Case Study of Differential-GPS Safety Integrity
Performance on Qinghai-Tibet Railway Line
Debiao Lu
School of Electrical and
Information Engineering
EMC and GNSS Technology
for Rail Transportation
Beijing Jiaotong University
Beijing, China 100044
Email: debiao.lu@outlook.com
Abstract-At the design stage of GPS (Global Positioning
System), there is no provision of real-time integrity information
for the standard positioning service (SPS). Meanwhile the precise
positioning service (PPS) provides signal in space (SIS) integrity
as " lower than 1 x 10- 5 probability per hour". Because
PPS access to WAGE (Wide Area GPS Enhancements) rapid
ephemeris updates and corrections. But only SPS is available for
civilian applications.
However, safety-related applications like train localisation, strin-
gent integrity performance requirements must be fulfilled. Loca-
tion integrity is the measurement of qualitative and quantitative
trust to be placed on the correctness of the location measurement
result. The integrity of GNSS is affected by the healthy status
of the satellites, the environment along the signal transmission
path from the satellite to the receiver (including atmospheric and
ionospheric delays etc. ), the satellite geometry at the point of the
GNSS receiver. From the GNSS receiver side, the implemented
RAIM (Receiver Autonomous Integrity Monitoring) is the most
cost effective method to check the data consistency based on
the redundant information from the satellites. But the RAIM
algorithms are traditionally designed for the situations when
there is only one failure occurs at a time. From the augmentation
system side, the WAAS, like EGNOS, can also providing integrity
information for GPS currently. For more specific application
orientated investigation, the user side safety integrity monitoring
is the most efficient and specific for the required localisation
service.
This paper investigated the train-borne GPS receiver installed on
the locomotive running regularly on the Qinghai-Tibet railway
line at the west most part in China. The train control system on
this line is called Incremental Train Control System (ITCS), it
consists of two GNSS receivers, two wheel sensors, and a safety
verified digital track map on both train side and radio block
centre (RBC) side. All these forms the localisation unit of the
ITCS which performs train location for train control purpose.
The GPS data are collected and analysed for both accuracy
and safety integrity analysis. The safety integrity performance
evaluation method is proposed and the conclusion of the accuracy
and safety performance is determined. Finally the foregoing
required safety integrity level by the EN 50129 standard is
compared and analysed for further improvement of the receiver
selection and design.
I. INTRODUCTION
Train self perception and train localisation by means of
various sensors on the track side or train-borne side has been
978-1-5090-5275-2117/$31.00 ©20 17 IEEE
Baigen Cai
School of Computer and
Information Technology
State Key Lab of Rail
Traffic Control and Safety
Beijing Jiaotong University
Beijing, China 100044
Email: bgcai@bjtu.edu.cn
investigated by many researchers in order to improve the
localisation performance. The localisation function delivers the
train location as real time as possible for further services, as
safety-related services for example the train control system,
automatic train protection, fault identification and so on. The
locations are also used for non safety-related services as
passenger information.
The traditional train localisation approaches uses the track
circuit [1], axel counter[2], Euro-balises [3] and so on. These
above mentioned "sensors" are track side sensors or equip-
ments.A track circuit is a simple electrical device used to detect
the absence of a train on rail tracks, used to inform signallers
and control relevant signals. A track circuit typically has power
applied to each rail and a relay coil wired across them. So the
tracks need to be digged for splitting the whole track into
different sections. This makes the measurement accuracy of
the train locations into sections but continuously delivering
train locations. The Euro-balises delivers the pre-stored train
location when the train is passing by. Both sensors can only
deliver either section information or discrete train location.
The emerging techniques using Global Navigation Satel-
lite Systems (GNSS) and train-borne sensors to deliver train
locations both continuously and accurately is the trend of
the future train localisation function. Since GNSS can deliver
locations anywhere the signal is sufficient to calculate the user
position. It can also be applied in the railway applications for
the appropriate applications. In many research projects, GNSS
has been investigated a lot for the means of application and
how the performance will be [4][5][6]. These are using either
simulated data or collected data in different railway lines to
show the performance of GNSS alone or fusion results by other
sensors.
According to the railway application, especially the safety-
related applications, there are existing standards requesting
for the demonstration of reliability, availability, maintainability
and safety (RAMS) properties by EN 50126 [7]. The safety
performance is the key to be allowed in the railway safety-
related applications. For GNSS, when it is allowed for train
control purposes, the safety issues need to be quantitatively
demonstrated. According to this, there are currently several
methods trying to demonstrate the safety performance of the
locaisation unit properly by combining the different sensors.
But the GNSS alone performance also need to be investigated
in order to understand the gap between GNSS and the require-
ment.
II. GNSS ACCURACY ANALYSIS BAS ED ON DIGITAL
TRACK MAP
The GNSS performance for train localisation can be in-
terpreted from the requirement of the railway operation sce-
narios. According to U.S. Global Positioning Service (GPS)
standard [8], the GPS performance should be demonstrated
through accuracy, continuity, availability and integrity. All the
properties in this standard are analysed from the SPS SIS level.
The application of GPS is not regarded. In that the accuracy
analyses the accuracy from the following four aspects:
• the pseudorange data set accuracy (user range error,
URE)
• the time derivative of the URE (user range rate error,
URRE)
• the second time derivative URE (user range accelera-
