JP2024080715A - Vehicle positioning system - Google Patents

Abstract

[Problem] To provide a vehicle positioning system with improved safety [Solution] A ground-side GNSS antenna 31 of a ground device 3 in a vehicle positioning system 1 is installed at a predetermined fixed point P and receives signals from a positioning satellite. A ground-side GNSS receiver 32 performs positioning based on the signal received by the ground-side GNSS antenna 31. An on-board GNSS antenna 21 of an on-board device 2 receives signals from a positioning satellite. The on-board GNSS receiver 22 performs positioning based on the signal received by the on-board GNSS antenna 21. A ground-side processing unit 34 detects a failure in the satellite positioning system based on a comparison between fixed point position information and the positioning result by the ground-side GNSS receiver 32. When the ground-side processing unit 34 detects a failure in the satellite positioning system, it causes a transmission unit 33 to transmit a stop command. When the receiving unit 23 receives the stop command from the transmission unit 33, the on-board processing unit 24 stops outputting the positioning result. [Selected Figure] Figure 1

Description

The present invention relates to a vehicle positioning system for determining the current position of a vehicle using a satellite positioning system.

There is a satellite positioning system (GNSS) that determines a position using signals from artificial satellites (see, for example, Non-Patent Document 1). Satellite positioning systems include GPS and quasi-zenith satellites.

It has been proposed to use GPS to obtain vehicle positioning data for railways (see, for example, Patent Document 1).

However, satellite positioning devices are not designed or manufactured for railways or safety equipment, and many of them use commercially available devices known as Commercial Off-The-Shelf (COTS). Note that COTS is a term used in international standards, and in Japanese Industrial Standards it is translated as "commercially available products" (see JIS C5750-4-3:2021).

IEC 62425 "Safety-related electronic systems for signaling" is an international standard. In order to use a positioning device as a safety device (a device for maintaining safety), certain conditions must be met, such as fail-safety as shown in IEC 62425 and independence between items, establishment of safety functions through risk assessment, and technical methods based on the TFTR (Tolerable Functional Failure Rate) of the function and the SIL (Safety Integrity Level) that corresponds to that TFTR.

For this reason, positioning devices must not only have high positioning accuracy, but also be compatible with the use of commercial off-the-shelf (COTS) products and the technical requirements for security equipment as defined by international standards.

IEC62425 is an international standardization of European standard EN50129, and since it has not been made into a JIS standard, it includes terms that have not been translated into Japanese by the Japanese Industrial Standards Committee (JISC). According to JISZ8115:2019 "Dependability (total reliability) terminology," which is a JIS standardization of IEC60050-192, an item is something that is the target, such as an individual part, component, device, functional unit, equipment, subsystem, or system. Fail safety is the property of a system that can maintain safety in the event of a failure (see the same JIS). In the domestic railway industry, the term corresponding to fail safety is fail-safe. Fail-safe means that even if a device fails, it remains in a safe state and does not operate in a dangerous manner (see JIS3013:2022 "Railway signal safety terminology").

This section explains fail safety in the international standard IEC 62425. This standard requires that for functions designated as high-risk SIL3 or SIL4, fail safety must be achieved in accordance with certain rules in the systems that implement the functions. As shown in Figures 2(a), (b), and (c), IEC 62425 specifies three methods for achieving fail safety, and specifies that these three methods may be achieved alone or in combination.

Figure 2(a) shows composite fail-safety. In composite fail-safety, two items (item A and item B) are compared, and if they do not match or if a failure is detected in either item, the output is stopped.

Figure 2(b) shows reactive fail-safety. In reactive fail-safety, the output of an item (item A) is monitored, and if a failure is detected, the output is stopped.

Figure 2(c) shows inherent fail-safety. In inherent fail-safety, if an item (item A) fails, a safe output is generated.

In complex fail safety and reactive fail safety, detection and negation are carried out. There are several items required for this detection and negation. These items will be explained below.

The first is independence between items. When detecting failures in items, independence between items (item independence) is considered important so that the devices detecting the failures do not fail due to a common cause.

