Approach to Certification of Satellite Based Localisation Unit in Railways

Transcription

1 Transport Research Arena 2014, Paris Approach to Certification of Satellite Based Localisation Unit in Railways Hansjörg Manz a*, Eckehard Schnieder a, Uwe Becker b, Carsten Seedorff c, Arne Baudis c a Technische Universität Braunschweig, Institute for Traffic Safety and Automation Engineering, Braunschweig, Germany b iqst GmbH Institute for Quality, Safety and Transportation, Braunschweig, Germany c BBR - Baudis Bergmann Rösch Verkehrstechnik GmbH, Braunschweig, Germany Abstract The work of the consortium of the European Commission funded project GaLoROI (Galileo Localisation for Railway Operation Innovation) is presented in this paper. GaLoROI aims for a certifiable satellite based localisation unit for railways serving as a base for modern train control systems allowing safe and precise continuous localisation of trains, which increases the capacity and operational performance in railways. Within GaLoROI the specifications of the localisation unit on the basis of railway s current state of the art as basis for its technical and software development are derived. This is followed by system integration, validation, tests and demonstration runs. To enable the later certification of the localisation unit for different applications, the structure of the standard compliant safety case required in railways for every commissioning of new system or device is analysed and structured. The whole project is accompanied by an analysis of economical impacts to enable an introduction of the localisation unit into railway operations. Keywords: signalling, train control, GNSS, satellite based localisation. Résumé Ce document présente le travail du consortium de la Commission européenne sur le projet GaLoROI (Galileo Localisation for railway operation Innovation). Ce projet vise à concevoir une unité de localisation satellitaire Certifiée pour les chemins de fer servant de base pour les systèmes de contrôle des trains modernes permettant la localisation continue des trains de manière sûre et précise, ce qui augmente la capacité et la performance opérationnelle dans le secteur ferroviaire. Dans GaLoROI les spécifications de l'appareil de localisation sur la base de l'état de l'art actuel sur les chemin de fer comme base pour son développement technique et logiciel sont dérivées. Elle est suivie par l'intégration de systèmes, de validation, de tests et essais de démonstration. Pour activer la certification ultérieure de l'unité de localisation pour différentes applications, la structure du dossier de sécurité conforme à la norme requise dans les chemins de fer pour chaque mise en service d'un nouveau système ou un périphérique est analysé et structuré. L'ensemble du projet est accompagné d'une analyse des impacts économiques pour permettre une mise en place de l'unité de localisation dans l'exploitation ferroviaire. Mots-clé: signalisation, contrôle de train, GNSS, la localisation satellitaire. * Tel.: ; fax: address: h.manz@tu-bs.de.

2 Manz, Schnieder, Becker, Seedorff, Baudis/ Transport Research Arena 2014, Paris 2 Nomenclature EU European Union FOC Full Operational Capability GNSS Global Navigation Satellite System SBAS Satellite Based Augmentation System SoL Safety of Life Service TCC Train Control System GaLoROI Galileo Localisation for Railway Operation Innovation 1. Introduction Galileo, the European satellite based localisation system, is currently put into service with a planned full operational capability (FOC) in EGNOS, a satellite based augmentation system (SBAS) part of the Galileo concept, has already started its Safety of Life (SoL) service providing huge potentials for ground transport applications by allowing the localisation for safety relevant applications preparing the introduction of Galileo. Projects dealing with satellite based localisation in railways have so far only demonstrated the usability of satellite based localisation in railways. GaLoROI, the project introduced in this paper, is going one step further by providing a certifiable localisation unit enabling the usage not only in non-safety relevant applications. Safety relevant applications include more than only train control but as well the control of level crossings, track maintenance and many more applications. The results of this paper and the project GaLoROI are not only applicable in Europe but as well in other parts of the world, where track side train localisation equipment is regarded as expensive and more economic and efficient train localisation solutions are requested GaLoROI project overview To enable the application of satellite based localization in transportation for safety relevant purposes, an approval of the according train localization based on a certified localization unit is necessary. This certification can be done both generic and domain specific (Manz & Schnieder, 2012) including the consideration of liability issues (Schnieder, 2009). A generic certification of localization requires the proof of safety of the used Global Navigation Satellite System (GNSS) like GPS, Galileo, GLONASS or Compass or of the Satellite Based Augmentation System (SBAS) like WAAS, EGNOS or MSAS. A domain specific certification would require the certification of the localization unit for the specific domain. In GaLoROI the approach of a domain specific certification was chosen because a generic certification of a GNSS or SBAS is currently not available. GaLoROI targets for a certifiable localization unit in railways which can after a certification by the according authorities based on the relevant documents be used as solely localization device Structure of paper In this paper the satellite based localization unit for railways developed in GaLoROI is introduced including its development and certification. In chapter 2 localisation in railways is introduced in general with a view on the current diversity which serves as motication for this paper. An overview of the project GaLoROI is given in chapter 3 including details of the consortium, the objective as well as the approach. The normative background which has to be considered for the certification is regarded in chapter 4 which is an important base for the safety case introduced in chapter Localisation in railways state of the art Satellite based localisation is used for various applications in all domains of transportation. This is made possible by the innovative use of existing satellite based localisation systems. The growing number of satellites as shown in Fig. 1 enables an increased availability and accuracy of satellite based localisation.

