EP2593346B1

EP2593346B1 - Train locating system with real-time location estimation integrity check

Info

Publication number: EP2593346B1
Application number: EP11770506.1A
Authority: EP
Inventors: Antonio Saitto; Paolo Bellofiore; Andrea Bolle
Original assignee: Telespazio SpA
Current assignee: Telespazio SpA
Priority date: 2010-07-12
Filing date: 2011-07-12
Publication date: 2017-10-18
Anticipated expiration: 2031-07-12
Also published as: EP2593346A1; RU2584957C2; CN103221291A; RU2013105692A; ES2651011T3; WO2012007822A1; CN103221291B

Description

TECHNICAL SECTOR OF THE INVENTION

The present invention relates, in general, to localization of trains and, in particular, to a system designed for estimating the position of a train and for checking in real time the integrity of the estimation of the position.

STATE OF THE ART

As is known, in the railway sector there is markedly felt the need to develop positioning systems that are increasingly reliable for controlling the trains in movement in order to guarantee safety of rail traffic. In the aeronautic sector, said need has been tackled with the use of Satellite-Based Augmentation Systems (SBASs), which enable augmentation of the precision of the estimate of position and hence can be used for supporting air navigation. In addition, SBASs are designed for supplying also a "safety of life" signal and hence can be used for supporting air-traffic control systems.
Known systems of a SBAS type are:

the European Geostationary Navigation Overlay System (EGNOS), designed to provide the service of augmentation of the precision of estimate of position on the European continent and in North Africa (in particular in the North of Morocco, in Tunisia, Algeria, and Libya);
the Wide-Area Augmentation System (WAAS) developed in the States United of America and designed to provide the service of augmentation of the precision of estimate of position over a vast area of the North-American continent; and
the Multifunctional Satellite Augmentation System (MSAS) developed in Japan and designed to provide the service of augmentation of the precision of estimate of position over a vast area of the Asian continent.

When all of the aforesaid SBASs will be fully operative, an aeroplane that, for example, takes off from New York to go to London and then to New Delhi will always remain under the coverage of said SBASs.
In particular, SBASs guarantee a precision around two metres in the estimate of position. In addition, SBASs guarantee also the reliability of the data received from the Global Positioning System (GPS) and enable a much more precise calculation of the height, which in future may be used also for air navigation.
In detail, SBASs, in order to supply information that enables refinement of the estimate of position made on the basis of the signals received from the GPS and in order to supply "safety of life" signals, exploit:

a plurality of geostationary satellites (i.e., ones with fixed positions with respect to the Earth's surface, as against GPS satellites, which are in orbit);
a plurality of ground stations that are appropriately georeferenced, are provided with an appropriate time reference (high-precision clock), and are configured for determining the delays of the signals transmitted by the GPS satellites due to ionization of the troposphere; and
a plurality of data-processing base stations.

In greater detail, SBASs, in order to determine the errors made in the position estimate based upon the signals received from the GPS, operate in the way described hereinafter. The ground stations detect the error of the data transmitted by the GPS satellites (which can for the most part be put down to the ionization of the lowest layers of the atmosphere). For this purpose, the ground stations compare their own position calculated on the basis of the signals received from the GPS satellites with the data of the orbits of the GPS satellites and with the respective certified positions. As is known, GPS receivers base calculation of their own position on the delay with which they receive the signal from the GPS satellites. Since each ground station knows the respective exact position and the positions of the GPS satellites from which it has received the GPS signals (said positions being determined not on the basis of the signals received, but rather on the basis of the data of the orbits of the satellites themselves), each ground station is hence able to determine easily the error caused by propagation of the GPS signals through the atmosphere. Each ground station can hence generate, on the basis of the errors calculated, a respective lattice of surrounding points and detect the error margin for each of these points, thus widening the area in which the GPS errors calculated are valid. Consequently, in this way, each ground station determines a respective error model that is valid for a respective area of competence. The data generated by the ground stations are then sent to at least one data-processing base station, which generates a very dense lattice of corrective factors. It corresponds, in practice, to a large number of points of known position, for each of which the correction data for the signal received from each GPS satellite is processed. These data are updated in real time, in so far as the conditions of propagation of the GPS signal through the atmosphere obviously change according to the conditions of the atmosphere itself. These corrective factors are then sent to the SBAS satellites so that they can be finally retransmitted to ground using the same frequency as that of the GPS signals (i.e., the frequency L1) and then be received by the user terminals enabled. The terminal that receives the SBAS signals selects the data valid for the points of the lattice closest thereto, applies them to the satellites that it is receiving at that moment, and uses them for calculation of its own position.
In the railway sector, the use of SBASs is not straightforward. In fact, the service of supply of the "safety of life" signals has been conceived principally for aeronautic procedures, which are profoundly different from railway procedures. In fact, railway procedures start from the idea that each train can be managed at each instant along its route by defining in real time, on the basis of the state of the train and of the level of knowledge of the position of said train, both the speed of travel and a possible stop in the case where safety procedures so require. The more sophisticated evolution of this process of control of travel of the trains is represented by the European rail-traffic management system (ERTMS) and by the European train-control system (ETCS).
In particular, the ERTMS-ETCS integrated system is an advanced system for management, control, protection, and signalling of rail traffic designed to replace the multiple and mutually incompatible systems of circulation and safety of the various European railways in order to guarantee the interoperability of the trains on the various European railway networks and maximize the levels of performance of the European railway networks, both the high-speed ones and those of greatest commercial interest.
ERTMS-ETCS is made up of different equipment, which has the purpose of implementing the aforesaid functions and is characterized by three different functional levels, specifically a first functional level, a second functional level, and a third functional level. The definition of each functional level depends upon how the railway line is equipped and upon how the information is exchanged between the train and the monitoring stations.
In the first-level ERTMS-ETCS authorization for movement and the corresponding information on the route are transmitted to the train and displayed in the cab to the driver in a discontinuous way by using balises, called "Eurobalises", which are distributed along the tracks, provide self-location of the train, and transmit the route conditions, this all being integratable by a further series of transmitting points that supply in a continuous way to the train the information and the corresponding travel and positioning control data.
In particular, currently trains are equipped with on-board odometers, which are configured for measuring the speed of the trains on which they are installed and for estimating the position of said trains by integration of the speed measured. In the first-level ERTMS-ETCS the Eurobalises are used for calibrating the on-board odometers, i.e., for correcting the estimates of position supplied by the on-board odometers on the basis of certified positions supplied by the Eurobalises.
The first-level ERTMS-ETCS supplies an on-board signalling that can be added to traditional signalling systems currently installed on railway lines, leaving the latter in operation for circulation of traditional trains.
Fixed transmitting balises (Eurobalises) transmit, via an appropriate encoding, the information supplied by the fixed line signals and supply to the on-board apparatuses of the train the necessary authorizations for movement. A computer on board the trains processes the maximum speeds and the braking curves on the basis of the data received from the Eurobalises. In order to be able to obtain from the ground balises the necessary information, in particular the necessary authorizations for the next movements, it is necessary for the train to engage said balises passing over them. The information regarding the integrity of the train and the respective positioning is detected via the track circuits. By installing additional Eurobalises (Euroloops) between a start-of-stretch signal and an end-of-stretch signal it is possible to obtain a sufficiently continuous transmission of information. The information can be transmitted upon passage of the locomotive via inductive means or via radio.
In this regard, Figure 1 shows a scenario of example in which a first-level ERTMS-ETCS operates.
In particular, Figure 1 illustrates schematically:

