Towards Safe Localisation for Railways: Results from the EGNSS MATE Project ^†

Abstract

Safe train positioning is a key technology to make rail transportation more efficient and cost-effective. Within the EGNSS MATE project, the project partners SBB, DLR, and IABG researched the use of European Global Satellite Navigation Systems for this application. The main contributions are the development of a novel map-based sensor fusion algorithm, the development of a test catalogue for jamming and spoofing cyberthreats, and the collection of a large and rich dataset for testing and validation. The dataset includes over 200 h of sensor data and ground truth data, covering most of the Swiss normal gauge network. In addition, tests were conducted to assess the impact of jamming and spoofing attacks. Results show promising performance of the algorithms on most of the lines, excluding some long tunnels and sections with heavy multipath. The findings of the project results will help to introduce safe train positioning into ETCS by boosting development and standardisation efforts.

1. Introduction

EGNSS MATE (European Global Navigation Satellite System-based Map-Assisted Train localisation for ERTMS) is a project that contributes towards climate-friendly, cost-efficient, digital, interoperable, and safe European railways by researching and analysing advanced GNSS based onboard train localisation. The project partners comprise the Swiss Federal Railways (SBB), Industrieanlagen-Betriebsgesellschaft mbH (IABG), and the German Aerospace Center (DLR). EGNSS MATE started in January 2023 and concluded in March 2025.

GNSS has become the main technology used to determine the position, velocity, and time (PVT) for many applications. This is due to the global availability and continuity of service, as well as the high accuracy and reliability at a competitively low cost. In railway applications, GNSS systems have been used for a variety of non-safe applications; however, using GNSS for safety-critical use cases has been challenging, mainly due to local effects such as multipath and non-line-of-sight signal reception. The evolution of the European Train Control System (ETCS) foresees the use of PVT GNSS-based systems to enhance its localisation system. This is manifested in the recent Change Request 1368 to the TSI Command Control and Signalling titled: Enhanced on-board localisation, which has the goal to allow GNSS-based localisation systems in addition to existing positioning railway solutions based on Eurobalises and odometry. The main goal of this enhancement is to move from trackside train detection to a train centric approach, where train based positioning information is used to determine the track occupancy status. This allows for a reduction of trackside assets and related costs while increasing track capacity.

The approach to safe train localisation in the EGNSS MATE project is a combination of GNSS, an inertial measurement unit, a tachometer, and digital maps. The integration of maps together with GNSSs and IMUs has been studied in the past in several publications [1,2,3,4,5,6]. The main basis for the algorithm development presented here is described in [7].

As a safety-critical infrastructure, railway systems must be robust and resilient to potential threats. Due to its phyical and technical working principles, GNSS is susceptible to radio interference from environmental effects and targeted attacks. Therefore, the inclusion of GNSS systems in railway operations can pose an additional threat since a PVT solution can be faulty due to a physical error(s) or due to a materialisation of a threat(s). In this context, it is important to identify which threats impact GNSS based solutions. In the EGNSS MATE project, we have analysed the impact on intentional radio frequency interference threats that can occur in the GNSS radio L-band. For that, we have defined and implemented a test catalogue to assess the impact in terms of availability and accuracy performance, which is of fundamental importance when using GNSS data with other sensor data.

2. Materials and Methods

2.1. Algorithm Development

Digital map data and map-supported localisation algorithms have been researched. A sensor fusion perspective [8] has been assumed with path-constrained state vectors, motion models, and measurement models to incorporate noise-affected measurements with varying rates from different onboard sources. The state of the art has been reviewed to assess GNSS aspects [9] and existing approaches, e.g., [2,10]. The algorithmic developments have been translated to Python 3.8 code, provided as a software toolbox, and integrated at SBB for testing on large datasets.