3 Author name / Transport Research Arena 2014, Paris GPS GLONASS Galileo Compass Fig. 1. Current und expected number of satellites in space Satellite based localisation is currently used in railways mainly for information purposes because of no existing certification. Therefore, traditional localisation is used as part of train control systems in Europe and worldwide. Fig. 2 shows these train control systems which have their specific sensors as means of localisation. They can be installed on the trains, at the infrastructure or at both, vehicle and infrastructure. The localisation solution presented in this paper is based on satellite based localisation which enables the localisation of trains independent from the train control system and is therefore an important base for the interoperability of trains in Europe required by the European Commission (European Commission, 2012) by overcoming the diverse implementations of localisation in the train control system EBICAB 700 EBICAB 700 EBICAB 900 ATP EBICAB 700 BRS AWS, TBL, PDS, TPWS ASFA, TVM, BRS ATBL, TBL, BRS KVB, TVM, BRS ZUB ATBL, 123 TBL ZUB 121, SIGNUM LZB, INDUSI LZB, INDUSI LVZ BACC, RSDD INDUSI SHP LVZ EVM not known various LZB, INDUSI, others various Fig. 2. Current train control systems in Europe (Meyer zu Hörste, 2004)

4 Manz, Schnieder, Becker, Seedorff, Baudis/ Transport Research Arena 2014, Paris 4 The safety relevant satellite based localisation of trains has currently no significant applications. This is due to the missing certification of satellite based localisation for railways as analysed in previous papers of the authors. Some branch lines are known using GPS as base for the train localisation, because of using radio based communication as fall back option, the safety relevant train control does not rely solely on GPS. In GaLoROI, this issue shall be considered with developing a certifiable satellite based localisation unit for railways which is an important step beyond the state of the art achieved by the authors. The base for the work of GaLoROI has been laid in previous national and international projects. The recent predecessor was DemoOrt, a German-funded project doing research on the accuracy of GNSS in railways proving the viability of the application of satellite based localisation in railways. Other projects were the French based LOCOPROL examining the integration of satellite based localisation into ERTMS and GEORAIL aiming on a European reference system for maps in railway applications on the base of EDTR GaLoROI: Innovative satellite based self localisation of trains The project GaLoROI is funded by the European GNSS Agency on behalf of the European Commission with a duration of 27 month from January 2012 until March The consortium consists of five partners iqst, BBR, IFSTTAR, iva and MRT. They will be introduced in the following subchapter 3.1. In subchapter 3.2 the objective of GaLoROI will be introduced, followed by the approach in subchapter Consortium members The project consortium of GaLoROI is lead by iqst which is a German small and medium size enterprise (SME) with a focus on safety in transportation. Their task as project leader is the coordination of all project relevant activities, meetings and schedules. BBR Verkehrstechnik is a German SME which develops and manufactures innovative electronic systems and products for railways and local public transport. They are responsible for the development of the GaLoROI localization unit and the system integration. IFSTTAR is the French institute of science and technology for transport, development and networks. In GaLoROI they contribute to the system integration, tests and the RAMS analysis for the safety case. The Institute for Traffic Safety and Automation Engineering (iva) of Technische Universität Braunschweig contributes to the project GaLoROI with a main focus on the assessment of the safety case and an analysis of economical impacts. The Department of Measurement and Control (MRT) at Karlsruhe Institute of Technology (KIT) specializes in the development of intelligent sensing techniques for autonomous vehicles. In GaLoROI, they develop the localization algorithm for the eddy current sensor Objective of GaLoROI The objectives of GaLoROI are to enable operational, economical, social and ecological innovations in railways. This shall be fostered by a higher dispatching flexibility and increased capacity which is a base for a more cost efficient operation. Furthermore the environmental influence and track maintenance efforts shall be reduced. A more cost efficient operation resulting by the developments in GaLoROI will lead to a stronger role of railways and therefore a more sustainable transport in general. Social innovations are various and include less waiting times for car drivers through reduced closing times of level crossings and exact stop at platforms of trains. To enable a safe localization in railways, the GaLoROI localization unit has to reach at least the safety level SIL 3. The objectives of GaLoROI are achieved by the realization described in the following subchapter. The localization unit developed in GaLoROI is tailored for low traffic density lines which have share of approximately 50% of the European railway network. Especially on these lines a more cost efficient operation