a section of railway line (designated as a whole by 11), which comprises two Eurobalises (designated, respectively, by 111 and 112), which are connected to a line unit (designated by 113), which is in turn remotely connected to a control centre (designated by 12); and
a train (designated as a whole by 13), which moves along the section of railway line 11 and installed on board which is an on-board computer (designated by 131), which is connected to a receiver (designated by 132) and to a control panel (designated by 133) configured for supplying information to the driver (designated by 134) of the train 13.

In detail, the control centre 12 sends to the line unit 113 information regarding the section of railway line 11, such as, for example, authorizations for movement of the trains, slowing down thereof, and maximum speeds allowed. The line unit 113 supplies to the Eurobalises 111 and 112 the information received from the control centre 12 together with other information supplied by fixed signalling systems (not shown in Figure 1 for simplicity) installed along the section of railway line 11. Each of the two Eurobalises 111 and 112 is georeferenced, i.e., knows the respective exact position, and transmits upon passage of the trains, via inductive means or via radio, the respective position together with the information received from the line unit 113. When the train 13 passes over the Eurobalises 111 and 112, the receiver 132 receives the information transmitted by said Eurobalises 111 and 112 and supplies it to the on-board computer 131. The on-board computer 131 displays on the control panel 133 the information received via the receiver 132 together with further information (for example, the current braking profile of the train 13) obtained via processing of said received information and of other information regarding the train 13 (for example, the speed, weight, and length of the train 13).
In addition, the on-board computer 131 is connected to an on-board odometer (not shown in Figure 1 for reasons of simplicity) of the train 13 for receiving from the latter estimates of the position of the train 13. The on-board computer 131 corrects said estimates on the basis of the positions received from the Eurobalises 111 and 112. The on-board computer 131 displays on the control panel 133 the estimates of position supplied by the on-board odometer when it does not have available the exact positions supplied by the Eurobalises 111 and 112, whereas, when it receives the exact positions supplied by the Eurobalises 111 and 112, it displays said exact positions on the control panel 133.
As regards, instead, the second-level ERTMS-ETCS, this enables management of the distance between the trains via radio communications between the trains and a control base station referred to as "Radio Block Centre" (RBC), which, knowing the state of the line and of the other trains, continuously sends to the trains information regarding the line (such as, for example, authorizations for movement of the trains, slowing down thereof, and maximum speeds allowed) using a connection based upon the international mobile-phone standard for railway communications "Global System for Mobile Communications-Railway" (GSM-R). The trains can thus determine their own speed profile also on the basis of their own characteristics of weight and braking. The system intervenes in a timely way in the case of possible risks for safety.
In particular, the second-level ERTMS-ETCS is a system for signalling and protection of the train based upon a radio transmission of digital data. In the driving cab of trains displayed on purposely provided control panels is the information regarding the route and authorizations for movement of the trains received directly from the RBC. The positions of the trains, the direction of travel, together with all the other necessary information, are transmitted automatically by the trains to the RBC at given intervals. The movement of the trains is thus monitored continuously by the RBC.
In second-level ERTMS-ETCS the Eurobalises assume only the function of reference points for control and correction of the positioning of the train along the line. The on-board computer processes continuously the data transferred and the maximum speeds allowed point by point.
In this regard, Figure 2 shows a scenario of example in which a second-level ERTMS-ETCS operates.
In particular, Figure 2 illustrates schematically:

a section of railway line (designated as a whole by 21), which comprises two Eurobalises (designated, respectively, by 211 and 212);
an RBC (designated by 22); and
a train (designated as a whole by 23), which moves along the section of railway line 21 and installed on board which is an on-board computer (designated by 231), which is connected to a receiver (designated by 232), to a GSM-R terminal 233, which exchanges information with the RBC 22, and to a control panel (designated by 234) configured for supplying information to the driver (designated by 235) of the train 23.

In detail, the RBC 22 sends to the GSM-R terminal 233 information regarding the section of railway line 21, such as, for example, authorizations for movement of the trains, slowing down thereof, and maximum speeds allowed. The GSM-R terminal 233 supplies the information received from the RBC 22 to the on-board computer 231. The on-board computer 231 displays on the control panel 234 the information received from the RBC 22 via the GSM-R terminal 233 together with other information (for example, the current braking profile of the train 23) obtained via processing of said information received from the RBC 22 and of other information regarding the train 23 (for example, the speed, weight, and length of the train 23).
Moreover, each of the two Eurobalises 211 and 212 is georeferenced, i.e., knows the respective exact position, and transmits upon passage of the trains, via inductive means or via radio, the respective position. When the train 23 passes over the Eurobalises 211 and 212, the receiver 232 receives the positions transmitted by said Eurobalises 211 and 212 and supplies them to the on-board computer 231.
In addition, the on-board computer 231 is connected to an on-board odometer (not shown in Figure 2 for reasons of simplicity) of the train 23 in order to receive from the latter estimates of the position of the train 23. The on-board computer 231 corrects said estimates on the basis of the positions received from the Eurobalises 211 and 212. The on-board computer 231 displays on the control panel 234 the estimates of position supplied by the on-board odometer when it does not have available the exact positions supplied by the Eurobalises 211 and 212, whereas, when it receives the exact positions supplied by the Eurobalises 211 and 212, it displays said exact positions on the control panel 234.
Finally, the position of the train 23, the direction of travel of the train 23, together with all the other necessary information, are transmitted automatically by the on-board computer 231 to the RBC 22 via the GSM-R terminal 233. In this way, the RBC 22 monitors the movement of the train 23.
As regards, instead, the third-level ERTMS-ETCS, this is still under study since some aspects regarding train safety must still be studied in greater depth. Broadly speaking, the third-level ERTMS-ETCS envisages elimination of many ground apparatuses and entrusting of location and control of integrity of the trains to purposely designed on-board transmitting apparatuses that dialogue continuously with a centre for processing and control of the data regarding travel of the trains over the stretch. In addition, the third-level ERTMS-ETCS will surpass the concept of fixed block section introducing that of dynamic block section not modelled on a pre-set physical space, but created according to the circulation requirements and to the possibilities afforded by the radio transmitting system.
A known system with intrinsic safety for low railroad traffic density lines is described in the European patent application EP 1 705 095 A1 .
In particular, EP 1 705 095 A1 discloses a train traffic block system on one track of a railroad line, wherein said block system comprises an onboard block signalling aid unit per vehicle, in turn including:

