Patent Publication Number: US-2021171078-A1

Title: System and method to supervise vehicle positioning integrity

Description:
RELATED APPLICATIONS 
     This application claims priority to U.S. Provisional Patent Application No. 62/946,024, titled “Method to Supervise the Integrity of the Vehicle Positioning in Safety Critical Application” and filed on Dec. 10, 2019, which is incorporated herein by reference. 
    
    
     BACKGROUND 
     Positioning includes determining the location of the vehicle&#39;s reference point, a predefined point on the vehicle, in a particular geo-spatial coordinate system, e.g., on a map. In other approaches, the positioning of a rail vehicle on the map of a guideway is determined by the following techniques. If the vehicle is manually operated based on signals controlled by an interlocking system, the vehicle&#39;s position on the guideway is determined based upon track circuits and/or axle counting blocks occupancy. If the vehicle is communication-based train control (CBTC) equipped, the vehicle&#39;s position on the guideway is initialized based on a radio-frequency identification (RFID) transponder reader installed on the vehicle and a corresponding transponder tag installed on the track bed. Then, the vehicle&#39;s position on the guideway is updated based on distance traveled and direction determined based on axle/wheel mounted tachometer or speed sensor measurements. 
     The track circuit and axle counting technique of positioning requires significant and relatively expensive infrastructure installed on the track bed and the backside and is prone to failures due to inadequate maintenance. 
     The RFID transponder reader and associated tag together with the tachometer or speed sensor technique of positioning requires significant infrastructure, such as transponder tags installed on the track bed, and is prone to failures in positioning accuracy due to wheel spin or slide. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram of a vehicle positioning system and method, in accordance with some embodiments. 
         FIG. 2  is a block diagram of a vehicle positioning system and method with a centralized architecture, in accordance with some embodiments. 
         FIG. 3  is a block diagram of an unscented Kalman Filter system and method in a centralized vehicle positioning system, in accordance with some embodiments. 
         FIG. 4  is a block diagram of a vehicle positioning system and method with a distributed architecture, in accordance with some embodiments. 
         FIG. 5  is a block diagram of an unscented Kalman Filter system and method in a distributed vehicle positioning system, in accordance with some embodiments. 
         FIG. 6  is a block diagram of a protection level subfunction system and method, in accordance with an embodiment. 
         FIG. 7  is a Stanford Diagram for protection level supervision, in accordance with an embodiment. 
         FIG. 8  is a high-level block diagram of a processor-based system usable in conjunction with one or more embodiments. 
         FIG. 9  is a positioning diagram, in accordance with an embodiment. 
         FIG. 10  is a positioning diagram, in accordance with an embodiment. 
     
    
    
     DETAILED DESCRIPTION 
     The following disclosure provides many different embodiments, or examples, for implementing different features of the provided subject matter. Specific examples of components, values, operations, materials, arrangements, or the like, are described below to simplify the present disclosure. These are, of course, merely examples and are not intended to be limiting. Other components, values, operations, materials, arrangements, etc., are contemplated. For example, the formation of a first feature over or on a second feature in the description that follows may include embodiments in which the first and second features are formed in direct contact and may also include embodiments in which additional features may be formed between the first and second features, such that the first and second features may not be in direct contact. In addition, the present disclosure may repeat reference numerals and/or letters in the various examples. This repetition is for the purpose of simplicity and clarity and does not in itself dictate a relationship between the various embodiments and/or configurations discussed. 
     Further, spatially relative terms, such as “beneath,” “below,” “lower,” “above,” “upper” and the like, may be used herein for ease of description to describe one element or feature&#39;s relationship to another element(s) or feature(s) as illustrated in the figures. The spatially relative terms are intended to encompass different orientations of the device in use or operation in addition to the orientation depicted in the figures. The apparatus may be otherwise oriented (rotated 90 degrees or at other orientations) and the spatially relative descriptors used herein may likewise be interpreted accordingly. 
     For a system to be rated as Safety Integrity Level (SIL)  4 , the system is required to have demonstrable on-demand reliability, and techniques and measurements to detect and react to failures that may compromise the system&#39;s safety properties. SIL  4  is based on International Electrotechnical Commission&#39;s (IEC) standard IEC 61508 and EN standards 50126 and 50129. SIL  4  requires the probability of failure per hour to range from 10 −8  to 10 −9 . Safety systems that are not required to meet a safety integrity level standard are referred to as SIL  0 . 
       FIG. 1  is a block diagram of a vehicle positioning system and method  100 , in accordance with some embodiments. Vehicle positioning system  100  includes first and second controller instances  102 ,  104 . The first positioning instance  102  includes a track-constrained unscented Kalman filter (UKF) subfunction  110  that computes a first estimate of the vehicle&#39;s along-tracks reference position and the precision of that estimate. The second controller instance  102  also includes a track-constrained UKF subfunction  112  that computes a second estimate of the vehicle&#39;s along-tracks reference position and the precision of that estimate. The first positioning instance  102  includes a UKF subfunction  110  using function A 1 . The second positioning instance  104  includes a UKF subfunction  112  using function A 2 . Function A 1  and function A 2  are subfunctions to estimate the vehicle&#39;s along-tracks reference position, and the precision of that estimate, using track-constrained unscented Kalman filter (UKF). The filter is initialized when the vehicle&#39;s reference point location is initialized upon cold start. Then, the reference point position is estimated using IMU 3-D specific force (acceleration) and angular rate measurements, this is the prediction phase of the filter. Then, when measurement is received, speed and/or position measurement, the filter uses the measurement to provide update. 
