ES2651011T3 - Train location system with integrity verification of real-time location estimation - Google Patents

Abstract

A satellite terminal (334) designed to be installed on board a train (33) and configured to: * store georeferencing data of a train railway route (33); * receive navigation signals from satellites belonging to one or more satellite navigation systems; * extract from the received navigation signals the positioning data corresponding to the satellites that have transmitted said navigation signals; and * determine, on the basis of stored georeferencing data and received navigation signals, a train position (33) along the railway route and an integrity level associated with said determined position; characterized in that it is further configured to: * if said satellite terminal (334) receives navigation signals from only two satellites, determine the position of the train (33) along the railway route by calculating a train position limit for the railway route based on stored georeference data and positioning data corresponding to said two satellites; and * if said satellite terminal (334) receives navigation signals from three or more satellites, - calculating, for each set of three satellites from which the navigation signals are received, a corresponding train position limit for the railway route on the basis of the stored georeferencing data and the positioning data corresponding to said three satellites, and a corresponding level of protection based on said position limit of the corresponding train for the railway route and the corresponding positioning data to said three satellites, wherein said corresponding level of protection is indicative of a maximum error associated with said corresponding train position limit for the railway route, - selecting a set of three satellites according to a selection criteria based on less at the calculated levels of protection, and - determine the position of the train (33) at along the rail route and the level of integrity associated with said position on the basis, respectively, of the train position limit for the rail route and the protection level calculated for the selected set of three satellites.

Description

Train location system with integrity verification of real-time location estimation

Technical sector of the invention 5

The present invention relates, in general, to the location of trains and, in particular, to a system designed to estimate the position of a train and to verify in real time the integrity of the position estimate.

State of the art 10

As is known, in the railway sector there is a marked feeling of the need to develop positioning systems that are increasingly reliable to control moving trains in order to guarantee the safety of railway traffic. In the aeronautical sector, this need has been addressed with the use of satellite-based augmentation systems (SBAS), which allow increasing the accuracy of position estimation and, therefore, can be used to support air navigation. In addition, SBASs are designed to also provide a "life safety" signal and, therefore, can be used to support air traffic control systems.

The known SBAS type systems are: 20

• the European geostationary navigation overlay system (EGNOS), designed to provide the service for increasing the accuracy of position estimation on the European continent and in North Africa (particularly in northern Morocco, in Tunisia , Algeria and Libya);

• the wide area augmentation system (WAAS) developed in the United States of America and designed to provide the service of increasing the accuracy of position estimation in a vast area of the North American continent; Y

• the multifunctional satellite augmentation system (MSAS) developed in Japan and designed to provide the service for increasing the accuracy of position estimation in a vast area of the Asian continent.

 30

When all the SBAS mentioned are fully operational, an airplane that, for example, takes off from New York to go to London and then to New Delhi will always be under the coverage of said SBAS.

In particular, SBAS guarantees an accuracy of about two meters in the position estimation. In addition, SBAS also guarantees the reliability of the data received from the global positioning system 35 (GPS) and allows a much more accurate height calculation, which in the future can also be used for air navigation.

In detail, the SBAS, in order to provide information that allows the refinement of the estimation of the position made on the basis of the signals received from the GPS and in order to provide “life safety 40” signals, exploit:

• a plurality of geostationary satellites (that is, ones with fixed positions with respect to the Earth's surface, facing GPS satellites, which are in orbit);

• a plurality of ground stations that are properly georeferenced, are provided with an appropriate time reference (high precision clock), and are configured to determine the delays of the signals transmitted by the GPS satellites due to the ionization of the troposphere; Y

• a plurality of data processing base stations.

In greater detail, the SBAS, in order to determine the errors made in the estimation of the position 50 based on the signals received from the GPS, operate in the manner described later in this document. The ground stations detect the error of the data transmitted by the GPS satellites (which can mostly be attributed to the ionization of the lower layers of the atmosphere). To this end, the ground stations compare their own calculated position based on the signals received from the GPS satellites with the data from the orbits of the GPS satellites and with the respective certified positions. As is known, the GPS 55 receive the base calculation of their own position with the delay with which they receive the signal from the GPS satellites. Since each ground station knows the respective exact position and positions of the GPS satellites from which they have received the GPS signals (said positions being determined not on the basis of the signals received, but rather on the basis of data from the orbits of the satellites themselves), each ground station is therefore able to easily determine the error caused by the propagation of GPS signals through the atmosphere. Each ground station can, therefore, generate, on the basis of the calculated errors, a corresponding grid of surrounding points and detect the margin of error for each of these points, thereby expanding the area in which the errors of GPS calculated are valid. Consequently, in this way, each ground station determines a respective error model that is valid for a respective area of competence. The data generated by the ground stations is then sent to at least one data processing base station, which generates a very dense grid of corrective factors. This corresponds, in practice, to a large number of known position points, for each of which correction data is processed for the signal received from each GPS satellite. These data are updated in real time, to the extent that the conditions of propagation of the GPS signal through the atmosphere obviously change according to the conditions of the atmosphere itself. These corrective factors are then sent to the SBAS 5 satellites so that they can finally be retransmitted to ground using the same frequency as the GPS signals (i.e., the L1 frequency) and then received by the enabled user terminals. The terminal that receives the SBAS signals selects the valid data for the grid points closest to it, applies them to the satellites it is currently receiving and uses them to calculate its own position.

 10

In the railway sector, the use of SBAS is not easy. In fact, the “life safety” signal supply service has been designed primarily for aeronautical procedures, which are profoundly different from railway procedures. In fact, the railway procedures start from the idea that each train can be managed at any time along its route defining in real time, based on the state of the train and the level of knowledge of the position of said train, both the travel speed as a possible stop in case security procedures require it. The most sophisticated evolution of this train travel control process is represented by the European rail traffic management system (ERTMS) and by the European train control system (ETCS).

In particular, the ERTMS-ETCS integrated system is an advanced management, control, protection and signaling system for rail traffic designed to replace the multiple and incompatible traffic systems and the safety of the various European railways in order to guarantee the interoperability of trains in the various European rail networks and maximize the performance levels of the European rail networks, both high-speed and high commercial interest.

 25

The ERTMS-ETCS is composed of different teams, which have the purpose of implementing the functions mentioned above and is characterized by three different functional levels, namely a first functional level, a second functional level, and a third functional level. The definition of each functional level depends on how the railway line is equipped and how information is exchanged between the train and the monitoring stations.

 30

In the first level ERTMS-ETCS, the authorization for the movement and the corresponding information on the route are transmitted to the train and are shown in the cabin to the driver in a discontinuous manner using beacons, called “Eurobalizas”, which are distributed to along the tracks, they provide the autolocation of the train and transmit the conditions of the route, all this being able to be integrated by an additional series of transmission points that continuously supply the train with the information and the data of displacement control and positioning corresponding.

