Method for secure determination of an object location, preferably a vehicle moving along a known course

[0002] This application claims the benefit of Provisional Application No. 60/215,607 filed Jun. 30, 2000.

[0003] The present invention relates to a method for securely determining the location and/or the positioning of an object moving along a course which is known by the location device.

[0004] The term “course” is intended to mean a subset of the space delimited by a tubular surface of arbitrary and variable cross section, in which the vehicle is strictly constrained to move. In the event that the cross section of this tube can be neglected, this gives two equations linking longitude, latitude and altitude of the moving object.

[0005] The present invention relates more precisely to a method for determining the location of a train moving on a railway track whose exact path is known.

[0006] The same principle can be applied to the case in which a single equation is known (movement of the moving object on a known surface).

[0007] The present invention relates to a method for determining the location and/or the positioning of a vehicle, this securely in terms of railway transport, that is to say it involves being able to determine the location, or more precisely the zones of non-presence of said vehicle on a section, this quasi-instantaneously, for a vehicle moving on a known course, and doing so with a given probability.

[0008] This location is based on the use of navigation satellites or equivalent terrestrial navigation beacons, generically referred to below as “satellites”.

[0009] In railway signaling, a train is not permitted to enter a specific section of track until it is certain that the train in front has departed therefrom, that is to say that the track section in question is free. To that end, it is necessary to ascertain with a margin of error which is predetermined, and of course extremely small, and to do so securely in terms of railway transport; for example with a maximum error level of the order of 10⁻⁹and preferably of the order of 10⁻¹², the zones in which non-presence of a train can be relied upon, and to do so at each iteration of the calculation.

[0010] It is known to determine the precise location of an object, and a fortiori of a train, with the aid of calculation of the position with respect to three satellites, the receivers that can receive the information from said satellites being capable of calculating the coordinates of said moving object with a relatively high precision.

[0011] However, it is necessary to add a precise measurement of the universal time, which may prove to be complex and sometimes costly to implement at the level of a receiver, for example one arranged in the train. Furthermore, it should be noted that it is necessary for the various satellites to belong to the same constellation and for them to use the same reference time.

[0012] For this reason, a fourth satellite is generally used, which permits precise location of the object in question by solving a system of four equations with four unknowns, so as to obtain the three coordinates of the point in question and the value of the time.

[0013] In reality, on the basis of knowledge of the coordinates of these satellites, an estimate is made by calculating the distance separating said satellites from the receiver object whose location is intended to be estimated.

[0014] Numerous strategies for increasing the quality and/or the quantity of information being used, in both the civilian and military fields, have made it possible to improve the precision of these measurements.

[0015] To that end, the following may be mentioned, inter alia:

[0016] increase of the number of satellites involved in the measurement (including on the ground),

[0017] correlation between successive measurements in order to reduce the weight of certain causes of errors,

[0018] radio broadcasting (via satellite or otherwise) of local correction information (DGPS, WAAS, for example),

[0019] increase of the precision of the timing measurement by synchronisation with the carriers of the satellites,

[0020] use of maintenance and control information broadcast by the ground monitoring network or networks of the constellations of satellites.

[0021] These various items of information are compiled in order to refine as much as possible the most probable value of the position of the object of interest and to increase its precision.

[0022] Furthermore, coding and autocorrelation techniques have also been suggested in order to assure protection against electromagnetic interference or malicious acts liable to occur when measurements are being taken.

[0023] Lastly, for certain applications, the satellite location system may be supplemented with complementary sensors, which can further improve the quantity or the quality of the available information, for example atmospheric pressure sensors in aeronautics, train-axle rotation sensors coupled with a Doppler radar, partial or complete inertial stations, etc.

[0024] It is therefore an aim of the present invention to describe a method and a device which permit secure location and/or positioning of an object, and thus a fortiori of a vehicle such as a train, moving on a known course.

[0025] The term secure location is intended to mean the location, or more exactly the non-presence of a train outside a zone which is redefined at each calculation, with a error level of less than 10⁻⁹and preferably capable of reaching 10⁻¹².

[0026] The present invention relates to a method for determining the location and/or the positioning of an object, in particular a vehicle such as a train, moving along a known course, and this securely in terms of railway transport, characterised in that said location and/or said positioning of said object is determined by a valid calculation at a given time based on the one hand, on an elementary measurement involving at least one satellite and, on the other hand, on a secure mapping of said known course.