     The along-tracks reference position of the vehicle is determined by a track-constrained unscented Kalman filter. Reference is made to: UK Patent Application GB 2579414 Method and Apparatus for Determining a Position of a Vehicle, filed Nov. 30, 2018 and UK Patent Application GB 2579415 Method and Apparatus for Determining a Position of a Vehicle, filed Nov. 30, 2018, each of which is hereby incorporated by reference in their entirety. 
     The UKF subfunction  110 ,  112  is an algorithm that is executed on a safety integrity level  0  (SIL  0 ) computing platform. This is because the algorithm is complex and it is quite difficult to demonstrate it can satisfy properties needed for SIL  4  function. The UKF subfunctions  110 ,  112  receive data corresponding to the vehicle&#39;s 3D acceleration and angular turn rate from an inertial measuring unit (IMU)  114 ,  116 . The UKF subfunctions  110 ,  112  receive data corresponding to the speed of the vehicle and the precision of the speed from an odometry function  118 ,  120 . The odometry function  118  is a speed measurement sensor such as radar, tachometer or other type of appropriate speed measurement sensor. 
     The UKF subfunction  110 ,  112  receives data corresponding to the position of the vehicle and position precision from a localization sensor  122 , such as radio frequency identifier (RFID) tags, global positioning system (GPS) sensors or global navigation satellite system (GNSS) sensors. The UKF subfunction  110 ,  112  receives data corresponding to support points from a central database  124 . The support points are used to construct the 3-D centerline between the two running rails the vehicle is moving on determining the constrained path the vehicle is moving along. The UKF subfunction  110  computes and outputs a first along-track position estimate and a precision for the estimate. The UKF subfunction  112  computes and outputs a second along-track position estimate and a precision for the estimate. 
     The along-track position estimate and precision provided by the UKF subfunction  110  is received by a protection level subfunction  126 . The along-track position estimate and precision provided by the UKF subfunction  112  is received by a protection level subfunction  128 . The protection level subfunction  126 ,  128  is implemented on a SIL  4  computing device. In the first instance  102 , the protection level subfunction  126  uses function B 1 . In the second instance  104 , the protection level subfunction  128  uses function B 2 . Function B 1  and function B 2  are protection level subfunctions which are much simpler algorithms than the track-constrained UKF. The protection level subfunctions use statistical techniques to determine if the position uncertainty determined by the UKF is below a certain predefined threshold called alarm limit. If the position uncertainty is below the alarm limit, then the UKF position and associated uncertainty can be trusted. 
     The protection level subfunctions  126 ,  128  receive data corresponding to an alarm limit and integrity risk from a configuration file  132 . The alarm limit value represents the maximum positioning uncertainty satisfying an integrity risk value which is the probability (per operation hour) of wrong side failure events (i.e., position uncertainty greater than the alarm limit). The integrity risk is the probability that, at any moment, the position uncertainty exceeds the alarm limit. In accordance with various embodiments, an alarm limit is 10 meters, which is the maximum position uncertainty tolerated by the Thales SelTrac CBTC product, or 6.5 meters, which is the position uncertainty of the loop based Thales SelTrac IS product. The integrity risk value is 10 −9  to 10 −11 , representing a wrong side failure probability corresponding to SIL  4  function. The protection level subfunctions  126 ,  128  compute and output time-stamped along track position estimates and protection level values, as described with reference to  FIG. 10 . 
     The protection level value is the statistical bound error computed to guarantee that the probability of the position uncertainty exceeding the alarm limit is less than or equal to the target integrity risk and the probability that, at any moment, the position uncertainty exceeds the alarm limit. 
     Based on the estimated along-track position and the estimated covariance, the protection level subfunction  126 ,  128  calculates in real-time a protection level value which is compared against an alarm limit value representing the maximum positioning uncertainty satisfying an integrity risk value which is the probability (per operation hour) of wrong side failure events (i.e., position uncertainty greater than the alarm limit). The integrity risk is the probability that, at any moment, the position uncertainty exceeds the alarm limit. 
     To provide SIL  4  protection, the integrity risk value is typically 10 −9  per hour or smaller. 
     The protection level subfunction  126 ,  128  is explainable and simpler than the along-track position estimation using track constrained UKF subfunction  110 ,  112  so the protection level subfunction  126 ,  128  is able to be implemented on a SIL  4  computing platform while the track-constrained UKF subfunction  110 ,  112  is implemented on a SIL  0  computing platform. 
     Protection level subfunction verification is based on statistically sufficient large number of test scenarios and cases ensuring sufficient coverage of both nominal test scenarios and tail case test scenarios. A tail case test scenario is a scenario that may be rare but can impact the safety integrity properties of the function. The test scenarios and cases are verified using ground truth positioning, either measured or synthetically generated. The integrity risk is demonstrated if the probability, per operation hour, of the position uncertainty (the difference between the estimated position and the ground truth position) while the protection level is less than the alarm limit, based on the collected position points presented on a Stanford diagram ( FIG. 7 ), is less than the target integrity risk. 
