SECRET SECurity of Railways against Electromagnetic aTtacks Grant Agreement number: 285136 Funding Scheme: Collaborative project Start date of the contract: 01/08/2012 Project website address: http://www.secret-project.eu Deliverable D 3.1 "Synthesis model" for experimental simulation of normal and attack conditions: methodology and results th Submission date: 24 July 2013 Deliverable on Railway electromagnetic environment analysis Date: 24/07/2013 Distribution: All partners Manager: IFSTTAR SECRET Project Grant Agreement number: 285136 Document details: "Synthesis model" for experimental simulation of normal and attack Title conditions: methodology and results Workpackage WP3 Date 28/06/2013 M. Heddebaut, J.P. Ghys, S. Ambellouis, D. Sodoyer, V. Deniau, S. Mili Author(s) V. Beauvois, H. Philippe Responsible Partner IFSTTAR SEC-D3.1-C-07 2013-Synthesis model for experimental simulation of Document Code normal and attack conditions-IFSTTAR Version C Status Final Dissemination level: Project co-funded by the European Commission within the Seventh Framework Programme PU Public X PP Restricted to other programme participants (including the Commission Services) Restricted to a group specified by the consortium (including the Commission) RE Services) Confidential, only for members of the consortium (including the Commission CO Services) Document history: Revision Date Authors Description Initial version 28/06/2013 M. Heddebaut, Draft v1.0 J.P. Ghys, S. Ambellouis, D. Sodoyer, V. Deniau, S. Mili, V. Beauvois, H. Philippe Minor 08/07/210 / v1.1 modifications Minor 11/07/210 / v1.2 modifications after reviewing SEC-D3.1-C-07 2013-"Synthesis model" for experimental simulation of normal and attack conditions- IFSTTAR 24/07/2013 2/42 SECRET Project Grant Agreement number: 285136 Table of content 1. Executive summary ___________________________________________________ 6 2. Introduction __________________________________________________________ 6 2.1. Purpose of the document ________________________________________________ 6 2.2. Definitions and acronyms ________________________________________________ 6 3. Considered railway critical systems ____________________________________ 8 3.1. Ground to train communication based on GSM-R __________________________ 9 3.2. Railway station operation based on TETRA _______________________________ 9 3.3. Train location and services based on GNSS/GPS _________________________ 10 3.4. Spot communication using EUROBALISE ________________________________ 11 3.5. Conclusion ____________________________________________________________ 12 4. Railway critical environments to be considered ________________________ 12 4.1. Lines __________________________________________________________________ 12 4.2. Stations _______________________________________________________________ 12 5. European selected railway sites and configurations ____________________ 14 5.1. LGV Est _______________________________________________________________ 14 5.2. Paris Gare de l’Est _____________________________________________________ 14 5.3. Liège Guillemins _______________________________________________________ 15 6. Normal environment measurement setup ______________________________ 16 7. Results of in situ measurement campaigns ____________________________ 17 7.1. Measurements along the LGV Est from France to Germany ________________ 17 7.2. Measurements in Paris Gare de l’Est ____________________________________ 20 7.2.1. Results obtained along the platform (Gare de l’Est - loc. A) ______________________ 22 7.2.2. Results in front of the control-command centre (Gare de l’Est - loc. B) ____________ 24 7.2.3. Junction between the railway and the subway stations (Gare de l’Est - loc. C) ______ 26 7.3. Measurements in Liège Guillemins ______________________________________ 27 8. Inputs for the definition of normal EM conditions _______________________ 30 8.1. TETRA 410-430 MHz ____________________________________________________ 30 8.2. GSM-R ________________________________________________________________ 30 8.2.1. Downlink frequency band 921-925 MHz _______________________________________ 30 8.2.2. Uplink frequency band 876-880 MHz __________________________________________ 30 8.3. GNSS - Civilian GPS ____________________________________________________ 32 8.4. EUROBALISE __________________________________________________________ 32 9. Anomaly detection techniques ________________________________________ 32 9.1. Introduction ___________________________________________________________ 32 9.2. Generalities ____________________________________________________________ 33 9.3. Description of the most common techniques _____________________________ 33 9.3.1. Discriminative methods ______________________________________________________ 33 SEC-D3.1-C-07 