Algorithms and Performance of the EGNOS CPF Independent Check Set

Transcription

1 Algorthms and Performance of the EGNOS CPF Independent Check Set Wolfgang Werne Udo Rossbach and Robert Wolf IfEN Gesellschaft für Satelltennavgaton mbh (IfEN GmbH) BIOGRAPHIES Dr. Wolfgang Werner receved n 994 a dploma n Computer Scence from the Unversty of Technology n Munch. He worked as a Research Assocate at IfEN n the feld of hgh precson DGPS, ambguty oluton and APL (arport pseudolte) earch. In 2 he receved hs PhD from the Unversty FAF Munch. Snce 999 he s Techncal Drector of IfEN GmbH. Udo Rossbach holds a degree n aeronautcal engneerng from the Techncal Unversty Aachen (Germany). From 994 to 998 he worked as a Research Assocate at the Insttute of Geodesy and Navgaton of the Unversty of Federal Armed Forces Munch, dong earch on GLONASS and GPS/GLONASS combnaton. Snce 999 he s workng as a systems engneer wth IfEN GmbH. There he s nvolved n the development of GPS/GLONASS/EGNOS algorthms and software. Robert Wolf studed Aerospace Engneerng at the Techncal Unversty of Munch. In 995 he receved hs dploma degree and entered the Insttute of Geodesy and Navgaton, Unversty FAF Munch, as a earch assocate. He worked n the feld of hybrd GPS / INS navgaton and later on precse orbt smulaton and orbt estmaton. He contrbuted to German and European studes concerned wth onboard satellte state estmaton and nter satellte rangng. Snce 999 he s workng for IfEN GmbH. He s currently nvolved n the development of the EGNOS CPF Check Set algorthms and ntegraton nto the EGNOS end-to-end smulator. ABSTRACT One of the man objectves of the European Geostatonary Navgaton Overlay System (EGNOS) s the protecton of the user by offerng not only poston accuracy but also servce ntegrty. For ths reason the Central Processng Faclty (CPF) s dvded nto two sets: the Processng Set (PS) and the Independent Check Set (CS). Whle the task of the PS s to generate onosphere as well as ephemers and clock correctons wth corpondng error bounds, the CS s n charge of verfyng the correctness of ths nformaton by checkng the whole set of NOF (Navgaton Overlay Frame) messages ndependently. Two man ssues have to be addsed by the CS to ensure the user s ntegrty: the ntegrty of satellte correctons on the one hand and of the onospherc correctons on the other hand. For each of these two types of correctons error bounds are transmtted to the user. These are the User Dfferental Range Error (UDRE) for satellte correctons and the Grd Ionospherc Vertcal Error (GIVE) for onospherc correctons. Two key requrements are conflctng wth each other: ntegrty and contnuty of servce. Concernng the Check Set, the contnuty of servce corponds to the false alarm rate and mplctly determnes decson thholds, whle the ntegrty requrement corponds to msdetecton probabltes n gven error stuatons. When the PSprovded error bounds are close to the true mnmum error bounds, the CS false-alarm probablty wll ncrease, thus leadng to a probable don t use for a satellte or onospherc correcton and hence to a contnuty of servce problem. Howeve when the error bounds are conservatve (thus rasng ntegrty), the contnuty of servce at user level mght be endangered through hs protecton level equatons for a gven phase of flght. The achevable overall performance depends on a wde varety of key parameters, lke measurement accuracy, number of montorng statons and observablty of the onosphere. Ths paper descrbes the CS algorthms that have been developed wthn the EGNOS project and pents some ults concernng ther performance fgu n terms of ntegrty and contnuty of servce. INTRODUCTION In lterature many papers can be found on WAAS (Wde Area Augmentaton System) or EGNOS dscussng ntegrty and contnuty from a system pont of vew (e.g. [], [2]). The requrements for WAAS are derved from ION GPS 2, 9-22 September 2, Salt Lake Cty, UT 29