The central algorithmic contribution is a map-supported Kalman filter (KF) bank with an elaborate railway path management. Each filter in the KF bank corresponds to a path hypothesis (a sufficiently long sequence of tracks) underneath the vehicle. The paths are extended and trimmed recursively. This includes generation of new hypotheses at switches. On-path KFs have been selected because of their many positive properties regarding uncertainties, confidence information, varying rates, GNSS outages, and much more. The performance assessment of all KFs is carried out using different sensor residuals over a sliding time window. This is a novelty and allows us to accurately and robustly determine the driven path in most situations. The algorithm architecture is provided in [11].

The algorithms have been tested intensively on measurement campaign data from November 2023 and then integrated at SBB in a big data environment to process several months of comparable sensor data recordings for independent evaluation.

2.2. Measurement Setup and Data Collection

To collect a large and rich validation dataset, a measurement campaign on the SBB network was conducted.

The EGNSS MATE project used the Swiss Federal Railways’ telecom measurement wagon MEWA12 to record localisation information on the railway tracks. The vehicle covers the standard gauge network in Switzerland once per year and is consequently the ideal setup with multiple available antennae to test different navigation and localisation sensors daily. The sensor setup consists of different types of sensors, which are briefly described here:

• GNSS receivers: For the project, a Septentrio AsteRx-U SSRC7 and NovAtel OEM7000 as part of an inertial navigation system were used. The precision of the receivers was improved using RTK.
• Odometry sensors: The project used two different kinds of odometry sensors: standard optical pulse generators, which output partial wheel revolutions, and, as a second sensor, the visual odometry sensor CORRail 1000 of HaslerRail.
• Inertial Navigation Systems: Two INSs were used: a tactical-grade IMU, as part of the INS iMAR iNAT-M200-SLN, was used to measure acceleration and angular rates as input for the algorithm post-processing, and a ring laser gyroscope, as part of the iMAR iNAT-RQT-4003, was used for the reference, called the ground truth.
• Balisereader: A balisereader was installed on the telecom measurement wagon to read Eurobalises. Eurobalises were installed in a fixed position on the track and, together with the digital map, used as absolute references in the ground truth generation.

The data collection on the vehicle is fully automated. The data is recorded and transferred to a big data environment at SBB. This enables the automated generation of ROS bags for replay scenarios and large-scale statistical analyses of the sensor data. The wagon is for around 1000 train journeys per year on the railway network and has approximately 750 operating hours.

Complementary to the sensor recordings, SBB has comprehensive map and route data. The map data consists of the geometrical representation of the railway tracks in Switzerland, including junctions, switches, and the 3D position and orientation of the rails. As previously introduced, both the geodetic and track position of the Eurobalises are part of the digital map. They are used for the generation of the reference values. The route provides information about the series of tracks passed per train journey and vehicle.

2.3. Jamming and Spoofing Scenarios

Intentional GNSS radio frequency interference in the form of jamming and spoofing (J/S) is a critical event that poses a safety and security threat to users, particularly in sectors that rely heavily on satellite-based positioning, navigation, and timing, such as aviation, maritime, emergency services, railway, road, and critical infrastructure. GNSS signals are strongly affected by radio frequency interference (RFI), with the potential to result in a threat, due to the physical properties of the GNSS radio signal power at the Earth surface level. At the Earth surface level, the signal power of the GNSS signal is extremely low, approximately on the order of ∼1.6 $\times {10}^{-16}$ Watts. Due to this fact, GNSS signals are extremely susceptible to all types of interferences, perturbations, or data tampering, a fact that malicious actors try to explore for their own benefit. GNSS jamming involves the deliberate transmission of radio signals in the L-band that interfere with the reception of authentic GNSS signals. The RFI can render the GNSS navigation systems inoperable or induce large errors on the determined PVT solution. Spoofing is more insidious as this process involves broadcasting fake GNSS signals that mimic authentic ones, misleading receivers into calculating incorrect PVT solutions. In order to assess the impact of J/S attacks and their potential propagation onto the data fusion algorithms, as developed in the EGNSS-MATE project, we have defined and implemented a J/S threat catalogue for that purpose. Two of the test cases out of that catalogue can be found in

Table 1. Table providing two test cases out of the EGNSS MATE test catalogue.

