Report on Rail User Needs and Requirements

REPORT ON RAIL USER NEEDS AND REQUIREMENTS Report on Rail User Needs and Requirements Outcome of the European GNSS’ User Consultation Platform Reference: GSA-MKD-RL-UREQ-250286 Issue/Revision: 2.0 Date: 01/07/2019

Change record Issue/ Revision Changes Date 1.0 First issue 18/10/2018 2.0 Refer to Annex 6 01/07/2019 REPORT ON RAIL USER NEEDS AND REQUIREMENTS 3

Table of Contents

1 Introduction 5 1.1 Methodology 5 1.2 Scope 7

2 Executive Summary 8

3 Reference Documents 11

4 Market Overview and Trends 14 4.1 Market Evolution and Key Trends 14 4.2 Main Market Players 15 4.3 Main User Groups 15

5 GNSS User Requirements Analysis 18 5.1 GNSS Use in Rail 18 5.2 Prospective use of GNSS in Rail 26 5.3 GNSS limitations for Rail use 27 5.4 Drivers for Railway User requirements 29 5.5 Policy and regulatory framework 31 5.6 Conclusions 35

6 User Requirements Specification 37 6.1 Requirements for Safety Relevant Applications 37 6.2 Requirements for Non-Safety Relevant Applications 41

7 ANNEXES 48 Annex 1: Past Initiatives Regarding GNSS Requirements in Rail 48 Annex 2: Current Initiatives Regarding GNSS Requirements in Rail 64 Annex 3: SUGAST Locator Units 66 Annex 4: Definition of key GNSS performance parameters 75 Annex 5: List of Acronyms 77 Annex 6: Updates following the User Consultation Platform 2018 79 4

Tables, Figures and Boxes 01 Table 1: Rail GNSS User Requirements 9 Table 2: Reference documents 11 Table 3: Main Rail user communities 16 Table 4: SIL Classification 29 Table 5: ERTMS User requirements 33 Table 6: Rail User Requirements (USA) 34 Table 7 : Parameters definition for rail applications requirements 36 Table 8: Requirements for Automatic Train Protection 37 Table 9: Requirements for Cold Movement Detection 38 Table 10: Requirements for Level Crossing Protection 38 Table 11: Requirements for Train Integrity and train length monitoring 39 Table 12: Requirements for Track Identification 39 Table 13: Requirements for Door Control Supervision 40 Table 14: Requirements for Trackside Personnel Protection 40 Table 15: Requirements for Odometer Calibration 41 Table 16: Requirements for Management of emergencies 41 Table 17: Requirements for Train warning systems 42 Table 18: Requirements for Infrastructure surveying 42 Table 19: Requirements for Location of GSM Reports 43 Table 20: Requirements for Gauging surveys 43 Table 21: Requirements for Structural monitoring 44 Table 22: Requirements for Fleet management 44 Table 23: Requirements for Cargo monitoring 45 Table 24: Requirements for Energy Charging 45 Table 25: Requirements for Infrastructure Charging 46 Table 26: Requirements for Hazardous Cargo Monitoring 46 Table 27: Requirements for passenger information 47 Table 28: GNSS requirements for Rail from the GNSS Rail Advisory Forum 48 Table 29: GRAIL User Requirements 50 Table 30: SUGAST User Requirements 56 Table 31: SUGAST Application Groups 60 Table 32: Locator Units Functions and Performances 61 Table 33: EU Project related to GNSS application in Railways 62 Table 34: NGTC WP7 Deliverables 65 Table 35: SUGAST - Applications and Locator Units Mapping 73

Figure 1: Rail User Requirements Analysis methodology 6 Figure 2: Shipments of GNSS devices by region ([RD29]) 14 Figure 3: Shipments of GNSS devices by application ([RD29]) 15 Figure 4: Maturity of Application Bundles 26 Figure 5: GNSS quality criteria within railway RAMS 30 Figure 6: Loosely coupling scheme 66 Figure 7: Tightly coupling scheme 67 Figure 8: Ultra-tightly coupling scheme 68 Figure 9: Locator Unit Class D 69 Figure 10: Locator Unit Class C 70 Figure 11: Locator Unit Class B 71 Figure 12: Locator Unit Class A 72 REPORT ON RAIL USER NEEDS AND REQUIREMENTS 5 introduction and context 01 of the report

NSS is already widely used for non-safety relevant It must be noted that the listed user needs and requirements application in Rail. Since a few years, safety relevant cannot usually be addressed by a single technological solu- Gapplications based on GNSS have also emerged. GNSS- tion but rather by combination of several signals and sensors. based solutions can indeed offer safety at lower cost. Thus, Therefore the report does not represent any commitment all around the world Rail stakeholders are investigating of the European GNSS Programmes to address or satisfy the its use for safety relevant application. However, Rail is a listed user needs and requirements in the current or future highly regulated domain in which the introduction of new versions of the EGNSS services. technologies can take time. The understanding of Rail user requirements is a key step to support the GNSS market uptake in this segment. Rail and GNSS communities have 1.1 Methodology worked together since many years to this end. The different safety philosophies make the process complex, but notable The following figure details evolutions have been observed over the past years. This the methodology adopted common effort must be pursued. for the analysis of the Rail All around user requirements. The User Consultation Platform (UCP) is a periodic forum the world Rail organised by the European Commission and the GSA involv- The analysis is split into two ing end users, user associations and representatives of the main steps including a “desk stakeholders are value chain, such as receiver and chipset manufacturers, research”, to gather main investigating GNSS- application developers and the organisations and institu- insights, and a “stakehold- tions dealing, directly and indirectly, with Galileo and EGNOS. ers consultation”, to validate based solutions for The event is a part of the process developed at the GSA to main outcomes. collect user needs and requirements and take them as inputs safety relevant for provision of user driven Galileo and EGNOS services. In More in details, the “desk this context, the objective of this document is to provide research” was based on a sec- applications. a reference for the European GNSS Programmes and for ondary research and aimed the Rail community reporting periodically the most up-to- at providing a preliminary date GNSS user needs and requirements in the Rail market structured analysis: segment. This report is considered a “living document” in yy Leveraging on the Rail applications’ segmentation as the sense that it will serve as a key input to the next UCP included in the GSA GNSS market report, additional rele- event where it will be reviewed and subsequently updated. vant applications have been identified and included; and The UCP will be held periodically (e.g. once per year) and this report will be also periodically updated, to reflect the yy For each application identified, the function and level of evolution in the user needs, market and technology cap- performance required has been determined. tured during the UCP. As a result of this activity, a first draft of the Rail User Require- The report aims to provide the GSA with a clear and up-to- ments document has been produced. date view of the current and potential future user needs and requirements in order to serve as an input to the continuous In the second step, the “stakeholder consultation” one, improvement of the services provided by the European main outcomes included in the document have been vali- GNSS systems and their evolutions. dated and updated. In this regards, preliminary validation interviews with selected stakeholders have produced the Finally, as the report is publicly available, it serves also as a current document to be used as an input for the UCP review reference for users and industry, supporting planning and and finalisation. decision-making activities for those concerned with the use of location technologies. 6 1/ INTRODUCTION AND CONTEXT OF THE REPORT

Figure 1: Rail User Requirements Analysis methodology

OVERALL METHODOLOGY

1 Identification of all existing Rail applications User level dimension and characterisation along with the function that they perform yy Identification of the key GNSS user level yy All Rail applications covered in GSA Market dimensions to describe Rail user requirements Report nº5 yy Identification and definition of GNSS performance criteria relevant to Rail Desk

Segmentation of Rail Applications Research yy Definition and classification of applications yy Focused on GNSS usage (not device-based)

Definition of the functions and level SECONDARY RESEARCH of performance required for each application INFORMATION GNSS magazines - Coordinates, yy Rail user requirements analysis based on open GPS World, Inside GNSS; Secondary research information ESA website; Articles on yy GNSS limitations, market/techno trends and drivers Google Scholar; Thesis and yy Table matching the main applications with the dissertations on specific performance criteria database; European regulation User requirement analysis – draft 1 or standard; Google

2 Validation interviews yy Interview guide yy Selection of the consulted stakeholders yy Primary research: Interviews and reporting User requirement analysis – final version

User Consultation Platform yy User requirements submitted to the first UCP

Consultation Consultation forum for review and finalisation Stakeholders Stakeholders update yy Update, validation and expansion of the user 2019

requirement analysis at each UCP REPORT ON RAIL USER NEEDS AND REQUIREMENTS 7

1.2 Scope

This document is part of the User Requirements documents yy Prospective use of GNSS in Rail is addressed in section issued by the European GNSS Agency for the Market Seg- 5.2. It assesses GNSS technology trends, along with the ments where Position Navigation and Time (PNT) play a key other technologies that are used in the Rail community. role. Its scope is to cover user requirements on PNT solutions yy GNSS limitations for Rail are described in section 5.3. from the strict user perspective and the market conditions, regulations, and standards that drive them. Therefore, the yy Section 5.4 identifies the document includes an analysis of the market trends on this drivers for user require- particular segment, then performs a detailed analysis includ- ments in Rail. The different ing the prospective uses of GNSS in this market finalising yy Section 5.5 analyses the with a specification of user requirements in a format that safety philosophies main relevant policy and can be used for System Engineering activities. regulations. make the process In more detail, this report is laid out as follows. It starts with yy Section 5.6 is a conclusion complex, but notable a summarised market overview for Rail (section 4), where on the GNSS user require- market evolution and key trends, the main market players ments analysis for Rail evolutions have and user groups are presented. applications. been observed. Then it moves on to the analysis of GNSS user requirements Finally section 6 summarises for Rail (section 5). Section 5 is organised as follows: the main GNSS user requirements for Rail in the applications domains analysed in this report. yy Section 5.1 presents an overview of the Rail applications extracted from GSA Market Report 5 but also from other The document is intended to serve as an input to more sources. It also provides definitions of these applications. technical discussions on Systems Engineering and evolution They have been typified into different categories accord- of the European GNSS systems so that space infrastructures ing to their usage (safety and non-safety) and a detailed are effectively linked to user needs. overview of GNSS user requirements is provided. 02

2019 update applications. relevantbility relevant andnon-liability lia dividedintwo sub-categories: often The non-safety relevant isitself category and non-safety relevant applications. ment. They are dividedintwo maincategories: safety relevant There are alarger seg- numberofPNTapplications inRail European GNSSmissionevolution. penetration andsubsequently define the inthismarket specifications in ofGNSSiscrucial terms to foster GNSS userrequirementsThe understandingofRail aswell astheir 2.1 most promising GNSS safety relevant applications. Automatic Train Protection (ATP)/Train control isoneofthe – where European GNSSdifferentiators canplay akey role. are then safety relevant relevant andliability applications The mainaxes ofdevelopment for GNSSapplications inRail methodologies orcertification. GNSS alsofaces otherissuessuchassafety demonstration 3 morless. Moreover beyond these “physical” limitations parallel tracks requires aHorizontal Protection Level HPLof ment for (e.g. somespecificfunctions train positioningon multipath, EMI,spoofing) andalsohighaccuracy require aviation, excessive positionerrors dueto localeffects(e.g. requirements for train positiondetermination incontrast to highsafety tions, integrity anddependability tunnels),very Signal-in-Space obscuration (e.g. sta PNTApplications concerntion inRail The mainlimitations for GNSSpenetra- tion applications. applications, suchas passenger informa are relevant non-safety and non-liability applications where GNSS is widely used penetration low. is alsooften The only relevantliability applications GNSS tion islow, or even nonexistent. For ing ontheapplications, GNSSpenetra- For safety relevant applications, depend

Executive Summary Executive Summary - - - - applications. relevant and liability are safety applications for GNSS of development The mainaxes - to support the definition of GNSS Rail user requirements. thedefinition ofGNSS to support SatelliteThe Navigation remains community a key player areuse cases that much complex more the aviation ones. applying the approach taken scenarios/ the approach by Rail aviation.applying The by GNSS requirements the to define exclusively community the for ERTMS level 3). ERTMS monitoringfor function and level train integrity 2/3 the following balise applications: both functionality virtual (through particular in architecture ERTMS the changing are tothe Rail community include GNSS without in ETCS However, of noticing that itis worth all the current efforts also benefitfrom positioning. GNSS-based architectureBalise inanERTMS butotherapplications shall y y y y deployed for train control most commonly in USA, for context, GNSSisalreadyOutside theERTMS being agement System GNSScould beusedasamean: (ERTMS), Within thecontext oftheEuropean Railway Traffic Man

To provide the train integrity monitoring function Tofunction provide thetrain integrity monitoring for theETCS Level 3. Control System (ETCS) Level 2; To balisesintheEuropean introduce virtual Train focused ontheuseofGNSSfor Virtual have oftheefforts Most or Shift2Rail. groups or projects funded by H2020, ESA formed in the framework of working such asETCS. The progresses are per ments for safety relevant applications Rail user requiredefinition of GNSS stakeholders aimsto contribute to the by thekeyRail The work performed in particular, quantified requirements. requirements applicableto GNSS,and ever, work isstillneededto defineuser their respective safety philosophy. How andunderstand communities to try been provided andGNSS by theRail the pastOver years, has a lot of effort Positive Train Control applications. It cannot be expected from the rail from expected It cannot be

- - - -

update update 2019

2019 9

2019 2019 update update 2019 update Safety Safety Safety Safety Safety Safety Safety Safety Safety Safety Safety Liability Liability Liability Liability relevant relevant relevant relevant relevant relevant relevant relevant relevant relevant relevant relevant relevant Category Non safety Non safety Non safety Non safety