a global navigation satellite system GNSS receiver providing georeferenced position P_GNSS and/or speed S_GNSS measurements of said train for each time period T_GNSS;
a group of sensors and means of connection with an odometer providing measurements of the angular speed of the vertical axis of the tractor unit ω₂ of said train and of the speed S_ODOM of said train;
a data acquisition and reasonability module configured so as to receive said measurements and to compare speed S_GNSS and S_ODOM measurements and to check said measurements with regard to pre-established reasonability criteria;
a module of safety qualification of the position P_GNSS measurement based on a digital database of said track, and configured so as to provide a projection of the safety-qualified position of the train on the track P_Proj;
a navigation and decision module configured to receive said safety-qualified position P_Proj measurement and/or the available speed S_GNSS and/or S_ODOM measurements, both checked by the data acquisition and reasonability module, and to determine the most likely location of said train Pest, and its location in terms of kilometer point P_k, and its estimated speed S_est;
a siding passage and track occupancy detection module configured so as to receive said position Pest and angular speed ω_z measurements, checked by the data acquisition and reasonability module, and configured so as to determine, from a digital track database with the singular siding points, the train status in terms of track occupancy or track status TS (that is, it attempts to determine if the train is in the siding area and, if it is, on which track the train is located, or it determines non-determination if the conditions necessary for determining the location of the train with sufficient safety are not present); and
a two-way radio communication subsystem for sending at least the position P_k of said train and the track occupancy status TS to a centralized traffic control CTC center.

On the other hand, the centralized traffic control CTC center according to EP 1 705 095 A1 comprises:

two-way radio communication means for receiving said position P_k of said train and the track occupancy status TS; and
data acquisition, processing and display equipment configured so as to extract, among others, said position P_k and the track occupancy status TS, and to graphically represent the occupancy status of the line track sections on a data display screen.

Furthermore, a known GNSS-based Railway User Navigation Equipment (RUNE) is described by Albanese et al. in the article "The Rune project: The Integrity Performances of GNSS-Based Railway User Navigation Equipment", Proceedings of the ASME/IEEE Joint Rail Conference, ASME, New York, NY, US, vol. 29, 16 March 2005, pages 211-218.
In particular, the GNSS-based RUNE described in the aforesaid article exploits navigation data coming from GPS with differential EGNOS corrections to determine train's position and velocity and integrates the use of GNSS signals with inertial sensors and on-board odometers in an intelligent system of mutual calibration, error filtering and error correction.

OBJECT AND SUMMARY OF THE INVENTION

The present applicant has decided to tackle the need for reliable positioning systems for control of trains in movement and, consequently, has conducted an in-depth study aimed at developing an innovative system for locating trains that is able to meet said need of the railway sector and to guarantee safety of rail traffic.
The aim of the present invention is hence to provide a system for locating trains that will be able to supply a reliable location and to guarantee safety of rail traffic.
The aforesaid aim is achieved by the present invention in so far as it regards a satellite terminal and a system for locating trains according to what is defined in the annexed claims.

BRIEF DESCRIPTION OF THE DRAWINGS

For a better understanding of the present invention, some preferred embodiments, which are provided purely by way of explanatory and non-limiting example, will now be illustrated with reference to the annexed drawings (not in scale), wherein:

Figure 1 is a schematic illustration of a scenario of example in which a first-level ERTMS-ETCS operates;
Figure 2 is a schematic illustration of a scenario of example in which a second-level ERTMS-ETCS operates;
Figure 3 is a schematic illustration of a positioning system of a train according to a preferred embodiment of the present invention;
Figure 4 is a schematic illustration of an architecture of a system of an ERTMS-ETCS type that integrates inside it an architectural level for satellite location according to a preferred embodiment of the present invention;
Figure 5 shows the typical error of an odometer and the error of the odometer corrected using satellite location according to a preferred embodiment of the present invention;
Figure 6 shows a cartesian reference system provided by way of example used in the calculation of the position of a train according to a preferred embodiment of the present invention; and
Figure 7 shows plots that represent errors and levels of protection that can be obtained in locating a train using the present invention.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS OF THE INVENTION

The ensuing description is provided for enabling a person skilled in the sector to implement and use the invention. Various modifications to the embodiments presented will be immediately evident to persons skilled in the branch and the generic principles disclosed herein could be applied to other embodiments and applications, without thereby departing from the scope of the present invention.
Hence, the present invention is not to be understood as being limited to just the embodiments described and shown, but it must be granted the widest sphere of protection consistently with the principles and characteristics presented herein and defined in the annexed claims.
The present invention stems from the idea of the present applicant to exploit one or more Global Navigation Satellite Systems (GNSSs), such as, for example, the GPS, the European navigation satellite system Galileo, the Russian navigation satellite system GLONASS, etc., in order to locate a train. In fact, the present applicant has had the intuition that use of a GNSS for controlling travel of trains would enable considerable simplification of the track infrastructure, drastically reducing the number of balises and consequently the maintenance costs of the infrastructure, which are currently particularly high. In addition, the present applicant has likewise had the intuition that thanks to the use of the satellite-positioning information it would be possible to switch to a concept of continuous balise since the satellite datum can potentially be used at any point of railway networks.
Finally, the present applicant has also understood that, at the moment when a GNSS is exploited for location of trains, it is necessary, in order to guarantee safety of the rail traffic, to have available also a certification of the satellite position datum, i.e., information on the integrity of the estimate of position.
Consequently, a first aspect of the present invention regards a satellite terminal that is designed to be installed on board a train and is configured for:

receiving navigation signals from satellites belonging to one or more satellite navigation systems, for example belonging to the GPS and/or to the Galileo system and/or to the GLONASS;
storing georeferencing data of a railway route that is to be followed by the train; and
determining, on the basis of the georeferencing data stored and of the navigation signals received, a position of the train along the railway route and an integrity level associated to said calculated position.