2013-"Synthesis model" for experimental simulation of normal and attack conditions- IFSTTAR 24/07/2013 3/42 SECRET Project Grant Agreement number: 285136 9.3.2. Generative methods ________________________________________________________ 34 9.4. Towards EM anomaly detection _________________________________________ 35 9.5. Bibliography of section 9 _______________________________________________ 35 10. Preliminary results using the experimental collected data _____________ 36 10.1. Analysis and model of the EM environment _____________________________ 36 10.1.1. Introduction and context ____________________________________________________ 36 10.1.2. Analysis and Characterization of the EM environment in normal conditions _______ 36 10.1.3. EM model : Intrinsic variations and variations in function of time ________________ 40 10.1.4. EM Spectrum model: Variations in function the location observation. ____________ 41 11. Conclusion ________________________________________________________ 41 12. Acknowledgements ________________________________________________ 41 SEC-D3.1-C-07 2013-"Synthesis model" for experimental simulation of normal and attack conditions- IFSTTAR 24/07/2013 4/42 SECRET Project Grant Agreement number: 285136 List of figures Figure 1: ERTMS/ETCS targets for EM threats ...................................................................................... 8 Figure 2: Eurobalise/BTM transmissions principle ................................................................................ 11 Table 1: Railway systems and associated electromagnetic parameters .............................................. 12 Figure 3: LGV Est line as seen from a measurement site ..................................................................... 14 Figure 4: Tracks and platforms of the Paris Gare de l’Est .................................................................... 15 Figure 5: Tracks and platforms of the Liège Gare des Guillemins ........................................................ 15 Figure 6a: Electric field measurement using the conical dipole (Paris, gare de l’Est) .......................... 16 Figure 6b: Magnetic field measurement using the active loop (Liège, Guillemins gare) ...................... 16 Figure 7a: Laboratory van and wideband conical dipole installed on top the van along LGV Est ........ 16 Figure 7b: Measuring equipment inside the laboratory van .................................................................. 16 Figure 8: 875-975 MHz GSM-R downlink LGV Est record .................................................................... 17 Figure 9: 918-928 MHz GSM-R downlink LGV Est ............................................................................... 18 Figure 10: 922 MHz BTS centered record – span = 120 kHz ............................................................... 18 Figure 11: 873-883 MHz GSM-R uplink LGV Est record ...................................................................... 19 Figure 12: GPS-L1 typical LGV Est record ............................................................................................ 19 Figure 13: Eurobalise 27 MHz band typical record ............................................................................... 20 Figure 14: Measurement locations on a platform (A), in front of the station control room (loc. A & B) . 21 Figure 15: Measurement at the junction between railway and subway stations (loc. C). ..................... 21 Figure 16: GSM-R downlink frequencies - span = 100 MHz (Gare de l’Est - loc. A). ........................... 22 Figure 17: GSM-R downlink frequencies - span = 10 MHz (Gare de l’Est - loc. A). ............................. 22 Figure 18: GSM-R uplink frequencies - span = 10 MHz (Gare de l’Est - loc. A). .................................. 23 Figure 19: GPS L1 civilian frequency - span = 2 MHz (Gare de l’Est - loc. A). ..................................... 23 Figure 20: Measurements at TETRA frequencies - span = 40 MHz (Gare de l’Est - loc. B). ................ 24 Figure 21: Measurements at TETRA frequencies - span = 20 kHz (Gare de l’Est - loc. B). ................. 24 Figure 22: GSM-R downlink frequencies - span = 100 MHz (Gare de l’Est - loc. B). ........................... 25 Figure 23: GSM-R downlink frequency band - span = 10 MHz (Gare de l’Est - loc. B). ....................... 25 Figure 24: GSM-R uplink frequencies - span = 10 MHz (Gare de l’Est - loc. B). .................................. 26 Figure 25: TETRA frequencies - span = 40 MHz (Gare de l’Est - loc. C). ............................................ 26 Figure 26: GSM-R downlink frequencies - span = 10 MHz (Gare de l’Est - loc. C). ............................. 27 Figure 27: GSM-R downlink frequencies - span = 100 MHz (Guillemins)............................................