In particular, trains are currently equipped with on-board odometers, which are configured to measure the speed of the trains on which they are installed and to estimate the position of such trains by integrating the measured speed. In the first-level ERTMS-ETCS, Euroballs are used to calibrate 40 on-board odometers, that is, to correct position estimates provided by on-board odometers based on certified positions supplied by Eurobalies .

The first-level ERTMS-ETCS provides on-board signaling that can be added to the traditional signaling systems currently installed on the railway lines, leaving the latter in operation for the circulation of traditional trains.

The fixed transmission beacons (Eurobalizas) transmit, through adequate coding, the information supplied by the fixed line signals and provide the necessary equipment for the movement to the on-board train equipment. A computer on board the train processes maximum speeds and 50 braking curves based on data received from the Eurobalises. In order to be able to obtain the necessary information from the ground beacons, in particular the necessary authorizations for the following movements, it is necessary for the train to activate said beacons by passing on them. Information regarding the integrity of the train and the respective positioning is detected through the track circuits. By installing additional Eurobalizas (Euroloops) between a start signal of the section and an end of the signal signal, a sufficiently continuous transmission of the information can be obtained. Information can be transmitted by passing the locomotive through inductive means or by radio.

In this regard, Figure 1 shows an example scenario in which a first level ERTMS-ETCS operates.

 60

In particular, Figure 1 schematically illustrates:

• a section of the railway line (designated as a whole by 11), comprising two Eurobalizas (designated, respectively, by 111 and 112), which are connected to a line unit (designated by 113), which in turn is remotely connected to a control center (designated by 12); and 65

• a train (designated as a whole by 13), which moves along the section of the railway line 11 and in which an on-board computer (designated by 131) is installed on board, which is connected to a receiver (designated by 132) and a control panel (designated by 133) configured to provide information to the driver (designated by 134) of train 13.

In detail, the control center 12 sends to the line unit 113 information regarding the section of the railway line 11, such as, for example, the authorizations for the movement of the trains, slowing them down, and the maximum speeds allowed. The line unit 113 supplies Eurobalises 111 and 112 with the information received from the control center 12 together with other information provided by the fixed signaling systems (not shown in Figure 1 for simplicity) installed along the section of the railway line 11. Each of the two Eurobalizas 111 and 112 are georeferenced, that is, they know the exact exact position 10, and transmit to the passage of the trains, through inductive means or by radio, the respective position together with the information received from the line unit 113. When the train 13 passes over the Eurobalises 111 and 112, the receiver 132 receives the information transmitted by said Eurobalises 111 and 112 and supplies it to the on-board computer 131. The computer of a board 131 shows on the control panel 133 the information received through the receiver 132 together with more information (for example, the current braking profile of the train 13) obtained it gives through the processing of said received information and other information with respect to train 13 (for example, the speed, weight and length of train 13).

In addition, the on-board computer 131 is connected to an on-board odometer (not shown in Figure 1 for reasons of simplicity) of train 13 to receive the latest estimates of train position 13. The on-board computer 131 corrects these estimates on the basis of the positions received from Eurobalises 111 and 112. The on-board computer 131 shows in the control panel 133 the estimates of the position supplied by the on-board odometer when the exact positions supplied are not available for Eurobalizas 111 and 112, while, when it receives the exact positions supplied by Eurobalizas 111 and 112, it shows these exact positions on the control panel 133. 25

As regards the second level ERTMS-ETCS, on the other hand, this allows the management of the distance between the trains through radio communications between the trains and a control base station known as the "radio blocking center" (RBC), which, knowing the status of the line and the other trains, continuously sends the trains information regarding the line (such as, for example, authorizations for the movement of the 30 trains, the slowdown of the trains) , and the maximum speeds allowed) using a connection based on the international mobile telephony standard for rail communications “global system for rail mobile communications” (GSM-R). Therefore, trains can determine their own speed profile also based on their own weight and braking characteristics. The system intervenes in a timely manner in the case of possible security risks. 35

In particular, the second level ERTMS-ETCS is a system for signaling and protecting the train based on a radio transmission of digital data. In the cockpit of the trains shown on the control panels provided on purpose, there is information regarding the route and authorizations for the movement of trains received directly from the RBC. The train positions, the direction of travel, along with all other necessary information, are automatically transmitted by the trains to the RBC at certain intervals. Therefore, the movement of trains is continuously monitored by the RBC.

In the second level ERTMS-ETCS, the Eurobalizas assume only the function of the reference points for the control and correction of the train position along the line. The on-board computer continuously processes the transferred data and the maximum speeds allowed point by point.

In this regard, Figure 2 shows an example scenario in which a second level ERTMS-ETCS operates.

In particular, Figure 2 schematically illustrates:

• a section of the railway line (designated as a whole by 21), comprising two Eurobalizas (designated, respectively, by 211 and 212);

• an RBC (designated by 22); Y

• a train (designated as a whole by 23), which moves along the section of the railway line 21 and in 55 which is installed on board an on-board computer (designated by 231), which is connected to a receiver (designated by 232), a GSM-R 233 terminal, which exchanges information with RBC 22, and a control panel (designated by 234) configured to provide information to the driver (designated by 235) of train 23.

 60

In detail, the RBC 22 sends information regarding the section of the railway line 21 to the GSM-R233 terminal, such as, for example, train movement authorizations, train slowdowns, and maximum speeds allowed. The GSM-R terminal 233 supplies the information received from the RBC 22 to the on-board computer 231. The on-board computer 231 shows on the control panel 234 the information received from the RBC 22 through the GSM-R terminal 233 together with other information (for example, the current braking profile 65 of train 23) obtained through the processing of said information received from RBC 22 and other information with respect to train 23 (for example, speed, weight and train length 23).

On the other hand, each of the two Eurobalizes 211 and 212 is georeferenced, that is to say, it knows the respective exact position, and transmits after the passage of the trains, through inductive means or by radio, the respective position. When the train 23 passes over the Eurobalizas 211 and 212, the receiver 232 receives the positions 5 transmitted by said Eurobalizas 211 and 212 and supplies them to the on-board computer 231.

In addition, the on-board computer 231 is connected to an on-board odometer (not shown in Figure 2 for reasons of simplicity) of train 23 in order to receive the latest estimates of train position 23. The computer of a on board 231 corrects these estimates on the basis of the positions received from Eurobeds 10 211 and 212. The on-board computer 231 shows on the control panel 234 the estimates of the position supplied by the on-board odometer when the available exact positions supplied by Eurobalizes 211 and 212, while, when you receive the exact positions supplied by Eurobalizes 211 and 212, you display these exact positions on the control panel 234.

 fifteen

Finally, the position of the train 23, the direction of travel of the train 23, together with all other necessary information, are automatically transmitted by the on-board computer 231 to the RBC 22 through the GSM-R terminal 233. Of this The RBC 22 monitors the movement of train 23.