In particular, the integrity level is indicative of a maximum error associated to the calculated position.
Since said satellite terminal determines the position of the train, also supplying in real time a certification, i.e., an integrity level, thereof, it is able to guarantee safety of the rail traffic. In particular, said satellite terminal, in order to certify the position of the train calculated on the basis of the navigation signals received from a plurality of GNSS satellites, verifies in real time proper operation of said GNSS satellites.
In what follows, operation of the satellite terminal according to the present invention will be described in detail.
As is obvious, a train can usually move along pre-set paths. This characteristic enables exploitation of a reduced number of GNSS satellites for calculating the position of a train. In particular, it is possible to calculate the position of a train using the navigation signals received from just two GNSS satellites. If more than two GNSS satellites are available, it is possible to obtain also information on the integrity of the satellite datum itself.
Furthermore, in addition to the information of integrity, it is also possible to improve the precision on the basis of the index of accuracy of the datum that can be achieved represented by the Geometric Dilution of Precision (GDOP), which is made up of a contribution linked to the positional uncertainty PDOP (Positional DOP) and a contribution linked to the time uncertainty TDOP (Time DOP); this index depends upon the angular distance that separates each of the GNSS satellites that are in view from the train to be located.
Within the framework of positional uncertainty it is moreover possible to identify the vertical uncertainty VDOP (Vertical DOP) linked to the vertical co-ordinate and the directional uncertainty in the plane of motion HDOP (Horizontal DOP). These concepts, which are well known in the field of aeronautic navigation, are subject to a profound reinterpretation in the context of analysis of motion of a train. In fact, in the railway sector, it is possible to introduce the concept of sDOP, where s stands for a curvilinear abscissa identifying the path imposed on a train by the tracks.
In particular, the uncertainty sDOP corresponding to the curvilinear abscissa s can be estimated by projecting the components of the positional error known in the classic approach on the direction of the path followed by the train, which constitutes an integration of the datum supplied by a possible inertial navigator on board the train, for example an odometer. The calculation itself of the DOP undergoes in any case a modification with respect to what occurs according to the classic approach in the field of aeronautic navigation. In fact, the presence of the geometrical constraint imposed by the tracks reduces the number of degrees of freedom, and hence the number of GNSS satellites necessary for evaluating the position. In particular, if the zero, i.e., the origin, of the curvilinear abscissa s is known, i.e., if the starting point of a train is known, the number of GNSS satellites necessary for evaluation of said curvilinear abscissa s and correction of the time offset drops to two. This means that, in the presence of a number of GNSS satellites, it is always possible to identify the best pair of, or set of three, GNSS satellites for the purposes of minimization of the sDOP, hence improving the precision in addition to the check on integrity.
Consequently, on the basis of what has just been described, the satellite terminal according to the present invention is conveniently designed for:

extracting from the navigation signals received positioning data corresponding to the GNSS satellites that have transmitted said navigation signals;
determining, on the basis of the georeferencing data stored and positioning data corresponding to at least two GNSS satellites, a position of the train along the railway route; and
determining, on the basis of the georeferencing data stored and positioning data corresponding to at least three GNSS satellites, an integrity level associated to said calculated position.

In order to determine the position of the train, said satellite terminal conveniently uses a cartesian reference system positioned in such a way that the axis z coincides with the local vertical to the Earth's surface, the axes y and x, which are perpendicular to one another, lie in a plane tangential to the Earth's surface, and the axis y is oriented in a direction concordant with the curvilinear abscissa s.
With the use of the curvilinear co-ordinate s and of the aforesaid cartesian reference system and imposing that the co-ordinate of the train with respect to the axis x is equal to 0 and that the co-ordinate of the train with respect to the axis z is equal to the mean local radius of the Earth increased by the mean local elevation (said values are known to the satellite terminal thanks to the georeferencing data stored that regard the stretch of railway covered by the train), it is possible to reduce to two the number of unknowns of the system of pseudo-range equations; i.e., the residual unknowns are the value of the curvilinear co-ordinate s and a time offset δt.
In particular, said time offset δt is due

principally to the time offset between the clock of the satellite terminal and the clock of the GNSS satellites from which said satellite terminal has received the navigation signals; and
secondarily to the phase offsets introduced into the navigation signals on account of various factors, for example on account of the multipath phenomenon, of the passage through the atmosphere, in particular the ionosphere, etc.

Two GNSS satellites are hence sufficient to solve the system of two pseudo-range equations in two unknowns; namely, it is possible to calculate the value of the curvilinear co-ordinate s and the time offset δt on the basis of the positioning data corresponding to just two GNSS satellites, whereas if positioning data corresponding to three or more GNSS satellites are available, it is also possible to introduce a criterion for evaluating the error committed in the determination of the curvilinear co-ordinate s.
For example, on the hypothesis that the satellite terminal receives navigation signals from five GNSS satellites, said satellite terminal, in order to calculate the position of the train and evaluate the error, can conveniently carry out the following operations:

for each possible combination of three GNSS satellites, the satellite terminal determines, on the basis of the positioning data corresponding to said three GNSS satellites, a respective time offset δt and a respective value of the co-ordinate y (i.e., of the curvilinear co-ordinate s) imposing, in the respective system of three pseudo-range equations, x = 0 and z equal to the mean local radius of the Earth increased by the mean local elevation (i.e., imposing z equal to a mean height h of the stretch of railway covered by the train, said mean height h being calculated on the basis of the georeferencing data of the stretch of railway stored by the satellite terminal); and,
for each possible combination of three GNSS satellites, the satellite terminal introduces in the respective system of three pseudo-range equations the respective values calculated for y and δt freeing x from the constraint of being equal to zero and thus determines the error that each pseudo-range equation introduces on the co-ordinate x on the basis of the pair of respective solutions found for y and δt.

In this way, the satellite terminal obtains, for each possible set of three GNSS satellites, a respective value for y, a respective value for δt, and three respective errors for x. Having available five GNSS satellites the satellite terminal can consider N sets of three GNSS satellites, i.e., N simple combinations of three GNSS satellites, where $N = \frac{5!}{(5 - 3)! 3!} = 10.$
From analysis of the errors, the satellite terminal can thus exclude the two GNSS satellites that cause the greatest error and hence consider only the combination or combinations formed by the GNSS satellites that cause the least error. In this way, the GNSS satellites with markedly erroneous data can be excluded from the calculation of the position of the train.
In particular, assuming that typically one or more sets of three GNSS satellites can be identified, it is possible to calculate, for each set of three satellites considered, a respective mean error corresponding to the co-ordinate x; specifically, it is possible to calculate the mean value of the three respective errors calculated corresponding to the co-ordinate x. Moreover, if we assume that the error has isotropic characteristics, the mean error corresponding to the co-ordinate x is also indicative of the mean error corresponding to the co-ordinate y, i.e., corresponding to the curvilinear co-ordinate s.
For each set of three GNSS satellites considered, it is hence possible to calculate:

on the basis of the respective mean error corresponding to x, a respective variance σ (which, on the hypothesis of isotropic error, is indicative of a respective variance of the error corresponding to y), if, for example, a Gaussian distribution of the error is assumed; and,
on the basis of the respective variance σ, a respective level of protection L_P, which is indicative of the maximum error potentially committed in the estimate of the position of the train and is, hence, inversely proportional to the accuracy of the estimate of the position of the train; for example, the level of protection L_P can be conveniently calculated as a multiple of the variance σ, i.e., L_P = A·σ, where A ≥ 2.

