High-integrity autonomous train location system in a rail network reference frame

Abstract

Disclosed is a high-integrity autonomous system for locating a train in a railway network reference system, comprising: - a high-integrity geographical locating device (1); - a high-integrity map database (2) of the railway network; and - a device (3) for tracking the train.

Description

[0001] The present invention relates to an integrated and autonomous system for locating a train in a railway network reference system.

[0002] Train tracking systems on a rail network are known to use dedicated ground infrastructure, which guarantees the integrity of the tracking, i.e. the risk that the train is not on the indicated section is lower than an acceptable limit. This limit is linked to the risk of a serious event, such as a collision or derailment, and to the capacity of the rail traffic control system. These devices have a very high cost.

[0003] Non-autonomous solutions require ground infrastructure that has high maintenance costs. The cost of ETCS L2 track signaling is approximately €200,000 per km of track, so its deployment is limited to high-traffic lines. This solution has a much lower cost depending on the level of integrity envisaged, which allows secondary network lines to be rehabilitated at lower cost.

[0004] There are also integrated and autonomous geographic location devices. Geographic location means the location of a mobile in a reference frame linked to the Earth, such as longitude, latitude, and altitude; integrated means the association with the location of an integrity protection interval or error ellipsoid and an alarm signal (the risk that the indicated position is outside the ellipsoid, without an alarm being raised, is smaller than an acceptable limit); and autonomous means the non-use of dedicated infrastructures.

[0005] A device based on a GNSS receiver and an inertial measurement unit (IMU) is an example of this type of integrated and autonomous geographic location device. For example, European patent EP 3018447B1.

[0006] For this type of device, the service provided does not locate the train with a guarantee of integrity: as soon as the error ellipsoid is larger than half the distance between the railway tracks, the train can no longer be located reliably on the railway network.

[0007] Document US 2003 / 216865 A1 discloses an integrated and autonomous localization system for a train in a railway network reference system comprising: a geographical localization device integrated in a global geographical reference system comprising an inertial unit, a GNSS receiver, and a module for hybridizing the measurements provided by the inertial unit and the GNSS receiver configured to provide the three position coordinates, the three speed components, and the heading angle of the train in the global geographical reference system as well as their respective integrity protection intervals with respect to feared events that may affect the integrated geographical localization device; an integrated cartographic database of the railway network configured to provide data geographically representing the railway network in the form of segments,and a train tracking device configured to autonomously determine a railway network segment identifier on which the train is located, an integrated position of the train on this segment in the railway network reference system, and the protection interval associated with the position of the train on the segment from data provided by the integrated cartographic database and positions, speeds, headings and integrity protections provided by the integrated geographic location device, by resolving ambiguities of candidate segments, the tracking device being configured to eliminate candidate segments not contained at least in part in the protection intervals provided by the integrated geographic location device and retroactively provide, during the movement of the train, to the integrated geographic location device information representative of the environment of the railway.,

[0008] One aim of the invention is to overcome the problems mentioned above.

[0009] According to the invention, there is provided an integrated and autonomous localization system with the characteristics of claim 1.

[0010] Such a system provides the integrated location service in the reference frame of interest, and not in the initial geographical reference frame. It thus makes it possible to use low-cost devices based on UMI and GNSS, which provide an integrity service in a geographical reference frame, and to have excellent system availability regardless of climatic conditions.

[0011] Thus, if the geographic location device uses one or more sensors whose measurements are likely to be corrupted by the railway environment, feedback can reduce this risk. For example, for a GNSS type sensor, measurements from satellites for which the geometric configuration of objects near the track presents a risk of alteration can be ignored a priori, so as not to compromise the integrity of the geographic location device.

[0012] According to the invention, the tracking device is configured to retroactively provide, to the integrated geographic location device, integrated measurements of lateral deviation and heading deviation of the train relative to the railway track of the railway network, the hybridization module being configured to take said measurements into account.

[0013] Thus, the geographic location device can benefit from additional measures, which are likely to improve its performance, without compromising its integrity.

[0014] According to the invention, the tracking device is configured to: eliminate candidate segments not contained at least in part within the protection intervals provided by the integrated geographic location device, compare the heading angle provided by the integrated geographic location device and the heading angle of the segments in the database compatible with the chaining of the railway network, and select segments compatible with the heading angle protection interval provided by the integrated geographic location device, and whose next segment or previous segment depending on the direction of travel has already been a candidate segment.

[0015] Thus, the device is able to safely reduce the number of candidate segments, until it discriminates the only true segment on which the train is located.

[0016] A candidate segment is a segment that has already been selected by the tracking device using one of the methods mentioned above. The set of candidate segments is stored from one calculation cycle to the next to determine the candidate segments for the next calculation cycle, which depend on the candidate segments from the previous calculation cycle and on the new data provided by the integrated geographic location device, as detailed later.

[0017] According to one embodiment, the tracking device is configured to perform a correlation along the curvilinear abscissa between the successive heading angles provided by the integrated geographic location device and the successive headings taken by each of the candidate segments, so as to select a single segment.

[0018] Thus, the tracking device is able to discriminate the true segment from other candidate segments when they follow different heading trajectories.

