ION GNSS+ 2018

Sept. 24-28 2018

Miami, Forida

A multi-sensor autonomous integrity

monitoring approach for railway and

driver-less cars

Pietro Salvatori1, Alessandro Neri1,2, Cosimo Stallo1

1 Radiolabs, Rome, Italy

2 University of ROMA TRE, Rome, Italy

Contents

• Rail & Road Accuracy and Integrity Requirements

• EM Scenario

• Space Diversity based Multipath Detection & Exclusion

• GNSS vs. Odometry based Multipath Detection & Exclusion

• Experimental results

• Conclusions

RAIL - SAFETY CRITICAL Requirements

GNSS Functionality Alert Limit Accuracy

VB detection VITAL 1 m 25 cm

VB detection NON

VITAL

5 m 125 cm

Track discrimination 2 m 50 cm

ERTMS/ETCS

Safety Integrity Level SIL-4

THR <10-9 [hazard/(h x Train)]

RBC 160 km/h

Train 2 Train 1

Section 1 Section 2 Section 3 Section 4Balise A Balise B Balise C Balise DTrack Circuit

Permitted Speed

ROAD - SAFETY CRITICAL Requirements

KPI Value

Lateral ALERT LIMIT < 25 cm

Longitudinal ALERT LIMIT 2 m

Speed accuracy ?

Trajectory handshake latency <100 msec

Status message latency <10 msec

Status message loss rate < 10-6

Status message rate > 10 Hz

Vehicles and Road users

• Position, speed

• acceleration

• direction (heading)

• Yaw rate

Static obstacles

• Position

Infrastructure

• High Accuracy

Digital map

From other sources

• traffic

• weather information

0Driver

Assistance

No

Automation

12 3

45

Partial

Automation

Conditional

AutomationHigh

Automation

Full

Automation

HUMAN DRIVER Automated Driving System ELECTRONIC

HORIZON

Railway EM scenario

Yellow: Unconstrained RTK (GPS)

Red: IMU+GPS• MULTIPATH is a Major Hazard

The EM scenario

Multipath is a

Major Hazard

Trains and Cars operate in the same EM Environment

MITIGATIONS

Camera Visible Horizon

Signal Domain

Correlation Domain

Measurement Domain

Position Domain (ARAIM)

Credits: Prof. Per Enge

5

-50

10

2015

25 RAIL

Enhanced Odometers

Ref. B. Allotta, et Al. (2012):Evaluation of odometry algorithm performances using a railway vehicle dynamic model, VehicleSystem Dynamics: Int. Journal of Vehicle Mechanics and Mobility, 50:5, 699-724

TACHOMETERd

dt

Acceleration Criterion

State Machine for velocity Estimation

Axle angular speed

PositionIncrement

Velocity

GYRO

ACCELEROMETERGravity

CompensationACCKF

GYROKF

OrientationReset

( ) ( ) ) ( )(en

OD k k k S ktv v t tt

zero mean

NARROW BAND

Gaussian process

zero mean

WHITE

Gaussian

Process

• Velocity measurement model

GNSS vs. ODOMETER

Difference between GNSS and ODOMETER velocity estimates

GNSS vs. ODOMETER

Difference between GNSS and ODOMETER velocity estimates

The Track constraint

• The location of the train is completely determined by its MILEAGEfrom the terminus station

Two unknowns:• Train mileage• Rx clock error

Virtual Balise

ai

li

VBR

Track Parametric Equations

( )Rx Rx sX X

Train mileage

Rx

Rx

s

c t

H

Sat

T

x NRx

Rs

E 1

X

Track Constrained Positioning

Virtual Track Concept

Reference path

Lateral offset

Virtual Track

virtual

track

q

s

(sVT ,qVT )

(s, q)

Nominal

path

Planned

path

Use of Imaging to estimate the lateraL OFFSET

Vehicle Position determined byIts curviinearcoordinates basedon lane middle line

Space Diversity Multipath Resilience

GPS BEIDOUBy fact:• Best Engineering practices

do suggest the use of• 2 independent Rx

Rx2 Rx1

2 2

p p

Rx Rxr e1 1

p p

Rx Rxr e

2 2 2 2,

p p q q

p q Rx Rx Rx RxDD

p-th

satellite

location

q-th

satellite

location

Double Difference

• Pseudorange Double Difference equations

2 2, / 1ˆ ˆ ˆ, q p

p q k k Rx Rxqp DD b e eζ

2 2, ,, q p

p q Rx Rx p qDD b e e

11 2 1 2 22 1

,

Rx Rx Rx Rx Rx Rx Rx Rx

pp p q q qp qq pn n n n

Thermal noise Multipath error

• Pseudorange difference Multipath Indicator

Space Diversity Multipath Resilience

GPS BEIDOUBy fact:• Best Engineering practices

do suggest the use of• 2 independent Rx

Rx2 Rx1

2 2

p p

Rx Rxr e1 1

p p

Rx Rxr e

2 2 2 2,

p p q q

p q Rx Rx Rx RxDD

p-th

satellite

location

q-th

satellite

location

Double Difference

• DOPPLER Double Difference equations (negligible rotations)

,p q Dq

DOP

p DD f ζ

• DOPPLER difference Multipath Indicator

,, ,

n

p q

MP

p Dq D qp DDD f DDDD f f

Thermal noiseMultipath error

ODOMETRY Based Multipath Resilience

GPS BEIDOUBy fact:• Best Engineering practices

do suggest the use of• 2 independent Rx

Rx2 Rx1

2 2

p p

Rx Rxr e1 1

p p

Rx Rxr e

2 2 2 2,

p p q q

p q Rx Rx Rx RxDD

p-th

satellite

location

q-th

satellite

location

Double Difference

• DOPPLER – ODOMETER Difference equations

, ,

ODO

p q D p q Dq

ODO

p SD f SD f ζ

• DOPPLER – ODOMETER Multipath Indicator

, ,,,

ODO MP

p q

n

p qp q DD p q D DSD Sf fS f f DD SD

, ,,p

pC

S

ODO p p

D Rx Rxp

R

at DOp

xt

O

Sa

ff

c

v e ev e

v

a. Initialize the set HealthyS of healthy satellites to the set of

visible satellites with elevation greater than the elevation

mask.

b. Repeat

for each satellite in HealthyS compute p

c. Select the satellite with the largest p

ˆHealthy p

p Sp Arg Max

d. If p exceeds a predefined threshold

remove p from the healthy set HealthyS

and mark the satellite as unreliable.

until p and HealthyS is non empty.