[0027] Preferably, said secure mapping makes it possible to obtain two relationships with three unknowns representing the coordinates of said object whose location and/or positioning is intended to be ascertained, while at least one other relationship between the same three unknowns is obtained with the aid of the information transmitted by at least one satellite whose position is known.

[0028] More precisely, the present invention relates to a method in which each elementary measurement consists in determining an individual domain along said course between two mileage points, said domain depending on the standard deviation of the timing measurement errors of said elementary measurement, the speed of light, a coefficient linked with the coordinates of said satellite in question and the course of the track, and a weighting factor defining the geometry of the error distribution for any measurement recording, so that the probability of non-presence of the train in said individual domain is predefined.

[0029] Advantageously, each measurement recording is redundant, which makes it possible to determine a plurality of individual domains by a plurality of elementary measurement recordings carried out simultaneously at the same given time, which are based on different satellites or on pairs of satellites.

[0030] According to a first embodiment, an elementary measurement will be carried out with the aid of a pair of satellites using the same reference time. Preferably, the pair of satellites will belong to the same constellation.

[0031] According to another preferred embodiment, an elementary measurement will be carried out with the aid of at least one satellite belonging to a constellation and a receiver linked with the object moving along the known course, said receiver having a clock synchronised with the reference time of said constellation to which the satellite belongs.

[0032] This means that it is sufficient to increase the number of satellites in order to take a plurality of elementary measurements simultaneously.

[0033] Preferably, the existence of a common domain is determined, which is defined as the intersection of the, and preferably of all the, various individual domains. Particularly advantageously, the individual domains which have no point in common with the common domain are rejected.

[0034] Hence, if there is a non-null common domain, the domain of possible presence of the moving object is determined as the union of the non-rejected individual domains.

[0035] It is deduced from this that the probability of non-presence outside the union domain is defined as the product of the probabilities of non-presence in the known individual domains.

[0036] According to a preferred embodiment, the individual domains defining the union domain depend on a parameter defining the geometry of the error distribution which is greater than or equal to the parameter selected for determining the individual domains defining the common domain.

[0037] The invention also relates to a device for determining the location and/or the positioning of an object, preferably a vehicle such as a train, moving along a known course, and this securely in terms of railway transport, comprising at least:

[0038] equipment associated with said object, said equipment comprising at least one central computer, at least one receiver/decoder of signals coming from one or more satellites, a radio interface and a database comprising the mapping of the course executed by said object,

[0039] central equipment comprising a central computer, one or more radio interfaces, a bus system, a database comprising the mapping of the course, an application for managing the modifications of said mapping and at least one console, as well as moving-object/central-equipment and man/moving-object interface elements.

[0040] Advantageously, the receiver/decoder comprises a clock synchronised with the reference time of the constellation of satellites.

[0041] Preferably, the device of the invention furthermore comprises a plurality of complementary sensors.

[0042] Preferably, the central equipment is optionally portable.

[0043] The method for determining the location and/or the positioning of an object, and more particularly of a train, moving along a known course, can in fact be interpreted according to two different modes of operation:

[0044] the linear mode, when the train is travelling along a track with no branching in the vicinity of its position, and

[0045] the topological mode, when the train is going to enter a switching-points zone or when it is not yet possible to be sure that it has departed therefrom.

[0046] The present invention relates more precisely to the location of a train moving in linear mode.

[0047] In the event of movement in topological mode, that is to say in a switching-points zone, for example, examples of implementation are described below which make it possible to revert rapidly from the topological mode to the linear mode, and therefore to apply the method according to the present invention

[0048] Of course, any generalisation to a vehicle moving along a known course may be made, for example to a boat moving on a canal network, a car moving on a motorway whose exact course is known, etc.

[0049] It should be noted that, in the field of railway signaling, the course of the object, and more precisely of the train, is known with precision and securely. It is therefore simply expedient to check that a train is not approaching a dangerous point (specific section of track) and to signal its presence to the train following it, until the latter can enter without any risk of colliding with it.

[0050] The refresh time in a railway system should be at most from one to a few seconds.

