An Analytical Evaluation for Hazardous Failure Rate in a Satellite-based Train Positioning System w.r.t. the ERTMS Train Control Systems

Transcription

1 An Analytical Evaluation for Hazardous Failure Rate in a Satellite-based Train Positioning System w.r.t. the ERTMS Train Control Systems A. Neri 1, A. Filip 2, F. Rispoli 3, and A.M. Vegni 1 1 RADIOLABS Consortium, Rome, Italy 2, Faculty of Electrical Engineering and Informatics, Pardubice, Czech Republic 3 Ansaldo STS S.p.A., Genoa, Italy ION GNSS, Nashville TN, September 17-21, 2012 University of Pardubice

2 Roadmap Introduction & Motivations European ERTMS-ETCS market evolution Adoption of Satellite localization and IP-based TLC into ERTMS-ETCS 3InSat - Train Integrated Safety Satellite System Demonstration project Safety Integrity Requirements 3InSat Reference Architecture & operational modes Integrity assessment model Fault Tree Case Protection Level Analysis Simulation results Conclusions

3 ERTMS-ETCS market evolution ERTMS-ETCS (European Rail Traffic Management System European Train Control System) developed in Europe for high speed lines is de facto the railways standard train control system being adopted in most new lines and major upgrades. The costs associated with the implementation and maintenance of ERMTS-ETCS is by fact the key factor limiting its extensive adoption (i.e. local and regional lines, freight lines)

4 New Challenges in Train Control Systems GNSS GPS, GLONASS fully operational GALILEO under development Make investments more attractive Increase market Exploit new technologies New Markets Private freight/mining/heavy haul lines Public or private lines, operating in rural/critical regions Low traffic-regional lines Extend ERTMS specifications to meet global requirements New ERTMS MoU Satellite localization IP-Based TLC

5 Market Trends Virtual Balises and GNSS Location Determination Systems ensure safety in both Dark Territories and Low Traffic Routes Dark Territories Low Traffic Routes The needs Ensure cost-effective train localization and protection over long stretches of semi-desert areas Efficiently ensure safety on low traffic passenger lines with satellite-based ATP solutions Command-control systems or ETRMS/ETCS systems are too expensive to be used on low traffic density lines Market expected to boom: > 1B in 3 years Virtual Balises / GNSS answers Satellite-based localization with SIL 4 accuracy combined with TETRA IP-based TLC Networks Significant cost for TETRA communications still cost-competitive vs. traditional technologies Next step: two-ways satellite-based communications Satellite based localization combined with communications based on public 3G-4G networks instead of GSM-R (e.g., Virtual GSM-R over LTE) Major reduction in ground infrastructure cost

6 The 3InSat ESA Project Project: Train Integrated Safety Satellite System (3InSat) Demonstration project Framework: ESA Integrated Applications Promotion Programme (ARTES 20) Objective: Roadmap: Partners: to introduce a train monitoring and control system compliant with the state of the art European and international regulations, that adopts satellite based navigation and telecommunications systems. up to validation and certification phases

7 The 3InSat Concept Development and validation of a new satellite-based platform suitable for the Train Control and Management System (ERTMS-ETCS). Exploitation of satellite assets for increasing the performance of existing train control and management systems. Replacement of wayside systems by GNSS and communication satellite technologies on the low-traffic and/or regional/local railway lines Benefits: Increased network capacity/efficiency Improved safety levels Lower capex & operational costs Priority targets: Local lines, low-traffic, Regional lines, new freight lines on a worldwide level

8 3InSat Reference Architecture GPS-GLONASS-EGNOS-GALILEO SPACE SEGMENT SATCOM USER SEGMENT TALS Server GNSS Receiver TLC Module RIM processor RIM Station GNSS Receiver INS & Tacho LDS selector TLC Module SatCom terminal ATP GNSS Receiver TLC Module RIM processor RIM Station TLC Module Radio Block Center GROUND SEGMENT EGNOS Rail Services IP BACKBONE

9 Challenge Major requirement Safety Integrity Level (SIL) 4 compliant systems Hazardous Misleading Information Rate HMR < 10 9 /h during 1 hour of operation Pr{ s >PL} < when this event has not been detected by the Integrity Monitoring algorithm. Approach 1. Multi-constellation GNSS capability, exploiting existing constellations (GPS, GLONASS) and new ones (e.g., GALILEO) 2. Use of SBASs (i.e., EGNOS in Europe) augmentation data for both integrity monitoring and accuracy and precision increase; 3. Deployment of a dedicated Track Area Augmentation and Integrity Monitoring Network with very high availability; 4. Independent on-board capability to further mitigate GNSS errors and autonomously assess the GNSS location integrity.