On the other hand, the third level ERTMS-ETCS is still being studied, since some 20 aspects related to train safety have yet to be studied in greater depth. In general terms, the third-level ERTMS-ETCS provides for the elimination of many terrestrial devices and to entrust the location and control of the integrity of trains to on-board transmission devices designed on purpose that continuously dialogue with a processing center and control of the data in relation to the displacement of the trains along the section. In addition, the third level ERTMS-ETCS will overcome the concept of fixed block section 25 by introducing the dynamic block section not modeled in a pre-established physical space, but created in accordance with the circulation requirements and the possibilities offered by the system of radio transmission

A known system with intrinsic safety for railway lines with low traffic density is described in European patent application EP 1 705 095 A1. 30

In particular, EP 1 705 095 A1 discloses a train traffic block system on a track of a railway line, in which said blocking system comprises an on-board block signaling assistance unit per vehicle , which includes:

 35

• a global GNSS satellite navigation system receiver that provides the PGNSS georeferenced position measurements and / or the SGNSS speed of said train for each TGNSS time period;

• a group of sensors and connection means with an odometer that provides measurements of the angular velocity of the vertical axis of the tractor unit ω2 of said train and of the SODOM speed of said train;

• a module for data acquisition and reasonableness configured in order to receive these measurements and to compare the SGNSS and SODOM speed measurements and to verify those measurements with respect to the pre-established reasonableness criteria;

• a safety qualification module of the PGNSS position measurement based on a digital database of said track, and configured in order to provide a projection of the train's qualified safety position on the PProj track; Four. Five

• a navigation and decision module configured to receive said PProj qualified safety position measurement and / or the SGNSS and / or SODOM available speed measurements, both verified by the data acquisition and reasonableness module, and to determine the location more probable of said train Pest, and its location in terms of the kilometer point Pk, and its estimated speed Sest;

• a detour passage and track occupancy detection module configured to receive said Pest position and 50 angular velocity ωz, verified by the data acquisition module and reasonableness, and configured to determine, from a database of digital tracks with unique deviation points, the state of the train in terms of occupation of the track or state of the TS route (that is, it tries to determine if the train is in the diversion zone and, if is, in which way the train is located, or determines the non-determination if the conditions necessary to determine the location of the train with sufficient safety are not present); and 55

• a two-way radio communication subsystem to send at least the Pk position of said train and the occupancy status of the TS track to a centralized traffic control center CTC.

On the other hand, the centralized traffic control center CTC according to EP 1 705 095 A1 comprises: 60

• a two-way radio communication means for receiving said Pk position of said train and the occupation status of track TS; Y

• data acquisition, processing and visualization equipment configured to extract, among others, said position Pk and the occupation status of the TS track, and graphically represent the occupation status of the 65 sections of the line track on a display screen of data.

In addition, a railway user navigation equipment based on a known GNSS (RUNE) is described by Albanese et al. in the article “The Rune project: The Integrity Performances of GNSS Based Based Railway Navigation Equipment”, Proceedings of the ASME / IEEE Joint Rail Conference, ASME, New York, NY, United States, vol. 5 29, March 16, 2005, pages 211-218.

In particular, the GNSS-based RUNE described in the aforementioned article exploits GPS navigation data with differential EGNOS corrections to determine train position and speed and integrate the use of GNSS signals with inertia sensors and odometers. on board in an intelligent system 10 of mutual calibration, error filtering and error correction.

Object and summary of the invention

The present applicant has decided to address the need for reliable positioning systems to control 15 moving trains and, consequently, an in-depth study has been carried out to develop an innovative system for the location of trains that is capable of satisfying such The need for the railway sector and to guarantee the safety of railway traffic.

The objective of the present invention is therefore to provide a system for the location of trains that is capable of providing a reliable location and ensuring the safety of railway traffic.

The above-mentioned objective is achieved by the present invention insofar as it relates to a satellite terminal and a system for the location of trains in accordance with what is defined in the appended claims. 25

Brief description of the drawings

For a better understanding of the present invention, some preferred embodiments, which are provided simply by way of explanation and not by way of limitation, will be illustrated below with reference to the 30 accompanying drawings (not in scale), in which:

• Figure 1 is a schematic illustration of an example scenario in which a first-level ERTMS-ETCS operates;

• Figure 2 is a schematic illustration of an example scenario in which a second level ERTMS-ETCS operates;

• Figure 3 is a schematic illustration of a train positioning system in accordance with a preferred embodiment of the present invention;

• Figure 4 is a schematic illustration of an architecture of a system of one type of ERTMS-ETCS that integrates within it an architectural level for satellite location according to a preferred embodiment of the present invention;

• Figure 5 shows the typical error of an odometer and the odometer error corrected using the satellite location according to a preferred embodiment of the present invention;

• Figure 6 shows an exemplary Cartesian reference system used in calculating the position of a train according to a preferred embodiment of the present invention; and 45

• Figure 7 shows graphical representations representing errors and levels of protection that can be obtained by locating a train using the present invention.

Detailed description of the preferred embodiments of the invention

 fifty

The following description is provided to enable a person skilled in the art to implement and use the invention. Various modifications to the presented embodiments will be immediately apparent to those skilled in the art and the generic principles disclosed herein could be applied to other embodiments and applications, without thereby departing from the scope of the present invention.

 55

Therefore, the present invention is not to be construed as limited to only the embodiments described and shown, but the broadest scope of protection should be granted in a manner consistent with the principles and features presented herein and defined in the appended claims. .

The present invention is based on the idea of the present applicant to exploit one or more global satellite navigation systems (GNSS), such as, for example, GPS, the European satellite navigation system Galileo, the Russian navigation system by GLONASS satellite, etc., in order to locate a train. In fact, the present applicant has had the intuition that the use of a GNSS to control the displacement of trains would allow a considerable simplification of the track infrastructure, drastically reducing the number of beacons and, consequently, the maintenance costs of the infrastructure, which are currently specifically 65 elevated. In addition, the present applicant has also had the intuition that thanks to the use of satellite positioning information it would be possible to switch to a concept of continuous beacon since the satellite data can potentially be used at any point of the rail networks.

Finally, the present applicant has also understood that, at the time when a GNSS is operated for the location of trains, it is necessary, in order to guarantee the safety of rail traffic, also to have a certification of the position data available of the satellite, that is, information on the integrity of the position estimate.