TTA* < 30s < 30s < 30s < 30s < 30s < 30s (TBC) 10s TTA < 10s TTA < 10s TTA < 10s < TTA 10s < TTA 10s < TTA TTA < 10s TTA TTA < 10s TTA TTA ≥ 30s TTA TTA ≥ 30s TTA ≥ 30s TTA TTA ≥ 30s TTA TTA < 10s TTA 4 4 4 2 2-4 SIL TBD TBD TBD TBD TBD TBD TBD TBD Low Low High High High High High High time) (if real (if real REPORT ON RAIL USER NEEDS AND REQUIREMENTS AND NEEDS USER RAIL ON REPORT Integrity Very HighVery HighVery HighVery Very HighVery Very HighVery processing) Low (if post Low applications (mostly based on [RD4] and [RD27]). Those Those [RD4] and [RD27]). (mostly based on applications or of value ranges by mostly expressed are requirements the reality. simplify to and tend requirements, qualitative the by the only ones recognized they are today, But as of Alarm requirement. To Time the for Rail community – except is still and work fragmented is indeed much more reality The reflection the actual of get realistic user needs. to required - - Low Low Low Low High High High High High High High High High Availability (2Sigma) Accuracy Accuracy 1 m < HNSE < 10 m 1 m < HNSE < 10 m (TBC) ACTE < 1.9 m HNSE < 1 m HNSE < 1 m 1 m < HNSE < 10 m HNSE < 1 m 1 m < HNSE < 10 m discrimination Track 1 m < HNSE < 5 m discrimination Track 0.01 m < HNSE < 1 m 1 m < HNSE < 100 m 0.01 m < HNSE < 1 m 0.01 m < HNSE < 1 m Altitude TBD req. Application Level Crossing Crossing Level Protection Integrity Train length and train monitoring Track Identification Odometer Calibration Cold Movement Movement Cold Detection Door Control Door Control Supervision Door Control Door Control Supervision in ATO Trackside Trackside Personnel Protection Management of Management emergencies Infrastructure surveying of GSM Location Reports Gauging surveys Structural monitoring Horizontal accuracy needs to be divided into along-track (ALTE) and across-track (ACTE) errors for some applications. some applications. for (ACTE) errors and across-track (ALTE) along-track accuracy be divided into Horizontal needs to in the table. some applications for discrimination“ “track by is defined requirement Across-track Table 1: Rail GNSS User Requirements 1: Rail GNSS User Table The Table 1 summarizes the most recent Rail user require most recent the 1 summarizes Table The Rail of sample a representative for expressed ments from validation interviews of both key players of the Rail of the interviews seg players of both key validation from Européennes) (Union des Industries UNIFE ment: Ferroviaires STS. and Ansaldo The user requirements presented hereafter were derived derived were hereafter presented requirements user The Executive Summary Executive 03 2019 update & Non- liability Liability Liability Liability Liability Liability relevant relevant relevant relevant relevant relevant Category Non-safety Non-safety

N/A TTA* < 30s 10s < TTA TTA ≥ 30s TTA TTA ≥ 30s TTA TTA ≥ 30s TTA TTA ≥ 30s TTA SIL TBD TBD TBD TBD TBD TBD N/A Low Low Low High High Integrity (charging) 95% High High High High High Availability (2Sigma) Accuracy Accuracy HNSE ≥ 10 m HNSE ≥ 10 HNSE ≥ 10 m HNSE ≥ 10 m HNSE ≥ 10 m 1 m < HNSE < 10 m HNSE < 100 m (global < 5 m ALTE information) (mass transit)

Application Fleet Fleet management Cargo monitoring Cargo Energy Charging Energy Infrastructure Charging Cargo Hazardous Monitoring Passenger Passenger information 2/ EXECUTIVE SUMMARY EXECUTIVE 2/ 10 REPORT ON RAIL USER NEEDS AND REQUIREMENTS 11 03 Reference Documents

Table 2: Reference documents

Id. Reference Title Date [RD1] SUGAST-INE-5300-D- Technical note on GNSS performances for rail 27.05.2011 5310-PU-2.0 (not public) [RD2] P1603D003 Rail Positioning Applications 20.06.2013 (not public) [RD3] EGN-TPZ-01-0011-TNO EGNOS V2 applications in Rail logistics and 29.04.2014 1.0 asset management (not public) [RD4] ESSP-TN-12586 v01-00 EGNOS V3 requirements for the rail domain 20.11.2014 (not public) [RD5] GNSS Market Report issue 4 March 2015 (available at: https://www.gsa.europa.eu/2015- gnss-market-report) [RD6] ESSP-TN-11715 v01-00 Report on the use of EGNOS V2 for Railway safety 08.05.2014 and non-safety applications (not public) [RD7] SUBSET-041 3.1.0 ERTMS/ETCS - Performance Requirements 01.03.2012 for Interoperability (available at: http://www.era.europa.eu/Document- Register/Documents/Set-2-Index014-SUBSET-041% 20v310.pdf) [RD8] SUBSET-091 3.3.0 ERTMS/ETCS - Safety Requirements for the Technical 08.05.2014 Interoperability of ETCS in Levels 1 & 2 (available at: http://www.era.europa.eu/Document- Register/Documents/Set-1-Index027-SUBSET-091% 20v250.pdf) [RD9] (EU) No 642/2014 Council Regulation establishing the Shift2Rail Joint 16.06.2014 Undertaking (available at: http://eur-lex.europa.eu/legal-content/FR/ TXT/?uri=CELEX:52013PC0922) [RD10] Shift2Rail Joint Undertaking - Annual Activity Report 2014 31.03.2015 (available at: https://ec.europa.eu/transport/sites/ transport/files/modes/rail/doc/s2r-annual-report-2014_ final.pdf) [RD11] Version 1.0 Shift2Rail Strategic Master Plan 24.09.2014 (available at: https://ec.europa.eu/transport/sites/ transport/files/modes/rail/doc/2015-03-31-decisionn4- 2015-adoption-s2r-masterplan.pdf) [RD12] GSC-D2.2 v1.2 GSC – Identification of Galileo Integrity requirements 09.2009 (not public) 12 3/ REFERENCE DOCUMENTS

[RD13] GRAIL-WP0-INE-DEL-05 Final Activity Report 10.12.2008 (available at: https://www.rssb.co.uk/research- development-and-innovation/research-and-development/ research-project-catalogue/t511) [RD14] GRAIL-WP3-TIF- GNSS Subsystem Requirements Specification for Enhanced 08.10.2008 DEL-3.1.2 ETCS Application (available at: https://www.gsa.europa.eu/sites/default/ files/virtual_library/2007-06-29_GRAIL_Project_-_GNSS_ Subsystem_Requirement_Specification_for_Enhanced_ ETSS_Applications.pdf) [RD15] GRAIL-WP3-TIF- GNSS Subsystem Requirements Specification for Enhanced 08.10.2008 DEL-3.1.1 Odometry Application (available at: https://www.gsa.europa.eu/sites/default/ files/virtual_library/2007-08-08_GRAIL_Project_-_GNSS_ Subsystem_Requirements_Specification_for_Enhanced_ Odometry_Application.pdf) [RD16] SUGAST-FDC-1100-D- SUGAST Final Report 13.06.2012 1118-PU-1.1 (not public) [RD17] PTC Implementation: The Railroad Industry Cannot Install March 2014 PTC on the Entire Nationwide Network by the 2015 Deadline (available: https://ohsonline.com/articles/2013/03/01/ ptc-implementation-impossible.aspx) [RD18] DOT-VNTSC- Federal Radionavigation Plan May 2015 OST-R-15-01 (Available at: https://www.navcen.uscg.gov/pdf/ FederalRadionavigationPlan2014.pdf) [RD19] GNSS for Train Localisation Performance Evaluation 17.06.2014 and Verification (available at: https://d-nb.info/1059369524/04) [RD20] Impact of the EGNOS and Galileo integrity on the design 2008 of railway on board fail-safe positioning equipment George BARBU, UIC (SATLOC project) [RD21] A relation among GNSS quality measures and 2008 railway RAMS attributes Aleš FILIP, Julie BEUGIN, Juliette MARAIS and Hynek MOCEK (proceedings CERGAL 2008) [RD22] Galileo for railway operations: question about the 18.01.2011 positioning performances analogy with the RAMS requirements allocated to safety applications Julie Beugin, A. Filip, Juliette Marais, M. Bernibeau (available at : https://link.springer.com/article/10.1007/ s12544-010-0032-3) [RD23] GRAIL-2: Enhanced Odometry based on GNSS 2011 (available at : https://ac.els-cdn.com/ S1877042812028017/1-s2.0-S1877042812028017-main. pdf?_tid=9d577528-ca1e-11e7-b3e3-00000aacb361&acdn at=1510762029_958ce5c26297e98f16f53cbaee22ed60) REPORT ON RAIL USER NEEDS AND REQUIREMENTS 13

[RD24] ERTMS, applications sécuritaires et applications 20.11.2014 satellitaires, quelles avancées de la recherche ? Juliette MARAIS, Ifsttar (available at : http://docplayer.fr/4695139-Ertms- applications-securitaires-et-applications-satellitaires- quelles-avancees-de-la-recherche.html) [RD25] 96S126 02S1266-6 ERTMS/ETCS - RAMS Requirements Specification 30.09.98 Chapter 2 – RAM (available at : http://www.era.europa.eu/Document- Register/Documents/B1-02s1266-.pdf) [RD26] Simulation-based Evaluation of Dependability and 31.10.2011 Safety Properties of Satellite Technologies for Railway Localization Julie Beugin, Juliette Marais (available : Simulation-based Evaluation of Dependability and Safety Properties of Satellite Technoligies for Railway Localization) [RD27] Validation Interview – UNIFE (not public) [RD28] Validation Interview – Ansaldo STS (not public) 19.01.2016 [RD29] GNSS Market Report issue 5 (available at: https://www.gsa. 2017 europa.eu/2017-gnss-market-report) [RD30] GNSS Technology Report issue 1 (available at: https:// 2016 www.gsa.europa.eu/european-gnss/gnss-market/2016- gnss-user-technology-report) update [RD31] GSA-MKD-RL- User Consultation Platform 2018 – Minutes of Meeting of 03.12.2018 2019

MOM-246193 the Rail Panel 04 Market Overview and Trends

4.1 Market Evolution yy Safety relevant applications are emerging with different and Key Trends maturity levels depending on region, e.g. in India, China and the Middle East, GNSS is taking up an important position. According to the GNSS Market Report issue 5 [RD29]. the key GNSS market trends in Rail segment are: yy GNSS based solutions can offer safety at a lower cost, e.g. as investigated in railway signaling. yy Non-safety relevant applications in Rail are already widely based on GNSS.

Figure 2: Shipments of GNSS devices by region [RD29]

350 300 250 200 150

Units (Thousands) 100 50 0 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025

EU28 Non-EU28 Europe North America Asia-Paciﬁc Middle East + Africa South America + Caribbean

As a general trend, shipments of GNSS devices have been constantly growing in the last years, with growth significantly intensifying since 2015. Europe is the leading region concerning GNSS Rail shipments, due to the high development of non-safety relevant applications related to passenger information. REPORT ON RAIL USER NEEDS AND REQUIREMENTS 15

Figure 3: Shipments of GNSS devices by application [RD29]

350 300 250 200 150

Units (Thousands) 100 50 0 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025

Asset Management Passenger Information Signalling and train control applications Driver Advisory Systems

Asset management applications are currently driving and yy European companies are dominant among system expecting to continue to drive GNSS devices shipments. integrators, controlling 72% of the market, where key operators have strong exports both to North America In the coming years, safety relevant applications (signal- and Asia. The top 3 companies are Ansaldo, Alstom and ling and train control) based on GNSS will be increasingly Siemens, but this category also includes: General Electric, developed. These applications require a very high level of Thales, Bombardier, Telespazio and Nottingham. performance and, depending on the strategy towards them, GNSS may be used as: yy We can cite among train and rolling stock manufacturers: Siemens, Bombardier, Alstom, Hitachi, and China yy Primary means as foreseen in the US with PTC; South Locomotive. yy A back-up solution as planned in Europe; or yy Train owners and operators include: train operating yy Even one of the means within a hybrid solution. companies and freight operating companies, such as Deutsche Bahn, Trenitalia, SNCF, Arriva, Colas, Renfe, Veolia, Stagecoach and urban transports operators. There 4.2 Main Market Players are also rolling stock operating companies as investment banks, consortia and national companies. The Rail industry is concentrated in Europe and North Amer- yy The Rail undertakings and infrastructure managers ica. European GNSS companies have a market share of 38%, include: Deutsche Bahn, RFI, RFF, Network Rail, ADIF among components and receivers and the top 3 companies and urban transport operators. in the continent are Septentrio, Hexagon (Leica Geosystems) and U-blox. 4.3 Main User Groups The main industry stakeholders in the Rail GNSS market value chain are system integrators, component manufacturers, The analysis of Rail PNT applications (5.1) enabled the iden- train manufacturers, train owners and operators as well as tification of the main user communities that are involved in Rail undertakings and infrastructure managers. the user requirement definition process. They are identified yy The main component manufacturers (receivers and in the table below. others) are: Trimble, Septentrio, Navis, Garmin, Broadcom, Furuno, Hexagon (Leica Geosystems), Omnicom, U-Blox and Infineon Tech. 16 4/ MARKET OVERVIEW AND TRENDS

Table 3: Main Rail user communities

Users

Rail Train owners / Undertaking / Group / Bundle Applications Result Passengers Others operators Infrastructure Managers Train Control and Automatic Train Protection - Enhanced Odometry Provide Location and Speed according to reference X X Signaling point Automatic Train Protection - Absolute Positioning Provides Positioning without integration of Speed X X Level Crossing Protection Ensure safety when trains cross intersections X X Road users Cold Movement Detection Confirms validity of the position stored when train is X powered off Train Integrity & Train Length Monitoring Ensures trains are complete X X Track Identification Determines the current track in which a train X X is running Safety Critical Odometer calibration Provides independant positioning to calibrate train X X odometer Protection and Emergency Trackside Personnel Protection Warns people working near or on the track of Trackside X X Management Systems an approaching train Personnel Management of Emergencies Organizes emergency teams and operations Rescue teams Train Warning Systems Warns passengers when a trains is to pass X X a platform over a certain speed limit Door Control Supervision Enables the opening of specific doors at particulier X X stations Hazardous Cargo Monitoring Hazardous Cargo Monitoring Monitors and tracks hazardous cargoes X X Asset Management Fleet Managements Tracks assets X (Rolling stock) Cargo Condition Monitoring Allows tracking of freight and planning X (e.g. estimation of the arrival at depots) Infrastructure Charging Charges for specific infrastructure usage X Energy Charging Charges in proportion of energy consumption X Non-Safety Critical Asset Management Infrastructure surveying Collects located data on the railway infrastructure X (Fixed asset) Structural Monitoring Supports the monitoring of railway infrastructure X X and embankments Passenger information Passenger information Provides information on train location to passengers: X - customer or staff - on-board or not