[0019] In one embodiment, the tracking device is configured to determine an integrated speed and direction of travel of the train, by projection onto the direction of the current segment of the speed and its protection interval, provided by the integrated location device.

[0020] Thus, the tracking device provides additional information, in addition to positioning information. Reliable speed and direction of travel information is essential for train control and traffic management.

[0021] According to one embodiment, said data representing the railway network in the form of segments comprise for each segment the position coordinates and the heading angle of the initial point of the segment in the global geographic reference system, the length of the segment, the value of a parameter representative of the curvature and its variation, and the value of chaining parameters of the segment with other segments, and the values ​​of the limits of the position error and the heading error of this segment.

[0022] Thus, a small number of parameters makes it possible to represent a significant length of the railway network. The chosen representation makes it possible, in particular, to calculate with precision the geographical position coordinates and the heading angle of any point belonging to the segment, from its curvilinear abscissa.

[0023] According to one embodiment, the tracking device comprises, to perform the resolution of ambiguities of the candidate segments: a module configured to perform a distance-based instantaneous resolution function; and / or a module configured to perform a heading-based instantaneous resolution function; and / or a module configured to perform a turnout resolution function.

[0024] This way, we take advantage of all the geometric characteristics of the railway to find our way.

[0025] In one embodiment, the system further comprises: an additional integrated geographic location device in a global geographic reference system, different from the integrated geographic location device, configured to provide the position, speed, and heading of the train as well as their respective integrity protections; an additional integrated cartographic database of the railway network, identical or similar to the integrated cartographic database of the railway network, configured to provide data representing the railway network in the form of segments;an additional train tracking device, identical or similar to the train tracking device, configured to determine an integrated and autonomous position of the train in the railway network reference system and a corresponding railway network segment identifier, from data provided by said additional integrated cartographic database and the respective positions, speeds, headings and integrity protections provided by the additional integrated geographic location device, by resolving candidate segment ambiguities;and a module for consolidating the integrity protections provided by the train tracking device and the additional train tracking device providing a consolidated segment identifier and a consolidated position on the segment, as well as the consolidated protection interval, so that the risk of non-integrity of the consolidated outputs is much smaller than the risk of non-integrity of the outputs of the two devices taken separately, the consolidated position being calculated by the weighted barycenter of the position of the main device and the additional device, and the protection interval being calculated by the combination of the protection intervals of the main device and the secondary device. ;

[0026] Identical or similar means something that is supposed to be identical but is made by two different entities, such as a database that is supposed to be identical but may be made by two different entities and contain some unfortunate differences.

[0027] The invention will be better understood by studying a few embodiments described as non-limiting examples and illustrated by the appended drawings in which: there figure 1 schematically illustrates an embodiment of an integrated and autonomous system for locating a train in a railway network reference system, according to one aspect of the invention; the figures 2 à 4 schematically illustrate how the geographic uncertainty ellipse results in the existence of several candidate segments, according to one aspect of the invention; figures 5 à 10 schematically illustrate the rules taken into account by the tracking device, according to one aspect of the invention; the figure 11 schematically illustrates an embodiment of a tracking device, according to one aspect of the invention; the figures 12 à 20 schematically illustrate the operation of the tracking device, according to one aspect of the invention; the figure 21 schematically illustrates an embodiment of an integrated and autonomous system for locating a train in a railway network reference system, according to one aspect of the invention.

[0028] Throughout the figures, elements with identical references are similar.

[0029] In the present description, the embodiments described are in no way limiting, and the characteristics and functions well known to those skilled in the art are not described in detail.

[0030] There figure 1 represents an integrated and autonomous localization system for a train in a railway network reference system comprising: a geographic location device 1 integrated into a global geographic reference system configured to provide the position, speed, and heading of the train as well as their respective integrity protections against feared events that may affect the integrated geographic location device; an integrated cartographic database 2 of the railway network configured to provide data geographically representing the railway network in the form of segments;and a train tracking device 3 configured to autonomously determine a railway network segment identifier on which the train is located, an integrated position of the train on this segment in the railway network reference system, and the protection interval associated with the position of the train on the segment from data provided by the integrated cartographic database 2 and positions, speeds, headings and integrity protections provided by the integrated geographic location device 1, by resolving ambiguities of segments of the railway network.;

[0031] From an integrated geographical location 1 (geographic position, geographical speed, geographical heading), the system carries out tracking 3 which uses a database 2 (describing the rail network) and which aims to provide the user with the identifier of the current segment with guaranteed integrity.

[0032] The tracking device 3 may further provide measurements of lateral deviation and heading deviation of the train relative to the railway to the geographical location device 1, to improve its performance. These deviation measurements are integral, which is essential, because otherwise these measurements could corrupt the geographical location device 1.

[0033] The tracking device 3 may also provide information enabling the geographic location device 1 to maintain the integrity of its measurements, taking into account the environment of the railway. In this operating mode, the cartographic database 2 includes descriptive elements of the environment of the railway when this is likely to corrupt the measurements of the integrated location system.

[0034] The system also provides the abscissa on the segment, the speed of the train on the segment, and the direction of travel, in an integrated manner and independently of the tachometric system based on the observation of the movement of the wheels.

[0035] So, we start from an integrated location, as illustrated in the figure 2 , and thanks to database 2 we move on to a protection uncertainty represented by the short broken lines of the figure 3 .

