GNSS for Rail Automation & Driverless Cars: A Give and Take Paradigm

Full text

GNSS for rail automation & driverless cars: a
Give and Take paradigm
Francesco Rispoli, Ansaldo STS, Hitachi Group Company, Genova, Italy
Per Enge, University of Stanford, USA
Alessandro Neri, Radiolabs @ University of ROMA TRE, Roma, Italy
Fabio Senesi, Massimiliano Ciaffi, Elena Razzano, RFI - Rete Ferroviaria Italiana, Roma, Italy
BIOGRAPHIES
Francesco Rispoli joined Ansaldo STS in 2011 and is the Manager for train control system’s satellite technology and the
General Director of Radiolabs. Since then, he has promoted the development of satellite technologies for train control
systems, chairing the Working Group for the satellite activities of the European Next Generation Train Control System and
coordinating research projects with the GSA and ESA. In 2012 he launched with RFI the ERSAT initiative to apply the
GNSS positioning and the public telecom and satcom into the ERTMS system. He is a board Director of Galileo Services
Association dealing with the satellite applications in the rail domain. From 2005 he was the Chief New Initiatives at
Telespazio and previously Vice President Multimedia Business Unit with Alenia Spazio. Francesco holds a doctoral degree
in Electronic Engineering (Polytechnic of Turin 1978) and a post-graduate Master in Applied Electromagnetism (University
La Sapienza in Roma 1980). In 2012 he was awarded the Finmeccanica Innovation Prize and the Italian Prize of Prizes with a
satellite-based innovation for train control systems.
Alessandro Neri is Full Professor in Telecommunications at the Engineering Department of the ROMA TRE University. In
1977 he received the Doctoral Degree in Electronic Engineering from “Sapienza” University of Rome. In 1978 he joined the
Research and Development Department of Contraves Italiana S.p.A. where he gained a specific expertise in the field of radar
signal processing and in applied detection and estimation theory, becoming the chief of the advanced systems group. In 1987
he joined the INFOCOM Department of “Sapienza” University of Rome as Associate Professor in Signal and Information
Theory. In November 1992 he joined the Electronic Engineering Department of ROMA TRE University as Associate
Professor in Electrical Communications, and became Full Professor in Telecommunications in September 2001. His research
activity has mainly been focused on information theory, signal theory, signal and image processing, location and navigation
technologies, and their applications to both telecommunications systems and remote sensing. Since December 2008, Prof.
Neri is the President of the RadioLabs Consortium, a non-profit Research Centre created in 2001 to promote tight
cooperation on applied research programs between universities and industries.
Fabio Senesi: MSc and PhD, he is the Head of Department of Technologies for Railways safety and effectiveness (Standard
Tecnologie), with a focus on innovative technologies including the ERSAT project since 2012. Previously he was involved in
the implementation of ERTMS on the Italian High Speed lines and in the upgrading of signaling and telecom systems for the
conventional lines (SCMT, SSC, GSM-R), as well as responsible of Command and Control System, Signalling, Electric
Power supply System, Telecommunication, Validation of new technologies. He was member of the Italian Railways Safety
Agency in 2010-2011, and later President of the EEIEG ERTMS USER Group.
Massimiliano Ciaffi, MSc, has been the 3inSAT and ERSAT EAV (Satellite Projects) Project Manager, and is currently the
ERSAT GGC PM. He was also responsible for the development, homologation and Functional Assessment of the ERTMS
on-board Subsystem. He worked to put in service ERTMS High-speed line Rome-Naples, Turin-Milan, Milan- Bologna and
Bologna- Florence, leading the ERTMS/ETCS test campaign in Italian ATC Lab. He is a member of the Commission for the
release of the licences to Maintenance and Operator staff of High Speed Lines Milano-Bologna, Bologna-Firenze, Torino-
Milano and Roma-Napoli, and also member of WGA9D CENELEC group for Standardization of ERTMS DMI (Driver
Machine Interface). Previously he was involved as a member of the GPRS trial site group for ERTMS applications.
Before the experiences in RFI, he worked as Telecommunication System Engineer in Siemens and Sirti in the design of TLC
Networks.
Elena Razzano: MSc and PhD in Aerospace Engineering, she joined RFI innovation projects as an expert on aerospace
systems and space applications for navigation and control. She is currently involved into the ERSAT GGC project. She is