10 GNSS-based Location Determination System The Augmentation Network includes Ranging & Integrity Monitoring Reference Stations (RIM RS), for the purpose of integrity monitoring, accuracy improvement of satellitebased position, and providing correction to mobile receivers. Each reference station has an LDS Safety Server, providing correction services and detecting systematic satellite faults. The outputs from reference stations are jointly processed by a Track Area LDS Safety (TALS) server. The On Board LDS unit is able to work on four operational modes: S 1 : GNSS augmented by the dedicated Track Area Augmentation and Integrity Monitoring Network S 2 : GNSS augmented by SBAS from direct Signal In Space (SIS) S 3 : GNSS augmented by SBAS data retransmitted over Train Signaling Network, S 4 : Stand alone GNSS.

11 Fault Tree LDS Dangerous failure HR R IDIAG DUF R MLDS DUF DR DR GNSS GNSS DR DR ODO ODO R GNSS HMI R GNSS DUF R ODO HMI R ODO DUF GNSS _ RX GNSS GNSS _ LDS DUF DUF DUF GNSS DRGNSS R R DR R N GNSS _ RX Independent diganostics failure IDIAG R DUF GNSS failure ODOMETER failure MULTISENSOR LOCALIZATION & RAIM undetected failure MLDS R DUF N INS INS TACHO ODO ODO _ LDS RDUF RDUF DUF DUF ODO DRODO DRODO R R DR N TACHO GNSS LDS undetected failure GNSS HMI ODO LDS undetected failure ODOMETER HMI GNSS R HMI ODO R HMI AUGMENTED GNSS LOCALIZATION undetected failure GNSS RX #1 undetected failure... GNSS RX #N undetected failure ODOMETRIC LOCALIZATION undetected failure INS #1 undetected failure... TACHOMETER #M undetected failure GNSS _ LDS R DUF GNSS _ RX R DUF GNSS _ RX R DUF OLDS R DUF INS R DUF TACHO R DUF Fig. 1. Dangerous fault tree.

12 Protection Levels Analysis Protection levels are generally evaluated assuming only 1 faulty satellite at any time. However, with the deployment of new constellations the number of satellites in view significantly increases. Three different events have been considered for the evaluation of the Integrity Risk Fault-free case (satellites in healthy but hazardous failure can still arise due to large random errors produced by multipath, receiver thermal noise or tropospheric incremental delays, etc.) Individual satellite faults (both in space and ground segments; historical data indicate an average number of faults for GPS constellation of about 3 per year) Correlated simultaneous satellite faults.

13 PL Analysis Fault-free Case Train location is given by the intersection of the spheres centered on visible satellites and the railway track. Major Unknowns: Train distance from Headend (curvilinear abscissa) Train clock offset 1 2 The conditional probability of an Misleading Information event given an Missed Alarm event when the receiver is in the S h operational status and all the satellites of a given constellation are healthy, equals the probability that the position error will exceed the protection level PL. 1 PL b 1 PL b P S s PL erfc erfc SH h h MI / MA( h ) Pr PE 2 PE The position estimate error variance is directly related to the satellite lines of sight w.r.t. the actual track and to the pseudo-range measurement noise that may vary with the operational mode and the considered satellite. 2 T 1 PE v h H R H h 1 h 1,1 h

14 PL Analysis Individual Satellite Faults Whenever the receiver operates in a differential equivalent mode, as in the operational modes S 1, S 2,, and S 3 errors on ephemeris and satellite clocks are essentially compensated. 1 PL b 1 PL b P s Pr s PL erfc erfc, h 1, 2,3 SF h h MI / MA h PE 2 PE h h