[0036] Thanks to the tracking device 3, we move to a position uncertainty represented by the short broken lines of the figure 4 .

[0037] The present invention applies to the railway field, and generally to all positions and speeds of rail vehicles, such as trains, trams, and other construction site vehicles on rails.

[0038] The integrated geographic location device 1 may comprise a GNSS receiver coupled to an inertial measurement unit UMI by an integrated hybridization for example described in the Thales patent EP 3018447.

[0039] The railway network database 2 describes the network in the form of segments, and defines the characteristics of each segment by geometric characteristics (such as the coordinates of the start of the segment, the length of the segment and the value of the clothoid or spline parameters) and the chaining characteristics in the network (for example: identifier of successor and predecessor segments). In one mode of use, the database 2 may also contain descriptive elements of the environment in the vicinity of the position considered.

[0040] The tracking device 3 receives as input the location information provided by the integrated geographic location device (geographic position, geographic speed, geographic heading, protection radii at 10 -x< / h and associated alarms) and uses the database to identify the current segment so that the probability that the train is not on the indicated segment, without an alarm being raised, is less than 10 -x< / h.

[0041] The integrated geographic location device 1 produces the following information: the geographic position (longitude, latitude, altitude); the parameters of the ellipsoid protecting the position at 10 -x< / h (North, East, Vertical, North / East, North / Vertical, East / Vertical components); the geographic heading angle; Interval protecting the heading at 10-x / h; the geographic speed (North speed, East speed, Vertical speed); the parameters of the ellipsoid protecting the speed at 10 -x< / h; and the alarm signal (indicating that integrity is no longer assured).

[0042] The geographic location device 1 is integral in the sense that the probability (taking into account normal, rare and abnormal events that may affect this data source) that the measurements produced by the location are outside the protection domain announced by the geographic location device 1, without an alarm being raised, is lower than the specified risk (for example 10 -6 < / h).

[0043] Thales patent EP3018447 describes an example of IMU / GNSS hybridization providing all this information.

[0044] Typically, an IMU / GNSS hybridization usually produces position, velocity, and heading angle, but also roll and pitch angles. In the present invention, heading plays an important role in routing resolution, but roll and pitch angles do not.

[0045] Note that, as the train moves on locally flat terrain, the protection volume or interval is reduced locally to the intersection of the ellipsoid with this plane (which is an ellipse).

[0046] Map database 2 satisfies the following integrity conditions: for each segment of the railway network described in the database, the chaining information is not erroneous (identifier of the segment and of the contiguous segments); and for each segment described in the database, the positioning information allows the tracking device 3 to calculate the geographic position and the geographic heading of any point of the segment with an error smaller than the error limits indicated in the description of the segment.

[0047] More rigorously, these conditions are held with a given risk: for example, if the risk of non-integrity of the database is 10 -6 < / h, and the average number of segments visited by the train is 100 segments / hour, then an error rate of 10 -8 < / segment is tolerated.

[0048] On the figure 5 , the segments correspond to the portions between the crosses.

[0049] The branches correspond to the different possible choices in the network route, here three branches (of different routes) are represented, implementing two junctions (framed cross).

[0050] A junction is a zero-length segment that has one entrance and two possible exits. The junction exists in only one direction: if the train is traveling in the other direction, the junction does not create an alternative.

[0051] In one embodiment, the database 2 further contains descriptive elements of the environment, when the latter is likely to corrupt the integrity of the integrated geographic location device 1. For example, if one of the sensors used by the integrated geographic device 1 is a GNSS receiver, it may be corrupted by the contribution of the environment close to the position occupied by the train, in particular in an area presenting a risk of GNSS paths reflected on surrounding buildings or an area presenting a risk of radiofrequency interference (radiofrequency pollution near a telecommunications retransmitter, or a specific industrial site).The descriptive elements of an area at risk of reflected paths may, for example, provide the distance and height of buildings relative to the considered point on the railway, which allows the integrated geographical location device 1 to select only the GNSS satellites whose orientation of the visual axes does not present a risk, or to modify the weighting given to the different axes in the calculation of the integrated position, so as to guarantee that the protection ellipsoid is not underestimated when the train is in the vicinity of the risk area. The descriptive elements of an area at risk of interference may be limited to the single indication "do not use", so that the integrated geographical location source does not use the GNSS measurements in the vicinity of this area.

[0052] Tracking device 3 implements rules that reflect the constraint of the rails, and ambiguity resolution methods that make it possible to reduce the number of possible segments among all the segments of the rail network.

[0053] The main rules taken into account by the tracking device are as follows: R1: The train cannot leave the uncertainty zone provided by the integrated input location. On the figure 6 , only short dashed lines are possible for the true position with the given error risk. R2: The train cannot jump from a current segment to a non-adjacent segment without passing through a junction. This allows to take advantage of the past situation: for example, as illustrated in the figure 7 , the train was previously on segment 2, so it cannot now be on segment 1 even if the uncertainty of the input geographic position allows it to be there. R3: The train cannot return to a previous segment if its direction of travel has not changed. For example, on the figure 8 , if the position uncertainty increases following a loss of GNSS signal, as illustrated in the figure 9 , the fact that the train passed over the track above now becomes plausible unless we know that the direction of travel has not changed. The change of direction is monitored from the speed provided by the location source with a given risk. R4: The train cannot change branches (set of successive segments) without undergoing a variation of heading. If the new branch is parallel to the previous one, the variation of heading is momentary (it corresponds to passing over the switch). If the new branch is not parallel, the change of heading persists. These events are monitored using the heading angle provided by the location source with a given risk.