Accordingly, a first aspect of the present invention relates to a satellite terminal that is designed to be installed on board a train and that is configured to:

• receive navigation signals from satellites belonging to one or more satellite navigation systems, for example, belonging to GPS and / or the Galileo system and / or GLONASS;

• store georeferencing data of a railway route that the train must follow; and 15

• determine, on the basis of stored georeferencing data and received navigation signals, a train position along the railway route and an integrity level associated with said calculated position.

In particular, the level of integrity is indicative of a maximum error associated with the calculated position. twenty

Since said satellite terminal determines the position of the train, it also provides a certification in real time, that is, a level of integrity of the train, is capable of guaranteeing the safety of railway traffic. In particular, said satellite terminal, in order to certify the position of the train calculated on the basis of the navigation signals received from a plurality of GNSS satellites, verifies in real time the correct operation 25 of said GNSS satellites.

Next, the operation of the satellite terminal according to the present invention will be described in detail.

 30

As is evident, a train can, in general, move along pre-established paths. This feature allows the exploitation of a small number of GNSS satellites to calculate the position of a train. In particular, it is possible to calculate the position of a train using the navigation signals received from only two GNSS satellites. If there are more than two GNSS satellites available, it is also possible to obtain information about the integrity of the satellite data itself. 35

On the other hand, in addition to the integrity information, it is also possible to improve the accuracy based on the accuracy index of the data that can be achieved represented by the geometric precision dilution (GDOP), which is composed of a contribution linked to the uncertainty positional PDOP (positional DOP) and a contribution linked to time uncertainty TDOP (temporary DOP); This index depends on the angular distance 40 that separates each of the GNSS satellites that are in sight of the train to be located.

Within the framework of positional uncertainty, the vertical uncertainty VDOP (Vertical DOP) linked to the vertical coordinate and the directional uncertainty in the plane of motion HDOP (horizontal DOP) can also be identified. These concepts, which are well known in the field of aeronautical navigation, are subject to a profound reinterpretation in the context of the analysis of the movement of a train. In fact, in the railway sector, it is possible to introduce the concept of sDOP, where s represents a curvilinear abscissa that identifies the path imposed on a train by the tracks.

In particular, the sDOP uncertainty corresponding to the curvilinear abscissa can be estimated by projecting the 50 components of the positional error known in the classical approach in the direction of the path followed by the train, which constitutes an integration of the data provided by a possible inertial navigator. on board the train, for example, an odometer. The calculation of the PDO itself is subject in any case to a modification with respect to what happens according to the classic approach in the field of aeronautical navigation. In fact, the presence of the geometric constraint imposed by the tracks reduces the number of degrees of freedom and, therefore, the number of 55 GNSS satellites needed to assess the position. In particular, if zero is known, that is, the origin of the curvilinear abscissa s, that is, if the starting point of a train is known, the number of GNSS satellites necessary for the evaluation of said curvilinear abscissa s and the Time offset correction is reduced to two. This means that, in the presence of a number of GNSS satellites, it is always possible to identify the best pair of GNSS satellites, or a set of three, in order to minimize the sDOP, thereby improving accuracy 60 in addition to verifying the integrity.

Accordingly, based on what has just been described, the satellite terminal according to the present invention is conveniently designed to:

 65

• extract, from the received navigation signals, the positioning data corresponding to the GNSS satellites that have transmitted said navigation signals;

• determine, on the basis of stored georeferencing data and positioning data corresponding to at least two GNSS satellites, a train position along the railway route; Y

• determine, on the basis of the stored georeferencing data and the positioning data corresponding to at least three GNSS satellites, an integrity level associated with said calculated position. 5

In order to determine the position of the train, said satellite terminal conveniently uses a Cartesian reference system positioned such that the z axis coincides with the vertical local to the Earth's surface, the y and x axes, which are perpendicular to each other. , are in a plane tangential to the surface of the Earth, and the y axis is oriented in a direction consistent with the curvilinear abscissa 10

With the use of the curvilinear coordinate s and of the Cartesian reference system mentioned above and imposing that the coordinate of the train with respect to the x axis is equal to 0 and that the coordinate of the train with respect to the z axis is equal to the average local radius of the Land increased by the average local elevation (these values are known for the satellite terminal thanks to the stored georeferencing data that refer to the section of railway covered by the train), it is possible to reduce the number of unknowns of the system of two pseudo interval equations; that is, the residual unknowns are the value of the curvilinear coordinate s and a time shift δt.

In particular, said time shift δt is due

• mainly to the time offset between the satellite terminal clock and the GNSS satellite clock from which said satellite terminal has received the navigation signals; Y

• secondarily to the phase shifts introduced in the navigation signals due to various factors, for example, due to the multipath phenomenon, the passage through the atmosphere, in particular the ionosphere, etc.

Therefore, two GNSS satellites are sufficient to solve the system of two equations of pseudo interval in two unknowns; specifically, it is possible to calculate the value of the curvilinear coordinate s and the time shift δt based on the positioning data corresponding to only two GNSS satellites, while 30 if the positioning data corresponding to three or more GNSS satellites are available, you can also enter a criterion to evaluate the error made in determining the curvilinear coordinate s.

For example, in the hypothesis that the satellite terminal receives the navigation signals from five GNSS satellites, said satellite terminal, in order to calculate the train position and evaluate the error, the following operations can be conveniently performed:

• for each possible combination of three GNSS satellites, the satellite terminal determines, on the basis of the positioning data corresponding to said three GNSS satellites, a respective time shift δt and a respective coordinate value and (ie , of the curvilinear coordinate s) imposing, in the respective system of three equations of pseudo interval, x = 0 and z equal to the average local radius of the Earth increased by the average local elevation (that is, imposing z equal to an average height of the railway section covered by the train, said average height being calculated based on the georeferencing data of the train section stored by the satellite terminal); Y

• for each possible combination of three GNSS satellites, the satellite terminal enters into the respective system 45 of three equations of pseudo interval the respective values calculated for yy δt releasing x from the restriction to be equal to zero and therefore determines the error that each pseudo-interval equation enters in the x coordinate based on the pair of respective solutions found for yy δt.