tion error, URAE)
• the UTC offset error (UTCOE)
They are all analysed from the system level of the GNSS,
in order to apply GNSS into railway or other transportation
applications, the signal on the ground accuracy need to be
analysed. The standard published by the department of defence
proposed the requirements of the four performance properties
from the user side [9]. The accuracy is described as "the
accuracy of an estimated or measured position of a receiver
(handheld, vehicle, aircraft, or vessel) at a given time is the
degree of conformance of that position with the true position
of the receiver at that time". The accuracy performance of
the train localisation results using GNSS should be analysed
according to this definition.
Among the GNSS performance, the accuracy is the base-
ment for other performance properties. The continuity and
availability is not going to be analysed in this paper. Further the
safety showing another aspect of the system will be regarded
as the safety integrity monitoring techniques in this paper.
A. Accuracy Analysis Characteristics
Accuracy is the statistical measurement of the performance,
a statement of the PNT system accuracy is meaningless unless
it includes a statement of the uncertainty in position that
applies. The train is moving dynamically on the railway track
under the permitted velocity. The statistical measurement of
the train locations acquired by the receiver includes both static
and dynamic measurements, the measurements should be split
into both static and dynamic measurements.
Normally the PNT system location measurements have
errors, or deviation between the measured value and the
true value. The statistical measurement of the performance
derives a error distribution for each series of measurement. The
uncertainty in location measurement can be expressed as the
probability that the error will not exceed a certain threshold.
The error of the GNSS, according to GNSS SIS, is comprised
2
1)
2-
0...
Accuracy
?
u
.~
.~
I I I
Predictable
e
Repeatable
Relati ve
Accuracy Accuracy
U'"
..c (Trueness) (Precision)
Accuracy
r r r
.~ Mean Deviation Confidence Bias of the
§ of Measured Level Measuremet
0 Position (95%) System
Fig. 1. Measurement Accuracy in Attribute Hierarchy
by errors caused by instability of the transmitted signal , effects
of the weather, physical changes in the propagation medium,
errors in the receiver, and the errors made by the user. They
are categorised into random errors and system error. Further
applications of GNSS into railway converts the navigation
system measurements into one-dimensional along the track and
cross track errors.
When specifying linear accuracy, or when it is necessary
to specify requirements in terms of orthogonal axles, normally
the 95 % confidence interval is used. This paper also adopts
the general use of the 95 % confidence internal to represent
the measurement accuracy of the dynamic train locations.
And the specification of the measurement accuracy can be
answered as predictable accuracy, repeatable accuracy and
relative accuracy.
According to the definition expressions in DoD federal
radionavigation plan and the ISO 5725:1997 [10], the pre-
dictable accuracy is actually the measurement trueness, the
repeatable accuracy is actually the measurement precision, and
the relative accuracy is the reproducibility of the measurements
by different persons.
To make clear of the representation for the raised accuracy,
an attribute hierarchy structure is used as a summary of the
properties to be quantitatively analysed. The measurement
accuracy can be regarded as the concept to illustrate, using
a attribute hierarchy based on UML (unified modelling lan-
guage). The attribute hierarchy structure is interpreted from
top to down as -+ concept -+ property -+ characteristic -+
quantity -+ value & unit. This structure is developed by iVA
at Technische Univeritat Braunschweig [11]. The structure en-
ables clearly controlled definition of terms with exact relation
between each other, thus reduce ambiguity and complexity for
understanding a large number of terms possibly causing wide
range of understandings. The relation between the accuracy
description terms in this section can be shown as in Fig.
1. The measurement accuracy is regarded as the concept,
measurement trueness and measurement precision of the tests
are regarded as the property, under precision the repeatability
and reproducibility characteristics are represented together,
 l
{?
.if Measured Location
Easting
Fig. 2. Cross and Along Track Errors of the Measured Location
Fig. 3. A Short Clip of One Train Station Typology
both of them are represented as using standard deviation to
illustrate its value and unit.
Normally the measured location in railway is projected to
the corresponding track as the true location by the help of the
digital track map. This process is called map-matching. Then
the errors are divided into cross track error <SeT and along
track error <SAT . The decomposition of the error is shown in
Fig. 2.
B. Digital Track Map for Accuracy Analysis
Normally to evaluate the performance of the localisation
system, a reference system with higher measurement accuracy
level should be established [12]. The reference system needs
a lot of time to build and the accuracy or other performance
indicators should all be analysed before it is put in use as
the reference. So a more convenient and useful reference
is the digital track map. The digital track map is a pre-
surveyed track data, composed by the track line data, point
of interests (POI) including switches, signals etc. The making
of the digital track map starts from the CAD sketch of the
train station with the topological connections of the signalling,
turnouts, passenger platforms and also the switches. This kind
of map is primary for construction purpose for infrastructure
and electronic device installations. A short clip of one of the
train station is shown in Fig. 3.
In order to generate the map for performance evaluation,
the topological structure of the map should be converted
digitally with latitude and longitude information. The structure
is cut into the necessary map elements same as mentioned
POls and also track pieces. Then the each piece of the track is
surveyed one by one by high precision GNSS receivers. The
3
Fig. 4. Map Tool Editor for Surveyed GNSS Data
surveyed data are recorded and analysed in a map editor tool as