5 Author name / Transport Research Arena 2014, Paris would lead to more railway traffic and therefore a more sustainable transport. GaLoROI supports therefore with its objectives the target of the European Union (European Commission, 2001). GaLoROI has furthermore the objective to use EGNOS as satellite based localization information which is as well in line with the target of the European Commission to deploy EGNOS and make it available to a large market Approach of GaLoROI In previous GNSS related projects prototypes have shown that safe and precise satellite based localization is possible in railways. No project achieved the development of a safe satellite based localization unit in railways beyond the prototype status. To get beyond this prototype status, in GaLoROI a certifiable satellite based localization unit ready for the market will be developed. The main unique characteristic of the GaLoROI localization unit is the vehicle self localization without track side equipment or activities of the driver. With the resulting continuous instead of discrete localization the targets of GaLoROI like higher dispatching flexibility and improved passenger information as well as cost reduction can be reached. The economic impacts of GaLoROI are analyzed in a separate work package which is currently ongoing. The main saving factors are expected through a more efficient operation and no track side localization and signaling needed anymore. The localization unit shall have as output a safe train localization provided by the general structure is shown in Fig. 3. Two sensors eddy current sensor and Galileo receiver are installed twice to enable safety by redundant data input. Furthermore, a digital map is available which serves as well as sensor. For each line where trains shall operate a digital map has to be available. The input of the sensors is fused on a localization unit internal computer and then furthermore processed on a vital computer which is already certified for railway applications. Space Galileo receiver Track Eddy Current Sensor Data Fusion/ map matching algorithm Train Localisation Infrastructure Digital Map Vital computer Fig. 3. GaLoROI localisation principle The localization unit shall after its certification be used as solely localization device in train control. This can be for example done as virtual balise or with other solutions. The localization information which is obtained only by train side sensors will be communicated from the train via a communication network to the train control centre. The train control center sends an according movement authority and other relevant information back to the train. This basic principle is shown in Fig. 4.

6 Manz, Schnieder, Becker, Seedorff, Baudis/ Transport Research Arena 2014, Paris 6 Fig. 4. Integration of GaLoROI into train control system 4. Normative background To bring the localisation unit into operation, a certification according the normative background has to be carried out. Therefore, it needs to be analysed as base for certification and approval of the localisation unit in railways. As basis for the later certification of the satellite based localisation unit in railways, it and its associated systems have to be analysed according its properties and attributes. Based on this knowledge, a certification process appropriate for satellite based localisation in railways will be derived enabling innovative applications. A brief introduction to the safety case will be given in chapter General structure of legal documents To conduct a safety case, the relevant legal documents have to be followed. Because they are different in each domain and the application of the localisation unit as interoperable device in Europe is targeted, the general legal context in Europe will be regarded. As base for this evaluation, a general structure of legal documents is derived according to (Rüthers, 1999; Schnieder & Schnieder, 2013) which is shown in Fig. 5. Based on this, the legal structure of satellite based localisation and railways is analysed in the following subchapters with the geographic focus on Europe. Fig. 5. General structure of legislation, based on (Rüthers, 1999; Schnieder & Schnieder, 2013)