ID Number	Type	Interference Profile Characteristics
T-4000-01	J	En route chirp interference test
	Description:	Saw tooth chirp signal with 20 MHz bandwidth that is centred around 1.57542 GHz. This case assumes that a vehicle with a jammer approaches, maintains a constant distance to the train, and then recedes away.
T-4000-05	S	Shunting spoofing test
	Description:	Spoofing GPS and GNSS L1/E1 signals generates a position aligned towards the track trajectory. The attack consists of modifying the coordinates determined by the GNSS receiver after the train passes a switch.

.

2.4. Automated Testing and Validation

As explained in Section 2.2, the data recorded in the field as well as the results of the post-processed algorithm are stored in a big data environment, serving as the basis for the automated testing and validation. A simulation environment has been developed within the frame of the project. The container-based application can process any developed algorithm fulfilling the specified ROS Messages (https://github.com/EGNSS-MATE/emate_ros, accessed on 20 February 2026) as the interface. This implementation enables scalable and adaptable runs of different versions, configurations of the developed algorithm, and different input sensors. The output of the algorithm is then tagged, versioned, and automatically stored in the database.

Besides the post-processing pipeline, the testing with respect to the requirements has been automated. Each intermediate version of the algorithm has been classified based on requirement conformity, and reports have been generated. Validation of the algorithm’s functionality has been performed for different fields of application, called localisation profiles, including start of mission, en route, shunting scenarios, and different environmental conditions such as landscapes.

Automated testing and validation has been proven to be crucial. Fast iterations with final results insights are key during the development process. The established pipelines enable tuning, leading to improvements in the quality of the project’s results. Requirements engineering is essential for conformity with the system requirements formulated at the beginning of the project.

3. Results

3.1. Dataset

Table 2. Characteristics of the dataset.

Parameter	Value
Number of train runs	400
Period	8 September 2023–18 June 2024
Duration of measurements	275 h
Covered distance	17,190 km
Minimum and maximum duration	2 resp. 290 min
Minimum and maximum covered distance	1 resp. 305 km

presents the characteristics of the validation data package. It covers 400 train journeys recorded between the 8 October 2023 and the 18 June 2024. All train runs together lasted around 275 h, in which just over 17,000 km was covered. There are very short train runs with a duration of 2 min or a length of 1 km. These are usually shunting operations or specific experiments, such as the ones used for jamming and spoofing. However, there are also significantly longer journeys of up to almost 5 h over a distance of more than 300 km.

3.2. Jamming and Spoofing Tests

The impact of these RFIs was evaluated in terms of position accuracy by comparing the reference system against the system under test in the ENU coordinate system. These results are shown in Figure 1.

The previous results addressed situations associated with intentional J/S. A serendipitous observation during the test campaign performed in November 2023 was the verification that the L-band was impacted by an unintentional radio noise background due to radio telecommunications and unknown sources. This situation is shown for three cases in Figure 2. A high-level analysis indicated that this RF background affects the position accuracy. The ITU forbids any type of interference in the GNSS radio band due to its universal usage, importance, and criticality. Therefore, it is recommended to address this situation and equally to validate compliance with the limits on the allowed RF transmissions in the L-band.

3.3. Big Data Analysis

In the following section, we will present some selected results from the algorithm testing and validation for Localisation Profile 1 (LP1), which describes the travelling on open lines.

3.3.1. Stanford Diagrams of Position and Speed

Figure 3 shows the Stanford diagrams of the 1D position and speed. The availability limit for the position is set to 30 m and for the speed to 2 km/h ≈ 0.55 m/s. The dataset is filtered for the outputs for which the algorithm flags itself as available. The position confidence interval is always below 30 m and therefore fully available. A total of 1.90% of the samples have an error larger than the confidence interval and are therefore classified as unsafe while available. A total of 98.10% of the position samples have an error within the confidence interval, and the confidence interval is below the availability limit. The speed confidence interval is nearly always below the availability limit. A total of 0.01% of the data points are unavailable but still safe. A total of 99.52% of the samples are available and have an error which is enclosed by the confidence interval. A total of 0.47% have an error which exceeds the confidence interval.