specialized in space applications for Navigation and Control analyzing a Space-Based system for maritime monitoring and
navigation built on the existent AIS coastal system. She worked for the German group OHB Technology on different
European and National (IT, DE) projects. She holds an Executive MBA and worked as a consultant on innovative projects for
Telco and Logistics companies.
ABSTRACT
GNSS positioning with high Integrity and accuracy attributes is a key application for implementing more efficient and safer
automated train systems. The goal is an overall system concept and train equipment that is competent in high multipath
environments, suitable for being integrated into the train safe platform ensuring at the same time economy on total cost of
operations. Connected cars applications rely also on accurate and safe positioning and have in common with the trains the
operational environment and a centralized command and control system. This paper introduce the give and take paradigm to
liaise train control systems and autonomous cars stake holders and develop a common GNSS platform. The ambition is to
export to the autonomous cars the safety capabilities of train control systems demonstrated during tens of years of operations,
and to exploiting the large car’s market potential to lower the GNSS platform costs. The paper starts with the characteristics
of the European Railways Train Management Systems (ERTMS) that guarantees the highest safety levels through a platform
which is interoperable, standard and certifiable with harmonized procedures. Then we describe the plan to validate and certify
the GNSS positioning applications into the ERTMS, which is one of the Game Changer technologies of the ERTMS
evolution plan. The synergy with the connected cars is discussed by first introducing the virtual track concept to drive a car
on the road as a train on the railways and then by developing the virtual horizon to safely monitor the way ahead detecting
obstacles. The roadmap is driven by the ERSAT GGC (Galileo Game Changer) H2020 project, involving the rail community,
and the EMERGE initiative, dealing with the automotive sector.
INTRODUCTION
Although autonomous-driving cars are a long-term perspective, a first step, earlier achievable, will be setting autonomous
taxis, minibuses and trucks to operating inside predefined, geo-fenced areas - linking for example the last mile between
homes and rail stations, or for managing emergency vehicles. Meanwhile, autonomous train systems are de-facto a well-
established standard with the metros already transporting daily millions of passengers, and with autonomous freight trains
getting regulator’s go-ahead in Australia [1]. The European Railways Train Management Systems (ERTMS) is becoming a
world’s benchmark in terms of safety and efficiency and is continuously enhanced, targeting a full driverless capability [2].
The most important pillar of the ERTMS is its unbeaten safety performance with the SIL 4 safety level in a scale ranging
from 0 to 4, meaning that the fraction of trains that did not stopped at the prescribed point or violated the maximum allowed
velocity must not exceed a rate of 10E-9/hour. The other distinctive characteristic of the ERTMS is the architecture based on
a platform which is interoperable, standardized, and certifiable according to harmonized procedures [3]. The evolution plan
of the ERTMS includes also the GNSS positioning that has been recognized as a Game Changer innovation to improving the
ERTMS total costs of ownership by a significant reduction in all track-side conventional train detection components (balises,
track circuits, axle counters, etc.) [4]. The adoption of the GNSS positioning is conditioned by the selection of an overall
system concept and train equipment that is competent in high multipath environments, suitable for being integrated into the
safe ERTMS platform and ensuring at the same time its economical sustainability to justify a large scale deployment.
Additional risks introduced by the GNSS, such as satellite signals degradation and more importantly multipath and
interferences, must be mitigated with solutions verified against the Common Safety Method for risk evaluation and
assessment (CSM-RA) described in [5]. The case of the GNSS certification for the ERTMS has been recently addressed in
[6] while the Shift2Rail TD 2.4 task has the objective to define a fail-safe train positioning, backward compatible, for the
core ERTMS [7]. Meanwhile, RFI has been nominated the Game Changer for satellite integration into the ERTMS. After
having shared the certification and authorization strategy with ERA and the Italian Safety Agency and two Notify Bodies,
RFI has launched a pilot line with the objective to validate and certify the GNSS positioning into the ERTMS, supported by a
team of experts from the railways and space agencies [8], [9].
The topic of high integrity GNSS positioning for railways applications was analyzed in the Rail High Integrity Navigation
Overlay System (RHINOS) research project [10]. Concluding the project, a way forward has been proposed through a
validation and verification (V&V) process to meet the needs of the stakeholders and to assure synergy with the user
equipment communities for aviation and/or driverless automobiles [11]. A deeper look at the effects of railway multipath on
GNSS integrity, at the best means to detect cyber attacks by spoofers, and at non-GNSS tests to cross-check the integrity of
the GNSS estimates of train position and velocity was recommended.