Component manufacturers, system integrators and train manufacturers can also play an important role in the definition of user requirements, in particular for safety relevant applications. REPORT ON RAIL USER NEEDS AND REQUIREMENTS 17

Users

[RD2] [RD1] [RD3] Application Prioriti- Applications Applications Applications Bundle sation 1 Low Density Line signalling 2 ERTMS Positioning Absolute Positioning Driver route knowledge 8 assistant Automatic Train Protection On-train ERTMS Interface Train Awakening Train Awakening Cold movement detection Cold movement detector Train integrity and train Train integrity and train length monitoring length monitoring

Autonomous Pantograph Control Train 5 Tilting train control Control Door Operations On-train Monitoring Recorder Odometer Calibration Track Identification Level Crossing Protection Enhanced Odometry

Safety critical applications User Worked Crossings Detonator Replacement (“Virtual Detector”) Traffic Management & Traffic Management Regulation Systems (Dispatching) Disruption Management Traffic 7 Trackside Personnel Trackside Personnel Management Protection Protection Alternative Temporary Block Working Incident Management Management of Response Emergencies On-board Train Monitoring and Recording Unit REPORT ON RAIL USER NEEDS AND REQUIREMENTS 19 GNSS User Requirements Analysis [RD2] [RD1] [RD3] Application Prioriti- Applications Applications Applications Bundle sation Train Approaching Train warnings Systems 10 Warnings Possessions Management Digital Route Map creation Digital Map Creation Surveying for digital map creation Structural Monitoring Structural Monitoring Structural monitoring Maitenance 11 and Survey Gauging surveys Gauging surveys Infrastructure Data Infrastructure surveying Collection Safety critical applications Automated Infrastructure Maintenance Eco-Driving Energy efficiency Temporary Speed Driver Restrictions & Emergency 8 assistance Speed Restrictions Driver advisory systems (automation stage 1) Centralised clock (GNSS to synchronise multiple on- board devices) Fast and slow line discrimination

Autonomous Automatic Train Operation Train 6 (automation stage 2) Services Driverless Trains (automation stage 3) On-train Monitoring Automated Lubrication On-train braking measurement probes

Non-Safety critical application Location of GSM-R Reports Location of GSM Reports Fleet Management Fleet Management Fleet management Multi-modal Terminal Terminal Management Management

Asset Passenger Count 3 Management Infrastructure charges Infrastructure Charging Infrastructure Charging Energy Charging Energy Charging Delay Attribution Inter-modal transfers On-train CCTV

Safety critical Liability critical Fixed asset Managment Rolling stock Managment (Liability critical) (Liability critical) 20 5/ GNSS USER REQUIREMENTS ANALYSIS

[RD2] [RD1] [RD3] Application Prioriti- Applications Applications Applications Bundle sation On-train ticketing, retail & authentication On-train reservations On-train catering and services Train Crew information services Passenger Customer Information 4 information Systems On-board Passenger Information systems Personal Journey Assistant Location Based Services & Points of Interest Passenger Broadband

Non-Safety critical application (Internet Access Caching) Logistics Planning and 12 Monitoring (support vehicles) Cargo Condition Cargo Condition 13 Cargo Monitoring Monitoring Monitoring Hazardous Cargo Hazardous Cargo Monitoring Monitoring

This document considered only some of these applications. Automatic Train Protection aims to prevent a train proceed- Please refer to reference documents for exhaustive informa- ing beyond the point of danger and to prevent the speed tion about Rail PNT application definitions. of the train exceeding the permissible limit in the event of a driver error. It consists of the safe determination of position, The selected applications correspond to the applications speed and direction of train movement in order to supervise considered in [RD4] and [RD5], as well as to the applica- the safe movement of the train up to its stopping point tions considered as “First priority applications” in [RD2]. (End of Movement Authority). This application requires the This panel of applications is a representative sample of the combination of several functions (or lower level applications) wide range of Rail PNT applications and their associated which in turn are strongly dependent of the accurate and user requirements. safe determination of position and speed of the trains: yy Calculation of End of Movement Authority 5.1.2 SAFETY RELEVANT APPLICATIONS yy Calculation the emergency braking curve to get to the 5.1.2.1 AUTOMATIC TRAIN PROTECTION EOA Automatic Train Protection (ATP) applications are used to yy Train Location / Train Position Report ensure that trains run safely and efficiently on the right yy Speed profile calculation tracks with appropriate speed. The Rail safety principle is to design and provide controlled safe response of the systems yy Train spacing to failures. The main applications included in this group are yy Supervision to buffer stops (in particular Calculation on described in this section. board the release speed for the approach to buffer stop) REPORT ON RAIL USER NEEDS AND REQUIREMENTS 21

ERTMS/ETCS – the European Automatic Train There are many ATP applications where GNSS could be used, Protection System among them: Enhanced Odometry, Absolute Positioning, Cold Movement Detection, Train integrity and train length The European Rail Traffic Management System (ERTMS) monitoring, Track Identification, Odometer Calibration, and initiative aims to provide a new generation of train control Level Crossing Protection which are described here after. and signalling capabilities (ETCS – European Train Control System), which includes automatic train protection by con- 5.1.2.1.1 Enhanced Odometry tinuously supervising train speed and braking. In ERTMS, train protection is based on the knowledge of train position with respect to a spot to be protected and the ERTMS has two basic components: supervision of a braking curve. The spots to be protected yy ETCS, the European Train Control System are referred with respect to balises located on the track. This system implies the need for odometric systems providing yy GSM-R, radio system standard for signalling data trans- current position and speed. One of the traditional odometry mission systems more widely used calculates the train speed from the number of turns of a wheel of the train with corrective The ERTMS technology has different levels of capacity and mechanisms for avoiding slide and slip phenomena. The aim performance: of the additional GNSS Enhanced Odometry Subsystem is yy Level 0 is when an ETCS vehicle is used on a non-ETCS to support the odometry with accurate position and speed. route. The trainborne equipment computes the maxi- The GNSS Enhanced Odometry Subsystem could be used mum train speed and the train driver as a substitute for/complement of the must monitor the trackside signals. current odometer sensors (tachometers, INS/IMU, Doppler radar etc.) in the yy In Level 1, ‘Eurobalise’ radio bea- ETCS odometry. However it should be cons transmit trackside signals as The Rail mentioned that if an odometry subsys- a movement authority to the train- safety principle tem should be used as an independent borne equipment. There, the maxi- diagnosis (cross-check) of ETCS virtual mum speed and braking curve are is to design balise detection based on GNSS, then obtained and automatic train pro- the enhanced odometry subsystem con- tection is ensured with these data. and provide taining GNSS cannot be used due to a yy In Level 2, it is possible to remove controlled potential Common Cause Failure effect. side light signals as the trains automatically report, on a regular basis, safe response 5.1.2.1.2 Absolute Positioning their navigation data to a Radio Block of the systems The main purpose of this ATP application Centre, which transmits back the is to provide absolute train position- next movement authority. to failures. ing information for input to the ERTMS yy In level 3, no line side signals will be system. This application provides a con- required for delivering movement fidence interval on position which is authorities. A train shall be able to locate itself. All infor- independent of the travelled distance – contrary to the mation will be exchanged between the ETCS on-board odometry sensors – and can provide location information system and the RBC trackside system (Radio Block Center) with a higher and relevant integrity level. through mobile networks. Two data are communicated by the train to the RBC: its location and the confirmation 5.1.2.1.3 Cold Movement Detection that the train did not lose any wagon. This information is Cold Movement detector (CMD) function detects train move- called “integrity” in the railway domain and is an element ments while equipment is in No Power mode (equipment is of the safety. This last level of ETCS shall also improve line not powered up). If the Location Unit works independently capacity by making it possible to manage circulations of train power, CMD function compares train positions when with moving blocks. In this context, GNSS is investigated entering and exiting of NP mode. If an external power is to be the basis for new embedded train locator. supplied to the UT, CMD function detects train movement during NP mode. ERTMS will intervene if the train over-speeds, to bring it back to safe levels. The system stops a train safely to pre- 5.1.2.1.4 Train integrity and train length monitoring vent it from exceeding its movement authority. Precise knowledge of the train speed, thus, is a central topic in the Train Integrity is the level of belief in the train being complete ERTMS developments. and not having left coaches or wagons behind. The train 22 5/ GNSS USER REQUIREMENTS ANALYSIS

length monitoring could be provided by two positioning The GNSS subsystem should manage a Digital Map with systems – satellite positioning system or odometry sensor – geographical information: level crossing location, track at the front and rear end of the train and by a communication description in the level crossing surroundings, location system and a computing unit. This function is essential for activation / deactivation point. This function must be inte- level 3, and level 2 high density, to increase line capacity. grated with the ERTMS system to ensure interoperability.

5.1.2.1.5 Track Identification 5.1.2.2 PROTECTION AND EMERGENCY MANAGEMENT A track identification system would 5.1.2.2.1 Trackside Personnel Protection Personnel make use of GNSS and other track working on or based infrastructure information The maintenance and upgrade of the infrastructure is a major to determine the current track on activity involving movements of personnel, equipment close to the which the train is running. and materials. Personnel working on or close to the track must be protected from trains using the network. Speed track must be 5.1.2.1.6 Level Crossing Protection restrictions may apply or the train may be prevented from entering the work zone completely. Alternatively, personnel protected from GNSS could be technical solution working must be warned when a train is approaching the for Level crossing protection sys- working area. Main applications related to the protection trains using tems. the network. and emergency management are described in this section. The protection systems of the GNSS applied to trackside personnel protection will improve level crossing need the location current manual or semiautomatic procedures. This appli- information of a train approaching cation can monitor the location of the working team, the the level crossing. Besides, information about the location, assets (rail construction machinery, etc.) and the trains. The identification, status and other conditions concerning the system, knowing the position of the elements, could issue level crossing must be transmitted to trains. warnings to the trains for slowing speed or event stop, and orders to the working equipment and teams to abandon The level crossing protection applications is able to send working areas when trains are approaching. a speed restriction to the train. The value of the speed restriction depends upon the status of the level-crossing, closed detected, closed not detected, and on the line and direction of the movement. REPORT ON RAIL USER NEEDS AND REQUIREMENTS 23

5.1.2.2.2 Door Control Supervision Gauging surveys The purpose of this application is to enable the opening of This is one sub-application of infrastructure surveying. The specific doors at particular stations. GNSS is used to locate purpose is to provide high-precision positioning information the train within a station. to gauging surveys. Gauging surveys are undertaken on platforms, structures, Some stations have short platforms or platforms on both bridges and tunnels; these operations mainly involve struc- sides, it is required that only the correct doors (i.e. those ture clearance and passing clearance assessments when with a platform next to them) are opened when a train new rolling stock or structures are introduced. stops at a station. This application requires knowledge of the train location within the station and identification of Appropriate loading gauges, with scarce tolerance mar- the train at a specific platform. Location data can also be gins, are needed in the track sections so that the rolling used by passenger information systems to alert passengers stock can transit without incidents. The ability to move for the need to move to other vehicles, e.g. long trains at a railway vehicle and its load on a particular part of the short platforms. network depends on the height and width profile, known as loading gauge, of the route concerned. A railway vehicle must comply with the route loading gauge to ensure that 5.1.3 NON-SAFETY RELEVANT APPLICATIONS it passes clear of all structures, principally over-bridges 5.1.3.1 FIXED ASSET MANAGEMENT (ASSET MANAGEMENT) and tunnels but also features such as station platforms, canopies and overhead or trackside equipment. The Fixed asset management is linked with the railway environ- compatibility of rolling stock and infrastructure must be ment, from the infrastructure to the trackside equipment. assessed through dedicated structural surveys which use Therefore, the accuracy needed for the location of the assets techniques ranging from a conventional wood platform in some cases can be demanding and requiring high pre- gauge to 3D laser scanning. cision surveying. GNSS is, as in other topographic applications, an important technology to consider, as it does not only provide appro- 5.1.3.1.1 Infrastructure surveying priate accuracies, but also geo-referenced output. The railway is a dangerous environment with a growing demand for shorter journey times (i.e. faster trains) and Location of GSM Reports greater capacity (more trains). This puts severe time and This is another sub-application of infrastructure surveying financial constraints for access to working on or near the whose accuracy may be lower. This consists of the site survey line. To allow data to be collected on the railway infrastruc- as part of GSM-R cell planning. As the link budget is not ture, while accommodating the constraints of obtaining only affected by the accurate placement of GSM-R stations, access, mobile surveying systems have been developed but also by the track section shape, foliage, multipath and which combine GPS with digital images, video and laser attenuations/gains, the siting accuracy can be consequently measurements (data geo-referencing). Some operations moderate. that might benefit from this technology include: yy Signal sighting 5.1.3.1.2 Structural monitoring yy Asset data collection The industrial driver for the use of GNSS technology in structural monitoring is the increasing need for reliable, yy Site surveys accurate and cost-effective condition monitoring systems yy Design verification for bridges and other major structures within the railways. yy Route familiarisation Monitoring is an important tool in planning the systematic maintenance of the bridge stock in order to preserve yy Rapid response adequate levels of structural integrity and maximise opera- yy Gauging surveys tional benefits. In addition to bridges, slope stability is also required to be monitored to ensure that the embank- yy Location of GSM-R reports ments are stable and the risk of landslide is minimised. yy Virtual Inspection GNSS solutions are supporting both application areas. GNSS is used to provide real-time position sensing of In [RD1], [RD2] and [RD5], this application is considered as critical locations which can be used to inform infra- a Liability relevant application. structure operators and train operators of any “out of tolerance” behaviour. 24 5/ GNSS USER REQUIREMENTS ANALYSIS

In [RD1], [RD2] and [RD5], this application is considered as maintenance are facilitated if a more automated tracking a Liability relevant application. of these resources can be made.