In this way, the satellite terminal obtains, for each possible set of three GNSS satellites, a respective value for y, a respective value for δt, and three respective errors for x. Having five GNSS satellites available from the satellite terminal may consider N sets of three GNSS satellites, that is, N simple combinations of three GNSS satellites, where

 55

From the analysis of the errors, the satellite terminal can thus exclude the two GNSS satellites that cause the greatest error and therefore consider only the combination or combinations formed by the GNSS satellites that cause the least error. In this way, GNSS satellites with markedly erroneous data can be excluded from the train position calculation. 60

In particular, assuming that one or more sets of three GNSS satellites can usually be identified, for each set of three satellites considered, a respective mean error corresponding to the x coordinate can be calculated; specifically, it is possible to calculate the average value of the three respective errors calculated corresponding to the x coordinate. On the other hand, if the error is assumed to have isotropic characteristics, the average error corresponding to the x coordinate is also indicative of the average error corresponding to the y coordinate, that is, corresponding to the curvilinear coordinate s. 5

For each set of three GNSS satellites considered, it can therefore be calculated:

• on the basis of the respective mean error corresponding to ax, a respective variance σ (which, in the hypothesis of the isotropic error, is indicative of a corresponding variance of the corresponding error a), if, for example, a Gaussian distribution of the error; Y,

• on the basis of the respective variance σ, a respective level of protection LP, which is indicative of the maximum error potentially committed in estimating the train position and is, therefore, inversely proportional to the accuracy of the estimate of the position of the train; for example, the protection level LP can be conveniently calculated as a multiple of the variance σ, that is, LP = A · σ, where A ≥ 2. 15

At this point, the satellite terminal rejects, based on the LP protection levels calculated for various sets of three GNSS satellites, the GNSS satellites which, when taken into account for the calculation of the train position, determine the highest levels of LP protection, choosing to determine the position of the train the set or sets of three GNSS satellites that is / are formed only by GNSS satellites that produce the lowest levels of LP protection.

In particular, the satellite terminal can conveniently determine the position of the train on the basis of the calculated position (0, and,) that is associated with the minimum level of protection LP, the level of integrity associated with said train position being determined by therefore on the basis of said minimum level of protection LP. 25 h

Alternatively, the satellite terminal can conveniently:

• calculate, for each set of three GNSS satellites from which it receives the navigation signals, a corresponding index DOP based on the positioning data corresponding to said three GNSS satellites 30 and the corresponding position (0, and ,) calculated on the basis of the positioning data corresponding to said three GNSS satellites, and a corresponding reliability index based on said corresponding index DOP and the corresponding level of protection LP; h

• select a set of three GNSS satellites based on the calculated reliability indices; for example, the satellite terminal may select the set of three GNSS satellites that corresponds to a reliability index that minimizes an appropriate combination of the index DOP and the LP protection level; Y

• determine the position of the train and the level of integrity associated with said position on the basis, respectively, of the position (0, and,) and of the level of protection LP calculated for the set of the three selected satellites. h

Thus, a satellite terminal that receives the navigation signals from five GNSS satellites is capable of identifying up to two “wrong” GNSS satellites; specifically, they cannot be used to calculate the train position. In the case where there are three “wrong” GNSS satellites, the satellite terminal manages to choose the best configuration, but the error cannot be completely eliminated, and the protection level value increases. In the case where the “wrong” GNSS satellites are more than three, the satellite terminal can no longer determine integrity, but provides a higher level of protection. Four. Five

In this sense, five examples of analysis of the integrity of the satellite data are provided hereunder in the case where the satellite terminal receives navigation signals from five GNSS satellites, each example is summarized in a respective table.

 fifty

In particular, they are provided hereinafter:

• Table 1, which summarizes a first example scenario in which the satellite terminal receives the navigation signals from five GNSS satellites none of which causes errors (satellites that do not cause errors are associated in the following five tables with the symbol "●"), that is, in which the five GNSS satellites can be used by the satellite terminal to determine the position of the train with a minimum level of protection, that is, making a minimum error (said minimum level being of protection designated in the following tables by 1);

• Table 2, which summarizes a second example scenario in which the satellite terminal receives the navigation signals from five GNSS satellites of which only one causes errors (the satellites causing errors associated in the following tables with the symbol "X"), that is, in which four 60 GNSS satellites can be used per satellite terminal to determine the position of the train with protection level 1;

• Table 3, which summarizes a third example scenario in which the satellite terminal receives the navigation signals from five GNSS satellites of which two cause errors, that is, in which only three GNSS satellites can be used per satellite terminal to determine the position of the train with protection level 1;

• Table 4, which summarizes a fourth example scenario in which the satellite terminal receives the navigation signals from five GNSS satellites of which three cause errors, that is, in which the satellite terminal manages to determine the position of the train only with a medium level of protection, that is, with a medium error (said average level of protection being designated in the following tables by 2); Y

• Table 5, which summarizes a fifth example scenario in which the satellite terminal receives the navigation signals from five GNSS satellites of which four cause errors, that is, in which the 5-satellite terminal manages to determine the position of the train only with a high level of protection, that is, with a very high error (said high level of protection being designated in the following tables by 3).

TABLE 1 (the 5 satellites can be used)

 Combinations of three satellites

 C1

 C2 C3 C4 C5 C6 C7 C8 C9 C10

 Satellites

 S1 ● ● ● ● ● ●

 S2 ● ● ● ● ● ●

 S3 ● ● ● ● ● ●

 S4 ● ● ● ● ● ●

 S5 ● ● ● ● ● ●

 Protection level

 1 1 1 1 1 1 1 1 1 1

 10

TABLE 2 (5 satellites, 4 can be used)

 Combinations of three satellites

 C1

 C2 C3 C4 C5 C6 C7 C8 C9 C10

 Satellites

 S1 ● ● ● ● ● ●

 S2 X X X X X X

 S3 ● ● ● ● ● ●

 S4 ● ● ● ● ● ●

 S5 ● ● ● ● ● ●

 Protection level

 2 2 2 1 1 1 2 2 2 1

TABLE 3 (5 satellites, 3 can be used)

 Combinations of three satellites

 C1

 C2 C3 C4 C5 C6 C7 C8 C9 C10

 Satellites

 S1 ● ● ● ● ● ●

 S2 X X X X X X

 S3 ● ● ● ● ● ●

 S4 X X X X X X

 S5 ● ● ● ● ● ●

 Protection level

 2 3 2 2 2 1 3 2 3 2

TABLE 4 (5 satellites, 2 can be used) 15

 Combinations of three satellites

 C1

 C2 C3 C4 C5 C6 C7 C8 C9 C10

 Satellites

 S1 ● ● ● ● ● ●

 S2 X X X X X X

 S3 X X X X X X

 S4 X X X X X X

 S5 ● ● ● ● ● ●

 Protection level

 3 3 2 3 2 2 3 3 3 3

TABLE 5 (5 satellites, only one can be used)

 Combinations of three satellites

 C1

 C2 C3 C4 C5 C6 C7 C8 C9 C10

 Satellites

 S1 X X X X X X

 S2 X X X X X X

 S3 X X X X X X

 S4 X X X X X X

 S5 ● ● ● ● ● ●

 Protection level

 3 3 3 3 3 3 3 3 3 3

The examples just described consider the case where the satellite terminal receives the navigation signals from five GNSS satellites, which represents the most frequent case for a GNSS receiver. In any case, the methodology for calculating the position of a train just described can be applied, of course, also for the case where the satellite terminal receives the navigation signals from four GNSS satellites. In this case, the sets of three GNSS satellites that can be considered are four and, therefore, it is possible to identify a single satellite with error. In addition, the methodology for calculating the position of a train just described can, of course, also be applied to cases where the satellite terminal receives the 10 navigation signals from more than five GNSS satellites. In these cases, the number of satellites with error that can be identified increases.