The automotive sector, differently from the railways where the ERTMS stakeholders have defined a common strategy
targeting full train automation, is envisioning the cars driven by themselves on a long-term perspective with different plans
promoted by cars and software giants. In the shorter time, instead, the Connected car approach is widely recognized as the
first step of car’s automation gaining consensus among car manufacturers who are deploying the technology on the field. A
likely evolution of this concept is based on a centralized system that gives to cars the authorization to proceed upon the
knowledge of the car’s position and the knowledge of the surrounding environment, resembling in practice the ERTMS
system. In fact, the ERTMS operates under the supervision of the Radio Block Center (RBC) and a secure communication
link to exchanges the train’s positions before to issue to the train the movement authority once the safety requirements are
met. Due to these similarities, our paper proposes a liaison for harmonizing train and car automation development strategies
that we defined a Give and Take paradigm for the potential benefits to both the transportation means. The ambition is to
export to the autonomous cars the safety capabilities of the ERTMS demonstrated in tens of years of operations and soon
with the GNSS positioning as a primary means to reset the errors of the odometer. On the other side, the million units car’s
market potential represents a unique opportunity to lower the costs of multi-sensor positioning systems that neither the trains
nor the airplanes applications alone can achieve [12]. Furthermore, these synergies will likely generate benefits across the
value chain of multi-modal operators, when for example cars and trucks can be automated to travelling on virtual tracks as
“trains” in the road. In that scenario the ERTMS platform could be a suitable and cost effective solution for hybrid-engine
trucks with a pantograph being experimented on electrified lanes and also for emergency-vehicles which can be safely driven
beyond the visual horizon.
The GNSS-Based ERTMS Ecosystem
The train position on the ERTMS is determined with the odometer measuring the distance travelled respect to predetermined
reference points. These devices known as balises, are georeferenced transponders located along the line which in turns reset
the errors accumulated by the odometer. The concept of Virtual Balise (VB) has been introduced to adopt the GNSS
positioning seamlessly on the ERTMS, being functionally equivalent to the physical balises. The detection of VB is
performed by an on-board Virtual Balise Reader (VBR) as the physical balises are detected by the balise reader. In that way
the train position is transmitted by a position report to the Radio Block Center (RBC) which does not care whether the train
position is computed by using a physical or a virtual balises. For safety reasons the sequence of balises is pre-set so that their
expected position and orientation are known in advance to the train. In that way a linking mechanism is established with a
safety reaction tasked to verify if balises are detected correctly or missed in the expectation window. Otherwise the
intervention of the emergency/service brake is automatically activated whenever the number of missed balises has exceeded
the configured threshold.
The task to localize a train with accuracy and integrity can be achieved by using different GNSS and IMU technologies or a
combination thereof. A driver to select the most suitable solution is first of all to fit with the ERTMS architecture, ensuring
compliance with the SIL 4 (10E-9 hazard/hour) safety levels and then proving that an economy of scale is achievable on the
whole ERTMS costs chain (design, implementation, validation, certification, operation and maintenance).
This section presents the framework in which the VB concept is being developed. The VB are expected to motivate the
adoption of the ERTMS on the local and regional railways lines most of which are equipped with legacy control systems
lacking of a standard and interoperable solution. For these lines the economical sustainability of the ERTMS is improved by
the VB avoiding trackside equipment and maintenance costs and increasing the availability of the on-board signaling system.
The goal is an ERTMS solution with lower costs for the Infrastructure Manager (IM) and also for the Train Operator (TO)
that can increase traffic capacity, for example at peak hours, and to guarantee a better train’s punctuality thanks to less
dysfunctions caused by the reliability of the on-board balise reader chain. In fact, just extrapolating the actual reliability
figures of the balise reader equipment chain measured in Italy, a total of some 7000 maintenance events per year are
forecasted if the ERTMS with physical balises is deployed on the whole regional network.
Therefore, consensus is mounting to embark the Virtual Balise Reader as a new subsystem of the ERTMS interoperability
constituents, and the VB concept appears today a good compromise respect to other positioning solutions that indeed might
imply a profound modification and requalification of the ERTMS system [13].

Figure 1, ERTMS L2 architecture and the linking principle of balises
Figure 1 shows the generic ERTMS level 2 architecture based on a punctual re-calibration of the odometer with data
transmitted by the fixed balises that are transponders energized by the balise reader when the train passes over the expected
balise. The safe front end of the train depends on the odometer error and the braking curves so that to reduce the safe train
length, that impacts on the line capacity, more balises must be deployed. By replacing these balises with virtual balises, the
ERTMS architecture remains unchanged as shown in Figure 2, except that an external GNSS augmentation network is
needed to bound the GNSS positioning error. This architecture is being deployed within the ERSAT program (ERTMS +
Satellite) launched in 2012 by RFI with Ansaldo STS as a test bed for the adoption of the satellite technology supported by
European research projects [14],[15]. The augmentation network is an external facility to the ERTMS but it plays an
important role for achieving the safety requirements, guaranteeing the interoperability and ensuring the economical
sustainability of the ERTMS system.
Figure 2, High level ERTMS L2 architecture with the GNSS positioning
On ERSAT the validation of the GNSS positioning is based on a stepped approach in accordance with the European Space
Agencies. In the first step (Figure 3) a local augmentation network is deployed to accompany the validation and certification
process. The second step consists of upgrading this architecture employing a public augmentation network targeting to
reusing the EGNOS systems developed and certified for the aviation applications. The final objective is to provide an
augmentation service to the IM, mirroring the approach implemented for the aviation community. A possible solution is to
deploy a dedicated multi-modal augmentation network serving both the railways and road applications. Since roads and
Linking distance
Estimated position
Odometric error +
antenna offset
Max safe front end
Min safe front end

railways are generally not too distant from each other. This multi-modal approach can be a cost efficient solution if the ICT
infrastructures under construction for the smart road applications can be shared with the railways [16].
Figure 3, Reference Architecture based on a dedicated augmentation network
The ERSAT plan will be executed on a pilot line, located between the stations of Pinerolo and Sangone in the north-west of
Italy on top of the ERTMS L2 Baseline 3 platform to be deployed. The validation and certification framework has to comply
with the compatibility requirements set forth in the ERTMS MoU signed in 2016. That condition means a legal and technical
certainty that a compliant Baseline 3 ERTMS On-board Unit can safely run on any compliant ERTMS line with an
acceptable level of performance. Maintaining compatibility entails that the satellite Game Changer will not create technical
barriers to accessing the infrastructure. The satellite Game Changers will have to contribute to the future evolution of the
ERTMS and be developed according to an agreed planning, recognizing the compatibility concept. To facilitate this task, RFI
being the satellite Game Changer, has set up a collaborative framework with representatives of the railways sector as the
European Union Agency for Railways (ERA), the Italian Safety Agency for Railways (ANSF) and Shift2Rail together with
experts from the GSA, ESA and ASI representing the space sector (Figure 4). This collaborative effort aims to guarantee the
correctness of the certification process of the GNSS positioning in the frame of the ERTMS regulations and also to prepare
the ground for the future standardization and exploitation.
Figure 4, Team of Experts for the Certification of the GNSS application into the ERTMS