5.1.3.2 ODOMETER CALIBRATION Nowadays some service provider is providing satellite based solutions based on the use of a GNSS receiver integrated The odometer is used for speed, distance, acceleration and with satellite or terrestrial communication installed on each running direction measurements by measuring the train’s coach. movement along the track. Odometer accuracy is com- promised by wheel slips due to rain, ice, snow, and leaves. 5.1.3.4.2 Cargo monitoring Independent positioning can be used to calibrate the train odometer for systematic biases that have been introduced The importance of accurate information for freight custom- through operation. GNSS could be used to assist in the ers, particularly accurate estimates of the arrival of trains at calibration of the train’s odometer. depots, is inestimable. Unplanned late arrival can result in delays to unloading that seriously disrupt the running of 5.1.3.3 MANAGEMENT OF EMERGENCIES subsequent services. The management of emergencies can be greatly improved Complete train, individual containers or even goods can be

update if an accurate, continuous location of the train is available, tracked by radio-navigation systems potentially through allowing the emergency teams to optimise their operations, 2019 multiple modes of transport, thereby requiring the inte- thus GNSS is suitable for this kind of application. gration of management information from multiple service providers and requiring the interoper- In the event of an accident, it is impor- ability of different systems. tant to know the location of the train in the line, so that rescue teams can reach The railway is 5.1.3.4.3 Infrastructure charging the place of the accident. For this kind of application the geographical position a dangerous In the Member States, according to the of the train shall be provided and it shall environment new directives (First Railway Package be expressed in co-ordinates under- European Directive 2001/14/EC) and standable to railway personnel and the with a growing the liberalisation of the Rail sector, train emergency services, which normally use operators are charged in proportion to different coordinate systems. demand for use of the infrastructure. Penalties are shorter also imposed according to delays. An 5.1.3.4 ROLLING STOCK MANAGEMENT independent GNSS-based location/ (ASSET MANAGEMENT) journey times speed/time service could be used within the charging process to determine accu- The rolling stock term is usually mean- and greater rate infrastructure usage according to ing vehicles that move on a railway location and duration and hence gener- including both powered and unpow- capacity. ate accurate billing information. Besides, ered vehicles, for example locomotives, the application allows for transparent railroad cars, coaches, and wagons. The process for allocating blame and charges and provision of applications identified as interesting involving GNSS are evidence. described here after. 5.1.3.4.4 Energy charging In [RD1], [RD3] and [RD5], this application is considered as a Liability relevant application. To monitor the energy consumption of trains and hence users, vehicles can be fitted with GNSS and energy meters. 5.1.3.4.1 Fleet management Meter readings will then be available either when borders are crossed or as required. Border crossing events can be The tracking of assets (rolling stock, wagons) is crucial to registered by GNSS and the reading from the energy con- achieve an optimised use of an operator fleet. The accu- sumption meter is forwarded to a recording point for later rate determination of position and distances covered by a invoicing. resource can ease the maintenance of a vehicle. The vehicles can be monitored everywhere at every time of their 5.1.3.4.5 Hazardous Cargo Monitoring life-cycle. Some of the goods carried by Rail freight operators can Long-term management and planning of the use of roll- damage the environment if they are spilt in transit and/or ing-stock, the composition of train and the preparations for pose a threat to society if they are stolen. These include: 25

2019 update Train Warning Systems Warning Train REPORT ON RAIL USER NEEDS AND REQUIREMENTS AND NEEDS USER RAIL ON REPORT On-train ticketing, retail & authentication retail ticketing, On-train reservationsOn-train and services catering On-train servicesinformation Crew Train Systems Information Customer systems Information Passenger On-board Journey Assistant Personal of Interest Based ServicesLocation & Points Caching) (Internet Access Broadband Passenger y y y y y y y y y y y y y y y y y y 5.1.3.5.1 on passengers a special warning to require Some railways and is expected to is approaching when a train a platform than a defined level. greater a speed at pass the platform This application requires details of train location, speed and location, details of train requires application This in an automatic result and may data, other infrastructure via a public service announcement station broadcast. PASSENGER INFORMATION

application bundle “Passengers information”. Please refer refer Please information”. “Passengers bundle application including: these applications, of the definition [RD2] for to 5.1.3.5 can be included in the that 9 applications [RD2] identifies security, etc. It also helps in archiving of vital condition data It data of vital condition etc. also helps in archiving security, cargoes. stolen and an ability track to managers to remotely monitor, track and communicate and communicate track monitor, remotely managers to this application Furthermore, in real-time. with their cargoes mapping directions, speed, on location, updates provides GNSS can be used to provide an alarman alertand when provide to used be can GNSS system - communi or terrestrial used in conjunction with satellite solution allows This technologies. geofencing and cations liquefied and refrigerated gases; flammable/corrosive/toxic flammable/corrosive/toxic gases; refrigerated and liquefied wastes. hazardous and chemical/nuclear chemicals crude petroleum and petroleum products; compressed, compressed, products; petroleum and petroleum crude 26 5/ GNSS USER REQUIREMENTS ANALYSIS

5.2 Prospective use of GNSS in Rail

The results presented in this section were consulted with UNIFE and Ansaldo STS (see the reports of the validation interview [RD27] and [RD28]).

Figure 4: Maturity of Application Bundles

Train Approaching Warnings

Traﬃc Management

ERTMS Passenger Safety related ETCS Information Non-safety related

Automatic Automatic Low Traﬃc Asset Train Train Line Management Operation Protection Signaling

Concept In use

Figure 1 shows the maturity of the different functional of the train to the running speed, speed regulation and groups, this can only be an approximation, since they are smoothly stopping the train at the proper position at groups of individual applications; but it gives an overall station platforms or in front of stopping signals. GNSS impression as to the market readiness of each application could be used for ATO but this requires further study grouping. Although the figure shows more groups in use as never address before. than at a concept stage, it should be noted that the GNSS yy Low Traffic Line Signalling: The purpose is to provide full penetration within these in-use groups is often low and signalling functionality without interlocking or blocking improved location information would offer advantages. systems. The train location, speed, direction and identification must be known for every train in the control area. Three application bundles, not addressed as such in the previous part are briefly defined: yy Traffic Management: this applications bundle include applications such as Traffic Management Systems1 yy Automatic Train Operation: This application bundle has (Dispatching), but also Trackside Personnel Protection, been identified during UNIFE interview. Automatic Train Management of Emergencies (see previous section). Operation, or ATO, is an ATC subsystem which performs on-board, non-vital functions normally performed by a train driver, including ensuring a smooth acceleration

1 (please see [RD2]) REPORT ON RAIL USER NEEDS AND REQUIREMENTS 27

GNSS is already used in applications in which people’s safety 5.3 GNSS limitations for Rail use isn’t at stake, such as passenger information applications, which are mainly mature applications. Rail is a very safety-sensitive environment and this why there are still limitations to use GNSS technology in Rail The main axes of development for GNSS applications in applications. Rail are safety relevant and liability relevant applications. The European GNSS differentiators can play a key role in The main limitations for Rail these applications. GNSS applications concern obscuration, which might Automatic Train Automatic Train Protection is one of the most promising take place in tunnels, deep Protection is GNSS safety relevant applications. It can be seen under two cuttings and in the shade of perspectives: inside and outside the ERTMS framework. high hills/mountains, and at one of the most high latitudes or out of cov- yy Within the ERTMS framework, GNSS could be used as erage for EGNOS obscuration. promising GNSS a means: Another limitations is GNSS safety relevant accuracy regarding position- To introduce the virtual balise in the ERTMS ETCS ing a train on parallel tracks Level 2/3 applications. or in train stations (HPL ≤ 3 m To provide the train integrity monitoring function required). for the ETCS Level 3 This section highlights the challenges related to the satel- yy Outside the ERTMS framework, GNSS is already being lite positioning in the Rail domain. This section is based on deployed for train control most commonly in USA, for [RD20], [RD21], [RD22] as input documents. Positive Train Control applications. The train location determination is a primary function in As it comes to Galileo system, it could bring increased avail- the railway activity management. Indeed, it contributes not ability and accuracy to train control, low traffic line and level only to the traffic management, but also to the train control. crossing management, rolling stock management and other The train control aims to avoid collision or other accident. applications, even in difficult environments. With other constellations, it could help increase integrity via advanced technology at receiver level. 28 5/ GNSS USER REQUIREMENTS ANALYSIS

Currently, odometric sensors are used to measure the train Secondly, the train location is determined upon only one speed and the relative train position in the European Train coordinate: the distance from the last balise to the train. Each Control System, computed by integration of the speed. track has its own coordinate system. Taking into account the Balises are regularly spaced out along the railway track. The railway network map the general three-dimensional posi- train assesses its position thanks to two tachometers and tioning principle can be reduce to a one-dimensional model: two Doppler radars, whose errors are reset periodically by the distance travelled by the train from its departure place the beacons. The operating and maintenance costs of this (assuming that an accurate and reliable map is available). type of equipment are very high. This leads sometimes to the closure of low traffic lines. For the positioning systems the railway applications require variable safety levels: The use of satellite positioning systems in the ETCS could yy A very high level for safety relevant applications. For resolve the economic issues and meet the interoperability instance, the train control function which ensures the requirements, as the current train control equipment differs non-collision of trains requires SIL4 from country to country. yy A very low level for the others. However, some railway specificities have to be considered, when taking in to account using GNSS in Rail applications. At last, when a failure occurs a train has to immediately stop. The railway community wants to take no risk. Therefore, the First of all, the train moves along the track, and so along notion of Time-To-Alarm in the railway domain dissents from one axis – horizontal. It involves that: the aeronautical one. yy the train driver can only brake but not avoid Today, the used railway location systems are more determin- yy but, the train can stop in response to a failure ist. The potential use of GNSS systems in the ETCS involves the use of its statistical parameters. The railway safety problematic is thus very different to the aeronautical one. REPORT ON RAIL USER NEEDS AND REQUIREMENTS 29

5.4 Drivers for Railway User requirements 5.4.1 THE RAILWAY SAFETY PHILOSOPHY SIr = P(2f) + P(syf) + P(false_if) According to [RD20], The Railway Safety philosophy is based on three main principles: yy P(2f) the probability that during the imposed and designed time of failure detection, identification yy Avoidance, and as far as possible exclusion, the trans- and enforcement to safe response (1s) a second formation of the inherent human non-intended errors failure occurs. into wrong-side failures (= failures, technical or human, yy P(syf) the probability of systematic failures for which susceptible to develop into hazards, to produce harm). the system is not designed to the detection. Prevention of imaginable non-intended failures of the human operator to become wrong-side failures => yy P(false_if) the probability that bad information is not the railway system is not designed to protect against detected and the system uses a false information. intended wrong-side human failures. The railway safety standards (EN 50126...EN 50129) clearly yy The controlled reliability, mainly applicable to the prescribe the methodology to be followed over the whole vital components. life cycle of a sub-system or component to assure that its yy Detection and identification of any possible random safety integrity risk is controlled and maintained under the critical technical failure (= any technical non function- prescribed level. ality which has the potential to produce a non-safe response) and immediate enforcement of a safe state. The classification of the safety integrity is prescribed on 5 The safety integrity risk is given below: levels (from EN 50129):

Table 4: SIL Classification

Safety On Demand Mode Continuous Mode Consequence integrity (Low demand mode) (High demand mode) of a failure Probability of Tolerable Hazard Level Availability failure on Demand Rate per hour (failure/demand) and function SIL4 > 99.99% ≥ 10-5 to <10-4 ≥ 10-9 to <10-8 Several possible dead people in surrounding community SIL3 99.99% ≥ 10-4 to <10-3 ≥ 10-8 to <10-7 Several possible dead people SIL2 99% -99.99% ≥ 10-3 to <10-2 ≥ 10-7 to <10-6 Possible serious wounded people or one dead person SIL1 90% -99% ≥ 10-2 to <10-1 ≥ 10-6 to <10-5 Possible minor wounds SIL0 No requirement N/A

This table indicates the probability of failure, the safety Note: integrity risk allocated to each of the levels (the figures yy The “on demand mode” is reserved for systems used in represent probabilities expressed in events/hour). intermittent/sporadic way. The classification of SIL makes a distinction between the yy The “continuous mode” concerns systems permanently continuous (high demand) mode of operation and the used for a period of time. operation on demand. This distinction takes into account that the operation on demand shall be preceded by an initial check of the element’s fail-less state. In this study we will be interested exclusively in the continuous mode. 30 5/ GNSS USER REQUIREMENTS ANALYSIS

5.4.2 SAFETY AND DEPENDABILITY PARAMETERS = RAMS failure to operational status over a given time interval assuming that the maintenance is made under given The Railway quality attributes differ from the GNSS quality conditions with prescribed procedures and means. criteria. yy Safety integrity: the probability of a system satisfactory Railway definitions according to the EN 50126 standard are: performing the required safety functions under all stated conditions within a stated period of time. yy Reliability: the probability that an item can perform a required function under given conditions for a given time interval. 5.4.3 RELATION BETWEEN GNSS PERFORMANCE yy Availability: the ability of a product to be in state to PARAMETERS AND RAILWAY QUALITY MEASURES perform a required function under given conditions at a The scope of this part is to explain the relation between given instant in time or over a given time interval assum- the GNSS performance parameters and railway quality ing that the required external resources are provided. measures. A number a research work on this topic has been yy Maintainability: the probability that a given mainte- carried out since more than 15 years. In spite of different nance action, for an item under given conditions of use safety philosophies, the GNSS performance parameters can can be carried out within a stated time interval when be described by means of RAMS terminology according to the maintenance is performed under stated conditions railway standards. and using stated procedures and resources. It means the ability of a system being maintained or restored after a For more information please refer to [RD22].