     The time-stamped along-track position estimates and protection level value provided by the protection level subfunctions  126 ,  128  are received by a supervisory controller such as protection level supervision subfunction  130 . The protection level supervision subfunction  130  is executed on an SIL  4  computing device. The protection level supervision subfunction  130  uses function C. The protection level supervision function (C) is pictorially described in  FIGS. 9 and 10 . Each track-constrained UKF—protection level subfunction pair provides an estimated reference point position and an indication if associated uncertainty of the estimated reference point position is greater than the alarm limit or not. If the uncertainties of both instances are less than the alarm limit then the protection level supervision subfunction  130  checks the affinity, as shown in  FIGS. 9 and 10  to ensure the two instances are consistent. The protection level supervision subfunction  130  receives the speed and direction of the vehicle  134  from the odometry function. 
     The vehicle&#39;s reference point along-track position is estimated by two independent instances of the track constrained UKF subfunctions  110 ,  112 . Each UKF subfunctions  110 ,  112  receives data from a dedicated IMU  114 ,  116  and speed information  118 ,  120  from the odometry function. The estimated positions computed by the two independent UKF subfunctions  110 ,  112  are compared to determine if the protection level calculated at each instance is less than the alarm limit. The ground truth along-track position is common to both instances. Therefore, the affinity is calculated as: 
       Affinity=(2×AL−ΔPosition (P1,P2))/( 2×AL), where AL is the alarm limit, P 1  is instance 1 position estimate and P2 is instance 2 position estimate.
 
     The affinity is positive when the position estimates are trustable. A higher affinity value indicates an increase in the trust that is placed on a position determined from the two instances position estimates. If the affinity value is zero or negative, the instances position estimates are not trusted. The position estimates are determined based on measurements taken at slightly different times, therefore the affinity value is corrected, where the corrections are based on the vehicle&#39;s speed and the time difference between the measurements corresponding to each instance. The speed corrected affinity is calculated as: 
       Affinity=(2×AL−Δposition (P1,P2)− 2×VΔt (P1,P2) )/(2×AL)
 
     The database  124 , localization sensor  122  and configuration  132  are common to both instances; however, the IMUs  114 ,  116  and the odometry functions  118 ,  120  are independent. 
     The output of the protection level supervision subfunction is provided to a vehicle control system (not shown) that operates the vehicle using the along-track position estimates if the along-track position estimates are validated 
       FIG. 2  is a block diagram of a vehicle positioning system and method with a centralized architecture  200 , in accordance with some embodiments. 
     Vehicle positioning system  200  includes SIL  4  computing platform  202  executing first and second positioning replicas  204 ,  206 , similar to the first and second instances of  FIG. 1 . The first positioning replica  204  executes two track-constrained UKF  208 ,  210 . The first UKF subfunction  208  computes the along-track reference position estimate using the track constrained UKF subfunction function Al. The second UKF subfunction  210  computes the along-track reference position estimate using the track constrained UKF subfunction function A 2 . The second positioning replica  206  executes two track-constrained UKFs  212 ,  214 . The first UKF subfunction  212  computes the along-track reference position estimate using a track constrained UKF subfunction function Al. The second UKF subfunction computes the along-track reference position estimate using a track constrained UKF subfunction function A 2 . 
     Each UKF subfunction  208 ,  210 ,  212 ,  214  provides an estimate of the vehicle&#39;s along-tracks reference position and the precision of that estimate. The UKF subfunction  208 ,  210 ,  212 ,  214  is a is a safety integrity level  0  (SIL  0 ) function. The UKF subfunctions  208 ,  210 ,  212 ,  214  receives data through an input equalization  216 . The first instance inputs  218  are provided to the first replica 204  while the second instance inputs  220  are provided to the second replica  206 . In the input equalization  216 , the first replica  204  provides the first instance inputs  218  to the second replica  206  and the second replica  206  provides the second instance inputs  220  to the first replica  204 . The equalization process in this case ensures that both replicas  204 ,  206  have the data from the first and second inputs  218 ,  220 . This arrangement provides replica determinism, which means if the two replicas  204 ,  206  have the same inputs and identical functions then the outputs of both replicas  204 ,  206  must be identical. 
     The vehicle positioning system  200  includes first and second instances of input  218 ,  220 . The UKF subfunctions  208 ,  210  executed on the first replica  204 . UKF subfunction  208  receive data from a first instance of inputs  218 . The first instance inputs  218  include an IMU  222  providing data corresponding to the vehicle&#39;s 3D acceleration and angular turn rate. The first instance inputs  218  include an odometry function  226  providing data corresponding to the speed of the vehicle and the precision of the speed. UKF subfunction  210  receives data from a second instance of inputs  220 . The second instance inputs  220  include an IMU  224  providing data corresponding to the vehicle&#39;s 3D acceleration and angular turn rate. The second instance inputs  220  include an odometry function  228  providing data corresponding to the speed of the vehicle and the precision of the speed. 
     The UKF subfunctions  212 ,  214  executed on the second replica  206 . UKF subfunction  212  receive data from a first instance of inputs  218 . The first instance inputs  218  include an IMU  222  providing data corresponding to the vehicle&#39;s 3D acceleration and angular turn rate. The first instance inputs  218  include an odometry function  226  providing data corresponding to the speed of the vehicle and the precision of the speed. UKF subfunction  214  receive data from a second instance of inputs  220 . The first instance inputs  220  include an IMU  224  providing data corresponding to the vehicle&#39;s 3D acceleration and angular turn rate. The second instance inputs  220  include an odometry function  228  providing data corresponding to the speed of the vehicle and the precision of the speed. 