The Connected Car Scenario
In recent years the development and type approval process for automated vehicles is evolving to include the Automatically
Commanded Steering Functions (ACSF) that requires higher safety levels with THR ~ 1E-9/hour for car position
determination similarly to what is specified for the VB in the ERTMS. Also the clearly defined certification and safety
approval process for these high safety levels to use cars with ACSF will have to be backed by a standardization of safety
assurance. This implies to set the minimal requirements that autonomous car must satisfy, and how these requirements are
verified as for the regulations governing the aviation and railways applications. Recent progress on solving the above tasks
can be found within the Report of UN ECE expert groups (United Nations Economic Commission for Europe) [17] and [18]
where a mathematical model for safety assurance called Responsibility-Sensitive Safety (RSS) is described.
We believe that the validation of Autonomous Vehicles (AV) cannot rely only on the results of extensive tests on the field
only because the challenge is a lack of safety guarantee and scalability on all the possible operative scenarios.
The ultimate target of autonomous cars is to guarantee zero accidents due to human errors by mitigating the risks generated
by multiple causes that can provoke a fatal collision. In the case of train control systems there are two major risks, namely a
failure of the train control system to supervise the maximum allowed speed and overpassing the prescribed stopping point.
Other risky failures are the breaking of the rail and or the carriages wheels which can provoke a derailment of the train. Let’s
consider the ERTMS and assume that it is possible to manage the Connected car by a similar centralized system. The
challenge is to exploit the constrainon the vehicle route, in order to know the position of the vehicle and the way ahead,
including the distance with other vehicles and obstacles. Once this information is known, the centralized control system can
issue the authorization to proceed to the vehicle as shown in Figure 5.
Figure 5, Connected car adopting the ERTMS principles
With respect to the Connected car, the railways operations exhibit two differences: a) the train is constrained by the railways
to move along one dimensional path, b) the interlocking system will set the way with the guarantee that is free from other
trains.
Other peculiarities are due to the different braking distance that for the trains is longer because of the lower friction between
the wheels and the rail imposing the minimum distance between consecutive vehicles. Instead, cars can be spaced closer to
each others, providing that the latency for receiving the movement authority is kept sufficiently low. As a matter of fact, the
movement authority for cars has to cope with the gap between the actual range of the obstacle-detection sensors and the
braking distance, which increases with the speed. Whenever the braking distance exceeds the range of the sensors providing

obstacle detection, a virtual horizon has be implemented to guarantee the safety of the system; otherwise, significant limits
on the speed have to be applied.
Figure 6, Virtual electronic Horizon for car braking distance management
Summing up, the train management systems can benefit from a system able to advise on possible obstacles along the line,
that indeed is mandatory for car automation, and from low latency telecom means to increasing the railways capacity. The
Connected car ecosystem can reuse the principles of the ERTMS centralized system with its already achieved standardization
and certification process. Thinking ahead, the architecture shown in Figure 5 has been retained for testing on the EMERGE
initiative [19]. EMERGE is a research framework to develop and test the enabling technologies for Connected cars:
positioning, communications and cybersecurity. One of its operational scenarios deals with the management of emergency
vehicles through a centralized system to supervising, controlling and instructing the vehicles to safely move on the road in
presence of eventual obstacles.
GNSS Positioning with High Integrity for Railways Applications
The RHINOS project strongly progressed the case for rail navigation using GNSS [20]. Most importantly, RHINOS provided
a sober assessment of the faults that would threaten the integrity of such a safety critical system. This assessment conducted
with the GNSS team of the University of Stanford (Figure 7) and other research institutions included the faults that have been
addressed by the aviation community and faults that arise in the immediate neighborhood of the train. We call these faults
wide area faults and local faults respectively that are common to different applications as depicted in Figure 8.

Figure 7, prof. Per Enge talking about RHINOS at Workshop in the Stanford University
Figure 8, prof. Per Enge speaking at the Center for Automotive Research at Stanford – CARS, [21]
Figure 9 sketches the high level GNSS architecture defined on RHINOS and the greyed boxes show the baseline Localization
Determination System (LDS). The baseline system relies on trackside systems, shown in the middle of Figure 8, to detect
faults that are observable at a distance. These are the above-mentioned wide area faults and include: GNSS clock runoffs,
upload failures, on-satellite failures of the signal chain, and ionosphere perturbations by space weather. RHINOS counts on
innovative solutions within the on-board unit (OBU), shown on the top of Figure 9, to detect the local faults. These faults
include multipath and spoofing. The RHINOS team conducted a deep look at multipath, because it is the greatest threat to the
viability of GNSS for train navigation. As shown in Figure 9, the LDS includes two levels of multipath detection:
measurement domain and position domain. In the measurement domain, the GNSS receiver operates on the individual
satellite signals and attempts to isolate any measurements that contain appreciable errors due to multipath. In the position
domain, the GNSS receiver implements Advanced Receiver Autonomous Integrity Monitoring (ARAIM), which is currently
under development by the aviation community. ARAIM makes a best estimate of the position and velocity of the vehicle.
This best estimation is projected onto the line-of-sights to each satellite used in the position solution. Subtracting these
projections from the original measurements creates the so-called measurement residuals. Large residuals are cause to believe
that the measurements contain a faulty measurement. Uniformly small residuals are cause to be optimistic that the