Figure 5: GNSS quality criteria within railway RAMS

Quality of Railway Signalling System (RAMS) based on GNSS

Dependability

S A Availability – according to railway RAMS CR(t)=PF (t) DD A{(t|M(t)} ≈ 1 - {IR(t)+CR(t)} +PFSD(t)

Continuity Risk CR(t) Maintainability M(t)

Latent failures Integrity Risk IR(t) Correct position & diagnostics

PSDt IR(t)=PFDU(t)

PDDt PSt

PDt

Reliability (Correct position and diagnostics) REPORT ON RAIL USER NEEDS AND REQUIREMENTS 31

Besides, [RD20] states that GNSS parameters relevant and specifications is published by the European Commission impacting to the fail-safe design in compliance with the following the approval of the Member States, it is based railway principles and standards are: on a recommendation from ERA. This recommendation is widely discussed with the railway sector, including UNISIG, yy The Position Accuracy, and considerable work is undertaken by the consortium to yy The HAL (and consequently the AL), define these specifications. yy The Integrity Risk computed when the HAL and IR thresh- The UNISIG Consortium is an Associated Member of UNIFE. old are considered in the computation. Seven companies now known as Alstom, Ansaldo STS, Bombardier, Siemens, Thales, CAF and AŽD Praha are The other parameters of GNSS (such as the continuity risk) its Full Members. MERMEC became Associated Member are not directly relevant to the safe design in the railway in 2010. applications in contrast to aviation, given the random obstruction / visibility environment a continuity condition The UNISIG Satellite Positioning Working Group was cre- cannot be applicable. For completeness’ sake it should be ated (June 2012) to specify and standardize the application mentioned that GNSS SoL service continuity does not only of the satellite positioning to ERTMS. depends on SIS visibility. Continuity in aviation is the hardest requirement of all. Background: In 2011 UNIFE launched a market analysis of the new requirements coming from Customers outside and 5.5 Policy and regulatory inside Europe. framework The result of the analysis showed that Customers 5.5.1 POLICY AND REGULATORY STAKEHOLDERS worldwide are strongly in- Customers terested in the application The main policy and regulatory European stakeholders of ERTMS, and that they worldwide involved in the user requirement definition process are the would also be interested in European Railway Agency (ERA) and the UNion Industry of some new features, such as are strongly SIGnalling (UNISIG). (partial) elimination of balises interested in in ETCS Level 2 through the European Railway Agency use of satellite positioning the application functionality. The European Railway Agency was set up to help create of ERTMS. this integrated railway area by reinforcing safety and inter- The UNISIG Satellite Position- operability. The Agency also acts as the system authority ing WP objectives are the fol- for the European Rail Traffic Management System (ERTMS) lowing ones: project, which has been set up to create unique signalling standards throughout Europe. yy To develop a basic concept for train localization through the use of satellite positioning UNISIG yy To define, how the new functionality influence the UNISIG is the main entity involved in the definition of user current ETCS architecture requirements for safety relevant applications, and in par- yy To ensure that the impact on the existing system archi- ticular for ERTMS user requirements. tecture and existing products can be kept minimal. UNISIG is an industrial consortium, which was founded in 1998/99 at the specific request of the EU Commission with 5.5.2 REGULATIONS TOWARDS GNSS USER REQUIREMENTS the task of drafting the technical specifications for ERTMS/ 5.5.2.1 EUROPEAN RAIL USER REQUIREMENTS SPECIFICATION – ETCS. ERTMS/ ETCS RAM

Its role today is to develop, maintain and update the ERTMS Further specifications on ERTMS are provided by UNISIG on specifications in close cooperation with the ERA, which the design, certification and application of ERTMS equip- has been made the “system authority” for ERTMS. To do ment. Those considered to be more related to GNSS appli- so, UNISIG actively contributes, together with the railway cations are commented in this section. These specifications representative bodies, to the various related working are related to a function in which GNSS receivers can be groups of the agency. Whilst the final version of the ERTMS included but to the GNSS receiver itself. 32 5/ GNSS USER REQUIREMENTS ANALYSIS

For more information about ERTMS/ETCS RAM requirements Also in case of malfunctioning the on-board equipment specification, please refer to [RD25]. shall evaluate a safe confidence interval. yy Accuracy of speed known on-board: ± 2km/h for Reliability requirements consist of quantitative require- speeds lower than 30km/h, then increasing linearly ments in terms of Mean Time Between Failures (MTBF); up to ± 12km/h at 500km/h. and differentiates in reason of the criticality (Immobilizing, Service or Minor) of such failures. They are also called ERTMS yy Age of location measurement for position report to track- RAM (for Reliability, Availability and Maintenance) require- side: The location of the train head indicated in a position ments and are stated as follows (these are all defined for report shall be estimated less than 1 sec before the begin- on-board equipment) [RD25]. ning of sending of the corresponding position report. yy The MTB Immobilizing hardware Failures shall be not Clock less than 2,7x106 hours. yy Safe clock drift: 0.1 %. This value is not only a performance yy The MTB Service hardware Failures MTBF-SONB shall be but also a safety related requirement as it refers to clock not less than 3,0x105 hours. information used for time-stamping of messages and for supervision of time-outs, the magnitude of which yy The MTB Minor hardware Failures MTBF-MONB shall be is a few minutes. not less than 8,0x103 hours. 5.5.2.3 SAFETY REQUIREMENTS Availability must be not less than 99.973%, in order to assure compatibility with the ERTMS availability. For more information about safety requirements, please refer to [RD6]. Maintainability is also standardized by European Stand- ards. Apart being designed in order to These requirements refer to generic minimize periodical maintenance and high-level quantitative safety require- to control hazard levels, the equip- ments for ETCS operating either in Level ment installation must not interfere The railway 1 or Level 2. They are presented here with the access to other systems and safety in order to illustrate the magnitude devices on-board the train. The system order of Tolerable Hazard Rates of the supplier must specify the needed and problematic is transmission systems. This information forbidden maintenance procedures, it is important if we consider that, in order must also present auto test systems to very different to to replace balises by virtual balises, the verify periodically the correct operation the aeronautical GNSS-based equipment must provide and include a “maintenance mode” for a performance as good as the existing the maintenance operation, including one. equipment. interfaces maintenance. A dangerous failure is an undetected 5.5.2.2 PERFORMANCE REQUIREMENTS failure of the positioning system leading to the position provided being out of the accuracy range. For more information about performance requirements, please refer to [RD6]. Only the safety requirements for the ETCS onboard equipment are addressed in this report. Performance Requirements for Interoperability define possible values for technical performance requirements of ERTMS The safety integrity level will be derived from the different on-board equipment. tolerable hazard rates, taking into consideration the specified environment. For Hazard Rates of < 10-9 failures/hour, a SIL This section contains an analysis of the required technical 4 process will be applicable. It is important to notice only performances of ERTMS/ETCS equipment that could include failures that cause the ETCS hazard need to be considered. a GNSS component inside. Considering ETCS onboard equipment without the transmis- Accuracy sion system, the hazard rate for the ETCS onboard system yy Position accuracy measured on-board: For every trav- excluding those parts forming part of the transmission eled distance s the accuracy shall be better or equal to paths shall be shown not to exceed a THR of 0.67x10-9 ± (5m + 5% s). The fixed ± 5m tolerance is intended dangerous failures/hour. The process of confirmation to cover the longitudinal uncertainty of the balise that the train data is correctly stored on-board must be of reader in detecting the balise reference location. a quality commensurate with a SIL 4 system. REPORT ON RAIL USER NEEDS AND REQUIREMENTS 33

Table 5: ERTMS User requirements

Application Position Accuracy Speed Accuracy Safety Level ERTMS 5m + 5% s ±2km/h for speed ≤ SIL 4 UNISIG Specifications s is the distance travelled 30km/h from the last calibration of increasing linearly up to the odometric device ±12km/h at 500km/h

5.5.2.4 USA SITUATION – PTC AND USER REQUIREMENTS yy Wayside System: Monitors railroad track signals, One of the most important applications for GNSS in the USA switches and track circuits to communicate authoriza- is Positive Train Control, which is a set of highly advanced tion for movement to the locomotive. technologies designed to automatically stop a train before yy Back Office Server: The storehouse for all information certain types of accidents occur. It includes a GPS and com- related to the rail network and trains operating across munications-based system to monitor and control trains’ it – speed limits, track composition, speed of individual movements in order to provide increased safety. PTC main locomotives, train composition, etc. – and transmits functions are train separation or collision avoidance, line the authorization for individual trains to move into new speed enforcement, temporary speed restrictions and rail segments of track. worker wayside safety. As stated by the Federal Radionavigation Plan ([RD18]), in the According to the Association of American Railroads ([RD17]), USA, the railroad industry does not have any specific short- PTC systems are composed of three main elements inte- term need for satellite systems based on the performance of grated by a wireless communications system, which are: current GPS and non-NDGPS differential systems. The GPS yy Onboard or Locomotive System: Monitors the train’s dependent Positive Train Control systems currently being position and speed and activates braking as necessary deployed do not depend on differential systems availability. to enforce speed restrictions and unauthorized train Some other applications require more accurate positioning movement into new sections of track. information and therefore use differential systems. 34 5/ GNSS USER REQUIREMENTS ANALYSIS

Since the train is constrained to be located on a track, the 5.5.2.5 RUSSIAN SITUATION - KLUB-U location in the railroads context is a one-dimensional prob- Russia developed an Integrated Train Protection System lem, with well-defined discrete point where the potential called KLUB-U, using both GPS and GLONASS technologies to diverge exists, where the interval between locations for train positioning. at which a train may diverge from its current route over a switch is considerably small, not reaching 20m. This system determines train movement qualitative values (coordinates, speed) by the data from satellite navigation The most stringent requirement for the location determi- devices, the digital track map of a railway section and dis- nation system in PTC is to determine which parallel tracks tance-and-speed sensors/meters, which are installed on a a train is occupying with a probability of 99,999% with a wheel-set journal box2. Different issues shall be addressed minimum track spacing of 3,5m. by this modern train control system: this is on the one hand the low visibility of signals at difficult environmental Aside from position and timing needs for safety critical PTC conditions like fog, rain and snow; on the other hand the system operations, some other potential uses for railroad targeted high speeds where driving at sight to signals is functions are infrastructure surveying and mapping, track not possible. This technology still needs to be improved defect location, weather forecasting, locomotive control for extreme environments. and high capacity communications. These position and timing needs can also rely on a variety of GPS based and KLUB-U3 in-cab signaling systems are able to decode the non GPS based systems. track-side ALSN codes (Continuous Automatic Train Signali- zation). In the most recent block control system, the KLUB-U systems decode signals by digital radio including a remote initiation of a train stop. In those areas the train position is

Table 6: Rail User Requirements (USA)

Measures of minimum performance criteria to meet requirements Accuracy Integrit Requirements Time to (Meters, Availability Continuity (alert Coverage alert 2 drms) limit) Positive Train 1.0 99.9% N/A 2 m 6 s Railroad right of way Control (PTC) in all 50 states and District of Columbia Track Defect 0.3 99.9% N/A 0.6 m 30 s Railroad right of way Location (TDL) in all 50 states and District of Columbia Automated 0.2 99.9% N/A 0.4 m 30 s Railroad right of way Asset Mapping in all 50 states and (AAM) District of Columbia Surveying 0.02 99.7% N/A 0.04 m 30 s Railroad right of way in all 50 states and District of Columbia Bridge and 0.002 99.7% N/A 0.004 m 30 s Railroad right of way Tectonic in all 50 states and Monitoring for District of Columbia Bridge Safety Telecommuni- 340 nsec 99.7% N/A 680 nsec 30 s All 50 states and cations Timing District of Columbia

2 http://en.irz.ru/products/20/70.htm 3 https://en.wikipedia.org/wiki/KLUB-U 35

2019 update - - Rail is a very Rail is a very safety-sensitive safety-sensitive GNSS technology. limitations to use limitations why there are still environment and this - - - REPORT ON RAIL USER NEEDS AND REQUIREMENTS AND NEEDS USER RAIL ON REPORT For the applications “Pro the applications For tection and Emergency no SIL allo Management”, ([RD27]). needed is cation The ESSP Technical Note “EGNOS v3 requirements for for requirements v3 “EGNOS Note Technical ESSP The project mainly based on SUGAST results domain”, the rail (see [RD4]); interview validation UNIFE ([RD27]). of The is need No SIL allocation relevant non-safety ed for (see Annex applications 1). y y y y y Rail for describing user requirements Parameters applications y Recommendations for for Recommendations works future is much more reality The is and work fragmented get realistic to still required a example is ATC The reflection of the actual user needs. implementations, plenty ATC of are There illustration: good trying and other needs of spe the operational match to regional, high-speed, (urban, mainline, cific applications and modes more are there itself, systems ATC Within etc.). GNSS will differ. for the requirements functionalities, where (see Annex 2), It initiatives can be expected current that such cooperating, sector the in are players major where project and NGTC Navigation, WG on Satellite as UNISIG future) close the as (in well project as EAV ERSAT H2020 going are project, that TD2.4 and H2020 STARS Shift2Rail in the definition of GNSS way in a significant contribute to such applications relevant safety for user requirements rail be closely should activitiesThe of these initiatives as ETCS. monitored. reality. But as of today, they are the only ones recognized by by ones recognized the only they are But as of today, reality. Alarm require To Time the for the Rail except community– Rail any The express community indeed not able to is ment. TTA. of in terms requirement appli- sections the requirements summarize following The section in 1.1.1. considered applications rail the to cable from: mainly derived are requirements These y defined in section are 1.4.1. worth IntegritySafety It is Levels community: rail to according noticing that y - - - ail applications. ail applications.

is at the center of an expanded concept EKS (ЕКС EKS (ЕКС of an expanded concept center the is at 4 Conclusions

http://www.eav.ru http://www.eav.ru

4 Those requirements are mostly expressed by ranges of of ranges by mostly expressed are requirements Those simplify the to and tend requirements, or qualitative value They represent the most recent Rail User Requirements Rail Requirements User the most recent represent They sample of R a representative for expressed interviews of both key players of Rail of interviews market:(Union UNIFE players of both key and Ansaldo STS Européennes) des Industries Ferroviaires (see [RD27] and [RD28]). GNSS, and in particular, quantified requirements. requirements. quantified GNSS, and in particular, validation from derived are hereafter presented results The the Rail and GNSS communities to trythe Rail to and GNSS communities and understand their work (see Annex 1). However, philosophy safety respective to applicable requirements define user is still needed to 5.6 by a lot of effort has been provided Over years, the past No user requirements were identified in public literature. in public literature. identified were No user requirements to found a joint venture to develop the ITARUS-ATC system. system. the ITARUS-ATC develop to venture a joint found to system control use the train deal includes a project to The - 2020 until lines 50 and trains 100 stations, 100 equip to worthto be find the deal Euro. estimations about 2 billion trol system on the Pan-European transport corridors 2 and on the Pan-European system trol com (parent 2010 Finmeccanica end of November the 9. At (Mother Company of Ansaldo) and Russian Railways pany a Memorandum of Understanding signed VNIIAS) have of ITARUS-ATC on the test track for a later rail connection rail to a later for track on the test ITARUS-ATC license to Belarus wants games. the 2014 winter Sochi up to con train KLUB-compatible and this ETCS- use to the system Ansaldo was contracted in January contracted the Ansaldo was deploy 2010 to its Radio Block Center) but adds satellite navigation to the to navigation but adds satellite its Radio Block Center) inertial combines and wheel system navigation The system. safety enhance and turns to distance measure sensors to passenger servicefor in the Russian Federation. developed the Italian-Russian train control system ITARUS- system Italian-Russianthe control developed train It ERTMS to ETCS. similar is with compatible being ATC with communicate use GSM-Rto to able (being Level-2 allows representation of signals according to European European to according of signals representation allows transport Finland, to cross-border For standards. railway in 2007, which created was STS with Ansaldo cooperation подвижным составом - Single Unified Train Control Sys Control Train - Single Unified составом подвижным Eurobalises from signals decode will be able to This tem). that in an extended version the information and display KLUB-U - единая управления система комплексная тяговым KLUB-U is connected to an in-caban GSM-Rvia connectedto is digital system KLUB-U KLUB-U The 2 RBC block control. Level ERMTS with the radio tracks. high-speed capable for are systems derived from a satellite navigation system (GPS or GLONASS). GLONASS). or (GPS system navigation a satellite from derived 36 5/ GNSS USER REQUIREMENTS ANALYSIS