In accordance with a second aspect of the present invention, the satellite terminal described above can be advantageously exploited with a first level, second level, and third level ERTMS-ETCS. fifteen

In particular, the position of the train supplied by the satellite terminal, together with the integrity information in relation to said position, can be advantageously exploited to correct the estimation of the position supplied by the on-board odometer of a train. In this way, it is possible to avoid having to use a dense distribution of Eurobalizas (one per kilometer or less) and limit their use to a very few 20 points. In fact, the integral positioning data supplied by the satellite terminal is replaced and expands the beacon concept. In fact, the use of satellite positioning data prevents the odometer integration error, which is based on the angular velocity data, and therefore the satellite position data, if associated with a remarkable point, It constitutes a virtual beacon. In addition, the satellite positioning data is much more representative: associated with a completely georeferenced railway line, it can be used at any time along the route, thus revolutionizing the idea of fixed fixed points.

A technical advantage associated with the use of the satellite terminal described above is represented by the fact that the latter allows the use of on-board odometers that are less precise and therefore less expensive (both as a product and from the point of view of the service life). 30

Figure 3 is a schematic illustration of a system for locating trains in accordance with a preferred embodiment of the present invention.

In particular, Figure 3 shows, by way of non-limiting example, the integration of said positioning system into a second level ERTMS-ETCS. 35

In detail, Figure 3 shows:

• a section of the railway line (designated as a whole by 31), comprising a Eurobalize (designated by 311); 40

• an RBC (designated by 32); Y

• a train (designated as a whole by 33), which moves along the section of the railway line 31 and in which an on-board computer (designated by 331) is installed on board, which is connected to a receiver (designated by 332), to a GSM-R 333 terminal, which exchanges information with RBC 32, to a GNSS 334 terminal, which stores the georeferenced route that train 33 is following and calculates the position of train 33 45 in the manner described above, and a control panel (designated by 335) configured to provide information to the driver (designated by 336) of train 33.

In detail, the RBC 32 sends the information regarding the section of the railway line 31 to the GSM-R 333 terminal, such as, for example, the authorizations for the movement of the trains, the slowdown of the trains, and the maximum speeds allowed. The GSM-R terminal 333 supplies the information received from the RBC 32 to the on-board computer 331. The on-board computer 331 displays on the control panel 335 the information received from the RBC 32 through the GSM-R terminal. 333 together with other information (for example, the current braking profile of train 33) obtained on the basis of the processing of said information received from RBC 32 and other information related to train 33 (for example, speed, weight , and the length of the train 33).

 5

On the other hand, Eurobalize 311 is georeferenced, that is, it knows its own exact position, and transmits after the passage of trains, through inductive means or by radio, said exact position. When the train 33 passes over the Eurobalize 311, the receiver 332 receives the position transmitted by said Eurobalize 311 and supplies it to the on-board computer 331.

 10

In addition, the on-board computer 331 is connected to an on-board odometer (not shown in Figure 3 for reasons of simplicity) of the train 33 to receive estimates of the position of the train 33 from the latter. The on-board computer 331 is configured to:

• if the exact position supplied by Eurobaliza 311 is received from receiver 332, determine, as 15 train position 33, the exact position supplied by Eurobaliza 311 and correct the estimate of the position supplied by the on-board odometer on the base of said exact position;

• if the exact position supplied by Eurobaliza 311 is not received from the receiver 332 and the GNSS terminal 334 provides a position associated with a level of integrity that meets the specific railway safety conditions, determine how the position of train 33, the position supplied by the GNSS 20 334 terminal and correct the estimate of the position supplied by the on-board odometer based on that position supplied by the GNSS 334 terminal;

• If the exact position supplied by Eurobaliza 311 is not received from the receiver 332 and the GNSS 334 terminal supplies a position associated with a level of integrity that does not meet the specific railway safety conditions, determine how the position of the train 33 , the estimate of position 25 supplied by the on-board odometer;

• if the exact position supplied by Eurobaliza 311 is not received from the receiver 332 and the GNSS terminal 334 does not provide any position (for example, because train 33 is located in an area not covered by any GNSS), determine such as the position of train 33, the estimate of the position supplied by the on-board odometer. 30

The specific railway safety conditions can be conveniently stored by the on-board computer 331 and / or dynamically determined by the on-board computer 331 and / or dynamically supplied to the on-board computer 331 by the RBC 32 through the GSM-terminal R 333. For example, the on-board computer 331 can determine the specific railway safety conditions on the basis of the information with respect to the section of the railway line 31 received from the RBC 32 and of the data with respect to the train 33, such as, for example, the speed, weight, and length of train 33. In particular, the on-board computer 331 can conveniently assess whether the current level of integrity associated with the position supplied by the GNSS terminal 334 complies with the railway safety conditions for the section of the railway line 31 in order to guarantee the safety of the rail transport in said section of the railway line. railway line 31. 40

Finally, the position of the train 33, the direction of travel of the train 33, together with all other necessary information, are automatically transmitted by the on-board computer 331 to the RBC 32 through the GSM-R 333 terminal. In this way, the RBC 32 monitors the movement of train 33.

 Four. Five

On the basis of what has been described above, it is clear that the satellite terminal according to the present invention is specifically useful in the ERTMS-ETCS perspective insofar as:

• guarantees a certification procedure for real-time position data; that is, it is able to provide in real time a level of integrity of the calculated position; fifty

• allows its integration into the first level and second level ERTMS-ETCS with minimal modifications to the current configuration of said system; in particular, it does not require any substantial modification to the radio block center and requires only a few modifications to the on-board train system;

• It is capable of functioning as a virtual beacon, thus allowing the evolution of the use of beacons from the concept of discrete use to the especially innovative concept of use without any discontinuity, allowing the correction of the on-board odometer error in any point of the section of the railroad and therefore allows the introduction of the third level ERTMS-ETCS, that is, the mobile block.

In summary, the satellite location according to the present invention can be conveniently integrated into the ERTMS-ETCS architecture as an overlay level, as schematically shown in Figure 60 4.

In particular, Figure 4 shows a block diagram, illustrating an architecture of a system of an ERTMS-ETCS type, which integrates the satellite location according to the present invention.