The second is the relationship between SDT (Safe Down Time) and safety. As shown in Figure 3, the detection and negation time required to detect a fault and transition to the safe side is defined as SDT. It is necessary to evaluate whether the length of time it takes for this SDT to output a dangerous fault when the system is configured has any impact on the safety of the entire system.

The third is the relationship between SDR (Safe Down Rate) and safety. The frequency at which a failure is detected and transition to the safe side (Detection and Negation Rate) is defined as SDR. It is necessary to evaluate whether this SDR is consistent with TFFR (Tolerable Functional Failure Rate).

The following is a further explanation of item independence, which is considered important in IEC 62425. The standard stipulates that common cause failures (CCFs) are prevented by ensuring item independence. This item independence is confirmed from four perspectives, Type A to Type D, as shown in Table 1.

For hardware that implements safety integrity level SIL3 or SIL4 functionality, preventing electrostatic and electromagnetic coupling between items is a Type A measure.

Appropriately dealing with environmental influences, power sources, and input/output that affect the entire item is a Type C countermeasure.

For Type B, we will evaluate the impact of data transmission between items on the sharing of information, which may undermine independence.

For Type D, check whether independence is impaired by utilizing the functions of external devices that are commonly connected.

When implementing the functions of an item using software, it is necessary to evaluate the relationship and independence between the item and the software. For example, if the same software is used to detect failures in item A and item B in Figure 2(a), errors caused by that software cannot be detected. A similar problem occurs when the same software is used for item A and item B. Regarding this issue, when using multiple items with the same hardware design to achieve composite fail-safety, there are two ways to deal with it: using the same software, and using different software to ensure software diversity.

According to IEC 62279 "Railway sector: communication, signalling and processing systems - Software for railway control and protection systems", which is often referenced by railway safety systems, software diversity is not required, and is addressed by adjusting the strictness of software management and testing according to the SIL (Safety Integrity Level). When the same software is used, any errors in the software will inevitably result in a common cause failure (CCF), which can be a major cause of impeding item independence. For this reason, the basic idea of IEC 62279 is to reduce the likelihood of common cause failures occurring by improving software quality.

However, it is unlikely that software in COTS devices (commercially available off-the-shelf devices) is created using the management methods specified in IEC 62279. This poses a major problem when using COTS devices in security equipment.

When using a positioning device in a safety device, there is a method to ensure safety by adopting both composite fail-safety and inherent fail-safety. For example, as shown in Figure 4, there is a conventional method of attaching multiple tachometer generators to different axles. This method is based on ensuring physical independence by ensuring sufficient separation to prevent coupling for Type A independence and obtaining rotation speeds from different axles for Type C independence. In addition, the device that compares and integrates the two speeds uses the hardware of existing safety devices, and the software is also managed in the same way as existing safety devices. This method has been used since before IEC 62425 and IEC 62279 were established, and there is no significant contradiction when compared to current standards, except for the strictness of software management.

Next, let us consider the case where GNSS (Global Navigation Satellite System) is used. Figure 5 shows a configuration in which the tachometer generator is simply replaced with a GNSS receiver. The device that compares and calculates the outputs of two GNSS receivers complies with IEC 62425 and IEC 62279. This configuration differs from the configuration that uses a tachometer generator (see Figure 4) in the following two ways.

The first difference is that the configuration shown in Figure 5 receives from the same GNSS satellites, and the radio wave propagation paths are also nearly identical unless the GNSS antenna separation can be ensured. This is because effects that are nearly identical over a wide range, such as those in the ionosphere, cannot be eliminated by simply separating them at the front or rear of the train formation, even if multiple antennas are installed. For this reason, even if multiple GNSS receivers are installed in a train formation, it is difficult to eliminate common cause failures in the input to the GNSS receivers.