However, it is worth noticing that all the current efforts of yy An important request from the Rail community is to the Rail community are to include GNSS in ETCS without closely refer to applications as they are defined in Rail changing the ERTMS architecture (through in particular the segment, following both applications: virtual balise functionality for yy The applications defined in the context of “Autonomous ERTMS level 2/3 and train integrity monitoring function for Train Operations” should be further analyzed. the ERTMS level 3). It cannot be expected from them the tremendous work required to express rail user requirements 06 Last but not least, an important descriptive work on the Rail in terms of GNSS requirement by applying e.g. the avia- PNT applications is still required, in particular the operational tion approach. The rail scenarios/use cases are much more descriptions. complex that the aviation ones. The Satellite Navigation community remains a key player to support the definition of GNSS Rail user requirements.

Both following additional points should be considered for future analyses:

Table 7: Parameters definition for rail applications requirements

Parameter Description Accuracy Accuracy is a statistical value and is defined as the degree of conformance between the measured position and its true position, at a given level of confidence, at any given instant in time, and at any location in the coverage area. When specifying accuracy it is essential to specify the statistical context, which is usually assumed to be Gaussian. It is usually expressed as a confidence interval which is associated to probability (normally 95%). Only horizontal accuracy is considered in rail applications. Availability According to EN 50126, availability is the ability of a product to be in a state to perform a required function under given conditions at a given instant of time or over a given time interval, assuming that the required external resources are provided. In the present document the availability is defined as the intrinsic availability of location information fulfilling its performance requirements at the location unit output. In railways, where the relative unavailability of Signal in Space (SiS) owing to limited visibility is a natural condition, lack of SiS is not a cause of non-availability for highly demanding applications (other sensors will compensate for this fact through hybridization). Integrity Integrity relates to the trust that can be placed in the correctness of the information supplied by the Location Unit to the application. Integrity is defined here as the ability of the Location Unit equipment to provide timely warnings to the user when data provided by the system should not be used. Time to Alert Maximum allowable time between the occurrence of the failure in the system (e.g. satellite fault) (TTA) and its presentation to the user. The failure can be due to an excessive inaccuracy being detected (see alert limit) or that a particular satellite is untrustworthy. Integrity risk Appears when location is out of the tolerance limit (false), but the Location Unit reports “information available” and no “alarm” is triggered within the time to alarm. For safety applications, the integrity risk can be described by the tolerable hazard rate which is derived from a risk analysis of the application. A Safety Integrity Level shall be then allocated to the Location Unit according to the application. 37

2019 update [RD4], [RD27] Source Performance Performance (Accuracy) Performance (Accuracy) Performance (Availability) Performance (Integrity) (Safety Performance Integrity Level) (TimePerformance Alarm) To Type REPORT ON RAIL USER NEEDS AND REQUIREMENTS AND NEEDS USER RAIL ON REPORT -

Safety Integrity Level 2-4. IntegritySafety Level time between maximum allowable The in the of the failure the occurrence to PNT solution and its presentation the user shall be less than 10s. The PNT solution shall provide the train the train PNT solution shall provide The accuracy of position with a horizontal Line. Traffic Low for more 10m or even information of the location availability The the PNT solution fulfilling its by provided shall be High.performance requirements ability provide The of the PNT solution to the user when to timely warnings the solution should by provided data High.Very not be used shall be a PNT solution shall achieve The solution shall provide the train the train PNT solution shall provide The accuracy within position with a horizontal High Line. Speed of 1-10m for a range Description User Requirements Specification Requirements User

Requirements for Safety

GSA-MKD-USR- REQ-RAI-0060 GSA-MKD-USR- REQ-RAI-0050 REQ-RAI-0040 GSA-MKD-USR- GSA-MKD-USR- REQ-RAI-0030 GSA-MKD-USR- REQ-RAI-0020 REQ-RAI-0010 Id GSA-MKD-USR-

Table 8: Requirements for Automatic Train Protection Train Requirements 8: Automatic for Table 6.1

ence source not found.. When a requirement is common to to is common a requirement When not found.. source ence is used. reference the same nomenclature groups one or two The requirements have been gathered according to the the to according been gathered have requirements The Refer Error! described paragraph in applications of groups 06 38

2019 2019 2019 update update update Table Cold for Movement Detection 9:Requirements Table 10: for Level Requirements Crossing Protection 6/ USER REQUIREMENTS SPECIFICATION REQ-RAI-0160 GSA-MKD-USR- REQ-RAI-0110 GSA-MKD-USR- REQ-RAI-0150 GSA-MKD-USR- REQ-RAI-0100 GSA-MKD-USR- REQ-RAI-0140 GSA-MKD-USR- REQ-RAI-0090 GSA-MKD-USR- REQ-RAI-0130 GSA-MKD-USR- REQ-RAI-0080 GSA-MKD-USR- REQ-RAI-0120 GSA-MKD-USR- REQ-RAI-0070 GSA-MKD-USR- Id Id the usershallbelower than10s. PNT solutionanditspresentation to the occurrence ofthefailure inthe The maximumallowable timebetween the usershallbelessthan10s. PNT solutionanditspresentation to the occurrence ofthefailure inthe The maximumallowable timebetween a Safety Integrity Levela Safety Integrity 4. The PNTsolutionshallachieve Levela Safety Integrity 4. The PNTsolutionshallachieve not beusedshall Very High. data provided by thesolutionshould timely warnings to theuserwhen ofthePNTsolutiontoThe provide ability not beusedshall Very High. data provided by thesolution should timely warnings to theuserwhen ofthePNTsolutiontoThe provide ability performance requirementsperformance shallbeHigh. provided by thePNTsolutionfulfillingits The availability ofthelocation information requirementsperformance shallbeHigh. provided by thePNTsolutionfulfillingits The availability ofthelocation information a range of1-10m. position withahorizontal within accuracy The PNTsolutionshallprovide thetrain than 1m position withahorizontal lower accuracy The PNTsolutionshallprovide thetrain Description Description (Time ToAlarm) (Time Performance ToAlarm) (Time Performance Integrity Level)Integrity Performance (Safety Level) (Safety Integrity Performance (Integrity) Performance (Integrity) Performance (Availability) Performance (Availability) Performance (Accuracy) Performance (Accuracy) Performance Type Type 13.01.2016 validation interview, [RD27]: UNIFE 20.11.2014 the rail domain”, requirements for V3 00 “EGNOS TN-12586 v01- [RD4]: ESSP- [RD31] [RD27] [RD4] [RD31] [RD27] [RD4] 13.01.2016 validation interview, [RD27]: UNIFE 20.11.2014 the rail domain”, requirements for V3 00 “EGNOS TN-12586 v01- [RD4]: ESSP- 13.01.2016 validation interview, [RD27]: UNIFE 20.11.2014 the rail domain”, requirements for V3 00 “EGNOS TN-12586 v01- [RD4]: ESSP- [RD31] [RD27] [RD4] Source Source REPORT ON RAIL USER NEEDS AND REQUIREMENTS 39

Table 11: Requirements for Train Integrity and train length monitoring

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4]: ESSP- REQ-RAI-0170 position with a horizontal accuracy within (Accuracy) TN-12586 v01- a range of 1-10m. 00 “EGNOS V3 requirements for GSA-MKD-USR- The availability of the location information Performance the rail domain”, REQ-RAI-0180 provided by the PNT solution fulfilling its (Availability) 20.11.2014 performance requirements shall be High. GSA-MKD-USR- The ability of the PNT solution to provide Performance [RD27]: UNIFE REQ-RAI-0190 timely warnings to the user when (Integrity) validation interview, data provided by the solution should 13.01.2016 not be used shall be Very High. update GSA-MKD-USR- The PNT solution shall achieve Performance (Safety [RD4] [RD27] 2019

REQ-RAI-0200 a Safety Integrity Level 4. Integrity Level) [RD31] GSA-MKD-USR- The maximum allowable time between Performance [RD4]: ESSP- REQ-RAI-0210 the occurrence of the failure in the PNT (Time To Alarm) TN-12586 v01- solution and its presentation to the 00 “EGNOS V3 user shall be between 10s and 30s. requirements for the rail domain”, 20.11.2014

[RD27]: UNIFE validation interview, 13.01.2016

Table 12: Requirements for Track Identification

Id Description Type Source update

GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4] 2019 REQ-RAI-0220 position with a horizontal accuracy lower than (Accuracy) [RD27]

1.9m for track discrimination. [RD31] GSA-MKD-USR- The availability of the location information Performance [RD4]: ESSP- REQ-RAI-0230 provided by the PNT solution fulfilling its (Availability) TN-12586 v01- performance requirements shall be High. 00 “EGNOS V3 requirements for GSA-MKD-USR- The ability of the PNT solution to provide Performance the rail domain”, REQ-RAI-0240 timely warnings to the user when (Integrity) 20.11.2014 data provided by the solution should not be used shall be Very High. [RD27]: UNIFE GSA-MKD-USR- The PNT solution shall achieve Performance (Safety validation interview, REQ-RAI-0250 a Safety Integrity Level 2-4. Integrity Level) 13.01.2016 GSA-MKD-USR- The maximum allowable time between Performance (Time REQ-RAI-0260 the occurrence of the failure in the PNT To Alarm) solution and its presentation to the user shall be between 10s and 30s. 40 6/ USER REQUIREMENTS SPECIFICATION

Table 13: Requirements for Door Control Supervision

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4]: ESSP-TN-12586 REQ-RAI-0320 position with a horizontal accuracy within (Accuracy) v01-00 “EGNOS V3 a range of 1-10m. requirements for the rail domain”, 20.11.2014

[RD27]: UNIFE validation interview, 13.01.2016

GSA-MKD-USR- When using ATO, The PNT solution shall provide Performance [RD4] REQ-RAI-0321 the train position with a horizontal accuracy (Accuracy) [RD27] 2019 update within a range of 1m. [RD31] GSA-MKD-USR- The availability of the location information Performance [RD4]: ESSP-TN-12586 REQ-RAI-0330 provided by the PNT solution fulfilling its (Availability) v01-00 “EGNOS V3 performance requirements shall be High. requirements for the rail domain”, GSA-MKD-USR- The ability of the PNT solution to provide timely Performance 20.11.2014 REQ-RAI-0340 warnings to the user when data provided by (Integrity) the solution should not be used shall be High. [RD27]: UNIFE GSA-MKD-USR- The maximum allowable time between Performance validation interview, REQ-RAI-0350 the occurrence of the failure in the PNT (Time To Alarm) 13.01.2016 solution and its presentation to the user shall be between 10s and 30s.

Table 14: Requirements for Trackside Personnel Protection

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4]: ESSP-TN-12586 REQ-RAI-0360 position with a horizontal accuracy within (Accuracy) v01-00 “EGNOS V3 a range of 1-10m. requirements for the rail domain”, GSA-MKD-USR- The availability of the location information Performance 20.11.2014 REQ-RAI-0370 provided by the PNT solution fulfilling its (Availability) performance requirements shall be High. [RD27]: UNIFE GSA-MKD-USR- The ability of the PNT solution to provide timely Performance validation interview, REQ-RAI-0380 warnings to the user when data provided by (Integrity) 13.01.2016 the solution should not be used shall be High. GSA-MKD-USR- The maximum allowable time between Performance REQ-RAI-0390 the occurrence of the failure in the PNT (Time To Alarm) solution and its presentation to the user shall be between 10s and 30s.