 65

In detail, the architecture shown in Figure 4 comprises:

• an architecture level of one type of ERTMS-ETCS 41; Y

• a level of location architecture of GNSS 42 in accordance with the present invention, which partially overlaps the level of architecture of a type of ERTMS-ETCS 41. 5

As described above, the GNSS system for the location of trains according to the present invention works as follows:

• if a beacon is present, the train position is that supplied by the beacon, and the on-board odometer error is reset using the position supplied by the beacon;

• If the beacon is not present and the level of integrity provided by the GNSS location meets the specific railway safety conditions, the train position is that obtained through the GNSS location, and the on-board odometer error is correct using the position obtained through the GNSS location; fifteen

• if the beacon is not present and the level of integrity provided by the GNSS location does not meet the specific conditions of railway safety, the train position is that supplied by the on-board odometer; Y

• If the beacon is not present and the location of the GNSS does not provide any position, the train position is supplied by the on-board odometer. twenty

Assuming that the beacons can be placed with extreme precision (of the order of the meter) through georeferencing (for example, using GPS receivers) having statistics that are quite long over time, the errors in the case of ERTMS-ETCS depend mainly on the accuracy of the on-board odometer, the type of route the train has covered (sliding on the rail, braking, etc.), and the distance between two 25 consecutive beacons.

Figure 5 is a graphical representation representing the odometer error and the odometer error corrected on the basis of the position obtained by means of GNSS location as a function of the train position (assuming a train speed of 300 km / h and linear slip errors). 30

As shown in Figure 5, the maximum error due to the odometer after 10 km is 300 m, while the odometer error corrected on the basis of the position obtained through the GNSS location is always of the order of a few meters

 35

The GNSS location error basically depends on the measurement of the position and is of the order of a few meters, regardless of the train speed conditions since the position is obtained directly from the satellite triangulation and not from the integrations of the speed (as in the case of the odometer). In addition, it is possible to reduce the ionospheric error using GNSS signals at two frequencies.

 40

An important advantage of the present invention is obtained from the possibility of obtaining the error information from the position calculation data, exploiting the restriction for the train of having to follow the georeferenced path. In fact, in this way, as described above, the unknowns for the train become two: the curvilinear coordinate and the time offset.

 Four. Five

In this regard, an exemplary Cartesian zsxsys reference system is shown in Figure 6 as an example used in calculating the position of a train according to the present invention.

In particular, as shown in Figure 6, the y-axis, where is the average height of said route 61 calculated on the basis of the georeferencing data of said route 61. Assuming that xs represents the curvilinear abscissa sa along which the train moves, the xs axis represents the normal direction to the curvilinear abscissa, and zs represents the local vertical to the Earth's surface. In addition, in Figure 6 the route followed by the train is designated by 61, which, as described above, is positioned such that for each point along said route 61 xs = 0 and zs = se and s are isotropic in terms of the distribution of errors (since both xs and ys coordinates are in a plane tangential to the Earth's surface), as described above, the value of ys (and time offset) can be calculated by solving the system of the pseudo-interval equations and then recalculate the errors in xs with respect to the position of the nominal “0”. h h

The evaluation of these errors for each satellite allows the calculation of the LP protection level in such a way that said LP protection level is always greater than the error in ys. In addition, the developed algorithm allows to obtain 60 important information about the various components of the error to be obtained, not least of them is the contribution of the ionosphere.

Figure 7 shows a typical graphic representation of the error and the level of protection LP on a route of approximately 60 km. 65

As shown in Figure 7, the error is always within the LP protection level that is calculated in real time for the best set of three available GNSS satellites. The GNSS system for the location of trains is able to identify the malfunction of GNSS satellites and eliminate GNSS satellites that are malfunctioning from the train position calculation. The train route can be both straight and curvilinear and can be approached with a high degree of accuracy. From Figure 7 it can be seen that, in comparison with the error of 300 m over 10 km, due to the on-board odometer (error shown in Figure 5), the location of GNSS introduces errors of less than 30 m over a route that has any length in practice. This implies that, having errors of less than 30 m, it is reasonable to provide beacons, instead of one every 2-3 km, one every 50-60 km without altering the measurement accuracy and safety of rail transport. From this point of view, it should be noted that a beacon can be established in places that are easily accessible for maintenance and also easily controllable from the point of view of system security.

Another important observation regarding the continuous availability of the position data, which makes it possible to address, at contained costs, the introduction of the third level of the ERTMS-ETCS, that is, the mobile block.

 fifteen

It is clear that, in the case where the satellite data was not available or the error indicated by the level of integrity was too high, for example, more than 50 m (a situation that could last a few seconds), the system is capable if indicated (absence of level of protection or error beyond the limit) and the odometer would be for that period, the only source of information that can be used (data fusion procedure based on the exclusivity mechanism) to avoid multiple sources of information. twenty

From the above description, the advantages of the present invention can be easily understood.

In particular, it should be emphasized once again that the present invention can be advantageously integrated into current systems and future systems (i.e. those already in the design stage) for traffic management, control, protection and signaling. railway in particular, it can be advantageously exploited with the three levels of ERTMS-ETCS. In fact, the present invention:

• provides a position data that guarantees an efficient train positioning service;

• guarantees an accuracy of the position data that allows the improvement of the monitoring procedures and control of the displacement of the trains;

• provides in real time the integrity of the position data, thus guaranteeing the safety (in the sense of “life safety”) of rail transport in real time; Y

• supplies the position data in a way that is interoperable with Eurobalises.

 35

From a logical point of view, the GNSS positioning data associated with a georeferenced point along the track (notable point) constitutes a virtual beacon. This implies that the number of physical beacons can be reduced to the advantage of simpler and more economical management and maintenance of the system.

The real advantage of satellite data lies, however, in the possibility of not being tied to a rigid, though virtual, positioning of the reference points, providing what may be called a continuous beacon system. The concept of continuous beacon is the turnkey towards the third level of the ERTMS-ETCS, which is not tied to the fixed section of the track. The key element for the adoption of satellite data in the ERTMS-ETCS architecture is, therefore, the integrity of the data itself in real time.

 Four. Five

Furthermore, the present invention advantageously falls within the scenario of the development of the Italian and European railways in which the hypothesis for the future of using the European satellite navigation system Galileo has been formulated, which, as is known, will provide the information of certification of operation of the satellites and the error introduced in the position. But, since the present invention can be exploited advantageously with any GNSS, it makes it possible to expand the scenario of using satellite data in the positioning of the 50 trains. An important reason for using a system based not only on the Galileo system is found in the "control" factor. In fact, it would be unlikely that Russia, China or India would use a non-proprietary system (that is, Galileo) for strategic and critical infrastructure, such as the railway sector. In this perspective, in the case of railways, it might be more valid to adopt a strategy of using a series of constellations (both for backup techniques and for comparison techniques), of which usually only one (in 55 Europe Galileo, in Russia GLONASS, etc.). Therefore, since the present invention can be used with one or more GNSS, this would allow the development of a system for locating trains that have marked interoperability characteristics between the railroads of different countries.