At this point, the satellite terminal rejects, on the basis of the levels of protection L_P calculated for the various sets of three GNSS satellites, the GNSS satellites that, when taken into account for calculating the position of the train, determine the highest levels of protection L_P, choosing for determining the position of the train the set or sets of three GNSS satellites that is/are formed only by the GNSS satellites that yield the lowest levels of protection L_P.
In particular, the satellite terminal can conveniently determine the position of the train on the basis of the calculated position (0, y, h ) that is associated to the minimum level of protection L_P, the integrity level associated to said position of the train hence being determined on the basis of said minimum level of protection L_P.
Alternatively, the satellite terminal can conveniently:

calculate, for each set of three GNSS satellites from which it receives navigation signals, a corresponding index DOP on the basis of the positioning data corresponding to said three GNSS satellites and of the corresponding position (0, y, h ) calculated on the basis of the positioning data corresponding to said three GNSS satellites, and a corresponding reliability index on the basis of said corresponding index DOP and of the corresponding level of protection L_P;
select a set of three GNSS satellites on the basis of the calculated reliability indices; for example, the satellite terminal can select the set of three GNSS satellites that corresponds to a reliability index that minimizes an appropriate combination of the index DOP and of the level of protection L_P; and
determine the position of the train and the integrity level associated to said position on the basis, respectively, of the position (0, y, h ) and of the level of protection L_P calculated for the set of three satellites selected.

In this way, a satellite terminal that receives navigation signals from five GNSS satellites is able to identify up to two "erroneous" GNSS satellites; namely, it cannot be used for calculation of the position of the train. In the case where there are three "erroneous" GNSS satellites, the satellite terminal still manages to choose the best configuration, but the error cannot be completely eliminated, and the value of the level of protection increases. In the case where the "erroneous" GNSS satellites are more than three, the satellite terminal no longer manages to determine the integrity, but supplies a higher level of protection.
In this regard, provided hereinafter are five examples of analysis of the integrity of the satellite datum in the case where the satellite terminal receives navigation signals from five GNSS satellites, each example being summed up in a respective table.

In particular, provided hereinafter are:
• Table 1, which summarizes a first scenario of example in which the satellite terminal receives the navigation signals from five GNSS satellites none of which causes errors (the satellites that do not cause errors being associated in the five tables below to the symbol "●"), i.e., in which all five GNSS satellites can be used by the satellite terminal to determine the position of the train with a minimum level of protection, i.e., committing a minimum error (said minimum level of protection being designated in the following tables by 1);
• Table 2, which summarizes a second scenario of example in which the satellite terminal receives the navigation signals from five GNSS satellites of which only one causes errors (the satellites that cause errors being associated in the following tables to the symbol "X"), i.e., in which four GNSS satellites can be used by the satellite terminal to determine the position of the train with the level of protection 1;
• Table 3, which summarizes a third scenario of example in which the satellite terminal receives the navigation signals from five GNSS satellites of which two cause errors, i.e., in which just three GNSS satellites can be used by the satellite terminal to determine the position of the train with the level of protection 1;
• Table 4, which summarizes a fourth scenario of example in which the satellite terminal receives the navigation signals from five GNSS satellites of which three cause errors, i.e., in which the satellite terminal manages to determine the position of the train only with an medium level of protection, i.e., with a medium error (said medium level of protection being designated in the following tables by 2); and
• Table 5, which summarizes a fifth scenario of example, in which the satellite terminal receives the navigation signals from five GNSS satellites of which four cause errors, i.e., in which the satellite terminal manages to determine the position of the train only with a high level of protection, i.e., with a very high error (said high level of protection being designated in the following tables by 3).

TABLE 1 (5 satellites all of which usable)

		Combinations of three satellites
		C₁	C₂	C₃	C₄	C₅	C₆	C₇	C₈	C₉	C₁₀
Satell ites	S₁	●	●	●	●	●	●
	S₂	●	●	●				●	●	●
	S₃	●			●		●	●	●		●
	S₄		●		●	●		●		●	●
	S₅			●		●	●		●	●	●
Level of protection		1	1	1	1	1	1	1	1	1	1

TABLE 2 (5 satellites, 4 of which usable)

		Combinations of three satellites
		C₁	C₂	C₃	C₄	C₅	C₆	C₇	C₈	C₉	C₁₀
Satell ites	S₁	●	●	●	●	●	●
	S₂	X	X	X				X	X	X
	S₃	●			●		●	●	●		●
	S₄		●		●	●		●		●	●
	S₅			●		●	●		●	●	●
Level of protection		2	2	2	1	1	1	2	2	2	1

TABLE 3 (5 satellites, 3 of which usable)

		Combinations of three satellites
		C₁	C₂	C₃	C₄	C₅	C₆	C₇	C₈	C₉	C₁₀
Satell ites	S₁	●	●	●	●	●	●
	S₂	X	X	X				X	X	X
	S₃	●			●		●	●	●		●
	S₄		X		X	X		X		X	X
	S₅			●		●	●		●	●	●
Level of protection		2	3	2	2	2	1	3	2	3	2

TABLE 4 (5 satellites, 2 of which usable)

		Combinations of three satellites
		C₁	C₂	C₃	C₄	C₅	C₆	C₇	C₈	C₉	C₁₀
Satell ites	S₁	●	●	●	●	●	●
	S₂	X	X	X				X	X	X
	S₃	X			X		X	X	X		X
	S₄		X		X	X		X		X	X
	S₅			●		●	●		●	●	●
Level of protection		3	3	2	3	2	2	3	3	3	3

TABLE 5 (5 satellites, just one of which usable)

		Combinations of three satellites
		C₁	C₂	C₃	C₄	C₅	C₆	C₇	C₈	C₉	C₁₀
Satell ites	S₁	X	X	X	X	X	X
	S₂	X	X	X				X	X	X
	S₃	X			X		X	X	X		X
	S₄		X		X	X		X		X	X
	S₅			●		●	●		●	●	●
Level of protection		3	3	3	3	3	3	3	3	3	3