measurement suite is error free. This cascade of multipath monitors may enable the 5 and 12 meters protection levels that we
seek for rail navigation.
Figure 9, High level GNSS architecture for train control system
Figure 10 shows a simplified version of the RHINOS fault tree. Like Figure 9, it uses greyed boxes to highlight the fault
modes and monitors that need the most technical verification. As shown, the highest verification efforts will concern
multipath, spoofing and the development of a GNSS-independent cross-check (Function B).
Multipath is the most significant integrity challenge to GNSS for rail applications, and the RHINOS team devoted significant
effort to this hazard. As mentioned above, the baseline RHINOS strategy uses two levels of multipath detection. The first
level is a set of multipath screens that isolate and discard most of the measurements that contain serious multipath defects.
The second level is an end-around integrity check based on Advanced Receiver Autonomous Integrity Monitoring (ARAIM)
that catches the multipath defects not flagged by the first level. This bi-level approach yields the performance shown in Table
1. The table shows a mild multipath environment where the rail yard standard deviation is equal to three times the standard
deviation assumed for air navigation. It also shows a more severe multipath environment where the rail standard deviation is
eight times the aviation standard deviation. The probability the multipath screens fail to detect multipath events is shown as a
function of the satellite elevation angle in columns two through four. Under these assumptions, RHINOS demonstrated
protection levels of five meters with high availability in the mild environment, and protection levels of 12 meters in the
severe environment. The RHINOS cascade of multipath screens and ARAIM seems to be effective for the two cases
described in Table 1. However, a large field campaign is needed to verify these findings.
As a hedge against any remaining multipath difficulties, the RHINOS effort looked seriously at precise point positioning
(PPP) as a means to further reduce multipath. Today, PPP is provided by a number of commercial companies and Galileo
plans to include PPP in its Commercial Service (CS). In addition, GSA is funding a European consortium of companies to
investigate PPP for safety-critical automotive navigation. PPP routinely delivers decimeter accuracy under open sky, but
multipath is still a problem in urban settings. Even three-frequency PPP based on E1, E5 and E6 (or L1, L2 and L5) remains
an embryonic idea for GNSS in urban environments, and any rail adoption of this technique would require a large verification
effort. In fact, PPP is a perfect example of the tension associated with the way forward for rail navigation based on GNSS.
On one hand, it seems to be a likely technique to reduce the multipath, which may continue to trouble the rail application.
However, the rail marketplace for GNSS receivers will never be large, and so we must monitor the air and automotive
applications of PPP, hoping that they would provide economy of scale for the user equipment.

Figure 10, Simplified RHINOS Fault Tree with the functions that need the most V&V in grey
Spoofing represents also a potential hazard and it can take at least three forms: repeating spoofers, simulators and re-radiating
spoofers. Of these, the repeating spoofers and simulators have been observed in the field. Re-radiating spoofers seem to be
laboratory curiosities, but they are feasible to build and more difficult to mitigate, so they remain a threat of concern. We
opine that all three varieties should be countered for an application as critical as rail navigation and a specific study is
undergoing to assess this phenomenon within the ERTMS ecosystem [22].
Table 1: Parameters for the MAAST Analysis of RHINOS Protection Levels in Multipath Environments. The first four
columns define two multipath models (mild and severe), and the final column shows the protection level that RHINOS can
provide in such environments.
Standard deviation of the
multipath in a rail yard
Psat for
elev.<15°
Psat for
15°<elev.< 45°
Psat for
elev.>45°
Protection levels in Berlin with 24
Galileo & 24 GPS satellites
Mild: σ rail = 3σ air
10-3
10-4
10-5
HPL < 5 meters
Severe: σ rail = 8σ air
10-3
10-5
10-6
HPL < 12 meters
Looking ahead to optimize the efficiency and the economical sustainability of the VB we have derived the target GNSS
positioning performance for the ERTMS as reported in the Figure 11. These performances, matching the specifications of the
physical balise and allowing to discriminate the track where the train is at start of mission, would simplify the problem to
substitute seamlessly all the physical balises without impacting on the operational modes of the ERTMS. Similar
performances are also expected for the automotive applications. As shown in the simplified Fault Tree of Figure 10, an
independent diagnostics (Function B) has been introduced to equate the THR for the GNSS errors to the 10E-6/hour which
represent the state of the art of SBAS networks. Meanwhile, as automotive applications are booming with an emerging
economy of scale, there is a chance to tackle these performances with more economically and sustainable solutions that will
likely be added to the generation of products customized only for railways applications. In that way, the effort to introduce
the VB into the ERTMS L2 will be springing up the ERTMS L3 operations, which is the ultimate mode of the ERTMS
introducing the moving block and allowing to eliminate all the track side circuits. With the ERTMS L3 the train positioning
will become an exclusive task of the train on-board unit and the GNSS is expected to play a significant role.