[0054] The main ambiguity resolution methods implemented in Tracking Device 3 are: Distance-based instantaneous resolution: Segments (described in database 2) whose positions are outside the integrity ellipse provided by the integrated geographic location device 1 are discarded. The uncertainty of the integrated map database 2 is also taken into account in this decision. Heading-based instantaneous resolution: Candidate segments whose heading interval does not intersect with the heading interval provided by the integrated geographic location device 1 are discarded. The uncertainty of the integrated map database 2 is also taken into account in this decision. Turnout resolution: When the current position and its uncertainty indicate the proximity of a turnout, the Turnout resolution function is activated.It analyzes the successive heading measurements provided by the integrated geographic location device 1 and evaluates the correlation of these measurements with the geometric heading values, along the two candidate trajectories, extracted from the integrated cartographic database 2. The length of the displacement, on which this analysis is carried out, and the decision thresholds are calculated taking into account the position and heading uncertainties produced by the integrated geographic location device 1 as well as the uncertainties of the integrated cartographic database 2, so that the probability of a bad decision is bounded. When the switch is divergent (i.e. non-parallel tracks at the switch exit), the resolution function also analyzes the position deviation from the two candidate trajectories.

[0055] The tracking device 3 has several functions: first-level tracking: the inputs to this function are the position, heading, and associated protections (position-protecting ellipsoid, heading protection interval, alarm), provided by the integrated geographic location device 1, as well as the segment description from the integrated database 2. First-level tracking identifies the temporal sequence of segments, and implements the routing resolution (see above) whenever necessary. First-level tracking is activated at a sufficiently high frequency (typically 10 Hz) to be able to follow the sequence of segments. The output of first-level tracking is the list of candidate segments, and the position on each candidate segment. In "normal" mode, this list contains a single segment. Depending on the level of uncertainty of the inputs, first-level tracking is not always able to identify the current segment: in this case, the list contains several candidates.Second-level tracking: The inputs to this function are the candidate list provided by the first-level tracking, the position, speed, heading and associated protections provided by the integrated geographic location device 1, as well as the description of the segments of the integrated database 2. This function is activated at a lower rate (typically 1 Hz) because the computational volume can be significant. This function analyzes the candidate list identified by the first-level tracking and compares it with the list constructed from the outputs (position and associated protection) produced by the integrated geographic location device 1, in order to detect complex cases (see the figure illustrating the outgoing switch followed by an incoming switch).False candidate elimination implements instantaneous resolutions based on distance and heading, as well as speed measurement that allows to detect changes of direction. The implemented treatments use the protection information (on the position, on the heading, on the speed, on the content of the database) so that the probability of bad decision is bounded. In case of cold start, all segments of the database integrate 2 are candidates. production of outputs and associated indicators: this function calculates the operational outputs (segment identifier, abscissa on the segment, abscissa protection interval, direction of movement, speed on the segment, speed protection interval, alarm, operating mode).production of deviation measurements: when the operating mode indicates "nominal", only one segment is a candidate, the position on the segment is known with the associated protection interval, and the geographic heading is known with the associated protection interval. We can then calculate the lateral deviation between the position produced by the integrated geographic device 1 and the track, as well as the deviation between the heading produced by the integrated geographic device 1 and that of the track, as well as the associated uncertainty intervals. production of descriptive elements of the railway environment: if the integrated database 2 also contains a description of the environmental elements likely to corrupt the integrity of the integrated geographic device 1, the tracking device 3 can provide this information to the integrated geographic device 1 when the tracking device 3 is in "nominal" operating mode.Indeed, in this case, the knowledge of the segment and the position on the segment, as well as its associated protection interval, makes it possible to identify in the integrated database 2 the descriptive elements associated with the zone centered on the estimated position and of length equal to twice the protection interval. When the operation is not "nominal" (several segments are possible), these descriptive elements are also provided, but considering the worst contribution offered by the candidate segments in the database.

[0056] There figure 10 illustrates an example of a complex situation, in which the possible reversal of the train's direction of travel must be taken into account in the tracking system.

[0057] There figure 11 represents tracking device 3.

[0058] Tracking 3 is divided into two parts: a first-level tracking part 3a and a second-level tracking part 3b. The choice to carry out this tracking 3 in two parts is mainly due to the fact that second-level tracking 3b is computationally intensive and must be carried out at a lower frequency.

[0059] The purpose of Level 3a tracking is to: determining the curvilinear abscissa associated with all candidate segments based on the current position from the integrated geographic location and previous curvilinear abscissas, updating all candidate segments each time a junction is encountered using the database and updating the tracking mode (see below), resolving switches under certain conditions (see below), developing the deviations between the position and heading, produced by the geographic location module, and the position and heading calculated from the database, and providing them to the integrated geographic location when only one segment is a candidate, and providing a set of candidate segments and curvilinear abscissas associated with second-level tracking 3b.