7 Author name / Transport Research Arena 2014, Paris In the introduced structure it becomes obvious that legal documents can be divided into not binding technical rules and mandatory legal rules. Mandatory legal rules are the base for legislation with the constitution as fundamental law. In Europe, not only the national constitution but as well the European constitution is binding for the member states. Within the process of merging Europe, the importance of European legislation is growing. EU decisions and regulations are both adopted by the European parliament and are directly binding in the member states. Furthermore, laws and regulations of the member states are the valid national legislation. EU directives are adopted by the European parliament but are not directly valid in the member states. They need to be ratified before being valid in the member states. Further not binding technical rules are EU recommendations and technical standards. EU-directives 2004/49: Railway Safety Directive 2008/57: Interoperability Directive 2009/131: Interoperability of the rail system within the Community 2009/149: Common Safety Indicators and common methods to calculate accident costs 2011/18: Interoperability of the rail system within the Community Documents of manufacturer D1.2 Specification of localisation unit E12016 SZB-SZO-GaLoROI: Technical Specification D2.1 Progress report in hardware development D4.2 Safety Case of Localisation Unit Documents of operator Operational specifications/ regulations Specifications Subset 026 ETCS Specifications Subset 076 Test Plan Technical standards EN 50126:1999 Railway applications - The specification and demonstration of Reliability, Availability, Maintainability and Safety (RAMS) EN 50128:2011 Railway applications - Communication, signalling and processing systems - Software for railway control and protection systems EN 50129:2003 Railway applications - Communications, signalling and processing systems - Safety related electronic systems for signalling EN 50121:2007 Railway applications - Electromagnetic compatibility EN 17025:2005 General requirements for the competence of testing and calibration laboratories EU-recommendations Laws AEG: General Railway Act from 1951, last amended 1993 EBO: Ordinance on the Construction and Operation of Railways from 1904, last amended 2012 National German basic law from 1949, last amended 2012 National legislations Constitutions Regulations BGBl. I S Legislation on interoperability of trans european rail system EU-regulations 2009/352: Common safety methods 2007/653: common European format for safety certificates and application documents EU-decisions 2010/409: Common safety targets 2012/88: Technical specifications on interoperability (TSI) 2012/696: TSI relating to the controlcommand and signalling subsystems of the trans-european rail system 2012/757: TSI relating to the operation and traffic management subsystem of the rail system in the European Union European Treaty of Lisbon from 2007 as constitutional base Not binding Technical rule Mandatory Legal rule Fig. 6. Legal documents in railways, based on (Rüthers, 1999; Schnieder & Schnieder, 2013)

8 Manz, Schnieder, Becker, Seedorff, Baudis/ Transport Research Arena 2014, Paris 8 Nevertheless, they are state of the art and have a general importance when developing technical systems. Specific importances depending on the respective product have the documents of operator and manufacturer as well as valid specifications. According the shown general structure, legal documents of specific domains can be grouped. In the following subchapter this will be done for the certification relevant documents of the focused application domain railways. This is necessary because of the importance of the legal documents for conducting the safety case Railway Certification Documents The structure introduced in Fig. 5 is applied in Fig. 6 for railways. There a large number of EU decisions and regulations focusing on the interoperability of trains in Europe are introduced. These legal documents have a growing importance for the certification of trains and need therefore to be analysed in detail in future research. A well known and widely applied base for the development of safety relevant products in railways are the technical standards. Specific for the product are documents of the manufacturer and specifications valid in the specific area where the product shall be certified. 5. Safety Case Based on the normative background introduced in chapter 4, the safety case and its according structure will be introduced. For the safety relevant use of any system or part of it in railways a safety case is necessary. In GaloROI a structured safety case for satellite based localization in railways shall be composed as base for the later certification of the localization unit to be developed. The main target of this part of the project is to identify further steps for a development of the localization unit Documents The structure of the safety case is regulated in EN (EN, 2003). This structure is shown in Fig. 6. The parts 1 (Definition of System), Part 4 (Technical Safety Report) and Part 6 (Conclusion) are written specific for the project, Part 2 (Quality Management Report), Part 3 (Safety Management Report) and Part 5 (Related Safety Cases are general documents of the manufacturer which is BBR in this case. To enable a straightforward process and direct results, the development in GaLoROI is accompanied by a continuous safety assessment. This is done building up on existing standards and previous project work. In the European Commission funded project INESS 170 statements have been derived from standardization which need to be proved during safety case (von Buxhoeveden & Trog, 2012). Fig. 7. Structure of safety case according standardisation (EN, 2003; May, 2010)