Figure 11, Target GNSS positioning requirements for the ERTMS
The Virtual Track Constraint
The Virtual Track (VT) constraint is an indispensable feature to allow a Connected car to behave on the roads as a train on
the railways. Cars have an additional degree of freedom to keep their lateral position with respect to the middle line of the
roadway compared to trains that are constrained by the railway track. On the other hand, no individual technology can
currently assure a safe driving in all weather conditions, so that the autonomous vehicle navigation systems are based on the
fusion of the data supplied by a large variety of sensors that include GNSS receiver, odometers, speedometers, INS, LIDAR,
RADAR, and video cameras.
By fact, longitudinal and lateral vehicle control are decoupled. Moreover, the lane-keeping and the lane-departure warning
functionalities currently rely on the use of video cameras for road surface markings detection. In this context, the role of the
GNSS receiver will be focused on the longitudinal control and on all those functionalities, like the cooperative collision
avoidance, that require a shared knowledge of the overall scenario.
In this case, a unified approach to the positioning of cars and trains can be pursued by exploiting the knowledge about the
lateral vehicle position provided by the imaging sensors. To illustrate this concept, given a roadway, let us first consider the
case of an autonomous vehicle whose motion is restricted to a single traffic lane. Then we introduce a curvilinear coordinate
system as in [23], [24] with the s coordinate line of the base frame coincident with the middle line of the lane and the q axis
orthogonal to
s
as illustrated in Figure 12a.
Figure 12, The curvilinear coordinate frame: a) single lane, b) lane change maneuver
In presence of lane changes, during the manoeuvring phase, the base frame is defined by the planned vehicle path, as
illustrated in Figure 12b. Here, we assume that the vehicle lateral coordinate q and its orientation

with respect to the base
frame are estimated by processing the images acquired by the front and rear cameras.

Let
ˆ
q
be the estimate of the lateral coordinate at the k-th epoch. Then, let
( , )
VT VT
sq
be the curvilinear coordinates system,
denoted in the following as the “virtual track”, obtained by applying an offset
ˆ
q
to the lane based curvilinear coordinates
system
( , )sq
, as illustrated by Figure 12. Then, given
()
VT
st
, the Cartesian coordinates of the GNSS antenna reference point
(ARP) are described by the parametric equations:
 
( ) ( )
Rx Rx VT
t s t=XX
(1)
Therefore, the GNSS based estimate of the longitudinal position of the vehicle
()
VT
st
can be computed by solving the non-
linear system
 
() Diff
Rx Rx VT Rx
s c t

= + + +rX  
, (2)
where
r
is the geometric range vector with components
 
, 1,...,
pp
Rx Rx Sat Sat
r p N= − =X X X
, (3)
p
Sat
X
is the vector of the coordinates of the Antenna Reference Points of the p-th visible satellite;
Sat
N
is the number of
visible satellites;
()
Rx k
is the vector of the measured pseudorange;
Rx
t

is the error of the receiver clock,
Diff


is the vector
of the differential corrections given by the augmentation network; and

represents the equivalent observation noise that
includes the receiver thermal noise, the errors caused by local hazards like multipath and radiofrequency interferences as well
as all terms not compensated by the differential corrections.
We remark that Eq. (2) is identical to the equation concerning train positioning as reported in [25]. Thus, it can be solved by
expanding (2) in Taylor’s series around the point
()
Rx VT
sX
corresponding to the initial guess
VT
s
of the longitudinal vehicle
position and retaining the terms up to the first order, then obtaining the following linear system:
Rx
 = +Hz
, (4)
where
 
()
Rx Rx Rx VT
s = −rX
, (5)
z
is the vector of the unknowns
Rx
s
ct

=




z
,
(6)
VT VT
s s s−
is the offset of the longitudinal position with respect to
VT
s
, and
H
is the observation matrix given by
VT VT
Rx
Tss=


==



Hz

Sat
T
Rx N

=
E D 1
, (7)
where
Rx
E
is the array of the line of sight unit vectors
12 Sat
N
Rx Rx Rx Rx

=
E e e e
, (8)
with
()
Rx Rx VT
p
pSat
Rx Rx s=


=


XX
r
eX
(9)
and
Sat
N
1
is a column vector of size
1
Sat
N
with elements equal to 1.
The main advantage of the VT concept is the possibility to use the a priori knowledge about the vehicle reference trajectory
to increase the integrity. In particular, joint use of odometers, speedometers, and rail and road maps, allows to predicting
pseudoranges and doppler shifts that can be used in Fault Detection and Exclusion algorithms to mitigate multipath hazards,
[25].
The Roadmap
Looking ahead and taking into account the contributions of further research and innovation projects referenced in [26] – [37]
we have defined a roadmap largely supported by on-going projects and aiming at exploiting the synergies between trains and