shown in Fig. 4. The collected data is processed for track line
inspection, abnormal point elimination, extra data reduction
and so on. The data are represented digitally in various way
by different models, for example the entity-relation model, the
top down model etc[13]. The data is normally stored in XML
format for easy fetching and data analysis.
After the digital track map is made, the validation of the
map should also be executed to get a safety proof for further
daily use and performance evaluation.
C. Accuracy Evaluation Method
The digital track map enables the evaluation of the GNSS
receiver performance not relying on external reference system
using pre-surveyed digital track map. So the GNSS receiver
delivers location at the measurement time t namely G t . The
map-matched location also at time t , namely M t . The distance
between the two points C'fJIJ t is the cross track error for the
measurement at time t. The traditional map matching is using
the nearest distance method to estimate the point projection
of the measurement. Take the nearest two point stored in the
digital track map as POli and POIH 1 . The estimation of the
M t by the known G t is estimated according to the following
equation:
~
GtMt . POliPOIH 1
)
= 0 (1)
Equation 1 shows the adjacent POls and the GNSS receiver
at the time t should meet orthogonally.
(2)
Equation 2 shows the projection of the GNSS receiver
measurement G t should be on the line of the corresponding
adjacent POls.
The two equatio~ether determines the projection of
G t , that is M t . The GtM can be regarded as the cross track
error.
Meanwhile, there are two GNSS receivers mounted on
the roof the locomotive, so there are two GNSS receiver
 Tolerable Hazard Rate Safety Integrity
THR per Level
hour and per function
10" ~ THR < 10~ 4
10~ ~ THR < 10" 3
10" ~ THR < 10~ 2
10~ ~ THR < 10~ 1
Fig. 5. SIL Table
measurements at the same time t , the mean along track error
can be calculated through two projections.
III. SAFETY INTEGRITY EVALUATION METHOD
In EN 50126, safety integrity is defined as "the likelihood
of a system satisfactorily performing the required safety func-
tions under all the sated conditions within a stated period of
time"[7]. This means the possibility of the safety function
to perform the required function. For the train localisation
function, the required safety function is to give alarm and
further safety reaction when the measurement accuracy is
lower than the required safety level.
A. Safety Integrity in Railway
The safety integrity as described before has been defined.
But the quantification of the safety integrity is described by
the safety integrity level (SIL). It means "One of a number of
defined discrete levels for specifying the safety functions to be
allocated to the safety related systems"[7]. In that the system
should meet the SIL requirements. This guides the system
design, so SIL is represented by tolerable hazard rate (THR).
The THR is used in the form of quantified safety targets for
each particular railway application.
Similar to measurement accuracy, the safety integrity com-
prises two parts:
• systematic failure integrity
• random failure integrity
It is the task to satisfy both systematic failure integrity and
random failure integrity requirements if the adequate safety
integrity is to be achieved. The systematic failure integrity is
normally non-quantifiable part of the whole safety integrity and
relates to hazardous systematic faults, may caused by human
errors. Normally systematic failure integrity is controlled by
quality management and safety management.
Random failure integrity is related to hazardous random
faults, normally the quantification of the random failure in-
tegrity shall be carried out by means of probabilistic calcula-
tions. These are based on known data for hardware component
failure rates and failure modes. The SIL table is applicable
to safety-related functions which consists of actually 5 levels
from 0 to 4. This can be shown in Fig. 5 [14]. This table is
used as a means of quantitative approach to control random
failures.
4
m m
:r- JL t ,
T,.l.Ul.L"N~N ~~=-
I
.A/\ .tVV ':1-
·
l\ ,/
/ ~
V\
·
WUDAOUAN TUOTUotiE Nf<QU
:1 GOli O
~5A
·
Fig. 6. The Qinghai-Tibet Railway Line with Altitude
B. Integrity of GNSS
The integrity of GNSS is different from the safety integrity
of railway. As defined in the U.S. Federal Radionavigation Plan
(FRP), from the transportation side, integrity is "the measure of
the trust that can be placed in the trueness of the information
supplied by a PNT system."[91. The integrity is estimated
quantitatively using the probability of hazardously misleading
information. The three characteristics are:
• probability of hazardously misleading information: the
probability that the SPS SIS's instantaneous URE
exceeds the not-to-exceed tolerance.
• time to alarm: Time from the onset of MSI until an
alarm indication arrives at the receiver's antenna.
• alarm limit: the maximum allowance for the applica-
tion is applicable
The alarm limit is the max (not - to - exceed tolerance).
The integrity risk is estimated according to the alarm limit. For
the train localisation function, the both along track and cross
track data need to be analysed to show the different safety
purposes.
IV. TEST ENVIRONMENT AND DATA COLLECTION
This paper uses in operation data recorded by the GNSS
receivers mounted on the roof of the locomotive running on the
Qinghai-Tibet railway line. The Qinghai-Tibet railway line is
1142 kilometres long between Golmud and Lhasa. The running
altitude is minimun 2828 metres, maximum 5072 meters. The
altitude information and tunnels can be shown in Fig. 6.
The whole structure of the differential-GPS is shown in Fig.
7 (Thi s figure belongs to Alstom). At each train station, there is
a so called "GPSRIM" having pre-surveyed accurate location.
The receiver mounted there also receives the GPS signal and
broadcast the information to the GNSS receiver installed on
the locomotive through WAN and GSM-R network. The GPS
receiver received data is basically differential-GPS data. The
following data shown in this paper are all differential-GPS
data.
A. Localisation Unit on ITCS
The in operation GNSS receiver installed on the roof of
the locomotive collects differential-GPS data in 1Hz. There are
two GPS receivers, two odometers together forming the voting
scheme at two layers and finally delivering the train location
 X 104 Digital Track Map Trajectory of Yangbajing Station
2