The examples just described all regard the case where the satellite terminal receives navigation signals from five GNSS satellites, which represents the most frequent case for a GNSS receiver. In any case, the methodology of calculation of the position of a train just described can be applied, obviously, also to the case where the satellite terminal receives navigation signals from four GNSS satellites. In this case, the sets of three GNSS satellites that can be considered are four and, hence, it is possible to identify just one satellite with error. In addition, the methodology of calculation of the position of a train just described can be applied, obviously, also to the cases where the satellite terminal receives navigation signals from more than five GNSS satellites. In these cases, the number of satellites with error that may be identified increases.
According to a second aspect of the present invention, the satellite terminal described previously can be advantageously exploited with a first-level, second-level, and third-level ERTMS-ETCS.
In particular, the position of the train supplied by the satellite terminal, together with the information of integrity concerning said position, can be advantageously exploited to correct the estimate of position supplied by the on-board odometer of a train. In this way, it is possible to avoid having to use a dense distribution of Eurobalises (one per kilometre or less) and limit use thereof to a very few points. In fact, the integral positioning datum supplied by the satellite terminal is substituted for and expands the concept of balise. In fact, the use of the satellite position datum prevents the integration error of the odometer, which is based on the datum of angular velocity, and hence the satellite position datum, if associated to a notable point, constitutes a virtual balise. In addition, the satellite position datum is much more representative: associated to a completely georeferenced railway line, it can be used at any instant along the route, hence revolutionizing the very idea of fixed notable points.
A technical advantage associated to the use of the satellite terminal previously described is represented by the fact that the latter enables use of on-board odometers that are less precise and hence less costly (both as product and from the standpoint of the service life).
Figure 3 is a schematic illustration of a system for locating trains according to a preferred embodiment of the present invention.
In particular, Figure 3 shows, by way of non-limiting example, integration of said positioning system in a second-level ERTMS-ETCS.
In detail, Figure 3 shows:

a section of railway line (designated as a whole by 31), which comprises a Eurobalise (designated by 311);
an RBC (designated by 32); and
a train (designated as a whole by 33), which moves along the section of railway line 31 and installed on board which is an on-board computer (designated by 331), which is connected to a receiver (designated by 332), to a GSM-R terminal 333, which exchanges information with the RBC 32, to a GNSS terminal 334, which stores the georeferenced route that the train 33 is following and calculates the position of the train 33 in the way described previously, and a control panel (designated by 335) configured for supplying information to the driver (designated by 336) of the train 33.

In detail, the RBC 32 sends to the GSM-R terminal 333 information regarding the section of railway line 31, such as, for example, authorizations for movement of the trains, slowing down thereof, and maximum speeds allowed. The GSM-R terminal 333 supplies the information received from the RBC 32 to the on-board computer 331. The on-board computer 331 displays on the control panel 335 the information received from the RBC 32 via the GSM-R terminal 333 together with other information (for example, the current braking profile of the train 33) obtained on the basis of processing of said information received from the RBC 32 and of other information regarding the train 33 (for example, the speed, weight, and length of the train 33).
Moreover, the Eurobalise 311 is georeferenced, i.e., it knows its own exact position, and transmits upon passage of the trains, via inductive means or via radio, said exact position. When the train 33 passes over the Eurobalise 311, the receiver 332 receives the position transmitted by said Eurobalise 311 and supplies it to the on-board computer 331.
In addition, the on-board computer 331 is connected to an on-board odometer (not shown in Figure 3 for reasons of simplicity) of the train 33 to receive from the latter estimates of the position of the train 33. The on-board computer 331 is configured for:

if it receives from the receiver 332 the exact position supplied by the Eurobalise 311, determining, as position of the train 33, the exact position supplied by the Eurobalise 311 and correcting the estimate of position supplied by the on-board odometer on the basis of said exact position;
if it does not receive from the receiver 332 the exact position supplied by the Eurobalise 311 and the GNSS terminal 334 supplies a position associated to an integrity level that meets specific conditions of railway safety, determining, as position of the train 33, the position supplied by the GNSS terminal 334 and correcting the estimate of position supplied by the on-board odometer on the basis of said position supplied by the GNSS terminal 334;
if it does not receive from the receiver 332 the exact position supplied by the Eurobalise 311 and the GNSS terminal 334 supplies a position associated to an integrity level that does not meet specific conditions of railway safety, determining, as position of the train 33, the estimate of position supplied by the on-board odometer;
if it does not receive from the receiver 332 the exact position supplied by the Eurobalise 311 and the GNSS terminal 334 does not supply any position (for example, because the train 33 is located in an area not covered by any GNSS), determining, as position of the train 33, the estimate of position supplied by the on-board odometer.

The specific conditions of railway safety can be conveniently stored by the on-board computer 331 and/or determined dynamically by the on-board computer 331 and/or supplied dynamically to the on-board computer 331 by the RBC 32 via the GSM-R terminal 333. For example, the on-board computer 331 can determine the specific conditions of railway safety on the basis of the information regarding the section of railway line 31 received from the RBC 32 and of data regarding the train 33, such as, for example, the speed, weight, and length of the train 33. In particular, the on-board computer 331 can conveniently evaluate whether the current integrity level associated to the position supplied by the GNSS terminal 334 meets the conditions of railway safety for the section of railway line 31 in order to guarantee safety of rail transport on said section of railway line 31.
Finally, the position of the train 33, the direction of travel of the train 33, together with all the other necessary information, are transmitted automatically by the on-board computer 331 to the RBC 32 via the GSM-R terminal 333. In this way, the RBC 32 monitors the movement of the train 33.
On the basis of what has been described above, it is clear that the satellite terminal according to the present invention is particularly useful in the perspective of the ERTMS-ETCS in so far as:

it guarantees a procedure of certification of the position datum in real time; i.e., it is able to supply in real time an integrity level of the position calculated;
it enables its integration in the first-level and second-level ERTMS-ETCS with minimal modifications of the current configuration of said system; in particular, it does not require any substantial modifications to the Radio Block Centre and requires only a few modifications to the system on board the trains;
it is able to function as a virtual balise, thus enabling evolution of the use of balises from the concept of discrete use to the particularly innovative concept of use without any discontinuity, which enables correction of the error of the on-board odometer at any point of the stretch of railway and hence enables introduction of the third level of the ERTMS-ETCS, i.e., of the mobile block.

In summary, the satellite location according to the present invention can be conveniently integrated in the ERTMS-ETCS architecture as an overlay level, as shown schematically in Figure 4.
In particular, Figure 4 shows a block diagram, which illustrates an architecture of a system of an ERTMS-ETCS type, which integrates the satellite location according to the present invention.
In detail, the architecture shown in Figure 4 comprises:

an architectural level of an ERTMS-ETCS type 41; and
an architectural level of GNSS location 42 according to the present invention, which is partially overlaid on the architectural level of an ERTMS-ETCS type 41.

if a balise is present, the position of the train is the one supplied by the balise, and the error of the on-board odometer is zeroed using the position supplied by the balise;
if no balise is present and the integrity level supplied by the GNSS location meets specific conditions of railway safety, the position of the train is the one obtained via GNSS location, and the error of the on-board odometer is corrected using the position obtained via GNSS location;
if no balise is present and the integrity level supplied by the GNSS location does not meet specific conditions of railway safety, the position of the train is the one supplied by the on-board odometer; and
if no balise is present and the GNSS location does not supply any position, the position of the train is the one supplied by the on-board odometer.