3.3.2. Histograms of Position and Speed Error

Figure 4 shows the histogram of the position and speed error. The histogram of the position error shows all errors between 0 and 30 m assigned to bins with a size of 1 m. Samples with errors larger than 30 m are assigned to the last bin $[30.0,\infty )$ m. The majority of samples have a position error below 10 m, while several thousand have an error larger than 10 m. Approximately 400,000 errors are below 2 m. Nearly 40,000 samples have an error of more than 30 m. For the speed, the image is very similar. Most of the errors are below 2.2 m/s, while most of them are between 0.0 and 0.6 m/s. Several hundred errors are then between 2.2 and 5.0 m/s, and approximately 20,000 points have a speed error larger than 5.0 m/s.

3.3.3. Availability of Localisation Information

The following map illustrates the availability per track edge based on the status. As a reminder, status 0 states the algorithm has a single track hypothesis, status 1 that no hypothesis is available, and status 2 that there are at least two track edge hypotheses. We have calculated the percentage of samples per track edge with either status 0, 1, or 2. Figure 5 shows this percentage for status 0. For the majority of track edges, samples have a status of 0 with a probability of 80 to 100%, independent of the localisation profile and landscape typology. For some track edges, the availability of status 0 is much lower, for example, a high-speed line between Bern and Zurich, the line between Lucerne and Zug, or smaller track edges before or after a point.

4. Discussion and Conclusions

A novel filter bank approach has been implemented. It is modular with respect to the sensor setup and tightly integrates map data to exploit the track-constrained vehicle motion. A more technical presentation of the algorithm is currently in preparation.

The jamming and spoofing tests were carried out successfully. The results show that jamming attacks can not only result in signal outages but also in significant position errors. Spoofing can lead to even larger position errors. These threats have to be mitigated when designing a train localisation system. Note that using map constraints in the navigation algorithm can make it easier to detect erroneous position inputs. A possible solution to spoofing attacks could be Galileo’s Open Service Navigation Message Authentication (OSNMA) service, which has also been investigated in the project. OSNMA allows the detection of spoofers. However, due to the latency induced by OSNMA, it is only useful during start-of-mission scenarios.

The algorithm’s performance is in the expected range as specified in the system requirements. The developed logic achieves a safety percentage of 98.1% while being fully available for one-dimensional localisation. Furthermore, the results for the along-track speed are even better at 99.52%. The main challenge for safety-related applications of 1D data is to detect large and rare error cases. The mitigation of them shall rely on a reasonable enlargement of the confidence interval on a deterministic basis. Generally, choosing a conservative and large confidence interval is not acceptable, as the availability criterion with a maximum acceptable uncertainty is essential for the operation of the railway system.

The verification of the requirements has been achieved by applying tests to a large number of post-processed trips. The completely automated implementation allowed us to quickly iterate and improve on obvious bugs in the algorithm. The majority of the tests have been passed by over 90% of the samples, while the remaining ones have a positive pass rate but do not reach 90%. The results of the testing seem to be acceptable. Less remaining time at the end of the project yields a reduced number of reiterations in the testing phase. Fine-tuning and trip-based analyses would have been beneficial to further search for specific error sources, which could have been mitigated and would have led to further improvements.

The availability of the developed algorithm is as expected, with optimisation potential for 3D non-safe localisation output. As anticipated, the most challenging areas are tunnels and mountainous areas. This is due to the reduced capability of GNSS signal reception. The availability of the algorithm output strongly depends on the railway network topology. The map has been closely integrated with the computation logic and therefore massively impacts the quality. The main advantage of the algorithmic technique is its simplicity, by concentrating on the 1D localisation (position, speed) along the railway track. But this also leads to its major drawback: track selectivity is essential. Without unique path selection at switches, the algorithm has to fight with topological obscurities, which can be handled, resulting in reduced availability. The determination of track selectivity shall be improved in follow-up activities, which further enhances the performance without changing the general logic concepts developed in EGNSS MATE.