Finally, it is emphasized once again that the present invention makes it possible to know at every moment not only the position of a train, but also the maximum error that has been committed in this measurement and the verification of the correct operation of the satellites

Finally, it is clear that various modifications can be made to the present invention, all of which fall within the sphere of protection of the invention as defined in the appended claims. 65

Claims (9)

1. A satellite terminal (334) designed to be installed on board a train (33) and configured to: • store georeferencing data of a train railway route (33); 5 • receive navigation signals from satellites belonging to one or more satellite navigation systems; • extract from the received navigation signals the positioning data corresponding to the satellites that have transmitted said navigation signals; Y • determine, on the basis of stored georeferencing data and received navigation signals, a train position (33) along the railway route and an integrity level associated with said determined position; characterized by being further configured to: • if said satellite terminal (334) receives navigation signals from only two satellites, determine the position of the train (33) along the railway route by calculating a train position limit for the railway route on the base of the stored georeferencing data and the positioning data corresponding to said two satellites; Y • if said satellite terminal (334) receives navigation signals from three or more satellites,  twenty - calculate, for each set of three satellites from which the navigation signals are received, a corresponding train position limit for the rail route based on the stored georeferencing data and the positioning data corresponding to said three satellites , and a corresponding level of protection on the basis of said position limit of the corresponding train for the railway route and of the positioning data corresponding to said three satellites, wherein said level of corresponding protection is indicative of a maximum error associated with said corresponding train position limit for the railway route, - select a set of three satellites according to a selection criterion based on at least the calculated levels of protection, and - determining the position of the train (33) along the railway route and the level of integrity associated with said position on the basis, respectively, of the train position limit for the railway route and the calculated level of protection for the selected set of three satellites. 2. The satellite terminal of claim 1, configured to, if said satellite terminal (334) receives navigation signals from only two satellites, determine the position of the train (33) along the railway route: • calculating a first coordinate of a train position limit for the railway route based on the stored georeferencing data, in which said first coordinate indicates an average height of the railway route; • imposing that a second coordinate of said train position limit for the rail route be equal to zero; Y • calculating a third coordinate of said train position limit for the railway route based on said first and second coordinates of said train position limit for the railway route and of the positioning data corresponding to said two satellites, wherein said third coordinate corresponds to a curvilinear abscissa associated with the railroad route; Four. Five in which the satellite terminal (334) is configured to, if it receives navigation signals from three or more satellites, calculate for each set of three satellites from which the navigation signals are received: • a corresponding train position limit for railway route 50 - calculating a first coordinate of said corresponding train position limit for the railway route based on the stored georeferencing data, in which said first coordinate indicates an average height of the railway route, - imposing that a second coordinate of said corresponding train position limit for railway route 55 be equal to zero, and - calculating a third coordinate of said corresponding train position limit for the railway route and a corresponding time offset associated with the navigation signals received from said three satellites based on said first and second coordinates of said position limit of the corresponding train for the railway route and the positioning data corresponding to 60 said three satellites, wherein said third coordinate corresponds to a curvilinear abscissa associated with the railway route; Y • a corresponding mean error associated with the second coordinate of said corresponding train position limit for the railway route based on the first and third coordinates of said corresponding train position limit for the railway route, of the displacement corresponding calculated time, and corresponding positioning data for said three satellites; Y • a corresponding level of protection on the basis of the corresponding mean of error such that the maximum error associated with said corresponding train position limit for the railway route is less than said corresponding level of protection.  5 3. The satellite terminal of claim 2, wherein: • the first coordinate of each train position limit calculated for the railway route corresponds to a first vertical axis of reference with respect to the Earth's surface; Y • the second and third coordinates of each train position limit calculated for the railway route 10 correspond, respectively, to a second reference axis and a third reference axis that are perpendicular to each other and are in a tangential plane to the Earth's surface. 4. The satellite terminal of claim 2 or 3, further configured to calculate for each set of three satellites from which navigation signals are received: • a corresponding variance associated with the corresponding mean error based on a predefined probability distribution; Y • the corresponding level of protection based on a multiple of the corresponding variance.  twenty 5. The satellite terminal according to any preceding claim, configured to select the set of three satellites for which the minimum protection level has been calculated. 6. The satellite terminal according to any claim 1-4, configured to:  25 • calculate, for each set of three satellites from which navigation signals are received, a corresponding index of dilution of accuracy based on the position limit of the corresponding train for the railway route and the positioning data corresponding to said three satellites, and a corresponding reliability index on the basis of said dilution index of the corresponding accuracy and the corresponding level of protection; and 30 • select the set of three satellites based on the calculated reliability indices. 7. A system for locating trains designed to be installed on board a train (33), comprising the satellite terminal (334) claimed in any preceding claim, and configured to:  35 • acquire a current estimate of the position supplied by said odometer from an odometer installed on board the train (33); • receive the exact train positions (33) from a signaling system (311) installed along the railway route; • if you receive from the signaling system (311) an exact position of the train (33), provide as the current position 40 of the train (33) that exact position and correct the current estimate of the position supplied by the odometer based on said exact position; • if you do not receive from the signaling system (311) no exact train position (33) and the satellite terminal (334) determines a current train position (33) along the railway route that is associated with a level of integrity that satisfies the predetermined railway safety conditions, provide as the current position of the train (33) the current position determined by the satellite terminal (334) and correct the current estimate of the position supplied by the odometer on the basis of said current position determined by the satellite terminal (334); • if you do not receive from the signaling system (311) no exact train position (33) and the satellite terminal (334) determines a current train position (33) along the railway route that is associated with a level 50 of integrity that does not satisfy the predetermined railway safety conditions, provide as the current train position (33) the current estimate of the position supplied by the odometer; Y • if you do not receive from the signaling system (311) any exact train position (33) and the satellite terminal (334) does not determine any current train position (33) along the railway route, provide as the position current train (33) the current estimate of the position supplied by the odometer. 55 8. A software product comprising parts of software code that can: • be loaded into a memory of a satellite receiver designed to be installed on board a train (33) and to receive navigation signals from satellites belonging to one or more satellite navigation systems; 60 • run by said satellite receiver; Y • make, when executed, that said satellite receiver becomes configured as the satellite terminal (334) claimed in any claim 1-6. 9. A software product comprising parts of software code that can: 65 • loaded into a memory of a positioning system, positioning system that is designed to be installed on board a train (33), comprising the satellite terminal (334) according to any claim 1-6, and which is configured for - acquire a current estimate of the position supplied by said odometer from an odometer installed on board the train (33), and - receive the exact train positions (33) of a signaling system (311) installed along the railway route; • be executed by said positioning system; and 10 • make, when executed, said positioning system to be configured as the system for locating trains according to claim 7.