Assuming that the balises can be positioned with extreme precision (of the order of the metre) via a georeferencing (for example, using GPS receivers) having statistics that are quite long in time, the errors in the case of the ERTMS-ETCS principally depend upon the accuracy of the on-board odometer, the type of route that the train has covered (slipping on the rail, braking, etc.), and the distance between two consecutive balises.
Figure 5 is a plot representing the error of the odometer and the error of the odometer corrected on the basis of the position obtained via GNSS location as a function of the position of the train (assuming a speed of the train of 300 km/h and linear slipping errors).
As shown in Figure 5, the maximum error due to the odometer after 10 km is 300 m, whereas the error of the odometer corrected on the basis of the position obtained via GNSS location is always of the order of a few metres.
The error of the GNSS location basically depends upon the measurement of position and is of the order of some metres irrespective of the conditions of speed of the train since the position is obtained directly from satellite triangulation and not from integrations of the speed (as in the case of the odometer). It is moreover possible to decrease the ionospheric error using GNSS signals on two frequencies.
An important advantage of the present invention derives from the possibility of obtaining the information of error from the data of calculation of the position, exploiting the constraint for the train of having to follow the georeferenced track. In fact, in this way, as previously described, the unknowns for the train become two: the curvilinear co-ordinate and the time offset.
In this regard, in Figure 6 shows a cartesian reference system z_sx_sy_s provided by way of example used in the calculation of the position of a train according to the present invention.
In particular, as shown in Figure 6, the axis y_s represents the curvilinear abscissa s along which the train moves, the axis x_s represents the direction normal to the curvilinear abscissa s, and z_s represents the local vertical to the Earth's surface. In Figure 6 moreover designated by 61 is the route followed by the train, which, as described previously, is positioned in such a way that for each point along said route 61 x_s = 0 and z_s = h, where h is the mean height of said route 61 calculated on the basis of the georeferencing data of said route 61. Assuming that x_s and y_s are isotropic as regards distribution of the errors (given that both the co-ordinates x_s and y_s lie in a plane tangential to the Earth's surface), as described previously it is possible to calculate the value of y_s (and the time offset) by solving the system of the pseudo-range equations and then recalculating the errors on x_s with respect to the position of nominal "0".
Evaluation of these errors for each satellite enables calculation of the level of protection L_P in such a way that said level of protection L_P is always greater than the error on y_s. The algorithm developed moreover enables important information on the various components of the error to be obtained, not least of which the contribution of the ionosphere.
Figure 7 shows a typical plot of the error and of the level of protection L_P on a route of approximately 60 km.
As shown in Figure 7, the error lies always within the level of protection L_P that is calculated in real time for the best set of three GNSS satellites available. The GNSS system for locating trains is able to identify malfunctioning of the GNSS satellites and eliminate from calculation of the position of the train the GNSS satellites that present malfunctioning. The route of the train can be both rectilinear and curvilinear and can be approximated with a high degree of precision. From Figure 7 it may be noted that, as compared to the error of 300 m over 10 km, due to the on-board odometer (error shown in Figure 5), GNSS location introduces errors of less than 30 m over a route having in practice any length. This implies that, to have errors of less than 30 m, it is reasonable to provide balises, instead of one every 2-3 km, one every 50-60 km without altering the precision of the measurement and the safety of the rail transport. From this standpoint, it should be noted that a balise can be set in places that are readily accessible for maintenance and easily controllable also from the point of view of safety of the systems.
Another important observation regards the continuous availability of the position datum, which makes it possible to face, at contained costs, introduction of the third level of the ERTMS-ETCS, i.e., the mobile block.
It is clear that, in the case where the satellite datum were not to be available or the error indicated by the integrity level were to be too high, e.g., more than 50 m (a situation that might last for a few seconds), the system is able to signal it (absence of level of protection or error beyond the limit) and the odometer would be for that period the only source of information that can be used (procedure of merging of the data based upon the exclusiveness mechanism) to avoid multiple information sources.
From the foregoing description the advantages of the present invention may be readily understood.
In particular, it should be emphasized once again that the present invention can be advantageously integrated in current systems and future systems (i.e., ones already in the design stage) for management, control, protection, and signalling of the rail traffic; in particular, it can be advantageously exploited with all three levels of the ERTMS-ETCS. In fact, the present invention:

supplies a position datum that guarantees an efficient service of positioning of the trains;
guarantees a precision of the position datum that enables improvement of the procedures of monitoring and control of travel of trains;
supplies in real time the integrity of the position datum, thus guaranteeing safety (in the sense of "safety of life") of the rail transport in real time; and
supplies the position datum in a way that is interoperative with the Eurobalises.

From a logic standpoint, the GNSS positioning datum associated to a georeferenced point along the track (notable point) constitutes a virtual balise. This implies that the number of physical balises can be reduced to the advantage of a simpler and more economic management and maintenance of the system.
The real advantage of the satellite datum lies, however, in the possibility of not being tied down to a rigid, albeit virtual, positioning of the reference points, providing what can be called a continuous-balise system. The concept of continuous balise is the turnkey towards the third level of the ERTMS-ETCS, which is not tied down to the fixed section of track. The key element for adoption of the satellite datum in the ERTMS-ETCS architecture is hence that of the integrity of the datum itself in real time.
Moreover, the present invention advantageously falls within the scenario of development of the Italian and European railways in which it has been hypothesized for the future to use the European navigation satellite system Galileo, which, as is known, will supply information of certification of operation of the satellites and of the error introduced on the position. But, since the present invention can be advantageously exploited with any GNSS, it makes it possible to expand the scenario of use of the satellite datum in positioning of trains. An important reason for using a system based not only on the Galileo system lies in the "control" factor. In fact, it would be unlikely for Russia, China, or India to use a non-proprietary system (i.e., Galileo) for a strategic and critical infrastructure such as the rail sector. In this perspective, in the case of railways, it could prove more valid to adopt a strategy of use of a number of constellations (both for back-up techniques and for comparison techniques), of which typically just one is controlled (in Europe Galileo, in Russia GLONASS, etc.). Hence, since the present invention can be used with one or more GNSSs, it would enable development of a system for locating trains that presents marked characteristics of interoperability between the railways of different countries.
Finally, it is once again emphasized that the present invention makes it possible to know at every instant not only the position of a train, but also the maximum error that is committed in this measurement and the check of proper operation of the satellites.
Finally, it is clear that various modifications may be made to the present invention, all of which fall within the sphere of protection of the invention as defined in the annexed claims.