[0060] The purpose of Level 3b tracking is to: determining the set of possible segments using: ∘ the uncertainty associated with the integrated geographic location position, and ∘ the set of possible segments provided by the online tracking, using the different geographic location parameters and their associated uncertainties to reduce the set of potential candidates to resolve potential junctions, providing the integrated geographic location with a geographic position measurement calculated from the database, if the position produced by the tracking device turns out to have a better uncertainty than that produced by the integrated location module.This is an additional functionality, which offers the possibility of occasional recalibration of the geographic location device, which makes it possible to improve its performance, and consequently to improve the future availability of the tracking device, providing the end user with: o all possible segments and the associated minimum and maximum curvilinear abscissas, ∘ the estimated position, ∘ the curvilinear abscissa(s) estimated according to the tracking mode.

[0061] There are three modes of tracking: a nominal mode in which all junctions have been resolved and the tracking is capable of providing: ∘ a single estimated segment and an associated curvilinear abscissa, ∘ an uncertainty translated by the minimum and maximum curvilinear abscissas on this segment, or by a set of several segments with their minimum and maximum curvilinear abscissas if the uncertainty extends over several contiguous segments. a "degraded" mode and an "init" mode in which the tracking is capable of providing: ∘ several estimated segments and several associated curvilinear abscissas, ∘ an uncertainty translated by a set of segments with their minimum and maximum curvilinear abscissas.

[0062] The "init" mode is activated when there is no information on possible candidate segments before searching for candidate segments in second-level tracking 3b.

[0063] The "init" mode is also activated if the internal geolocation device activates its integrity alarm signal.

[0064] First level 3a tracking starts from "init" mode and is initialized either: from an external aid, providing a segment, an associated curvilinear abscissa and the uncertainty associated with this abscissa (init), from the provision of a segment, an abscissa and an associated uncertainty from the search function for candidate segments. There are different types of segment resolutions as explained below: the resolution used here is the resolution in "init" mode.

[0065] When exiting "init" mode, we have a segment, a curvilinear abscissa and an associated uncertainty. We then enter nominal mode.

[0066] The inputs are then the current position P provided by the geographic location solution (position, heading, speed, uncertainties) and the previous segment (or segments), which is provided either by the "init" mode or by the list of candidate segments from the first-level tracking of the previous cycle (these segments being provided with their curvilinear abscissas), to which the segments identified by the second-level tracking 3b have been added or removed. From these inputs, the set of possible segments and the curvilinear abscissas associated with the current time are recalculated as follows.

[0067] Let P be the current position and let id be a candidate segment from the previous iteration. Let s be the curvilinear abscissa associated with the estimated point P1 of the candidate segment. At P1, we calculate the direction vector of the tangent to the segment. We project the vector P1P onto the direction vector calculated above. The value of the scalar product gives an approximation of the curvilinear abscissa deviation (Δs) between point P1 and point P projected onto the track. We update the value of s with s = s + Δs ​​to recalculate a new point P1. We iterate until the scalar product has become small to obtain a new estimated position on the track P2. On the figure 12 , the rail is represented by short broken lines, P1 the estimated position on the segment at the previous instant, P the current position sent by the integrated geographic location and P2 the position after iteration.

[0068] If position P2 has a curvilinear abscissa greater than the declared length of segment id, we search the integr2 database for the next segment. If the next segment is not a junction, we move on to the new segment with a new curvilinear abscissa. If the next segment is a junction, we create a new possible candidate and as output we have two possible segments with two curvilinear abscissas.

[0069] Switch resolution in line tracking 3a is only achieved if: we are in degraded mode (in nominal mode, there is nothing to resolve and in "init" mode it is the second level tracking 3b which does the work), and if the position and its uncertainty are entirely contained in the candidate segments. Indeed, otherwise, we could arrive at erroneous conclusions: as in the example which follows illustrated by the figures 13 et 14 .

[0070] On the example of figures 13 et 14 , segments S20 and S50 are the candidate segments. In the first configuration of the figure 13 , the switch resolution is enabled. In the second configuration of the figure 14 the switch resolution is disabled because the uncertainty overflows onto segment S51. In the second configuration, we risk choosing segment 20 because the true position heading is consistent with segment 20 and the two candidate segments are segments 20 and 50.

[0071] Switch resolution can be done in three ways: by instantaneous comparison of the heading between the heading of the geographic location solution and the heading of the candidate segments at the estimated curvilinear abscissa, by checking whether a single segment is contained in the confidence ellipse, and by correlation between the successive headings from the integrated geographic location module and the successive headings taken by each of the candidate segments over a given length, this makes it possible to eliminate the heading error linked to the position uncertainty.

[0072] At the end of the switching resolution, we have available a set of candidate segments and their associated curvilinear abscissas which can be transmitted to the second level tracking.

[0073] In nominal mode, when the estimated position and uncertainty are contained within the candidate segment, tracking measurements can be calculated. These are the lateral deviation from the track and the estimated heading at the estimated curvilinear abscissa. This information is sent to the integrated geographic location device with its associated uncertainties. The uncertainty depends on the accuracy of the database and the uncertainty on the curvilinear abscissa.

