by the train builder Position of the locator To limit the length of cable to the antenna, a suitable position for the GPS receiver might be the roof space or body-end equipment cupboards (passenger vehicles). Ease of access for installation and maintenance should be provided When retrofitting equipment to existing vehicles, the usual locations available, particularly on multiple units, are as set out in Table 4, together with specific environmental threats to consider. Location Environmental consideration Worst-case parameter Equipment cupboards Heat sources Max 55 C Ventilation requirements Zero air flow Roof space Luggage rack / stack EMI sources Heat sources Solar gain, temperatures in excess of 50 C have been recorded in these locations Ventilation requirements Leaking roofs Passenger interference Ventilation requirements Due to the combination of heat sources and solar gain, the equipment should be rated to meet the T3 category (70 C) as set out in EN 50155:2007 Zero air flow Page 48 of 86 RAIL SAFETY AND STANDARDS BOARD

49 Location Environmental consideration Worst-case parameter Underseat Passenger interference, a substantial enclosure, usually steel, is required for this location Ventilation requirements Liquid ingress from cleaning / passengers Table 4 Equipment location options Zero air flow The equipment itself should be sealed to EN 60529:1992 IP65, minimum Figure 12 Typical installation of a GPS receiver for OTMR function 6.5 EMC To ensure EMC, the equipment should not be located close to known sources of EMI, such as the following: a) Rotating machines and associated chokes and cables b) Line filter chokes c) Traction converters, transformers and alternators d) HV cables (25kV locomotives and EMUs) RAIL SAFETY AND STANDARDS BOARD Page 49 of 86