In the field of automobiles, for example, a vehicle electronic device and a method for diagnosing the failure thereof are known as a configuration similar to that shown in FIG. 5 (see Patent Document 2). In this device and method, two sets of GPS antennas and GPS receivers are arranged at a distance from each other across the vehicle interior space. This prevents one GPS receiver from adversely affecting the other GPS receiver. This is a measure for Type A of the GNSS receiver (GPS receiver) in FIG. 5. However, since the GPS satellites that are received are the same, if the positioning accuracy decreases due to, for example, a GPS satellite or the ionosphere, this becomes a common cause failure, and it is difficult to detect the failure. In other words, the measures for Type C of the GNSS antenna (GPS antenna) are insufficient for safety devices.

The second difference is that, unlike a speed generator, a GNSS receiver has software. Therefore, it is conceivable to adopt the IEC 62279 software management method that is consistent with the safety integrity level of the safety function to justify safety. However, using COTS only for the GNSS receiving hardware and creating the positioning algorithm using a management method that is consistent with IEC 62279 would reduce the cost benefits of using COTS.

Corresponding to these two different aspects, there are two challenges in using a GNSS receiver for position measurement (see Figure 5).

The first challenge is the impairment of independence (Type C) due to external influences. Such external influences include satellite system failures and anomalous radio wave propagation in the ionosphere. The safety function is to detect these failures and shut down the system (Detection and Negation). Therefore, it is sufficient to detect satellite system failures and anomalous radio wave propagation.

According to the specifications of the Quasi-Zenith Satellite System (registered trademark of "Michibiki"), the frequency of satellite failures when the ISF (Integrity Status Flag), an index showing an unexpected service error, is 1, is 1, and is 10 ^-8 /hour or less. This value is almost the upper limit compared to the THR (Tolerable Hazard Rate) set for important safety devices, so in terms of the THR concept alone, unsafe satellite failures are guaranteed to a certain extent. However, if the user's system detects and negates the event when ISF = 0, which is a worse situation, it remains a challenge to take measures to ensure that this function satisfies the TFFR (Tolerable Functional Failure Rate).

Furthermore, even if the service error frequency when ISF=1 is 10 ⁻⁸ /hour or less, this alone is not enough to make the system compliant with the IEC 62425 standard, and problems remain when standard compliance is a condition.

Next, it is possible to consider that compliance with satellite system standards is not taken into consideration, but that a certain THR (tolerable risk rate) is guaranteed, and to ensure safe operation when ISF = 0 by having the GNSS receiver comply with the standards. For example, the configuration shown in Figure 6 stops when ISF = 0, that is, operates on the safe side. However, this leads to a discussion of the safety of the software and hardware, as to whether GNSS receiver items A and B can output ISF while satisfying the required TFFR (tolerable functional failure rate). Having reached this point, it is conceivable to make a certain compromise, and this is not denied, but it would create issues in terms of compliance with standards.

In short, to comply with international standards, it is necessary to quantitatively describe how satellite system failures can be identified and how that information can be used to reliably detect and negate them.

The second issue is that the GNSS receiver has software. The GNSS receiver is the same as a general wireless receiver in that it down-converts the RF signal (radio frequency signal) to an intermediate frequency, performs IQ demodulation, correlates with the spread code, and extracts the code. On the other hand, the implementation of the GNSS positioning algorithm is the application software itself, and even if it is integrated into a single chip, there is no significant difference from software in terms of logic implementation. When using a GNSS receiver in a safety device, if the positioning produces an incorrect value, it is generally evaluated as having a very serious consequence, and a strict TFFR (tolerable functional failure rate) is required for the positioning function. For this reason, a SIL (safety integrity level) and SSIL (Software SIL, software safety integrity level) equivalent to this TFFR are assigned, and the GNSS receiver requires a management method required by the standard according to the SSIL level. However, creating software for GNSS receivers, which are mainly COTS (commercial off-the-shelf) products, using the management method required by the standard is not a very realistic solution at this time.

JP 2003-200829 A JP 2001-208823 A

JIS B 7912-8:2018 "Field test procedures for surveying instruments - Part 8: GNSS (RTK)"

The present invention aims to solve the above problems and provide a vehicle positioning system with improved safety.