[0074] The lateral deviation from the track is calculated as the scalar product between the direction vector perpendicular to the track at the estimated curvilinear abscissa and the vector P2P where P2 is the estimated position on the track and P is the estimated position sent by the geographic location device.

[0075] Below is the detail of the resolution of the candidate segments.

[0076] The "init" mode resolution does not make any assumptions about which segments may be candidates.

[0077] We start from a position estimate and its confidence ellipse from the integrated localization: cross and ellipse in solid lines on the figure 15 in the diagram below. For all segments in the 2-integrated database (all segments are potential candidates), we look for those that are included in the ellipse.

[0078] To check whether a segment belongs to an ellipse, we start by sampling the segment. The sampling distance must be a fraction of the minimum length between the position uncertainty and the segment length. Then, for each point, we check whether it is contained in the ellipse: the points contained in an ellipse with major axis a and minor axis b satisfy the equation: u 2

[0079] If only one segment branch (and not just one segment) is a candidate, we have found a segment to provide either to the list of segments of the first-level tracking, or to the initialization of the first-level tracking: transition [A]. We also order a switch to nominal mode. The candidate segment to provide is the closest to the estimated position. The curvilinear abscissa associated with the candidate segment will be the abscissa associated with the point of the segment that is closest to the estimated position. For reasons of simplicity, the uncertainty is that of the estimated position initially provided, even if we see that we could do better by geometric considerations.

[0080] At the end of this search, we are able to extract a set of candidate segments as well as the minimum and maximum abscissa per segment of the points contained in the ellipse which we call smin, smax. (we are indeed looking for a single branch of segments and not a segment since the estimate could be at the intersection between two segments).

[0081] On the example of the figure 16 : S2, S3, and S4 are candidates and belong to the same branch. So we can switch to nominal mode. The segment provided for online tracking is segment 2.

[0082] This search allows you to manage rule R1.

[0083] The second type of resolution, in nominal and degraded mode, is a resolution on a limited number of segments from the list of segments from the first-level tracking. This is the most complex part of the algorithm.

[0084] The search starts from the different segments provided by the first-level tracking. For each segment from the first-level tracking (only one in nominal mode and several in degraded mode), all of its possible preceding and following segments are searched. The set of possible following and preceding segments belongs to the confidence ellipse provided by the integrated location device 1.

[0085] The confidence ellipse has a larger axis whose value for the required integrity (10-n / h) is denoted R. This value is deduced from the information sent by the integrated geographic location by diagonalizing the position covariance matrix. For each segment id, of abscissa s and length L, provided by the first-level tracking, all the preceding and following segments of segment id, which are located within a length R (in terms of curvilinear integral) of the abscissa s of segment id, are considered included in the confidence ellipse. This is an approximation that will be completed using another method described later.

[0086] The search for the following segments is done as follows. For each segment id provided by the first-level tracking: If s+R>L (in other words, if the part of the segment starting from the abscissa s and arriving at the end of the segment id belongs to the confidence ellipse), then all the segments that directly succeed id are searched in the database. The value of R is then updated for the next segments R = R-(Ls), For each immediate successor of id denoted id1 of length denoted L1, the same procedure is applied. If R-L1>0, then the immediate successors of id1 are searched in the database and the value of R is further reduced R = R - L1, The previous operation starts again until R is zero.

[0087] At the end of the procedure, a list of successor segments is available and for each successor segment, a minimum abscissa and a maximum abscissa are associated.

[0088] The same operation is performed in the other direction for the predecessor segments.

[0089] In fact, a segment of length greater than R can be contained in the confidence ellipse since the segments are not straight lines. The segments and abscissas found in the previous method are completed by searching for segments whose at least one point is contained in the ellipse using the method presented in the "init" mode. Only the following and preceding segments of each segment provided by the first-level tracking are retained. The following and preceding segments are obtained by browsing the database starting from each segment provided by the online tracking.

[0090] The implementation of the two methods described above is more rigorous with respect to the integrity data provided by the integrated geographic location device 1 than the use simply based on the search for segments in the ellipsoid, since the uncertainty is taken into account depending on the direction of the track.

[0091] This search for successor and predecessor segments allows us to manage the fact that we cannot jump from one segment to another without going through a junction: rule R2. Indeed, a segment included in the ellipse, which is neither the successor nor the predecessor of a candidate segment resulting from the search detailed above, is not a candidate.

[0092] The direction of travel is then determined. The speed is obtained by projecting the geographic speed vector, produced by the geographic location device, onto the direction of the tangent to the segment. The speed protection interval is the interval delimited by the intersection of the speed protection ellipse, produced by the geographic location device, with the segment. The direction of travel is reliably identified when the speed modulus is greater than the half speed protection interval.

[0093] If the direction of travel does not change, segments that are predecessor segments of a successor segment, or segments that are successor segments of a predecessor segment, cannot be candidates. Otherwise, this would mean that the train has changed direction (see example below): this is rule R3. For this reason, these segments are not searched for in the method described above.

[0094] If the direction of advancement changes or if the direction of advancement is unknown (rule R3 no longer applies), for each successor segment obtained in the previous part, we look, for each successor segment obtained by the processing described previously, if its preceding segment is declared as a junction in the integrated database 2. If this is the case, all the segments preceding this junction must be added to the list of candidates for the first level tracking (transition [B]).