[0051] The Linear Mode

[0052] In this mode, the train is localised in terms of a domain defined by two mileage points, that is to say as a confidence interval defined by two curvilinear coordinates in which, for an identified track whose exact path is known (or at the very least if not the exact path, the probable path in the securely sense of the term), it is possible to define the non-presence of a train with an error level which is as small as necessary.

[0053] The mapping of the track gives two securely known equations between three coordinates (altitude, latitude and longitude). The mapping is stored in a secure database and is loaded on board the train at the start of service, while guaranteeing the integrity of the contents by the conventional railway transport secure means: coding, redundancy. Its updating, when appropriate, is preferably managed by a suitable protocol.

[0054] The third equation will be given by an elementary measurement involving at least one satellite, and preferably a pair of satellites. It is:

[0055] either a measurement of the transmission time between a satellite and the receiver arranged on the moving object (the train), which defines the distance between said satellite and the receiver, this being done in the event that said receiver has a clock synchronised with the reference time of the constellation to which the satellite belongs,

[0056] or a measurement of the difference between the transmission times of each of the satellites of a pair of satellites and their receiver arranged in the moving object (the train), in the event that said receiver is not provided with a clock synchronised with the reference time of the constellation to which the satellites belong.

[0057] It should be noted that, in the case of recording an elementary measurement with the aid of two satellites, belonging preferably to the same constellation, or at the very least to constellations using the same reference time, it will not be necessary for the receiver arranged in the train to have a clock synchronised with this reference time.

[0058] Conversely, in the case in which an elementary measurement is carried out with a single satellite, it is essential for the receiver arranged in the train to be provided with a clock synchronised with the reference time of the constellation to which this satellite belongs.

[0059] This increases the implementation cost of the method according to the present invention, but will reduce the number of satellites needed for each elementary measurement.

[0060] During an elementary measurement (i=1), an attempt will therefore be made to determine, using a system of equations (three or four) with a plurality of unknowns (three or four), the positioning of said moving vehicle, or more precisely the domain D_idefined on the course by the two mileage points Mⁱ_minand Mⁱ_max, which are counted from a reference that is arbitrary but unique for each line, and which are separated by a distance

[0061] 2 η_ac σ_iα_i, where

[0062] η is a dimensionless coefficient defining the geometry of the error distribution,

[0063] c is the speed of light,

[0064] σ_iis the known standard deviation of the timing measurement errors, and

[0065] α_iis a dimensionless coefficient linked with the coordinates of the satellites and with the course of the track.

[0066] If σ₁denotes the known standard deviation of the timing measurement errors during this first elementary measurement, performed for example with the aid of a first pair of satellites, then ±η_aσ₁may be regarded as being the limit of the measurement error with a probability P_a(10⁻²to 10⁻⁴, for example), which defines η_aas a dimensionless coefficient that allows the assumption to be made that the distribution is Gaussian when an elementary measurement is taken. Usually, η_ais between 1 and 4, and preferably between 2 and 3. Specifically, if η_ais too great, this decreases the stringency criteria on the measurements, that is to say it increases the error level probability. Conversely, if η_ais too small, the risk of the measurements not converging, and therefore of rejecting said elementary measurement, is increased.

[0067] η_aand the number of elementary measurements (and therefore the number of satellites being used) need to be selected in order to achieve the predefined probability conditions.

[0068] It should be noted that σ₁includes the random distribution errors linked, for example:

[0069] with the propagation speed of the wave in the ionosphere and the troposphere,

[0070] with the relative calibration errors of the internal clocks of the satellites,

[0071] with the errors between their actual position and their transmitted position,

[0072] with the errors of synchronisation with the received messages,

[0073] etc.

[0074] The elementary measurement is repeated k times (with k satellites or k different pairs of satellites). The k elementary measurements may be carried out by using different constellations. This determines domains D₂a . . . D_ka of the same kind as D₁a.

[0075] If all these domains D_i^acontain a subset of mileage points which is common to them, the common domain D₀^ais defined as the intersection of the domains D_i^a. In this case, the parameters of the subsystem of satellites which are used are in their normal mode of operation, at least for the measurement required at this moment. This may be imposed as a necessary condition in the calculation algorithm.

[0076] Furthermore, if the D₀^aexistence condition is satisfied, the probability of having an unknown anomaly in the subset of satellites which is being used may be neglected; such an anomaly would lead to a measurement being void, or to underestimation of the error probability in the calculated domain. In the converse case, complementary measurements may be employed by using one or two additional satellites.