The vehicle positioning system of the present invention is a system for locating the current position of a vehicle using a satellite positioning system, and includes an on-board device mounted on the vehicle and a ground device installed on the ground, the ground device having a ground-side GNSS antenna installed at a predetermined fixed point and receiving signals from a positioning satellite, a ground-side GNSS receiver that performs positioning based on the signals, a transmitter that transmits information, and a ground-side processing unit connected to the ground-side GNSS receiver and transmitter, and the on-board device has an on-board GNSS antenna that receives signals from the positioning satellite, and a ground-side GNSS receiver that performs positioning based on the signals. The vehicle has an on-board GNSS receiver that performs positioning, a receiving unit that receives information from the ground device, and an on-board processing unit connected to the on-board GNSS receiver and receiving unit, and the ground processing unit pre-stores fixed point position information, which is the position information of the fixed point, and detects a malfunction of the satellite positioning system based on a comparison between the fixed point position information and the positioning result by the ground GNSS receiver. When a malfunction of the satellite positioning system is detected, the on-board processing unit transmits a stop command to the transmitting unit, and when the receiving unit receives the stop command, the on-board processing unit stops outputting the positioning result.

In this vehicle positioning system, it is preferable that the on-board device has multiple sets of the on-board GNSS antennas and on-board GNSS receivers, and the on-board processing unit detects a malfunction of the on-board GNSS receiver based on a comparison of the positioning results from the multiple on-board GNSS receivers, and stops outputting the positioning results when it detects a malfunction of the on-board GNSS receiver.

In this vehicle positioning system, it is preferable that each of the multiple on-board GNSS receivers performs positioning using software created independently of each other.

According to the vehicle positioning system of the present invention, the ground equipment detects a malfunction in the satellite positioning system based on a comparison between fixed point position information and the positioning results from the ground-side GNSS receiver, and the on-board processing unit of the on-board equipment stops outputting the positioning results, so that malfunctions in the satellite system and abnormal radio wave propagation can be detected, improving safety.

FIG. 1 is a block diagram of a vehicle positioning system according to an embodiment of the present invention. 2(a), (b), and (c) are explanatory diagrams of fail-safe technical methods according to the international standard IEC62425. FIG. 3 is a diagram showing the concept of safe downtime (SDT) in the international standard. FIG. 4 is a block diagram of a conventional distance measurement system using a tachograph generator. FIG. 5 is a block diagram showing an example of positioning by a satellite positioning system. FIG. 6 is a block diagram showing an example of positioning using the integrity status flag (ISF) of a quasi-zenith satellite.

A vehicle positioning system according to one embodiment of the present invention will be described with reference to FIG. 1. The vehicle positioning system 1 is a system for determining the current position of a vehicle using a satellite positioning system. The vehicle positioning system 1 includes an on-board device 2 and a ground device 3. The on-board device 2 is mounted on the vehicle. The ground device 3 is installed on the ground.

The ground device 3 has a ground-side GNSS antenna 31, a ground-side GNSS receiver 32, a transmission unit 33, and a ground-side processing unit 34. The ground-side GNSS antenna 31 is installed at a predetermined fixed point P and receives signals from positioning satellites. The ground-side GNSS receiver 32 performs positioning based on the signals received by the ground-side GNSS antenna 31. The transmission unit 33 transmits information. The ground-side processing unit 34 is connected to the ground-side GNSS receiver 32 and the transmission unit 33.

The on-board device 2 has an on-board GNSS antenna 21, an on-board GNSS receiver 22, a receiving unit 23, and an on-board processing unit 24. The on-board GNSS antenna 21 receives signals from positioning satellites. The on-board GNSS receiver 22 performs positioning based on the signals received by the on-board GNSS antenna 21. The receiving unit 23 receives information from the ground device 3. The on-board processing unit 24 is connected to the on-board GNSS receiver 22 and the receiving unit 23.

The ground-side processing unit 34 prestores fixed point position information, which is the position information of the fixed point P. The ground-side processing unit 34 detects a failure in the satellite positioning system based on a comparison between the fixed point position information and the positioning result by the ground-side GNSS receiver 32. When the ground-side processing unit 34 detects a failure in the satellite positioning system, it transmits a stop command to the transmission unit 33.