     The IMU  222  and odometry function  226  in the first instance inputs  218  are physically and electrically independent of the IMU  224  and odometry function  228  of the second instance  220 . 
     The UKF subfunction  208 ,  210 ,  212 ,  214  receive data corresponding to the position of the vehicle and position precision from a localization sensor  224  through the input equalization  216 . 
     The along-track position estimate and precision provided by the UKF subfunction  208  is received by a protection level subfunction  230 . The along-track position estimate and precision provided by the UKF subfunction  210  is received by a protection level subfunction  234 . The along-track position estimate and precision provided by the UKF subfunction  212  is received by a protection level subfunction  232 . The along-track position estimate and precision provided by the UKF subfunction  214  is received by a protection level subfunction  236 . The protection level subfunctions  230 ,  234 ,  232 ,  236  are SIL  4  functions. Protection level subfunctions  230  and  232  execute protection level function B 1 . Protection level subfunctions  234  and  236  execute protection level function B 2 . Protection level subfunctions  230 ,  234 ,  232 ,  236  compute and output a time-stamped along track position estimate and a protection level value. Function B 1  and function B 2  are protection level subfunctions which are much simpler algorithms than the track-constrained UKF. The protection level subfunctions use statistical techniques to determine if the position uncertainty determined by the UKF is below a certain predefined threshold called alarm limit. If the position uncertainty is below the alarm limit, then the UKF position and associated uncertainty can be trusted. 
     The time-stamped along-track position estimates and protection level values provided by the protection level subfunctions  230 ,  234  are received by a protection level supervision subfunction  238 . The protection level supervision function (C)  230 ,  234  is pictorially described with respect to  FIGS. 9 and 10 . Each track-constrained UKF—protection level subfunction pair provides an estimated reference point position and an indication if associated uncertainty of the estimated reference point position is greater than the alarm limit or not. If the uncertainties of both instances are less than the alarm limit then the protection level supervision subfunction  130  checks the affinity, as shown in  FIGS. 9 and 10  to ensure the two instances are consistent. Protection level supervision subfunction  238  is a SIL  4  function. 
     The time-stamped along-track position estimates and protection level values provided by the protection level subfunctions  232 ,  236  are received by a protection level supervision subfunction  240 . Protection level supervision subfunction  240  is a SIL  4  function. The protection level supervision function determines the affinity between the two position estimates. The affinity must be positive, for the position estimates to be trusted. A higher affinity value means more trust can be assigned to the two position estimates. When the affinity has a zero or negative value, the two position estimates cannot be trusted. 
     An output comparison  242  receives the output of the protection level supervision subfunctions  238 ,  240 . The output from the protection level supervision subfunctions  238 ,  240  is cross compared and accepted only if the two outputs are identical. 
       FIG. 3  is a block diagram of an UKF subfunction  300  in a centralized vehicle positioning system, in accordance with some embodiments. 
     The UKF subfunction  300  is used to estimate vehicle position based upon sensor measurements which indirectly measure the vehicle&#39;s motion. The UKF subfunction  300  recursively predicts the position in a prediction step  302  and updates the predicted state based upon measurement data in an update step  304 . The position of the vehicle is a part of the state estimated by the UKF subfunction  300 . 
     The UKF subfunction algorithm  300  includes a prediction step  302  and an update step  304 . 
     The prediction step  302  estimates the vehicle&#39;s reference position using a strapdown navigation algorithm  308  such as a Lie group strapdown navigation algorithm. A Lie-group strapdown navigation algorithm operates in a state space and/or a measurement space which is represented by Lie groups (in particular, matrix Lie groups). It is advantageous to represent the state and the measurement spaces using Lie groups, because Lie groups can easily represent a complex state which comprises multiple sub-states using a product matrix Lie group without losing the typological structure of the state space. 
     The navigation algorithm calculates by dead reckoning the kinematic state (e.g., the position, attitude and velocity) of the vehicle to which the inertial measurement unit  306  is mounted. The navigation algorithm  308  generates data indicative of the predicted position of the vehicle by constraining the state, determined based on the IMU measurements  306  during the prediction step, such that the predicted position of the vehicle lies on a track defined by the track geometry data represented by the support points and the cubic spline approximation between the support points. The navigation algorithm  308  is constrained by track geometry data (i.e., the constraints imposed by the transport network to the vehicle). By constraining the navigation algorithm  308  by the track geometry data, the problem of estimating an unconstrained three-dimensional position of the vehicle is advantageously reduced to the problem of estimating a one-dimensional position of the vehicle along the track of the transport network, because the vehicle has only one degree of freedom along the track. Further, the constrained navigation algorithm  308  can be used to model the propagation of kinematic state estimation errors into the one-dimensional position solution space. Consequently, the utilization of the track geometry data in the strapdown inertial navigation algorithm is useful for improving the accuracy of the determined position of the vehicle and can reduce significantly errors accumulated by the UKF subfunction  300 . 