[0077] It should be noted that the reasoning adopted above is carried out on the basis of pairs of satellites. The same reasoning could of course be carried out with the aid of individual satellites acting interactively with the receiver, so long as the receiver itself has a clock synchronised with the reference time of the constellation to which the satellite or satellites belong(s). Nevertheless, the provision of a clock synchronised with the reference time of the constellation, such as a caesium clock, is still relatively expensive and it is very probable that this solution will not be directly contemplated.

[0078] If, lastly, the satellite pairs which are used belong to different constellations, or if suitable monitoring makes it possible to ensure that there is no common-mode error within a given constellation, then the probability that the actual location is outside a union domain: D_u^b(defined as the union of the individual domains D_i^b: 2 η_bc σ₁α₁) will be at most equal to (P_b)^k, which gives access to the error probabilities ranging from 10⁻⁹to 10⁻¹²that are necessary.

[0079] The coefficient η_bis defined with η_bη_a, such that the probability P_bof having a location outside the domain 2 η_bc σ_iα_ican be selected to be as small as possible (10⁻³to 10⁻⁶, for example).

[0080] Within a given constellation, the non-presence of common-mode error may be determined, for example, by looking for the position of known fixed stations on the basis of the same pairs of satellites. An anomaly may be communicated to the trains either via the command post or via a local radio link. The time needed for this operation must then be added to the calculation time per se.

[0081] The Topological Mode

[0082] As already described above, the movement of a train in a topological mode should be reverted as quickly as possible to a movement in a linear mode, so that the method according to the present invention can be implemented.

[0083] By way of example, if one train is following another train and the track between the two does not contain any switching points, the positioning of the train behind is carried out exclusively in linear mode; its allowed limit of movement will be calculated on the basis of possible knowledge of the rear of the train in front of it, which may involve direct or indirect dialogue with this train.

[0084] Similarly, when a train is travelling towards a switching point, the system gives it the certainty that there is no other object between this switching point and itself, allowing it for example to take possession of a (single-line) token associated with the switching points.

[0085] When it is in possession of this token, it can change the switching point according to the route assigned to this train by the control centre. Having confirmation that the switching point is locked in the required position, the topology of the track for this train in the vicinity of the switching point is known: the situation has therefore reverted to the previous case and the location can again operate in linear mode, apart from the fact that it may be necessary to change the reference mileage point after having crossed the switching point in order to fix it in the new track being taken.

[0086] The token is given back to the switching point when the fact that the end of the train has departed from it has been registered; it is then available for the train following it.

[0087] Giving back the token will often entail a change of mapping (new known course).

[0088] In conclusion, the situation in this exemplary case has reverted to a linear movement mode.

[0089] FIG. 1 represents the equipment necessary on board the train for implementing the method according to a first embodiment.

[0090] FIG. 2 represents the equipment necessary on the track for implementing the method according to a first embodiment.

[0091] FIG. 3 represents the equipment necessary in the central post for implementing the method according to a first embodiment.

[0092] Among the various embodiments of the method according to the present invention, the one described below is one of the most representative. It is described with reference to the figures mentioned above, which respectively describe specific or adapted elements which are arranged on board the train, in the track and at the control post.

[0093] FIG. 1 represents the equipment necessary on board the train for implementing the method according to a first embodiment, in a version which is not redundant in order to improve availability.

[0094] Specifically, depending on the technology of the satellite receiver being used and of its decoder, this equipment may be duplicated so that the transmitted information concerning different satellites cannot be affected in an obviously coherent way by faults.

[0095] The Train Interface Unit (TIU) element 1 is implemented in the event that a train protection functionality (ATP) is added to the system.

[0096] The Man Machine Interface (MMI) element 2 is normally present for dialogue with the driver. It would be omitted in the case of a strict protection system, not associated with the in-cabin signaling. Two cabins of a given train may be equipped using the same secure computer 10.

[0097] The mapping 3 of the track is a memory range managed by the safety computer 10 during normal operation, furthermore with a procedure for checking its content via the radio 4 and the central post at the start of service. If an update is necessary, a suitable procedure is put in place. This may involve validation by the driver via the Man Machine Interface element 2.

[0098] The radio 4 is a standard interface for a ground-train radio of the analogue or digital type (GSM-R, for example).