9 Shall report to Can report to Can report to Can report to (SIL 0, 1, 2) Shall not report to (SIL 3, 4) Author name / Transport Research Arena 2014, Paris 5.2. Involved parties The safety case in railways is carried out by several parties which have their distinguished responsibilities. The involved parties and responsibilities depend on the safety level the development of the system is targeting for. A safety relevant system is a system with a safety level of SIL 1 to SIL 4 whereby SIL 4 represents the highest level of safety. To reach this, separate teams have to accompany and assess the certification of the system to be developed. These teams are the teams responsibly for development, test, verification and validation. If SIL 1 or 2 is sufficient, verification and validation can be carried out by one person or team. For every safety relevant certification of a developed system, an assessment is necessary. The assessment team has to be independent in all cases. A summary of the responsibilities is given in Fig. 8. Project Manager Assessment Team Development Team Test Team Verification Team Validation Team Can be one person/ team (SIL 1, 2) Can be one person/ team (SIL 0) Fig. 8. Responsibilities in safety case Currently, in GaLoROI the development is carried out with an accompanied safety assessment. The results will be available after the tests have been carried out in winter 2013/ It is expected that the safe satellite based localisation of trains can be shown as base for the later certification of the localisation unit and integration in train control systems. 6. Summary Satellite based localisation is used for various applications in all domains of transportation. This is made possible by the innovative use of existing satellite based localisation systems. The project GaLoROI is aiming for the safety relevant application in railways and is carried out according the initial planning. The target to develop a certifiable localization unit for railways can be reached and has to be proven during the tests to be carried out. Part of further research is the safety case process and the integration into existing systems. Acknowledgements The authors want to thank the European Galileo Supervising Authority (GSA) for funding the European research project GaLoROI within the Seventh Framework Programme (FP7). References European Commission (2001). White Paper. European transport policy for time to decide. COM (2001) 370 final, Brussels. European Commission (2012). Decision on the technical specification for interoperability relating to the controlcommand and signalling subsystems of the trans-european rail system. TSI /88. EN (2003). EN 50129: Railway applications - Communications, signalling and processing systems - Safety related electronic systems for signalling, Berlin: Beuth Verlag. Manz, H. & Schnieder, E. (2012). Safety Case Design Structure for Satellite Based Localisation in Railways. In: Arab Institute of Navigation. Cairo: 14th IAIN Congress 2012 Seamless Navigation.

10 Manz, Schnieder, Becker, Seedorff, Baudis/ Transport Research Arena 2014, Paris 10 May, J (2010). Methodical safety case for an innovative rail traffic at the examply of vehicle autonomous localisation. TU Braunschweig, Dissertation. Meyer zu Hörste, M. (2004). Methodische Analyse und generische Modellierung von Eisenbahnleit- und - sicherungssystemen. TU Braunschweig, Dissertation. Düsseldorf: VDI-Verlag. Rüthers, B. (1999). Rechtstheorie. Begriff, Geltung und Anwendung des Rechts. München: Beck. Schnieder, E. (2009). Use of satellite based localization for railways in legal context, in: ZEVRail, 133 (2009), book 9, pp Schnieder, E., Schnieder, L. (2013). Verkehrssicherheit. Maße und Modelle, Methoden und Maßnahmen für den Straßen- und Schienenverkehr. Berlin, Heidelberg: Springer. von Buxhoeveden, G., Trog, C. (2012). INESS: Toolunterstützung bei der Erstellung des Sicherheitsnachweises, in: Signal+Draht, 107 (2012), book 5.