When the receiver 23 receives a stop command from the transmitter 33, the on-board processor 24 stops outputting the positioning results. When the on-board processor 24 does not receive a stop command, it outputs the positioning results.

The on-board device 2 has multiple pairs of on-board GNSS antennas 21 (21A, 21B) and on-board GNSS receivers 22 (22A, 22B). In FIG. 1, the on-board GNSS antenna 21A and the on-board GNSS receiver 22A form a pair, and the on-board GNSS antenna 21B and the on-board GNSS receiver 22B form a pair. The on-board processing unit 24 detects a failure of the on-board GNSS receiver 22 (21A or 21B) based on a comparison of the positioning results from the multiple on-board GNSS receivers 22A, 22B. When the on-board processing unit 24 detects a failure of the on-board GNSS receiver 22, it stops outputting the positioning results.

Each of the multiple on-board GNSS receivers 22A, 22B performs positioning using software created independently of each other.

The vehicle positioning system 1 will now be described in more detail. The satellite positioning system used by the vehicle positioning system 1 is the Global Navigation Satellite System (GNSS). GNSS is a general term for satellite positioning systems that use signals from artificial satellites to determine a position, such as GPS and quasi-zenith satellites (see terms and definitions in Non-Patent Document 1).

The on-board device 2 is mounted on the vehicle and moves with the vehicle. The vehicle positioning system 1 determines the current position of the vehicle, i.e., the vehicle itself. The ground device 3 is installed on the ground and does not move.

The ground-side GNSS antenna 31 is a GNSS antenna that receives signals from positioning satellites (GNSS satellites) and is installed at a predetermined, i.e., a specified fixed point P. The fixed point P is a fixed location. Because the orbit of the positioning satellite exceeds an altitude of 30,000 km, the fixed point P does not need to be near the section on which the vehicle travels. For this reason, the ground device 3 is shared by the on-board devices 2 of multiple vehicles. The fixed point position information, which is the position information of the fixed point P, is measured in advance and is known accurately. The fixed point position information is stored in the ground-side processing unit 34.

There is Type C independence in IEC 62425 between the ground-side GNSS antenna 31 and fixed point P (see Table 1).

The ground-side GNSS receiver 32 is a GNSS receiver. The software of the GNSS receiver does not need to be created using the management method required by international standards (IEC 62425 and IEC 62279), and the ground-side GNSS receiver 32 may be a COTS (commercial off-the-shelf) GNSS receiver. The positioning result by the ground-side GNSS receiver 32 is a measurement value of the position of the fixed point P.

There is Type C independence in IEC 62425 between the ground-side GNSS receiver 32 (item X) and fixed point P (see Table 1).

The transmitting unit 33 is a data communication device. Information transmitted by the transmitting unit 33 is received by the receiving unit 23 of the on-board device 2 via wireless data communication. Note that the transmitting unit 33 does not need to directly perform wireless data communication with the receiving unit 23, and part of the transmission path may be wired.

The ground-side processing unit 34 has a CPU, memory, etc., and functions by executing software. The ground-side processing unit 34 is, for example, a programmable logic controller. The ground-side processing unit 34 compares the fixed-point position information with the positioning result by the ground-side GNSS receiver 32. The difference between the fixed-point position information and the positioning result (the distance between two points) is the positioning error using the satellite positioning system. If the difference between the fixed-point position information and the positioning result (the distance between two points) exceeds a predetermined ground judgment threshold, the ground-side processing unit 34 detects that the satellite positioning system is malfunctioning because the positioning error is excessive. Then, when the ground-side processing unit 34 detects a malfunction of the satellite positioning system, it causes the transmission unit 33 to transmit a stop command. The stop command is a type of information.

This allows the vehicle positioning system 1 to detect satellite system failures and abnormal radio wave propagation and stop the system (Detection and Negation).