[0095] For each predecessor segment obtained by the processing described above, we look in the same way to see if its next segment is a junction. If this is the case, all segments following this segment must be added to the list of candidates for first-level tracking (transition [B]).

[0096] If there are too many junctions to resolve, we return to "init" mode because the segments sent by the first level tracking (segments representing past information) are no longer of interest.

[0097] On the example of the figure 17 we move from left to right (known direction of advancement), the mode is "nominal" and the first level tracking gives the segment S18. In short broken lines we represent the candidate segments. Segments S60 and S61 cannot be candidates because a change of direction would be required (rule 3). Segments S80 and S81 cannot be candidates because they must pass through a junction (rule 2). The application of the method cited above makes it possible to determine all the candidate segments while respecting rules R1, R2 and R3.

[0098] On the figure 18 , the direction of advancement becomes impossible to determine, the mode is "nominal", and the online tracking gives the segment S18 as input.

[0099] In this case, segments S60 and S61 become candidates, and segment S61 is added to the candidate list of the first-level tracking list. Let's imagine that the actual position is represented by the yellow star and that the train leaves in the other direction via S61. If S61 is not a candidate, the switch is not resolved and the train is not indicated on the correct segment.

[0100] To sort the candidate segments, we identify the segments compatible with the heading produced by the integrated geographic location device. This must be between the minimum heading and the maximum heading of the candidate segment portion. These minimum and maximum bounds must take into account the uncertainty of the heading of the integrated geographic location device as well as the uncertainty of the integrated cartographic database.

[0101] If there has been no change of direction and if the direction is known, then a segment can only be a candidate if its previous segment has already been a candidate. This algorithm makes it possible to manage rule R4 on heading variation. This algorithm can be supplemented by monitoring the temporal variation of the heading of the integrated geographic location device.

[0102] On the example of figures 19 et 20 , the switch junction S19 has not yet been resolved. The first-level tracking identified the candidate segments S20 and S50. The candidates for the second-level tracking, after applying the previous selection methods, are S18, S20, S50 and S21. S51 is not a candidate because its heading is not compatible with the heading of the integrated geographic location device. When the train moves (we imagine that it takes the lower branch), since the segments S51 and S52 are not candidates (because of the heading criterion), then S53 cannot be a candidate, although its heading is compatible. Thus the switch S19 is resolved correctly by selecting the branch S20 and S21.

[0103] The search for candidate segments thus helps resolve switches. It allows you to return to "nominal" mode by deleting segments that are no longer candidates. It then updates the list of online segments (transition [C]).

[0104] For the construction of measurements, tracking allows to reduce the uncertainty of position by removing incompatible candidate segments from the geographic location data via the rules cited above (in particular by using the heading of the database).

[0105] If the position uncertainty after tracking is less than the uncertainty of the geographic location position and the mode is nominal, the filter of the geographic location device can be recalibrated using a position measurement provided by tracking. This position measurement reduces the position uncertainty.

[0106] Regarding the provision to the user of the segment(s) and the associated uncertainty, it includes the following elements: three coordinates of the estimated position from the integrated geographic location; three coordinates of the estimated speed from the integrated geographic location; an estimated segment and an associated curvilinear abscissa, in "nominal" mode; an estimated speed and an associated uncertainty, in "nominal" mode; a direction of movement, if the speed module is greater than its uncertainty, in "nominal" mode; a position uncertainty translated by a set of segments with their minimum and maximum abscissas in all modes; and an indicator of the tracking mode ("nominal", "degraded", "init").

[0107] The system can be used alone, for applications with criticality of the order of 10 -5< / h to 10 -7< / h. To provide a "catastrophic" criticality service (10 -9< / h to 10 -10< / h), two integrated geographic location devices 1, 1bis can be used, each using an integrated device dissimilar from the other, as illustrated in the figure 21 .

[0108] A consolidation module 4 of the "com / mon" type then ensures the consolidation of the outputs of the two tracking devices, similar to what is done in critical aeronautical systems. For example, the consolidated position is a weighted barycenter between the position of the main device and that of the additional device and whose protection interval consists of the meeting of the protection intervals of the main device and the secondary device.

[0109] If the risk of non-integrity of device 1, 2, 3 is 10 -6 < / h and the risk of non-integrity of device 1bis, 2bis, 3bis is 10 -3 < / h, then the probability of having both sources fail simultaneously is 10 -9 < / h. This improvement is true if the two devices have no common mode up to 10 -9 < / h.

[0110] An example of the figure 21 consists of a device 1, 2, 3 ("command" chain) whose source is a GPS / UMI hybridization and a second device ("monitoring" chain) whose source is a Galileo / UMI hybridization, considering that the GPS and Galileo systems are independent, with certain precautions to deal with the common mode which is the disturbance of the GPS and Galileo signals near the ground.

[0111] In this example, the database can be a common mode. To reduce this common mode, we can limit the use of the database in one of the two chains. Thus on the figure 21 , the source of device 1, 2, 3 uses the track deviation measurements produced by the tracking device, while the source of device bis 1bis, 2bis, 3bis does not use the track deviation measurements. The consequence is that the accuracy of device bis is lower, but this is partly compensated by the fact that the protection radii of device bis are calculated for a lower criticality (10 -3 < / h instead of 10 -6 < / h).