GSA-MKD-USR- For ATO application, the PNT solution Performance (Safety [RD4] REQ-RAI-0391 shall achieve a Safety Integrity Level 2. Integrity Level [RD27] 2019 update [RD31] REPORT ON RAIL USER NEEDS AND REQUIREMENTS 41

6.2 Requirements for Non-Safety Relevant Applications 6.2.1 LIABILITY RELEVANT APPLICATIONS

Table 15: Requirements for Odometer Calibration

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4]: ESSP-TN-12586 REQ-RAI-0270 position with a horizontal accuracy lower (Accuracy) v01-00 “EGNOS V3 than 1m. requirements for the rail domain”, GSA-MKD-USR- The availability of the location information Performance 20.11.2014 REQ-RAI-0280 provided by the PNT solution fulfilling its (Availability) performance requirements shall be High. [RD27]: UNIFE validation interview, 13.01.2016 GSA-MKD-USR- The ability of the PNT solution to provide timely Performance [RD4] REQ-RAI-0290 warnings to the user when data provided (Integrity) [RD27] 2019 by the solution should not be used is low. [RD31] update GSA-MKD-USR- The PNT solution shall achieve Performance (Safety REQ-RAI-0300 a Safety Integrity Level 2-4. Integrity Level) GSA-MKD-USR- The maximum allowable time between Performance [RD4]: ESSP-TN-12586 REQ-RAI-0310 the occurrence of the failure in the (Time To Alarm) v01-00 “EGNOS V3 PNT solution and its presentation to requirements for the user shall be less than 10s. the rail domain”, 20.11.2014

[RD27]: UNIFE validation interview, 13.01.2016

Table 16: Requirements for Management of emergencies

Id Description Type Source update

GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4] 2019 REQ-RAI-0400 position with a horizontal accuracy within a (Accuracy) [RD27]

range of 5m and track selectivity is needed. [RD31] GSA-MKD-USR- The availability of the location information Performance [RD4]: ESSP- REQ-RAI-0410 provided by the PNT solution fulfilling its (Availability) TN-12586 v01- performance requirements shall be High. 00 “EGNOS V3 requirements for GSA-MKD-USR- The ability of the PNT solution to provide timely Performance the rail domain”, REQ-RAI-0420 warnings to the user when data provided by (Integrity) 20.11.2014 the solution should not be used shall be High. GSA-MKD-USR- The maximum allowable time between Performance [RD27]: UNIFE REQ-RAI-0430 the occurrence of the failure in the PNT (Time To Alarm) validation interview, solution and its presentation to the 13.01.2016 user shall be between 10s and 30s. 42 6/ USER REQUIREMENTS SPECIFICATION

Table 17: Requirements for Train warning systems

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4] REQ-RAI-0440 position with a horizontal accuracy within (Accuracy) [RD27] a range of 1-10m. [RD31] GSA-MKD-USR- The availability of the location information Performance REQ-RAI-0450 provided by the PNT solution fulfilling its (Availability) performance requirements shall be High.

update GSA-MKD-USR- The ability of the PNT solution to provide timely Performance

2019 REQ-RAI-0460 warnings to the user when data provided by (Integrity) the solution should not be used shall be High. GSA-MKD-USR- The maximum allowable time between Performance REQ-RAI-0470 the occurrence of the failure in the PNT (Time To Alarm) solution and its presentation to the user shall be between 10s and 30s.

Table 18: Requirements for Infrastructure surveying

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4] : ESSP- REQ-RAI-0480 position with a horizontal accuracy within (Accuracy) TN-12586 v01- a range of 0.01-1m. 00 “EGNOS V3 requirements for GSA-MKD-USR- The availability of the location information Performance the rail domain”, REQ-RAI-0490 provided by the PNT solution fulfilling its (Availability) 20.11.2014 performance requirements shall be Low. GSA-MKD-USR- The ability of the PNT solution to provide timely Performance [RD27]: UNIFE REQ-RAI-0500 warnings to the user when data provided by (Integrity) validation interview, the solution should not be used shall be High. 13.01.2016 GSA-MKD-USR- The maximum allowable time between Performance REQ-RAI-0510 the occurrence of the failure in the (Time To Alarm) PNT solution and its presentation to the user shall be 30s or even more. REPORT ON RAIL USER NEEDS AND REQUIREMENTS 43

Table 19: Requirements for Location of GSM Reports

Id Description Type Source update

GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4] 2019 REQ-RAI-0520 position with a horizontal accuracy within a (Accuracy) [RD27]

range of 100m. [RD31] GSA-MKD-USR- The availability of the location information Performance [RD4]: ESSP- REQ-RAI-0530 provided by the PNT solution fulfilling its (Availability) TN-12586 v01- performance requirements shall be Low. 00 “EGNOS V3 requirements for GSA-MKD-USR- The ability of the PNT solution to provide timely Performance the rail domain”, REQ-RAI-0540 warnings to the user when data provided by (Integrity) 20.11.2014 the solution should not be used shall be High. GSA-MKD-USR- The maximum allowable time between Performance [RD27]: UNIFE REQ-RAI-0550 the occurrence of the failure in the (Time To Alarm) validation interview, PNT solution and its presentation to 13.01.2016 the user shall be 30s or even more.

Table 20: Requirements for Gauging surveys

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4]: ESSP- REQ-RAI-0560 position with a horizontal accuracy within (Accuracy) TN-12586 v01- a range of 0.01-1m. 00 “EGNOS V3 requirements for GSA-MKD-USR- The availability of the location information Performance the rail domain”, REQ-RAI-0570 provided by the PNT solution fulfilling its (Availability) 20.11.2014 performance requirements shall be Low. GSA-MKD-USR- The ability of the PNT solution to provide Performance [RD27]: UNIFE REQ-RAI-0580 timely warnings to the user when (Integrity) validation interview, data provided by the solution should 13.01.2016 not be used shall be Very High. GSA-MKD-USR- The maximum allowable time between Performance REQ-RAI-0590 the occurrence of the failure in the (Time To Alarm) PNT solution and its presentation to the user shall be 30s or even more. 44 6/ USER REQUIREMENTS SPECIFICATION

Table 21: Requirements for Structural monitoring

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4]: ESSP- REQ-RAI-0600 position with a horizontal accuracy within (Accuracy) TN-12586 v01- a range of 0.01-1m. 00 “EGNOS V3 requirements for GSA-MKD-USR- The availability of the location information Performance the rail domain”, REQ-RAI-0610 provided by the PNT solution fulfilling its (Availability) 20.11.2014 performance requirements shall be Low. GSA-MKD-USR- The ability of the PNT solution to provide timely Performance [RD27]: UNIFE REQ-RAI-0620 warnings to the user when data provided by (Integrity) validation interview, the solution should not be used shall be Low. 13.01.2016 GSA-MKD-USR- The maximum allowable time between Performance REQ-RAI-0630 the occurrence of the failure in the (Time To Alarm) PNT solution and its presentation to the user shall be 30s or even more.

Table 22: Requirements for Fleet management

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4]: ESSP- REQ-RAI-0640 position with a horizontal accuracy of 10m (Accuracy) TN-12586 or even more. irements for the rail domain”, 20.11.2014 GSA-MKD-USR- The availability of the location information Performance REQ-RAI-0650 provided by the PNT solution fulfilling its (Availability) [RD27]: UNIFE performance requirements shall be High. validation interview, GSA-MKD-USR- The ability of the PNT solution to provide timely Performance 13.01.2016 REQ-RAI-0660 warnings to the user when data provided by (Integrity) the solution should not be used shall be Low. GSA-MKD-USR- The maximum allowable time between Performance REQ-RAI-0670 the occurrence of the failure in the (Time To Alarm) PNT solution and its presentation to the user shall be 30s or even more. REPORT ON RAIL USER NEEDS AND REQUIREMENTS 45

Table 23: Requirements for Cargo monitoring

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4]: ESSP- REQ-RAI-0680 position with a horizontal accuracy of 10m (Accuracy) TN-12586 v01- or even more. 00 “EGNOS V3 requirements for GSA-MKD-USR- The availability of the location information Performance the rail domain”, REQ-RAI-0690 provided by the PNT solution fulfilling its (Availability) 20.11.2014 performance requirements shall be High. GSA-MKD-USR- The ability of the PNT solution to provide timely Performance [RD27]: UNIFE REQ-RAI-0700 warnings to the user when data provided by (Integrity) validation interview, the solution should not be used shall be Low. 13.01.2016 GSA-MKD-USR- The maximum allowable time between Performance REQ-RAI-0710 the occurrence of the failure in the (Time To Alarm) PNT solution and its presentation to the user shall be 30s or even more.

Table 24: Requirements for Energy Charging

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4]: ESSP- REQ-RAI-0720 position with a horizontal accuracy of 10m (Accuracy) TN-12586 v01- or even more. 00 “EGNOS V3 requirements for GSA-MKD-USR- The availability of the location information Performance the rail domain”, REQ-RAI-0730 provided by the PNT solution fulfilling its (Availability) 20.11.2014 performance requirements shall be High. GSA-MKD-USR- The ability of the PNT solution to provide timely Performance [RD27]: UNIFE REQ-RAI-0740 warnings to the user when data provided by (Integrity) validation interview, the solution should not be used shall be Low. 13.01.2016 GSA-MKD-USR- The maximum allowable time between Performance REQ-RAI-0750 the occurrence of the failure in the (Time To Alarm) PNT solution and its presentation to the user shall be 30s or even more. 46 6/ USER REQUIREMENTS SPECIFICATION

Table 25: Requirements for Infrastructure Charging

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4]: ESSP- REQ-RAI-0760 position with a horizontal accuracy of 10m (Accuracy) TN-12586 v01- or even more. 00 “EGNOS V3 requirements for GSA-MKD-USR- The availability of the location information Performance the rail domain”, REQ-RAI-0770 provided by the PNT solution fulfilling its (Availability) 20.11.2014 performance requirements shall be High. GSA-MKD-USR- The ability of the PNT solution to provide timely Performance [RD27]: UNIFE REQ-RAI-0780 warnings to the user when data provided by (Integrity) validation interview, the solution should not be used shall be High. 13.01.2016 GSA-MKD-USR- The maximum allowable time between Performance REQ-RAI-0790 the occurrence of the failure in the (Time To Alarm) PNT solution and its presentation to the user shall be 30s or even more.

Table 26: Requirements for Hazardous Cargo Monitoring

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance [RD4]: ESSP- REQ-RAI-0800 position with a horizontal accuracy within (Accuracy) TN-12586 v01- a range of 1-10m. 00 “EGNOS V3 requirements for GSA-MKD-USR- The availability of the location information Performance the rail domain”, REQ-RAI-0810 provided by the PNT solution fulfilling its (Availability) 20.11.2014 performance requirements shall be High. GSA-MKD-USR- The ability of the PNT solution to provide timely Performance [RD27]: UNIFE REQ-RAI-0820 warnings to the user when data provided by (Integrity) validation interview, the solution should not be used shall be High. 13.01.2016 GSA-MKD-USR- The maximum allowable time between the Performance REQ-RAI-0830 occurrence of the failure in the PNT solution (Time To Alarm) and its presentation to the user shall be between 10s and 30s. REPORT ON RAIL USER NEEDS AND REQUIREMENTS 47

6.2.1 NON-LIABILITY RELEVANT APPLICATIONS The only non-safety and non-liability relevant application considered in this document is passenger information. The actual existing GNSS performances are meeting the user requirements. Table 27: Requirements for passenger information

Id Description Type Source GSA-MKD-USR- The PNT solution shall provide the train Performance (Accuracy) [RD27]: REQ-RAI-0840 position with a horizontal accuracy of less UNIFE than 100m. validation interview, GSA-MKD-USR- The availability of the location information Performance (Availability) 13.01.2016 REQ-RAI-0850 provided by the PNT solution fulfilling its performance requirements shall be of 95%. annex 1: Past Initiatives Regarding 07 GNSS Requirements in Rail GNSS Rail Advisory Forum GRAIL proposed a strategy consistent with the current deployment process of ERTMS/ETCS in Europe, for a smooth In 2000, the GNSS Rail Advisory Forum proposed some integration of GNSS into control and command applications possible common requirements for different safety and and particularly in signaling. Its objectives were: non-safety related applications. But at that time the way in which the performances are described was not under- yy To achieve a common specification for the GNSS sub- standable and consequently not recognized by the railway system for: actors (see [RD26]). Enhanced Odometry application Enhanced ETCS applications (absolute positioning) GRAIL yy To develop and test a prototype of the GNSS subsystem for the Enhanced Odometry and the Enhanced ETCS This section corresponds to a summary of the outcomes applications: of GRAIL project carried out from [RD6], [RD12], [RD13], Tests in a real ERTMS/ETCS line [RD14]and [RD15]. Tests in a lab environment yy To study the complementary aspects: Introduction economic issues This project was aimed at supporting the introduction of legal issues GNSS in the Rail market. It was carried out from the 31st development of GNSS local elements specific for August 2005 to the 31st July 2008. railways consistent with the objectives 1 and 2

Table 28: GNSS requirements for Rail from the GNSS Rail Advisory Forum

Horizontal Integrity Interruption Interruption Continuity Application accuracy Alert limit Time to (% of mission of service of service (m) (m) alarm (s) time) (s) (%) Safety related applications ATC on high density line/station/parallel track 1 2.5 <1.0 >99.98 <5 >99.98 Train Control on medium density lines 10 20 <1.0 >99.98 <5 >99.98 Train Control on low density lines 25 50 <1.0 >99.98 <5 >99.98 Mass commercial/information and management – operational applications Tracing & Tracking of vehicules 50 125 <10 >99.9 N/A N/A Cargo monitoring 100 250 <30 >99.5 N/A N/A Dispatching 50 125 <5 >99.9 N/A N/A Passenger information 100 250 <30 >99.5 N/A N/A Infrastructures & civil engineering, professional applications Positioning of machines 1 cm N/A <5 99.5 N/A N/A Infrastructure survey 1 cm 0.1 cm <10 99 N/A N/A Fix point applications 5 mm N/A <30 99 N/A N/A REPORT ON RAIL USER NEEDS AND REQUIREMENTS 49

Horizontal Integrity Interruption Interruption Continuity Application accuracy Alert limit Time to (% of mission of service of service GRAIL proposed (m) (m) alarm (s) time) (s) (%) Safety related applications a strategy ATC on high density line/station/parallel track 1 2.5 <1.0 >99.98 <5 >99.98 consistent with the Train Control on medium density lines 10 20 <1.0 >99.98 <5 >99.98 current deployment Train Control on low density lines 25 50 <1.0 >99.98 <5 >99.98 process of ERTMS/ Mass commercial/information and management – operational applications ETCS in Europe. Tracing & Tracking of vehicules 50 125 <10 >99.9 N/A N/A Cargo monitoring 100 250 <30 >99.5 N/A N/A Dispatching 50 125 <5 >99.9 N/A N/A Passenger information 100 250 <30 >99.5 N/A N/A Infrastructures & civil engineering, professional applications Positioning of machines 1 cm N/A <5 99.5 N/A N/A Infrastructure survey 1 cm 0.1 cm <10 99 N/A N/A Fix point applications 5 mm N/A <30 99 N/A N/A 50 7/ ANNEXES