1000 2000 3000 4000 5000 6000 7000 8000 9000

UTM Easting (m)

Fig. 9. Digital Track Map Trajectory of Yangbajing Station (with offset)

Fig. 7. ITCS Differential-GPS Structure

Measurement oltha Two Receivers (clip)

o dlfferentlal-GPSrecelverl
o ditferenl ial-GPSreceiver2

'000

600

Fig. 8. The Train Location Determination Process

200

and train speed. This is shown in Fig. 8. In this paper, since 7200 '<00 7600 7800 8000 8200 '<00 8600 '000 9000

only the GPS safety integrity performance is analysed, so the UTM Easting(m)

odometer data is not included.

B. Data Collection and Scenario Selection
The differential-GPS receivers are sending data when the
whole system is powered on. The collected data is logged on
the On-board computer. After each operation (from Golmud to
Lhasa, or backwards), the logged data is downloaded for fur-
ther investigation. This enables the analysis of the differential-
GPS data.
The selected data is a run in the station boundary of
Yangbajing. This is a 18.2 km long station track including
train station and the outside sections between the adjacent
train stations. The time for going through the boundaries of
the station is 15 minutes.
V. DATA ANALYSIS
The data analysis consists of two parts, the accuracy
analysis and the safety integrity performance.
A. Accuracy of the Measurements
The digital track map as the foundation of the accuracy
performance evaluation, the digital track map of the main line
of the station is shown in Fig. 9. The track map is used later
in this paper for the analysis.
Fig. 10. Comparison of the Receiver Accuracy
The data used in this paper is the data logged by N h34
locomotive, the date is 12th of October in 2016. The two GNSS
receivers are collected. In the selection station environment,
there are 2 tunnels, one is approximately 3.4 km long, the
other is approximately 1.6 km long. The distance between the
two tunnels is about 650 meters. So there are several signal
loss and big deviation before entering and leaving the tunnels.
In this 18.2 km long track, only 471 acceptable mea-
surements are collected for differential-GPS receiver 1, 701
acceptable measurements are collected for differential-GPS
receiver 2. After a comparison of the measurement at the same
time, the accuracy is analysed.
The mean cross track projection of the differential-GPS
receiver 1 is 0.27 m, the standard deviation is 0.17 m. And the
mean cross track projection of the differential-GPS receiver 2
is 0.22 m, the standard deviation is 0.23m. This showed the
cross track project of the both receivers are quite precise and
capable of delivering track selection in good signal reception
environments.