[0099] The secure computer 10 (by the secure principle in terms of railway transport) employs the conventional technologies: coding (NISAL or FIDARE, for example) or redundancy (2 of 2), which are optionally associated with redundancy in order to improve availability (1 of 2, 2 of 3, 2 of 4).

[0100] The secure computer 10 is in contact with the receiver/decoder of the first satellite 5 and the receiver/decoder of the second satellite 6. Usually, these receivers/decoders are multichannel receivers/decoders and can simultaneously have links with a plurality of satellites.

[0101] According to another embodiment, it is sufficient to provide one receiver/decoder arranged in the train and having a clock synchronised with the reference time of the constellation of satellites. In this exemplary case, a single satellite is sufficient for each measurement recording.

[0102] Versions with improved availability are produced by adding, according to requirements:

[0103] additional receivers,

[0104] an additional radio interface,

[0105] a redundant architecture for the central computer (whose memory carries the mapping),

[0106] a partially or completely redundant architecture for the Man Machine Interface (MMI) element and the Train Interface Unit (TIU) element.

[0107] Versions with improved precision are produced by optionally adding complementary sensors 7 (acceleration, gyroscopes, Doppler radars, etc.).

[0108] FIG. 2 represents a basic version which may be redundant in order to make it possible to improve the availability of the main object-controller equipment which is necessary in the track.

[0109] If necessary, the object controller 20 controls the relevant component 22 in the track (object) and receives the pertinent checks and state variables from it. It manages the token 23 and keeps it when it is not being used by a train or by portable or fixed specialised equipment The radio interface 24 is similar to that of the on-board equipment.

[0110] As in the case of the on-board equipment, various versions with redundancy may be made.

[0111] It is also possible to contemplate track equipment which is portable and intended for the workmen on the track and for certain emergency interactions with the traffic. In particular, it allows the workmen to find where they are on the network without risk of error, to securely impose the suitable traffic limitations (and to cancel them subsequently) and optionally to receive warnings of approaching trains.

[0112] In one of its possible embodiments, the architecture of this equipment is very similar to that of the on-board equipment.

[0113] The functionalities of the Man Machine Interface (MMI) element are modified: they do not contain those which are based on dynamic information of the equipment (target distance, speed, etc.), but instead allow certain operations on the tokens of the system.

[0114] The Train Interface Unit (TIU) element becomes an interface for advising (for example audibly) of an approaching train.

[0115] In order to increase the precision in the vicinity of critical places (station entries, for example) or for the purposes of monitoring the constellation being used, equipment complementary to the fixed-track location may be arranged at suitable places. Again, this equipment is very similar to that described in FIG. 1, but in this case it includes neither a Train Interface Unit (TIU) element nor a Man Machine Interface (MMI) element. Furthermore, it is in principle not provided with token-management functionalities, but is intended only for communicating, at the request of the trains or the central post, the instantaneous location discrepancies (linear location) for each pair of satellites being used by the system which it can pick up. These discrepancies are used to reduce the confidence interval of the measurements and to validate the satellites being used.

[0116] FIG. 3 describes the central post according to a preferred embodiment, which is characterised in that a minimum number of functions are processed securely. Apart from the mapping control, the basic functions of the equipment are implemented without resorting to the security at the central station.

[0117] In practice, safety equipment 40, 41, 42, 43, 44 may be added in order to implement complementary functions from the central computer 30: security for workmen on the track, various protections, remote function for compatibility with incompletely equipped engines, backup in the event of malfunction, etc.

[0118] The management of the mapping 33 is performed outside real time but securely by dedicated equipment 38.

[0119] The organisation of the system (priorities for the trains, instructions to them for establishing contact with the various object controllers in order to take their relevant tokens from them, etc.) is carried out by the central computer and the operator via the operational supervision console 42, and in compliance with the pre-established timetables via the timetable management console 41.

[0120] The maintenance monitoring and the particular interventions (emergencies, backup for partially deficient trains, etc.) may be carried out via specialised consoles 40, 41, 42, 43, 44 (as represented in FIG. 3) or via the same console as the operational supervision, for example. Specifically, the total number of consoles 40, 41, 42, 43, 44 needs to be adapted to the installation requirements.

[0121] The radio interfaces 34, 35, 36 put the central computer 30 and the satellites in communication via a radio bus 37, which is generally redundant.