Multipath Detection and Exclusion

• Multipath detection is performed by thresholding |p|

• To avoid masking of SIS of weak multipath by SISs with strongerMultipath an the iterative procedure that removes at each iteration the effects produced by those satellites whose signal is already classified as faulty is adopted

Iteration #1

a. Initialize the set HealthyS of healthy satellites to the set of

visible satellites with elevation greater than the elevation

mask.

b. Repeat

for each satellite in HealthyS compute p

c. Select the satellite with the largest p

ˆHealthy p

p Sp Arg Max

d. If p exceeds a predefined threshold

remove p from the healthy set HealthyS

and mark the satellite as unreliable.

until p and HealthyS is non empty.

Multipath Detection and Exclusion

• Multipath detection is performed by thresholding |p|

• To avoid masking of SIS of weak multipath by SISs with strongerMultipath an the iterative procedure that removes at each iteration the effects produced by those satellites whose signal is already classified as faulty is adopted

Iteration #2

a. Initialize the set HealthyS of healthy satellites to the set of

visible satellites with elevation greater than the elevation

mask.

b. Repeat

for each satellite in HealthyS compute p

c. Select the satellite with the largest p

ˆHealthy p

p Sp Arg Max

d. If p exceeds a predefined threshold

remove p from the healthy set HealthyS

and mark the satellite as unreliable.

until p and HealthyS is non empty.

Multipath Detection and Exclusion

• Multipath detection is performed by thresholding |p|

• To avoid masking of SIS of weak multipath by SISs with strongerMultipath an the iterative procedure that removes at each iteration the effects produced by those satellites whose signal is already classified as faulty is adopted

Iteration #3

Multipath in rail environment

• Line length: 120 km

• Physical Balises: about 500

• Track AreaAugmentation Network

3 RIMs equipped with 2 GPS receivers each

• PONTREMOLESE line

• Trains:

• 2 Ale.642 tractions equipped with 2 GPS receivers each

• Track Database based on RTK positioning survey

Multipath in rail environment

08/02/2016

• Line length: 120 km

• Physical Balises: about 500

• Track AreaAugmentation Network

3 RIMs equipped with 2 GPS receivers each

• PONTREMOLESE line

• Trains:

• 2 Ale.642 tractions equipped with 2 GPS receivers each

• Track Database based on RTK positioning survey

• Challenging environment w.r.t. multipath

• Tunnels

• Sky occlusions

Results: Doppler Double Diff. (2 Rx)

OFF ON

Results: Odometry based FDE

OFF ONOFF ON

Results: Doppler Double Diff. + Odometry

OFF ONOFF ON

Results

2oo2 Logic: The two estimates of the train mileage provided by the two receivers are

considered to be valid if the magnitude of their difference falls below a threshold

FDE OFF

2oo2Logic

FDE OFF

Results

2oo2 Logic: The two estimates of the train mileage provided by the two receivers are

considered to be valid if the magnitude of their difference falls below a threshold

FDE ON

2oo2Logic

FDE ON

2oo2 Performance

2 2

2 10 1 22 2 2 2

1 2 1 2

ˆ ˆ ˆs s s

(1) ( 2)

(1) (2)

0 2 1/ , ,ˆ ˆ ˆPr , , ,

i j

GSS

i jMI s H HP s s AL s s s H H

(1) ( 2)

(1) (1)

, , , ,

/ ,

1 1

2 22 2i j

Norm Norm

i j i j i j i jMI

GSS H H

AL ALP erfc erfc

(1) ( 2)

(2) (2)

, , , ,

/ ,

1 11

2 22 2i j

Norm Norm

i j i j i j i jMD

GSS H HP erfc erfc

(1) ( 2)

(1) ( 2) (1) ( 2)

(1) (2)

/ , , ,0 0

( ) Pr 0, 0i j i j

h hHMI GSS

GSS i j MI s H H H Hi j

P s FD FD P P

• O2O Mileage linear combination

11

1,i

2

2

2, j

• Let

• Then Misleading Information Probability is

Results: Doppler Double Diff. + Odometry

Doppler DD

ODO

OFF

Doppler DD + ODO

Conclusions

• EXPLOITATION of the two GNSS receivers of independent manufacturer usually deployed to reduce HW/SW Hazards allows to increase location AVAILABILITY even with single constellation

• GEOREFERENCED KNOWLEDGE of the railway is not essential when doppler are compared (pseudorange comparison requires a guess of the baseline between the receivers)

• ODOMETER- GNSS DOPPLER comparison is an effective means to face Multipath even when just one receiver is available

• COMPARISON of the positions provided by two receivers dramatically improves resilience.

• The proposed Multipath Detection & Exclusion is fully

COMPATIBLE with other means to mitigate multipath.

We recognize the contribution of the ERSAT-GGC project, which has received

funding from the European GNSS Agency under the European Union’s Horizon 2020

research and innovation programme, under grant agreement No 776039

Thank you for your attention