The on-board GNSS antenna 21 is a GNSS antenna. In this embodiment, two on-board GNSS antennas 21A and 21B are mounted on the vehicle as the on-board GNSS antenna 21. The on-board GNSS antenna 21A and the on-board GNSS antenna 21B are mounted apart from each other on the same vehicle or in a train configuration made up of multiple vehicles. Even if the vehicle moves, the distance between the on-board GNSS antenna 21A and the on-board GNSS antenna 21B does not change.

The on-board GNSS receiver 22 is a GNSS receiver. The software of the GNSS receiver does not need to be created in compliance with the management methods required by international standards (IEC 62425 and IEC 62279), and the on-board GNSS receiver 22 may be a COTS (commercial off-the-shelf) GNSS receiver. The positioning result by the on-board GNSS receiver 22 is the current position of the on-board GNSS antenna 21.

In this embodiment, two on-vehicle GNSS receivers 22A and 22B are mounted on the vehicle as the on-vehicle GNSS receiver 22. The on-vehicle GNSS receiver 22A performs positioning based on the signal received by the on-vehicle GNSS antenna 21A. The positioning result by the on-vehicle GNSS receiver 22A is the current position of the on-vehicle GNSS antenna 21A. The on-vehicle GNSS receiver 22B performs positioning based on the signal received by the on-vehicle GNSS receiver 21B. The positioning result by the on-vehicle GNSS receiver 22B is the current position of the on-vehicle GNSS antenna 21B. The current positions of the on-vehicle GNSS receivers 22A and 22B are the current position of the vehicle itself.

There is Type A independence in IEC 62425 between the on-board GNSS receiver 22A (item A) and the on-board GNSS antenna 21B (item B) (see Table 1).

The receiving unit 23 is a wireless data receiver. The information received by the receiving unit 23 is information transmitted by the transmitting unit 33 of the ground device 3.

The on-board processing unit 24 has a CPU, memory, etc., and functions by executing software. The on-board processing unit 24 is, for example, a programmable logic controller. The software for the on-board processing unit 24 is created in accordance with the management methods required by international standards (IEC 62425 and IEC 62279).

In normal operation, the on-board processing unit 24 outputs the positioning result of the vehicle's current position based on the positioning result by the on-board GNSS receiver 22. In this embodiment, there are two on-board GNSS receivers 22A, 22B. Therefore, for example, the on-board processing unit 24 outputs the positioning result of the on-board GNSS receiver 22 (22A or 22B) connected to the on-board GNSS antenna 21 (21A or 21B) that is closer to the front of the train. Note that the conversion of the positioning result (latitude and longitude) to kilometers may be performed by the on-board processing unit 24 or by a device outside the vehicle positioning system 1.

When the receiver 23 receives a stop command, the on-board processor 24 stops outputting the positioning results. In other words, when the ground processor 34 detects a failure in the satellite positioning system, the vehicle positioning system 1 does not output the positioning results using the positioning satellite. As a conventional technique, a tachometer generator is used when the positioning satellite is unavailable.

In addition, the on-board processing unit 24 compares the positioning results from the multiple on-board GNSS receivers 22A, 22B. If the positioning results from the on-board GNSS receivers 22A, 22B exceed a predetermined on-board judgment threshold, the positioning error is excessive, and at least one of the on-board GNSS receivers 22A, 22B is detected as malfunctioning. The on-board judgment threshold is set to take into account the difference in the mounting positions of the on-board GNSS antennas 21A, 21B. The on-board processing unit 24 may convert the positioning results from the on-board GNSS receivers 22A, 22B into kilometers and compare them after making a correction to remove the difference in the mounting positions of the on-board antennas 21A, 21B (difference in distance from the front of the train). When the on-board processing unit 24 detects a malfunction of the on-board GNSS receivers 22A, 22B, it stops outputting the positioning results. In other words, when the on-board processing unit 24 detects a malfunction in the on-board GNSS receiver 22, the vehicle positioning system 1 does not output the positioning results using the positioning satellites.

The software used by the on-board GNSS receiver 22A to perform positioning and the software used by the on-board GNSS receiver 22B to perform positioning are made independently of each other. For example, the on-board GNSS receiver 22A and the on-board GNSS receiver 22B are software independently developed by different manufacturers.