     The position solution is constrained to evolve along the track&#39;s centreline represented by support points from a database, such as  124  in  FIG. 1 , and cubic spline calculated in real-time. The UKF subfunction  100 ,  112  approximates a probability distribution by deterministically sampling support points and assigning weight to each of these points. Obtaining the track geometry data includes accessing a map database, where the map database includes support points positioned along tracks within the transport network; retrieving from the map database support points in the vicinity of the vehicle; and applying an interpolation function through the retrieved support points to obtain a track constraint function, wherein the track geometry data comprises the track constraint function. By applying an interpolation function through the retrieved support points from the map database, the track constraint function (which is included within the track geometry data) comprises lines/curves which represent centerlines of the tracks within the transport network. The cubic spline interpolation implicitly provides a twice differentiable curve with a continuous second-order derivative. Furthermore, amongst all of the twice differentiable functions, the cubic spline interpolation function yields the smallest norm of strain energy and allows the track constraint function obtained thereby to have a curve progression with minimal oscillations between the support points. The support points density reflects the tracks curvature and bounds the vehicle&#39;s reference position representation error. The IMU longitudinal axis is constrained to be parallel to the longitudinal axis of the moving platform that it is mounted to and which is itself determined from the track centreline constraint support points. 
     The strapdown algorithm  308  receives data corresponding to the 3-D acceleration and 3-D angular rate of turn measured by an IMU  306 . The prediction step  302  computes the mean  310  of the vehicle reference position estimates and computes the variance  312  of the vehicle reference position estimates. The UKF subfunction algorithm  300  determines at decision step  314  if process should proceed to the update step  304  based on the variance  312 . If the process should not proceed to the update step  304 , the process returns to the prediction step  302  and the prediction step  302  generates Sigma points  313  and uses the strapdown navigation algorithm  308  to compute a new estimate of the vehicle&#39;s reference position. The variance (uncertainty) of the predicted position is used to determine if the process proceeds to the update step  304 . 
     If the epoch is updated, the update step generates sigma points  316 . Receiving measurements  324 , including odometry, balise detection and other appropriate measurements, the update step  304  computes a measurement model  322 . The speed tangent to the track centreline is updated with an along-track speed measurement provided by a radar, tachometer, speed sensor or another type of speed measurement sensor. Upon position update from a localization sensor  122  in  FIG. 1 , such as RFID transponder reader, the along-track position is updated. 
     The update is performed based on the difference between the expected measurement (based on the prediction and its precision) and the actual measurement and its precision. In case of lack of measurements, pseudo-measurements derived from the track constraint are used to constrain the attitude error growth. 
     The generated sigma points  316  and the measurement model  322  are used to generate measurement sigma points  320 , measurements corresponding the set of generated sigma points  316 . The generated sigma points  316 , the measurement sigma points  320  and the measurement model  322  are used to compute the Kalman gain and re-estimate the kinematic states of the vehicle  326  including position, velocity, attitude and other appropriate states. The update step  304  returns to the prediction step  302  and generates sigma points  313  for a next generation estimate. 
       FIG. 4  is a block diagram of a vehicle positioning system and method with a distributed architecture  400 , in accordance with some embodiments. 
     Vehicle positioning system  400  includes a supervisory controller SIL  4  computing platform  402  executing first and second positioning replicas  404 ,  406 . The first positioning replica  404  receives an estimate of the vehicle&#39;s along-tracks reference position and the precision of that estimate from a track-constrained UKF  412 . The second positioning replica  404  receives an estimate of the vehicle&#39;s along-tracks reference position and the precision of that estimate from a track-constrained UKF  414 . The UKF subfunctions  412 ,  414  are algorithms that runs on a controller SIL  0  computing platform  408 ,  410 . The first UKF subfunction  412  computes the along-track reference position estimate using a track constrained UKF subfunction function Al. The second UKF subfunction  414  computes the along-track reference position estimate using a track constrained UKF subfunction function A 2 . 
     The UKF subfunction  412  receives data from a first instance of inputs  416 . The first instance inputs  416  include an IMU  420  providing data corresponding to the vehicle&#39;s 3D acceleration and angular turn rate. The first instance inputs  416  include an odometry function  424  providing data corresponding to the speed of the vehicle and the precision of the speed. 
     The UKF subfunction  414  receives data from a second instance of inputs  418 . The first instance inputs  418  include an IMU  422  providing data corresponding to the vehicle&#39;s 3D acceleration and angular turn rate. The second instance inputs  418  include an odometry function  426  providing data corresponding to the speed of the vehicle and the precision of the speed. 
     The first and second replica  404 ,  406  receive data corresponding to the estimate of the vehicle&#39;s along-tracks reference position and the precision of that estimate from the UKF subfunction  412 ,  410  through input equalization  428 . The first and second replica  404 ,  406  receive data corresponding to the position of the vehicle and position precision from a localization sensor  439  through the input equalization  428 . 
     The along-track position estimates and precision provided by the UKF subfunction  412  are received by a protection level subfunction  432 ,  434 . The along-track position estimates and precision provided by the UKF subfunction  414  are received by a protection level subfunction  436 ,  438 . The protection level subfunctions  432 ,  436 ,  434 ,  438  are implemented on SIL  4  computing platforms. The protection level subfunctions  432 ,  436 ,  434 ,  438  computes and outputs a time-stamped along track position estimate and protection level values. Protection level subfunctions  432  and  434  execute protection level function B 1 . Protection level subfunction  436  and  438  execute protection level function B 2 . 