15 PL Analysis Individual Satellite Faults When the receiver operates in the stand alone mode (S 4 ) and the i-th satellite presents a failure characterized by an uncompensated range error, the train location estimate is affected by an additional error that can drastically impact on the P HMI. For sake of simplicity a simple RAIM algorithm that detects a satellite fault by comparing the L 2 norm of the residuals with a fixed threshold AL named Faulty Satellite Alarm Level is considered 2 T 1 ν R ν When all satellites are healthy, the square of residual weighted norm is a random variable with a chi square distribution with N Sat -2 degrees of freedom, being N Sat the number of visible satellites. Thus the Alarm Level corresponding to a given false alarm probability is AL S D P S 1 ( ) 1 ( ). 4 2 fa 4 NSat 2

16 PL Analysis Individual Satellite Faults When a satellite fault produces a rage error b, the square of the L 2 norm of the residuals becomes a non-central chi square random variable, with non-centrality parameter whose magnitude is proportional to the square of b. Thus, the probability of missing the detection of the satellite fault can be expressed in terms of AL as follows SF nc P ( S ) D AL,. MA While the conditional probability that the position error magnitude will exceed the Protection Level is 4 2 Nsat 2 1 PL SLOPEMax 1 PL SLOPE SF Max PMI / MA( s4) erfc erfc PE PE 4 4 where SLOPE Max is the maximum value w.r.t. all satellites of the ratio between the magnitude of the position error and the square root of SLOPE Max Max i I K 1, i HK ii, R ii,

17 PL Analysis Individual Satellite Faults Consequently the HMI conditional probability w.r.t. the S 4 operational mode in presence of satellite failures can be evaluated as follows 1 PL SLOPEMax PL SLOPE P ( S ) P ( S ) D AL, erfc erfc SF SF nc MA 4 MI / MA Nsat 2 PE 2 4 PE4 Max

18 PL Analysis Correlated Simultaneous Satellite Faults A reliable statistical model for the failure rate of correlated Simultaneous satellite faults is not available When N Const constellations are considered, the probability that at least one constellation is not affected by a correlated failure is N CSF Const Pr N 1 1 P HealthyConst For P CSF =10-5 with 2 constellations (GPS and GLONASS) the probability that at least one constellation is not affected by correlated faults is less than

19 Hazard Misleading Information (HMI) Rate The HMI Rate is evaluated as the probability of an HMI event in 1 hour Since a reliable statistical model for the entity of the errors caused by satellite failures in not available, we set the Protection Level in accordance to the worst case. NDec NOp NOp 1 GNSS 1 PL bh 1 PL bh 1 PL bh HMI 1 1 OP( h) SH 1 h h 1 2 PE PE 2 PE R erfc erfc P S P erfc h h h 1 PL SLOPEMax PL SLOPE nc Max 1 Max D 2 AL, erfc erfc POP ( S4) P Nsat PE PE 4 4 N Dec SF

20 Simulation Results Reference case of a train travelling along a 350 km route, from Rome to Pisa (Italy), at a nominal speed of 80 km/h Both augmented and autonomous modes using the GPS and GPS+GLONASS satellites. Augment. Availability Description 0% no augmentation at all, the on board GNSS receiver is fully autonomous % representative of EGNOS SIS in Europe received from stations equipped with high gain antennas and broadcasted through train signaling network % representative of EGNOS augmentation provided by two independent satellite receivers in different locations + EDAS; % Representative of joint use of TAAS + EGNOS with mild requirements for single availability (e.g., 99.99% for each of them); 100% ideal case providing PL lower bound

21 Simulation Results PL vs. the train location when: A. Both GPS and GLONASS are jointly processed use of augmentation network with very high availability drastically reduces the PL. W.r.t the bound represented by the 100% availability of augmentation data, better performance can be achieved with more effective RAIM algorithms compared to the one used in the simulations B. GPS alone comparison with above results demonstrates the Gain achievable with two constellations.

22 Conclusions A novel GNSS solution and the theoretical modeling concerning the Safety Integrity Level for facilitating the adoption of the satellite-based localization systems in the ERTMS-ETCS ecosystem have been derived. The Multi-constellation architecture relying on GPS, GLONASS and in perspective GALILEO offers an higher degree of flexibility to reach the SIL-4 level (mandatory for the railways applications). Nevertheless, the availability of an augmentation network is of paramount importance in reducing the PL. Moreover, increased accuracy is requested when additional capabilities, like parallel track discrimination are required. In this sense, availability of current SBAS SIS developed for aeronautical applications is of primary concern As illustrated by the performance analysis, distributing augmentation data through the train signaling system network represents a cost effective mean to increase integrity information and augmentation data availability.