In this way, the vehicle positioning system 1 takes measures to prevent an error in the positioning result by the on-board GNSS receiver 22 from becoming a common cause failure, and places safety requirements based on international standards on the on-board processing unit 24 that compares the positioning results, but does not place safety requirements on the positioning result itself. Since the possibility of both on-board GNSS receivers 22A and 22B being in error simultaneously when the positioning result is incorrect is extremely low, if safety is required only for the on-board processing unit 24, the safety of the system is ensured by detection and negation.

As described above, according to the vehicle positioning system 1 of this embodiment, the ground device 3 detects a malfunction in the satellite positioning system based on a comparison between the fixed point position information and the positioning results by the ground-side GNSS receiver 32, and the on-board processing unit 24 of the on-board device 2 stops outputting the positioning results, so that malfunctions in the satellite system and abnormal radio wave propagation can be detected, improving safety.

By detecting a failure in the on-board GNSS receivers 22A, 22B based on a comparison of the positioning results from multiple on-board GNSS receivers 22A, 22B and stopping the output of the positioning results, the safety of the vehicle positioning system 1 is improved since the possibility of the on-board GNSS receivers 22A, 22B making an error at the same time is low.

The multiple on-board GNSS receivers 22A, 22B each perform positioning using software created independently of each other, which further reduces the possibility of simultaneous errors in the on-board GNSS receivers 22A, 22B, further improving the safety of the vehicle positioning system 1. This ensures the safety of the vehicle positioning system 1 while using a commercial off-the-shelf (COTS) GNSS receiver.

The present invention is not limited to the configuration of the above embodiment, and various modifications are possible within the scope of the invention. For example, when the ground-side processing unit 34 does not detect a failure in the satellite positioning system, it may cause the transmitting unit 33 to transmit failure non-detection information at a predetermined cycle. When the receiving unit 23 does not receive failure non-detection information for a period longer than the predetermined cycle, a failure in the ground equipment 3 and a failure in the transmission path from the ground equipment 3 to the on-board equipment 2 are detected.

Reference Signs List 1 Vehicle positioning system 2 On-board device 21, 21A, 21B On-board GNSS antenna 22, 22A, 22B On-board GNSS receiver 23 Receiving unit 24 On-board processing unit 3 Ground device 31 Ground GNSS antenna 32 Ground GNSS receiver 33 Transmitting unit 34 Ground processing unit P Fixed point

Claims (3)

A vehicle positioning system for determining a current position of a vehicle using a satellite positioning system,
An on-board device mounted on a vehicle;
and a ground device installed on the ground,
The ground device includes a ground-side GNSS antenna installed at a predetermined fixed point to receive signals from positioning satellites, a ground-side GNSS receiver that performs positioning based on the signals, a transmitter that transmits information, and a ground-side processing unit connected to the ground-side GNSS receiver and the transmitter,
the on-board device includes an on-board GNSS antenna that receives signals from the positioning satellites, an on-board GNSS receiver that performs positioning based on the signals, a receiving unit that receives information from the ground device, and an on-board processing unit that is connected to the on-board GNSS receiver and the receiving unit,
the ground-side processing unit pre-stores fixed-point position information, which is position information of the fixed point, detects a failure in the satellite positioning system based on a comparison between the fixed-point position information and a positioning result by the ground-side GNSS receiver, and when a failure in the satellite positioning system is detected, causes the transmitting unit to transmit a stop command;
The vehicle positioning system according to claim 1, wherein the on-board processing unit stops outputting the positioning result when the receiving unit receives the stop command. The on-board device includes a plurality of pairs of the on-board GNSS antenna and the on-board GNSS receiver,
The vehicle positioning system according to claim 1, characterized in that the on-board processing unit detects a malfunction of the on-board GNSS receiver based on a comparison of positioning results from multiple on-board GNSS receivers, and stops outputting the positioning results when a malfunction of the on-board GNSS receiver is detected. 3. The vehicle positioning system according to claim 2, wherein each of the plurality of on-board GNSS receivers performs positioning using software that is independently created.

Images