     The time-stamped along-track position estimates and protection level values provided by the protection level subfunctions  432 ,  436  are received by a protection level supervision subfunction  440 . The protection level supervision subfunction  440  is executed on SIL  4  computing platforms. The protection level supervision subfunction  440  executes protection level supervision function C. 
     The time-stamped along-track position estimates and protection level values provided by the protection level subfunctions  434 ,  438  are received by a protection level supervision subfunction  442 . The protection level supervision subfunction  442  is executed on a SIL  4  computing device. The protection level supervision subfunction  442  executes protection level supervision function C. 
     An output comparison  444  receives the output of the protection level supervision subfunctions  440 ,  442 . The output of the protection level supervision subfunctions  440 ,  442  include an along-tracks position, a flag indicating if the position uncertainty is less than the alarm limit and the affinity between the two position estimates. The output of the protection level supervision subfunctions  440 ,  442  are cross compared and accepted only if the two outputs are identical. 
       FIG. 5  is a block diagram of an unscented Kalman filter in a distributed vehicle positioning system  500 , in accordance with some embodiments. 
     The UKF subfunction algorithm  500  includes a prediction step  502  and an update function  504 . 
     The prediction step  502  estimates the vehicle&#39;s reference position using a strapdown navigation algorithm  510  such as a Lie group strapdown navigation algorithm. The strapdown algorithm  510  receives data corresponding IMU measurement data from data server  518 . The strapdown algorithm  510  receives data from track-constrained management  508 . The prediction step  502  computes the mean  512  of the vehicle reference position estimates and computes the variance  514 . The UKF subfunction algorithm  500  determines if the process  500  proceeds to the update step  504  using the variance  514 . The prediction step  502  generates sigma points  528  and uses the strapdown navigation algorithm  510  to compute a new estimate of the vehicle&#39;s reference position. 
     The update step  504  generates sigma points  522 . Using non-IMU measurement data from the data server  518 , the update step  504  computes a measurement model  526 . The generated sigma points  522  and the measurement model  526  are used to generate measurement sigma points  524 . The generated sigma points  522 , the measurement sigma points  524  and the measurement model  526  are used to compute the Kalman gain and re-estimate the filter state. The update step  504  returns to the prediction step  502  and generates sigma points  528  for a next generation estimate. 
     The track-constraint management  508  sends and receives data from the guideway  506 . 
       FIG. 6  is a block diagram of a protection level subfunction  600 , in accordance with an embodiment. 
     A UKF subfunction  602  is executed on a SIL  0  computing platform. The UKF subfunction  602  computes an along-tracks reference position estimate using track constrained UKF subfunction algorithm. The UKF subfunction  602  receives data corresponding to 3D acceleration and angular rate from an IMU  604 . The UKF subfunction  602  receives data corresponding to the speed of the vehicle and the precision of the speed from an odometry function  606 . The UKF subfunction  602  receives data corresponding to the position of the vehicle and the precision of the position from a localization sensor  608 . The UKF subfunction  602  receives data corresponding to support points from a database  610 . 
     The UKF subfunction  602  computes the along track position of the vehicle and the precision of that position. A protection level function  612  receives the along track position of the vehicle and the precision of that position. The protection level function  612  is executed on a SIL  4  computing platform. The protection level function  612  receives the alarm limit and integrity risk from a configuration file  614 . The protection level function  612  computes a protection level value. 
     When the protection level value, calculated in real-time, is less than the alarm limit, the along-track position of the vehicle reference point and its precision distribution (covariance) calculated by the track constrained UKF subfunction, pending further checks by the protection level supervision function, can be trusted even though its safety integrity level is zero. 
     The safety integrity level of the protection level function is four (SIL  4 ) when sufficiently large scenarios and test cases are tested and the integrity risk target is demonstrated based on these test results. 
       FIG. 7  is a Stanford Diagram for the protection level calculation method  700 , in accordance with an embodiment. The Stanford Diagram  700  is used by a Stanford Diagram verification technique to verify the protection level output by comparing the position error (PE) and the protection level (PL) to the alarm limit (AL). 
     In the “Nominal Operation” zone  702 , the protection level is greater than the position error, the protection level is less than the alarm limit and the position error is less than the alarm limit. If these conditions are met, the function safety integrity of the position estimate is properly demonstrated. 
     In the “Misleading Operation” zone  704 , the position error is less than the alarm limit, and the protection level is less than the position error but still less than the alarm limit. The safety integrity properties of the function is ensured in this zone however the results are misleading because the protection level is less than the position error. 
     In the rest of the zones  706 ,  708 ,  710 ,  712  the system is either unavailable or in a hazardous situation. Real-time supervision that the protection level is less than the alarm limit relying on statistical demonstration that the probability of wrong side failure, outside of the “nominal operation” zone  702 , per operation hour is less than 10 −9 . 
       FIG. 8  is a high-level block diagram of a processor-based system  800  usable in conjunction with one or more embodiments. 