cars automation. This roadmap, shown in Figure 13, consists of four consecutive steps with pre-defined milestones. The first
milestone (Step 1 - 2020) is targeting the validation and certification of a first GNSS application, as an-add-on feature of the
ERTMS L2, and operating with a dedicated local augmentation network. The second milestone (Step 2 – 2021) aims to
migrate the previous solution on a public augmentation network that is mandatory to preserve the interoperability of the
ERTMS. Whether the public augmentation network will be based on EGNOS or a combination of EGNOS with local
networks depends from one side on the outcomes of studies undertaken by ESA and from the other side on the synergies
with the automotive applications under development on the EMERGE initiative. The third milestone (Step 3 – 2022) is the
safe obstacles detection that is a mandatory feature for the Connected car application and is also exportable to the railways
sector to enhance the train control systems. The last milestone (Step 4 – 2024) consists of proving on the field the Connected
car reusing the ERTMS principles with the GNSS positioning and operating with a public augmentation network. Meanwhile
the 5G communications and high-fidelity road maps ancillary applications will be developed and in field verified on the
EMERGE test bed.
Figure 13, the roadmap towards a full exploitation of the GNSS positioning in train and cars applications
CONCLUSION
This paper has presented the rationale of a Give & Take paradigm to advance the GNSS technology beyond the state of the
art by combining the effort of railways and connected cars developments. Safety is a priority for both applications but finding
economically sustainable solutions that must be certified, scaled and standardized is the real challenge in the race towards
fully automated vehicles. A cooperative effort involving all the stake-holders since the early stages is creating a constructive
environment and a cross-fertilization process among different disciplines. We described the validation and certification
process underway with a Pilot line in Italy for the introduction of the GNSS positioning according to the safety standard of
the ERTMS that represents a world’s benchmark in terms of safety. Growth potential of GNSS positioning applications is
significant providing that cost effective high integrity-accuracy platforms will be made available. Results from research
projects have demonstrated the technical feasibility of the GNSS positioning for the ERTMS turning the priority on the
economical sustainability for which the synergy with the automotive application opens new horizons. The pillars of our plan,
which started in 2012, are the ERSAT GGC (Galileo Game Changer) project, coordinated by RFI, and the EMERGE
initiative coordinated by Radiolabs. Furthermore, the Connected cars stake holders reusing the ERTMS principles can
shorten the validation and certification process. The joint effort of these flagship projects together with on going technology
developments are the basis of our five-years roadmap and being aware of the amount of effort required to produce high
performance GNSS positioning devices for safety-relevant applications, we are stimulating synergies accruing in the train
and car intelligent control systems for their potential leverage on the mass market to lower the costs.

ACKNOWLEDGMENTS
A special tribute is due to honor the memory of professor Per Enge who has inspired this research and contributed to set a
roadmap to extend to train control the benefits of GNSS. His scientific contribution to the RHINOS project and the great
enthusiasm to investigate the new challenges facing the GNSS, motivating his team at Stanford University and the RHINOS
partners, will be a stimulus for all of us to proceed on the road he envisioned, as we attempted to do with this paper. We also
recognize the contribution of the ERSAT-GGC project, which received funding from the European GNSS Agency under the
European Union’s Horizon 2020 research and innovation programme, under grant agreement No 776039. Furthermore, we
are grateful to the Italian Space Agency for supporting the development of the satellite technology with ESA projects.
REFERENCES
[1] “Rio Tinto operates first driverless freight train” , Railway Age, July 16, 2018
[2] “The European Train Management System” www.ertms.net
[3] Guido, P. “ ERTMS The Challenge of European harmonisation” 1st UIC Global Conference on Signalling, Milan
Italy 26 – 28 March 2018
[4] Guido, P. “ERTMS European Rail Traffic Management System Evolution - game changers” IGAW RHINOS,
Rome, Italy, 22 June 2017
[5] Revised European Commission Regulation (EU) 402/2013
[6] Filip, A., Sabina, S. and Rispoli, F. “A Framework for Certification of Train Location Determination System
Based on GNSS for ERTMS/ETCS”, Manuscript for COMPRAIL 2018 conference, Lisbon, 2-4 July 2018
[7] https://shift2rail.org/research-development/ip2/
[8] Ciaffi, M., Neri, S. and Sabina, S. “The ERSAT Galileo Game Changer” 1st UIC Global Conference on Signalling,
Milan Italy 26 – 28 March 2018
[9] Senesi, F. “ERSAT Certification and Authorization Process” European Union Agency for Railways, Sept. 2018
[10] RHINOS project, www.rhinos-h2020.org
[11] Enge, P. “Way Forwards for Rail Navigation using GNSS” GSA, October 22, 2017
[12] Rispoli, F. “The Rise of Satellite Technology Appeal for Train Control Systems”, IRSE Australasia AGM &
Technical Meeting, Melbourne, Australia 16 March 2018
[13] NGTC, “Next Generation Train Control Final Report WP-7 Satellite”, European Commission FP-7, 2017
[14] www.ersat-eav.eu
[15] www.space4rail.esa.int
[16] Neri, A., Capua, R., Rispoli, F., Senesi, F., Ciaffi, M., “A High Integrity GNSS Infrastructure for Train Control
Systems and Autonomous Driving Cars”, submitted to the Intelligent Transportation Systems magazine Sept. 2018.
[17] Edwards, M., Seidl, M., Tress, M., Pressley, A. and Mohan, S. “Study on the assessment and certification of
automated vehicles” Final Report. European Commission - Directorate-General for Internal Market, Industry,
Entrepreneurship and SMEs, Directorate C — Unit C.4 — Automotive and mobility Industries, Brussels December
2016, published in July 2017
[18] Shalev-Shwartz, S., Shaked Shammah, Amnon Shashua, “On a Formal Model of Safe and Scalable Self-driving
Cars” Mobileye, 2017
[19] EMERGE program, Radiolabs, http://www.radiolabs.it/en/green-light-to-emerge/
[20] Lo, S., Pullen, S., Blanch, J., Enge, P., Neri, A., Palma, V., Salvitti, M., Stallo, C., “Projected Performance of a
Baseline High Integrity GNSS Railway Architecture under Nominal and Faulted Conditions” ION GNSS + 2017,
25-29 Sept.2017, Portland Oregon, USA
[21] Enge, P., “Cyber safe Navigation for Planes, Trains and Automobiles” Center for Automotive Research at
Stanford, 3 Nov. 2017
[22] Stallo, C., Neri, A., Salvatori, P., Coluccia, A., Capua, R., Olivieri, G., Gattuso, L., Bonemberg, L. K., Moore, T.,
Rispoli, F., “GNSS-based Location Determination System Architecture for Railways Performance Assessment in
Presence of Local effects” IEE/ION PLANS 2018, April 23-26, 2018, Monterey, California, USA
[23] Kim, J., Jo, K., Lim, W., Lee, M. and Sunwoo, M., “Curvilinear-Coordinate-Based Object and Situation
Assessment for HighlyAutomated Vehicles” in IEEE Transaction on intelligent Transportation Systems, vol.16,

