Projected Performance of a Baseline High Integrity GNSS Railway Architecture under Nominal and Faulted Conditions

GNSS is being gradually adopted for both navigation and control of many safety critical transportation system. This paper focuses on the important area of high integrity GNSS for railway applications which is critical for safe use of GNSS. While aviation has led the development of high-integrity GNSS applications, the Railway High Integrity Navigation Overlay System (RHINOS) effort aims to apply GNSS to railways utilizing similar integrity methodologies. In particular, it seeks to provide the accuracy necessary to support the most critical railway operations while assuring a very low probability of Hazardously Misleading Information (HMI). The RHINOS efforts are studying the most appropriate architectures (e.g., combinations of GNSS augmentations) and developing an integrity methodology suitable for the architecture that is chosen. This paper describes a reference RHINOS architecture and examines its performance under nominal and faulted conditions. The performance analysis is conducted through simulation using the Matlab Algorithm Availability Simulation Tool (MAAST). MAAST, which was developed for aviation integrity analyses, was modified to support Protection Level (PL) calculations based on a proposed RHINOS reference architecture. It calculates PLs at representative locations throughout Europe for both nominal and faulted cases. The nominal case assumes that all GNSS range measurements are bounded by faultfree error models. Error models derived from accepted Satellite Based Augmentation System (SBAS) and Ground Based Augmentation System (GBAS) models are used. The main exception is multipath, which is known to be more severe for trains than for aircraft. The fault cases examined are those where either ionosphere gradients, satellite (ephemeris or clock) errors, or multipath exceed the nominal models. The integrity monitoring should detect and exclude the fault, if it is sufficiently large or not detected it, in which case it will bound its effect. Finally, sensitivity analysis is conducted to provide insights for designing the system. Different multipath assumptions are tested and different levels of mitigation are examined what level of mitigation and monitoring should be targeted.