     In some embodiments, computing platform  800  is a general purpose computing device including a hardware processor  802  and a non-transitory, computer-readable storage medium  804 . Storage medium  804 , amongst other things, is encoded with, i.e., stores, computer program code  806 , i.e., a set of executable instructions. Execution of instructions  806  by hardware processor  802  represents (at least in part) a processing tool which implements a portion or all of the methods described herein in accordance with one or more embodiments (hereinafter, the noted processes and/or methods). 
     Processor  802  is electrically coupled to computer-readable storage medium  804  via a bus  808 . Processor  802  is also electrically coupled to an I/O interface  810  by bus  808 . A network interface  812  is also electrically connected to processor  802  via bus  808 . Network interface  812  is connected to a network  814 , so that processor  802  and computer-readable storage medium  804  are capable of connecting to external elements via network  814 . Processor  802  is configured to execute computer program code  806  encoded in computer-readable storage medium  804  in order to cause system  800  to be usable for performing a portion or all of the noted processes and/or methods. In one or more embodiments, processor  802  is a central processing unit (CPU), a multi-processor, a distributed processing system, an application specific integrated circuit (ASIC), and/or a suitable processing unit. 
     In one or more embodiments, computer-readable storage medium  804  is an electronic, magnetic, optical, electromagnetic, infrared, and/or a semiconductor system (or apparatus or device). For example, computer-readable storage medium  804  includes a semiconductor or solid-state memory, a magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk, and/or an optical disk. In one or more embodiments using optical disks, computer-readable storage medium  804  includes a compact disk-read only memory (CD-ROM), a compact disk-read/write (CD-R/W), and/or a digital video disc (DVD). 
     In one or more embodiments, storage medium  804  stores computer program code  806  configured to cause system  800  to be usable for performing a portion or all of the noted processes and/or methods. In one or more embodiments, storage medium  804  also stores information which facilitates performing a portion or all of the noted processes and/or methods. In one or more embodiments, storage medium  804  stores parameters  807 . 
     Processing system  800  includes I/O interface  810 . I/O interface  810  is coupled to external circuitry. In one or more embodiments, I/O interface  810  includes a keyboard, keypad, mouse, trackball, trackpad, touchscreen, and/or cursor direction keys for communicating information and commands to processor  802 . 
     Processing system  800  also includes network interface  812  coupled to processor  802 . Network interface  812  allows system  800  to communicate with network  814 , to which one or more other computer systems are connected. Network interface  812  includes wireless network interfaces such as BLUETOOTH, WIFI, LTE, 5G, WIMAX, GPRS, or WCDMA; or wired network interfaces such as ETHERNET, USB, or IEEE-1364. In one or more embodiments, a portion or all of noted processes and/or methods, is implemented in two or more systems  800 . 
     Processing system  800  is configured to receive information through I/O interface  810 . The information received through I/O interface  810  includes one or more of instructions, data, design rules, libraries of standard cells, and/or other parameters for processing by processor  802 . The information is transferred to processor  802  via bus  808 . Processing system  800  is configured to receive information related to a UI through I/O interface  810 . The information is stored in computer-readable medium  804  as user interface (UI)  842 . 
     In some embodiments, a portion or all of the noted processes and/or methods is implemented as a standalone software application for execution by a processor. In some embodiments, a portion or all of the noted processes and/or methods is implemented as a software application that is a part of an additional software application. In some embodiments, a portion or all of the noted processes and/or methods is implemented as a plug-in to a software application. 
     In some embodiments, the processes are realized as functions of a program stored in a non-transitory computer readable recording medium. Examples of a non-transitory computer readable recording medium include, but are not limited to, external/removable and/or internal/built-in storage or memory unit, e.g., one or more of an optical disk, such as a DVD, a magnetic disk, such as a hard disk, a semiconductor memory, such as a ROM, a RAM, a memory card, and the like. 
       FIG. 9  is a positioning diagram  900 , in accordance with an embodiment. 
     In the vehicle positioning system, the position estimates from multiple along-tracks constrained UKF function and its associated protection level function, such as  126  and  128  in  FIG. 1 , received by a protection level supervision function such as  130  in  FIG. 1 , which compares the two position estimates, assumed here simultaneously estimated. 
     Given an Alarm Limit (AL), two estimated positions  902  and  904  are separated by Δposition 1−2 . Position  1   902  has a first 2AL span  906 . Position  2   904  has a second 2AL span  908 . 
     If the difference between the two estimated along-track positions (Δposition 1−2 ) is less than or equal to 2AL then the vehicle&#39;s reference point along-track position determined based on the two instances position estimates can be trusted. The vehicle&#39;s reference point along-track position is determined to be the average position  912  between the two position estimates  902 ,  904 . The affinity (δ) between the two position estimates is δ=(AL−½Δposition 1−2 )/AL and the along-track position uncertainty (PU) is PU=±(2AL−(AL−½Δposition 1−2 )) 
     The larger the difference between the two estimated along-track positions (Δposition 1−2 ), the smaller the affinity between the two position estimates and the larger the position uncertainty. 
     If the difference between the two estimated along-track positions (Δposition 1−2 ) is greater than 2AL then the vehicle&#39;s reference point along-track position determined based on the two instances position estimates cannot be trusted. If this situation persists over a certain predefined period (e.g. 500 msec) then the position is determined to unknown. 