Table 29: GRAIL User Requirements

Train Length Application Accuracy Speed Accuracy Availability Continuity Integrity TTA Alert Limit Confidence Interval Accuracy Enhanced Odometry Travelled Distance Accuracy for main Independently of In any place within Assuming the SoL core >TBD% < 5s lines (urban and rural scenarios) and operational conditions the Service Volume, system performance REQ-GNSSUT-EO-PER-220 REQ-GNSSUT- for low visibility scenarios (tunnels, REQ-GNSSUT-EO-PER-190 when operating requirements (without EO-PER-230 covered stations) in the Nominal SIS receiver contribution) REQ-GNSSUT-EO-PER-170 Constellation state of 8x10-6/15s. REQ-GNSSUT-EO- REQ-GNSSUT-EO-PER-210 PER-200 Appr.1 ± (5m + 5% of the distance 2 km/h 95% < 8x10-5/15s. since last beacon) Appr.2 ± (5m + 2% of the distance 1 km/h since last beacon) Cold Movement Position Accuracy: 1m In any place within Assuming the SoL core Independently from Detection & Train REQ-GNSSUT-EE-TA-250 the Service Volume, system performance environmental influences Awakening when operating requirements (without topography and buildings in the Nominal SIS receiver contribution) of (REQ-GNSSUT-EE-TA-320) Constellation state 8x10-6/15s. REQ-GNSSUT-EE-TA-280 REQ-GNSSUT-EE-TA-290 95% < 8x10-5/15s. SIL 4 (final report) Absolute Positioning Position accuracy Velocity accuracy In any place within with a SIL 4 integrity level with a SIL 4 the Service Volume, REQ-GNSS-EE-AP-490 REQ-GNSS-EE-AP-510 when operating REQ-GNSS-EE-AP-500 REQ-GNSS-EE-AP-520 in the Nominal SIS Constellation state REQ-GNSSUT-EE-AP-530 Zone 1 Short Rural ≤ 100m ≤ 1.5 m/s term Urban ≤ 150m ≤ 3 m/s SIL 4 (final report) Long Rural ≤ 50m ≤ 1m/s term Urban ≤ 100m ≤ 2 m/s 99% Zone 2 Short Rural ≤ 30m ≤ 1.5m/s term Urban ≤ 40m ≤ 3 m/s Long Rural ≤ 20m ≤ 1 m/s term Urban ≤ 25m ≤ 2 m/s Train Integrity Train Length confirmation Accuracy: 99.98% main lines Assuming the SoL core Independently from ≤ 2L for high speed Length Monitor ≤ 10m 95% low traffic lines system performance environmental influences lines (headway 3’) REQ-GNSSUT-EE-TI-370 (final report) requirements (without topography and buildings ≤ 37.8%L for mixed receiver contribution) of (REQ-GNSSUT-EE-TI-440) traffic lines 8x10-6/15s. (headway 4’) REQ-GNSSUT-EE-TI-390 REQ-GNSSUT-EE- TI-370 < 8x10-5/15s. SIL 4 (final report) REPORT ON RAIL USER NEEDS AND REQUIREMENTS 51

The project developed works on the following selected Comment: applications: Two different approaches are proposed for the Enhanced yy Enhanced Odometry, Odometry. yy Train Awakening / Cold Movement Detector, yy The Approach 1 is a short term solution: the User Ter- minal (UT), or GNSS receiver, is used as a complement yy Absolute Positioning, of the current odometry sensors and with the current yy Train Integrity. ETCS performance requirements. yy The Approach 2 is a mid-term solution: a more advanced User Requirements UT is used as a complement or substitute of the current One of the main objectives of the GRAIL project was to odometry sensors, with a public interface and with define the performance requirements for the GNSS system enhanced ETCS Odometry performances. for some selected relevant applications in the railway sector. Two main applications classes were defined: the Enhanced Odometry applications and the Enhanced ETCS applications. Analysis of GRAIL user requirements Within the Enhanced ETCS applications three applications In the GRAIL documentation, most requirements are have been distinguished: the Absolute Positioning, the expressed according to the GNSS parameters. Some efforts Integrity Length Monitor, and the Train Awakening and were provided by the railway community. The use of GNSS Cold Movement Detector. in Rail seems to become a real need. In the GRAIL document each performance requirement refers For most applications, a very stringent integrity requirement to an acronym (REQ-GNSSUT-XX-XX). These acronyms will is specified. A SIL 4 corresponds to THR comprised between be used in the present document as references. 10-9/h and 10-8/h, which is pretty much equivalent to an Integrity Risk in the order of 10-11/150s. The following tables summarizes the requirements specified for each Rail application. Although a number of requirements were expressed, some of them are not yet mature or complete enough. REPORT ON RAIL USER NEEDS AND REQUIREMENTS 53

GRAIL-2 according to current rail standards and procedures. First, it was analysed if the original development concept would This section corresponds to a summary of the outcomes of meet the safety requirements imposed on the odometry GRAIL project carried out from [RD6], [RD23], and [RD23]. functionality. Then, a second iteration was performed to Reports of GRAIL-2 being not public, the level of information assess what parts of the design should be revised so that given in this report is very limited. the adequate level of safety is reached for the application. Finally, in parallel to the collection of evidences for the GRAIL-2 project aimed at defining, developing and validat- completion of the application safety case, an independent ing a GNSS-based ETCS application in high- speed railway safety analysis started, with the aim of ensuring the correct lines. Starting from the work done in the GRAIL project, use of the methodology set out by European norms to GRAIL-2 went further in the implementation and testing demonstrate safety. of the Enhanced Odometry so that a real validation of the application against user needs can be performed, thus Main outcomes of the safety studies achieving a system closer to a final product. Based on an existing development made in GRAIL, the core activities of the GRAIL-2 sequel consisted of making the The GRAIL-2 Consortium carried out the project in the period necessary evolutions in such a prototype so that a resulting from 1st September 2010 to 31st December 2013. odometry function was as much as possible consistent with the safety requirements imposed on The main objectives of this project were: a commercial system of these char- yy Definition of user and system requirements, acteristics. yy Development of a GNSS-based EO system prototype, GRAIL-2 aimed These requirements can be grouped yy Validation of the prototype by means of an extensive in a single requirement: a Safety at defining, test campaign, Integrity Level of four (SIL 4), which means that a systematic failure in the developing yy Demonstration that the safety requirements for the full function, originating fatal conse- application can be met by the system, by means of and validating quences, must have a probability less simulation, testing, modeling, etc., than 10-8 per hour. a GNSS-based yy Roadmap towards certification. The first safety iteration in the project ETCS application GNSS-based Enhanced Odometry for Rail consisted of analysing the SIL level in high-speed achievable by the GNSS User Termi- In ERTMS, the odometry is a function that determines the nal (which included an inertial unit), location of a train, related to a reference point and the railway lines. legacy from GRAIL. As SIL 4 was not distance from that point as measured by counting wheel achievable by such sensor, the origi- rotations. As the measurement is based on a reference nal aim of replacing all conventional point, the accuracy decreases with the distance travelled sensor types by the UT alone was abandoned and a more from the last reference point, so the position errors are reset pragmatic approach was decided: the odometer architec- periodically by eurobalises, whose location is known from ture would retain some conventional sensors, but remove a preloaded database. the Doppler radars, whose maintenance costs and some reported availability problems were the first motivation for The aim of the GNSS ‘enhanced odometry’ subsystem was choosing this application. to support the odometry function (speed measurement) with accurate location information. This subsystem aimed The independent safety analysis carried out by Veritas at replacing conventional sensors such as Doppler radars, showed that the SIL level achieved by the GNSS User which have shown to cause some operational problems Terminal is SIL 2. under some conditions and whose maintenance costs are high, enabling at the same time a cost-effective way to implement this function and paving the way for the introduction of other ERTMS functions which may rely also on the GNSS signals.

In parallel, comprehensive safety studies were performed, whose goal within GRAIL-2 was to demonstrate that the safety requirements for the application can be fulfilled, 54 7/ ANNEXES

SUGAST and hybridisation techniques which can be used to improve a LU. It also presented a selection of different groups of This section corresponds to a summary of the outcomes of applications whose requirements could be fulfilled by the SUGAST WP5000 project carried out from [RD1] and [RD16]. same LU, concluding with the proposed LU class for each of these selections. The SUGAST project aimed at carrying on the standardization process already started for EGNOS and Galileo in key Then, the general required performance for a LU was application areas. It was carried out from the 23rd March described, as well as the specific performances for each of 2010 to the 30th June 2012. WP5000 general objectives were the classes proposed in the previous section. to improve the common understanding of Galileo use for safety related applications in railways and to provide tech- Finally, the document presented a proposal of roadmap nical support to standardisation of safety applications in that the document should follow to become a real standard. ERTMS. In particular, the objective of WP5300 was to conduct technical studies to define the required GNSS performances The final version of D-5310 included tests data from previous for relevant Rail communities. experiments, i.e. RSSB Projects T510 and T892 and the GSA project GRAIL-2, to justify the performance characteristics in The main output of the WP consisted on deliverable D-5310, D-5310 regarding the locator unit classes developed there, “Technical Note on GNSS performances for Rail” ([RD1]). either directly or by extrapolation. The first draft of the D-5310 document started the definition of the minimum operating Rail Operational Environments performance standard for the The performances of the applications can be affected by most promising Rail applications SUGAST aimed several factors, which some of the main important are cited classified in different groups of below: at carrying applications which require similar performances. These perfor- yy Masking level on the mances are defined at Locator Open sky: 10° elevation has been used. This is a Unit (LU) level, that is, the min- standardization typical ‘best practice’ masking angle for many GNSS imum performances needed at applications. process the output of the LU to fulfill the application requirements. There- Medium masking: A variable mask scheme has been already fore, performances for different created that reflects a rail track environment with started for classes of locator units suitable for across-track masking of 30° and along-track of 10°. each group of applications were High masking: In this case, the across-track masking proposed, based upon the pre- EGNOS and is of 60° on both sides and the along-track masking vious experience and other R&D is of 10°. Galileo. projects, trying to settle a guide- line for the GNSS locator unit’s yy Obscuration designers. yy Multipath The Technical Note (TN) contained, first, information and yy Alternative Path assumptions needed to understand the rationale for equip- yy Interference ment characteristics and requirements stated throughout the document. It described typical GNSS-based application However, the environmental conditions also depend on sev- and operational goals including a brief description of the eral factors such as the line constructions and the intended applications and an overview of the railway environments, features of the lines. This leads do the definition of two from the points of view of both visibility and operation. operational scenarios: Low Traffic Lines and High Speed Lines, which differ mainly in terms of block sections’ needs, Then, the TN described different groups of GNSS based once both lines require high accuracy when approaching applications, classified according to their required perfor- a danger point: mances. A quantitative summary of performances was set out in order to find similar characteristics which would lead yy Low Traffic Lines: A LDL is a national, regional or local to outline a group. line with low traffic: about 1 to 10 trains per day. Most of them are single tracks with no train detection system Different proposals for LU classes were described then, installed along the track, but side signaling could be beginning with an overview of the different augmentation installed. Telephone Block Systems are widespread in REPORT ON RAIL USER NEEDS AND REQUIREMENTS 55

this kind of lines, while ATP systems are not, due to the The accuracy is expressed in “meters” reflecting the horizon- limited budget dedicated to these lines. tal accuracy (including cross accuracy for some cases such as in the Train Awakening in order to differentiate parallel yy High Speed Lines: High speed rail is a system of rolling tracks) while the integrity is expressed in “seconds” reflecting stock and infrastructure which regularly operates at the Time To Alarm needed. To be noted is that the integrity or above 200 or 250km/h. An important aspect of this is also related to the Safety Integrity Level for safety related environment is the use of continuous welded rail to applications. On the other hand, there are some liability reduce track vibrations and discrepancies between rail relevant applications which are not safety related (SIL 0) segments, which is very important to allow trains to pass but need high integrity, so there is not direct relationship at high speeds. Almost all of these lines are electrically between the integrity and the SIL. Therefore TTA has been driven via catenary and have in-cab signaling as well as chosen to quantify the integrity requirement instead of SIL. no level crossings. Then GNSS based applications were classified according to User Requirements their required performances. The table below describes the requirements needed for each Rail application. The groups are made based on the required performances needed by each application and performance requirements Applications marked with “LE” are the ones which require are expressed by the three standard Required Navigation very high accuracy services and almost all are extremely Parameters, these are “accuracy”, “integrity” and “availability” local. Besides, they all need coverage in adverse visibility (please find the related definitions in section Annex 4 Error! environments. Reference source not found.). In addition the need of using digital map, Local Elements (LE) and the SIL is indicated. The “DM” column refers to applications which require a Digital Map for their intended function.

Safety related applications need SoL services as shown in column “SoL”. For the ERTMS, a SIL 4 is required while for safety related applications outside ERTMS the safety studies have not been carried out and no SIL has been yet determined. On the other hand, no SIL allocation is needed for non-safety applications (SIL 0). 56 7/ ANNEXES

Table 30: SUGAST User Requirements

Features and qualitative performances for applications Operational Horizontal Accuracy Integrity Availability LE DM SoL SIL Group Environment

Enhanced odometry HSL High (5m + 5%s) 6 - 50m Very High < 10s High No (TBC2) No Required 4 4

LDL High (5m + 5%s) 6 - 50m Very High < 10s High No (TBC2) No Required 4 4

Absolute positioning HSL High (block sections) 6 - 50m Very High < 10s High Required (TBC) Required Required 4 4

Very High (approaching 1 - 5m Very High < 10s High Required (TBC) Required Required 4 1 a danger point)

LDL Low (block sections) 6 - 50m Very High < 10s High Required (TBC) Required Required 4 4

Very High (approaching 1 - 5m Very High < 10s High Required (TBC) Required Required 4 1 a danger point)

Train awakening HSL Very High (to distinguish 1 - 5m Very High < 10s High Required Required Required 4 1 Train control Safety Critical between parallel tracks) and signaling Applications applications LDL High (single track) 6 - 50m Very High < 10s High Required Required Required 4 4

Cold movement HSL Very High (to differentiate 1 - 5m Very High < 10s High Required No Required 4 1 detector between parallel tracks)

LDL Low (single track) > 50m Very High < 10s High Required No Required 4 7

Track identification N/A Very High 1 - 5m Very High < 10s High Required Required Required TBD 1

Level crossing N/A High 6 - 50m Very High < 10s High No Required Required 4 (TBD) 4 protection

Train integrity HSL High 6 - 50m Very High < 10s High No No Required 4 4 and train lenght monitoring LDL Low > 50m Very High < 10s High No No Required 4 7 REPORT ON RAIL USER NEEDS AND REQUIREMENTS 57