no.3, pp. 1559-1575, June 2015
[24] Chu, K., Lee, M. and Sunwoo, M. “local Path Planning for Off-road Autonomous Driving with Avoidance of
Static Obstacles” IEEE Transaction on Intelligent Transportation Systems, Vol.13, No.4, pp 1599-1616, Dec.2012
[25] Neri, A., Stallo, C. and Coluccia, A., “A Multi-sensor Autonomous Integrity Monitoring for Railways and Driver-
less Cars” ION GNSS+ 2018, Sept. 24-28, 2018, Miami, Florida, USA
[26] Juliette Marais, Cyril Meurie, Dhouha Attia, Yassine Ruichek, Amaury Flancquart, “Toward accurate localization
in guided transport: Combining GNSS data and imaging information”, Transportation Research Part C: Emerging
Technologies, Volume 43, Part 2, June 2014, Pages 188-197
[27] Marais, J., Beugin, J., Berbineau, M., “A survey of GNSS-based Research and Developments for the European
railway signalling”, IEEE Transactions on Intelligent Transport Systems.
[28] Marzoni, M. G., Lippi, A., Rispoli, F., Senesi, F., Rapaccini, A. (2015). “On the Certification Process for Satellite-
based Applications in the ERTMS ETCS Train Control System,” In Proceedings of European Navigation
Conference 7-10 April, 2015, Bordeaux (France).
[29] Otegui, J., Bahillo, A., Lopetegi, I. and Díez, L. E. “A Survey of Train Positioning Solutions”. IEEE Sensors
Journal, 2017
[30] Ni Zhu, Marais, J., Bétaille, D., Berbineau, M., “Evaluation and Comparison of GNSS Navigation Integrity
Monitoring Algorithms for Urban Transport Applications,” ION-ITM, January 30-February 2, 2017, Monterey,
California
[31] Moeller, N., Hansson, S. O., Holmberg, J., Rollenhagen, C., John Wiley & Sons, 4 gen 2018
[32] http://ec.europa.eu/eurostat/statistics-explained/index.php?title=Rail_accident_fatalities_in_the_EU
[33] Barfoot, T. and Clark, C. M. “Motion planning for formations of mobile robots,” Robot. Auton. Syst., vol. 46, no.
2, pp. 65–78, Feb. 2004.
[34] Werling, M., Ziegler, J., Kammel, S. and Thrun, S. “Optimal trajectory generation for dynamic street scenarios in a
Frenet frame,” in Proc. IEEE ICRA, 2010, pp. 987–993.
[35] Neri, A., Filip, A., Rispoli, F. and Vegni, A. "An Analytical Evaluation for Hazardous Failure Rate in a Satellite-
based Train Positioning System with Reference to the ERTMS Train Control Systems," in Proc. of ION GNSS
2012, Nashville, TN, USA, September 17-21, 2012.
[36] Neri, A., Capua, R. and Salvatori, P. "High Integrity Two-tiers Augmentation Systems for Train Control Systems,"
in ION Pacific PNT 2015, Honolulu, Hawaii, USA, 2015.
[37] Neri, A., Fontana, G., Sabina, S., Rispoli, F., Capua, R., Olivieri, G., Fritella, F., Coluccia, A., Palma, V., Stallo C.
e Vennarini, A. «High Integrity Multiconstellation Positioning in ERTMS on SATELLITE – Enabling Application
Validation,» in Proceedings of the ION 2017 Pacific PNT Meeting, May 1 - 4, 2017, Marriott Waikiki Beach
Resort & Spa,, Honolulu, Hawaii, 2017.