     Supervisions are implemented to monitor the behaviour of the difference between the two estimated along-track positions (Δposition 1−2 ) in time, such as: 
     If the Δposition 1−2  grows and approaches the 2AL threshold then an alarm should be raised indicating that the affinity between the two position estimates is low and the estimated position may become unstable. 
     If the Δposition 1−2  shrinks, the affinity between the two position estimates increases and the confidence in the estimated position increases, too. 
     The average and standard deviation calculated on multiple Δposition 1−2  may indicate the position confidence level. For example, a constant or close to constant average with constant or close to constant standard deviation is a possible indication of oscillatory behavior with a certain amplitude. 
       FIG. 10  is a positioning diagram  1000 , in accordance with an embodiment. 
     In the vehicle positioning system, the position estimates from multiple protection level functions, such as  126  and  128  in  FIG. 1 , received by a protection level supervision function such as  130  in  FIG. 1 , which compares the two position estimates, assumed here not simultaneously estimated. 
     A first positions  1002  is estimated at time t 1 . A second position is estimated at time t 2  greater than t 1  and  1004  are separated by Δposition 1−2 . Position  1   1002  has a first 2AL span  1010 . Position  2   1006  has a second 2AL span  1012 . 
     In reality the position estimates  1002 ,  1006  from the two instances are not simultaneously determined. For example, position  1   1002  is determined at time t 1  and position  2   1006  is determined at time t 2  greater than t 1 . In this case the time difference between the two estimates (Δt 1−2 ) has to be considered in the calculation of the affinity between the two position estimates and the position uncertainty together with the vehicle&#39;s speed. 
     If the difference between the two time and speed compensated estimated along-track positions  1002 ,  1004  (Δ′position 1−2 ) is less than or equal to the alarm limit then Δ′position 1−2 =Δposition 1−2 -VΔt 1−2  and the vehicle&#39;s reference point along-track position determined based on the two instances position estimates can be trusted. 
     The vehicle&#39;s reference point along-track position  1008  is determined to the average between the two position estimates, the affinity (δ) between the two position estimates is δ=(AL−½Δ′position 1−2 )/AL and the along-track position uncertainty  1014  PU=±(2AL−(AL−½Δ′position 1−2 )) 
     If the difference between the two time and speed compensated estimated along-track positions (Δ′position 1−2 ) is greater than 2AL then the vehicle&#39;s reference point along-track position determined based on the two instances position estimates cannot be trusted. If this situation persists over a certain predefined period (e.g., 500 msec) then the position is determined to unknown. 
     Supervisions are implemented to monitor the behavior of the difference between the two time and speed compensated estimated along-track positions (Δ′position 1−2 ). 
     Based on two independent instances, each using different sets of IMU and speed function source, of the along-track position estimated and the associated protection level the safety integrity level of the along-track vehicle&#39;s reference point position is enhanced if the protection level calculated at each instance is less than the alarm limit. 
     Based on two independent instances, each using different sets of IMU and speed function source, of the along-track position estimated and the associated protection level the safety integrity level of the along-track vehicle&#39;s reference point position is enhanced if the difference between the two position estimates, in consideration of the time difference between the two estimates, is less than or equal to 2AL. 
     Monitoring the time and speed compensated difference between the two position estimates behavior over time supervises the stability of the vehicle&#39;s reference point along-track position as if the difference is approaching the 2AL value and the affinity between the position estimates is low. The instability is increased to a point in which the position cannot be trusted any more if the difference is greater than 2AL. 
     The protection level supervision sub function is explainable and simpler than the along-track position estimation using track constrained UKF sub function. The verification of this function is straight forward and does not require significant statistical effort. 
     The proposed method relies upon an along-track position estimate using a track constrained UKF subfunction, such as  110  in  FIG. 1 , in which the primary sensor, such as  114  in  FIG. 1 , is a low-cost commercial off-the-shelf IMU with multiple sources of measurement updates (i.e. speed and position). A less dense landmark installation is required in comparison with existing technologies. For example, with traditional technologies landmarks are installed every 25 m to 150 m. The vehicle positioning system and method functions safely with a distance between landmarks greater than one km, so landmarks need be installed only at platform areas and switch zones. 
     The vehicle positioning system and method significantly reduces the system life cycle cost in terms of equipment cost, installation time and cost, maintenance cost, and provides a higher system reliability and availability. 
     The bound of the position uncertainty of the along-track position estimate derived using a track constrained UKF may not be possible to prove/demonstrate. This is recoverable and become an advantage because the position uncertainty bound is proved and demonstrated by using supervisory protection subfunctions including protection level subfunction such as  126  in  FIG. 1  and protection level supervision subfunction such as  130  in  FIG. 1 . 
     The along-track position estimate using track constrained UKF sub function, which is complex, may be developed according to SIL  0  development process and reside within a SIL  0  computing platform, not within the SIL  4  computing platform. This will save non-recurring engineering cost both in the software development and safety case domains. 
     The foregoing outlines features of several embodiments so that those skilled in the art may better understand the aspects of the present disclosure. Those skilled in the art should appreciate that they may readily use the present disclosure as a basis for designing or modifying other processes and structures for carrying out the same purposes and/or achieving the same advantages of the embodiments introduced herein. Those skilled in the art should also realize that such equivalent constructions do not depart from the spirit and scope of the present disclosure, and that they may make various changes, substitutions, and alterations herein without departing from the spirit and scope of the present disclosure.