Claims

A satellite terminal (334) designed to be installed on board a train (33) and configured to:
• store georeferencing data of a railway route of the train (33);

• receive navigation signals from satellites belonging to one or more satellite navigation systems;

• extract from the received navigation signals positioning data corresponding to the satellites that have transmitted said navigation signals; and

• determine, on the basis of the stored georeferencing data and of the received navigation signals, a position of the train (33) along the railway route and an integrity level associated with said determined position;
characterized by being further configured to:
• if said satellite terminal (334) receives navigation signals from only two satellites, determine the position of the train (33) along the railway route by computing a train's position bound to the railway route on the basis of the stored georeferencing data and of the positioning data corresponding to said two satellites; and,

• if said satellite terminal (334) receives navigation signals from three or more satellites,
- compute, for each set of three satellites from which navigation signals are received, a corresponding train's position bound to the railway route on the basis of the stored georeferencing data and of the positioning data corresponding to said three satellites, and a corresponding level of protection on the basis of said corresponding train's position bound to the railway route and of the positioning data corresponding to said three satellites, wherein said corresponding level of protection is indicative of a maximum error associated with said corresponding train's position bound to the railway route,

- select a set of three satellites according to a selection criterion based at least on the computed levels of protection, and

- determine the position of the train (33) along the railway route and the integrity level associated with said position on the basis, respectively, of the train's position bound to the railway route and of the level of protection computed for the selected set of three satellites.
The satellite terminal of claim 1, configured to, if said satellite terminal (334) receives navigation signals from only two satellites, determine the position of the train (33) along the railway route by:
• computing a first coordinate of a train's position bound to the railway route on the basis of the stored georeferencing data, wherein said first coordinate indicates a mean height of the railway route;

• imposing that a second coordinate of said train's position bound to the railway route is equal to zero; and

• computing a third coordinate of said train's position bound to the railway route on the basis of said first and second coordinates of said train's position bound to the railway route and of the positioning data corresponding to said two satellites, wherein said third coordinate corresponds to a curvilinear abscissa associated with the railway route;
wherein the satellite terminal (334) is configured to, if it receives navigation signals from three or more satellites, compute for each set of three satellites from which navigation signals are received:
• a corresponding train's position bound to the railway route by
- computing a first coordinate of said corresponding train's position bound to the railway route on the basis of the stored georeferencing data, wherein said first coordinate indicates a mean height of the railway route,

- imposing that a second coordinate of said corresponding train's position bound to the railway route is equal to zero, and

- computing a third coordinate of said corresponding train's position bound to the railway route and a corresponding time offset associated with the navigation signals received from said three satellites on the basis of said first and second coordinates of said corresponding train's position bound to the railway route and of the positioning data corresponding to said three satellites, wherein said third coordinate corresponds to a curvilinear abscissa associated with the railway route; and

• a corresponding mean error associated with the second coordinate of said corresponding train's position bound to the railway route on the basis of the first and third coordinates of said corresponding train's position bound to the railway route, of the corresponding time offset computed, and of the positioning data corresponding to said three satellites; and

• a corresponding level of protection on the basis of the corresponding mean error so that the maximum error associated with said corresponding train's position bound to the railway route is lower than said corresponding level of protection.
The satellite terminal of claim 2, wherein:
• the first coordinate of each computed train's position bound to the railway route corresponds to a first reference axis vertical with respect to the Earth's surface; and

• the second and third coordinates of each computed train's position bound to the railway route correspond, respectively, to a second reference axis and to a third reference axis that are mutually perpendicular and lie on a plane tangential to the Earth's surface.
The satellite terminal of claim 2 or 3, further configured to compute for each set of three satellites from which navigation signals are received:
• a corresponding variance associated with the corresponding mean error on the basis of a pre-defined probability distribution; and

• the corresponding level of protection on the basis of a multiple of the corresponding variance.
The satellite terminal according to any preceding claim, configured to select the set of three satellites for which the minimum level of protection has been computed.
The satellite terminal according to any claim 1-4, configured to:
• compute, for each set of three satellites from which navigation signals are received, a corresponding index of dilution of precision on the basis of the corresponding train's position bound to the railway route and of the positioning data corresponding to said three satellites, and a corresponding reliability index on the basis of said corresponding index of dilution of precision and of the corresponding level of protection; and

• select the set of three satellites on the basis of the computed reliability indices.
A system for locating trains designed to be installed on board a train (33), comprising the satellite terminal (334) claimed in any preceding claim, and configured to:
• acquire from an odometer installed on board the train (33) a current estimate of position supplied by said odometer;

• receive exact positions of the train (33) from a signalling system (311) installed along the railway route;

• if it receives from the signalling system (311) an exact position of the train (33), supply as current position of the train (33) said exact position and correcting the current estimate of position supplied by the odometer on the basis of said exact position;

• if it does not receive from the signalling system (311) any exact position of the train (33) and the satellite terminal (334) determines a current position of the train (33) along the railway route that is associated with an integrity level that satisfies pre-determined conditions of railway safety, supply as current position of the train (33) the current position determined by the satellite terminal (334) and correcting the current estimate of position supplied by the odometer on the basis of said current position determined by the satellite terminal (334);

• if it does not receive from the signalling system (311) any exact position of the train (33) and the satellite terminal (334) determines a current position of the train (33) along the railway route that is associated with an integrity level that does not satisfy the pre-determined conditions of railway safety, supply as current position of the train (33) the current estimate of position supplied by the odometer; and

• if it does not receive from the signalling system (311) any exact position of the train (33) and the satellite terminal (334) does not determine any current position of the train (33) along the railway route, supply as current position of the train (33) the current estimate of position supplied by the odometer.
A software product comprising software code portions that are:
• loadable into a memory of a satellite receiver designed to be installed on board a train (33) and to receive navigation signals from satellites belonging to one or more satellite navigation systems;

• executable by said satellite receiver; and

• such that to cause, when executed, said satellite receiver to become configured as the satellite terminal (334) claimed in any claim 1-6.
A software product comprising software code portions that are:
• loadable into a memory of a positioning system, which positioning system is designed to be installed on board a train (33), comprises the satellite terminal (334) claimed in any claim 1-6, and is configured to
- acquire from an odometer installed on board the train (33) a current estimate of position supplied by said odometer, and

- receive exact positions of the train (33) from a signalling system (311) installed along the railway route;

• executable by said positioning system; and

• such that to cause, when executed, said positioning system to become configured as the system for locating trains claimed in claim 7.