5
B. Safety Integrity of the Measurements [9] United States Department of Defense and United States Department of
Transportation, "2014 federal radionavigation plan: Dot-vntsc-ost-r-15-
The safety integrity of the measurements is basically the 01," 2014.
along track deviation, the uncertainty of the along track devi- [10] International Organization for Standardization, "Iso 5725-\: Accuracy
ation enables the estimation of the safety margin of the train. (trueness and precision) of measurement methods and results - part \:
The mean distance between the two map-matched locations General principles and definitions," 1997.
on the track is 1.91 m, the standard deviation for the measure- [II] L. Schnieder, "Formalisierte terminologien technischer systeme und
ihrer zuverlassigkeit," Dissertation, Technische Universitat Braun-
ments is 0.60 m. According to the estimation, using 20" as the schweig, Braunschweig, 2010.
threshold, among the 471 measurements of both differential-
[12] A. Resch, R. Pfeil, M. Wegener, and A. Stelzer, "Review of the
GPS receiver, the amount of data still cannot determine the Ipm local positioning measurement system;' in 2012 International
hazardous rate of the measurements along the track. Conference on Localization and eNSS (ICL-eNSS) , Starnberg, 2012.
[13] F. Bohringer and A. Geistler, "Location in railway traffic: Generation
of a digital map for secure applications;' in Computers in Railways X,
VI. CONCLUSION J. Allan, C. A. Brebbia, A. F. Rumsey, G. Sciutto, S. Sone, and C. J.
Goodman , Eds. Southampton , UK: WIT Press, 2006, pp. 459-468.
This paper shows a case study of the collected differential-
[14] Deutsche Institut fiir Normung, "En 50129 railway applications -
GPS data in the Yangbajing station boundary. One operation communications, signalling and processing systems - safety related
run was analysed for both accuracy and safety integrity anal- electronic systems for signalling."
ysis. The analysis results showed the cross track measurement
of differential-GPS is capable of track selection in good signal
reception conditions. The along track difference between two
GNSS receiver measurements is much lager comparing to cross
track error. The along track difference can be used as the
foundation for safety margin estimation.
More operation data should be collected, processed and
analysed to show the conclusion in larger scale. The signal
constrained environments also need to be studied to com-
pare the performance in different scenarios thus showing
the differential-GPS performance in various operation and
environment scenarios.

ACKNOWLEDGMENT

This research was supported by the International Science &

Technology Cooperation Program of China (2014DFA80260),
National Natural Science Foundation of China (61603027,
UI334211), Technological Research and Development Pro-
gram of China Railway Corporation (2015XOlO-B, 2016X001-
A) and the Fundamental Research Funds for the Central
Universities (WI5RC00090).

REFERENCES

[II Railway Group Standards, "General information on track circuits:

Gklrc0752," London, 1998.
[2] Railway Group Standards , "Axel counters: Code of practice for
resetting and restoration to services: Gkirt0027," London, 1998.
[3] UNISIG , "Unisig ertms/etcs - class \: Fit functional interface specifi-
cation (fffis) for eurobalise: Subset-036," 27.09.2007.
[4] J. Beugin and J. Marais, "Simulation-based evaluation of dependability
and safety properties of satellite technologies for railway localization,"
Transportation Research Part C: Emerging Technologies , vol. 22, pp.
42- 57, 2012.
[5] D. Lu, "Gnss for train localisation performance evaluation and ver-
ification," Dissertation, Technische Universitat Braunschweig, Braun-
schweig, 2014.
[6] A. Filip and F. Rispoli, "Safety concept of gnss based train location
determination system sil 4 compliant for ertms/etcs," in ENC eNSS,
Rotterdam, 2014.
[7] European Committee for Electrotechnical Standardization , "Cenelec
en 50126: Railway applications - the specification and demonstration
of reliability, availability, maintainability and safety (rams)," Brussels,
2007.
[8] United States Department of Defense, "Global positioning system
standard positioning service performance standard," Washington, 2008.