Claims

1. A high-integrity autonomous location system for locating a train in a rail network reference frame, high integrity meaning that the probability of measurements produced by the location system falling outside the protection domain is less than a specified risk, comprising: - a high-integrity geographical location device (1) for high-integrity geographical location in a global geographical reference frame, comprising an inertial central unit, a GNSS receiver, and a hybridisation module for hybridising the measurements provided by the inertial unit and the GNSS receiver, configured to provide the three position coordinates, the three speed components, and the heading angle of the train in the global geographical reference frame as well as their respective integrity protection intervals with respect to critical events that may affect the high-integrity geographical location device, so that the probability of the position or the speed or the heading angle being outside the integrity protection intervals is less than once every million hours; - a high-integrity map database (2) of the rail network, configured to provide data geographically representing the rail network in the form of segments and information representative of areas of the surroundings of the railway track exhibiting a risk of reflected GNSS paths in order to maintain the integrity of the geographical location device, and - a tracking device (3) for tracking the train, configured so as to autonomously determine an identifier of the rail network segment on which the train is located, a high-integrity position of the train on this segment in the rail network reference frame, and the protection interval associated with the position of the train on the segment based on data provided by the high-integrity map database and the positions, speeds, headings and integrity protections provided by the high-integrity geographical location device, by resolving ambiguities of candidate segments, such that the probability of the train not being at the indicated location of the rail network is less than once every million hours, - the tracking device (3) being configured to: - eliminate the candidate segments not contained at least partly within the protection intervals provided by the high-integrity geographical location device, to provide segments from the database that are compatible with rail network chaining; - compare the heading angle provided by the high-integrity geographical location device and the heading angle of the segments from the database that are compatible with the chaining of the rail network, - select, from the segments of the database that are compatible with the chaining of the rail network, the segments compatible with the protection interval of the heading angle provided by the high-integrity geographical location device, and for which the following segment or the previous segment, depending on the direction of travel, has already been a candidate segment, and - retroactively provide, during train movement, the high-integrity geographic localisation device with said information representative of areas surrounding the railroad track at risk of GNSS reflected paths; the high-integrity geographical location device being configured so as either to use only GNSS satellites for which the direction of the line of sight does not exhibit a risk of reflected paths at the location of the train, or to modify the weighting given to the various GNSS satellites used at the location of the train.

2. The system according to claim 1, wherein the module for hybridising the measurements provided by the inertial central unit and the GNSS receiver enables integrated hybridisation of the GNSS measurements; the high-integrity geographic location device being configured to guarantee the integrity of the measurements provided by the GNSS receiver.

3. The system according to one of the preceding claims, wherein the tracking device (3) is configured to perform a correlation along the curvilinear abscissa between the successive heading angles provided by the high-integrity geographical location device and the successive headings taken by each of the candidate segments, so as to select a single segment.

4. The system according to any one of the preceding claims, wherein the tracking device (3) is configured to retroactively provide high-integrity measurements of lateral deviation and heading deviation of the train with respect to the railway track of the rail network to the high-integrity geographical location device (1), the hybridisation module being configured to take said measurements into account.

5. The system according to any one of the preceding claims, wherein the tracking device (3) is configured to determine a high-integrity speed and direction of movement of the train, by projecting, onto the direction of the current segment, the speed and its protection interval as provided by the high-integrity location device.

6. The system according to any one of the preceding claims, wherein said data representing the rail network in the form of segments comprise, for each segment, the position coordinates and the heading angle in the global geographical reference frame, the length of the segment, the value of a parameter representative of the curvature and its variation, the value of parameters for chaining the segment with other segments, and the values of the limits in terms of the position error and the heading error of this segment.

7. A system according to any one of the preceding claims, provided with a redundant path guaranteeing the physical integrity of the system and the integrity of the database, comprising: - an additional high-integrity geographical location device (1bis) for high-integrity geographical location in a global geographical reference frame, different from the high-integrity geographical location device, configured to provide the position, the speed and the heading of the train as well as their respective integrity protections; - an additional high-integrity map database (2bis) of the rail network, identical or similar to the high-integrity map database of the rail network, configured so as to provide data representing the rail network in the form of segments; - an additional tracking device (3bis) for tracking the train, identical or similar to the tracking device for tracking the train, configured to determine a high-integrity autonomous position of the train in the rail network reference frame and a corresponding rail network segment identifier, based on data provided by said additional high-integrity map database and the respective positions, speeds, headings and integrity protections provided by the additional high-integrity geographical location device, by resolving ambiguities of candidate segments; and - a consolidation module (4) for consolidating the integrity protections provided by the tracking device for tracking the train and the additional tracking device for tracking the train, providing a consolidated segment identifier and a consolidated position on the segment, as well as the consolidated protection interval, such that the risk of lack of integrity of the consolidated outputs is much smaller than the risk of lack of integrity of the outputs of the two devices taken separately, the consolidated position being calculated by weighted barycentre of the position of the main device and of the additional device, and the protection interval being calculated by combining the protection intervals of the main device and of the secondary device.

Images