2 RTCA standards (WAAS MOPS [3], [4]). For reasons of nteroperablty they are also applcable to EGNOS. In ths paper a vew on performance ssues s pented from set level vew of the EGNOS CPF Independent Check Set. The paper detals for the frst tme ndvdual performances of the algorthms (algorthmc lmtatons) rather than the rsk allocaton comng down from system level. One of the man algorthmc lmtatons s that, due to the demandng tme-to-alarm requrement, long-term flters are allowed only to remove nose on measurements, but not for montorng some system propertes lke satellte orbtal errors, as these could change suddenly. To ensure the users ntegrty even n these cases, nstantaneous algorthms have been developed for checkng the EGNOS sgnal-n-space (SIS). CPF CS PHILOSOPHY The prmary task of the CPF Independent Check Set (CPF CS) s to protect the user from nvald EGNOS system data ( msleadng nformaton, MI). Ths type of nformaton could ult n a poston computaton that s outsde the accuracy specfcatons and must therefore be avoded. If there s no tmely warnng to the use then the msleadng nformaton becomes hazardous msleadng nformaton (HMI) and wll have severe consequences. Any occurrence of such stuatons has to be avoded n any case. Due to ths reason, the EGNOS system has to be qute conservatve n order to be able to detect such stuatons and rase an alarm n very short tme. The tme span allowed for the system to rase an alarm s dependent on the users requrements, wth CAT-I precson approach requrements beng the most demandng. The tme to alarm there must not exceed 6 seconds. The EGNOS system does not provde poston nformaton to the use but only rangng nformaton (correctons for the users satellte pseudorange measurements) and ntegrty nformaton. Ths leaves open the actual satellte geometry the user s usng, and smultaneously mposes demandng requrements on the CS. In prncple, there are two possbltes to verfy the user s ntegrty n EGNOS: Check the user s ntegrty n poston doman, and Check the user s ntegrty n pseudorange doman. There are several advantages and dsadvantages nvolved n the one or other check: Poston Doman + Verfy the user computatons end product - Enormous computaton power needed - User-satellte geometry not known at ground segment - Very lmted statstcal fault detecton and solaton capablty - Two ntegrty tests (at user and ground segment levels) workng smlarly Pseudorange Doman - Verfy pseudorange correctons only + Moderate computaton power needed + User-satellte geometry nformaton not needed - Transformaton from PR doman to poston doman not known + Good statstcal fault detecton and solaton capablty + Ground segment ntegrty s complemented by user s RAIM Due to the advantages and dsadvantages gven above, the phlosophy of the CS s to check the user s ntegrty manly n pseudorange doman. Ths pseudorange doman check, howeve wll be complemented by a rough poston doman check. Due to the demandng tme-to-alarm requrement, only about 5 ms are avalable for the CS to check the EGNOS ntegrty of a new message that s to be sent to the user. For ths reason, t s not possble to guarantee the full ntegrty of the EGNOS nformaton ncludng the new message by detectng and solatng any potental correcton fault. Therefore, the CS contans two man checkng subsets. These are the Check After Down-lnk subset, and the Check Before Up-Lnk subset. Whle the Check Before Up-lnk s lmted to the above mentoned 5 ms of tme between recevng the new message from the PS and sendng t to the up-lnk staton (NLES), the Check After Down-Lnk s allowed about 5 ms of tme. Due to the lmted tme allowed for the Check Before, the tests performed here are only rough statstcal tests wth no solaton capablty. Howeve these rough tests nclude a poston doman test (user lke) as well as a smple combned (satellte and onospherc) correcton pseudorange test. So, the CS s desgned n such a way, that msleadng nformaton may be sent to the user (at low probablty), but has to be detected at least when ths nformaton has been receved from the RIMS and sent agan to the CPF. 22

3 The ntegrty of the current actve set of EGNOS nformaton wll then be verfed by the more thorough Check After subset. The Check After subset wll perform statstcal tests to verfy the correct transmtted boundng levels for satellte correctons (UDRE) and for onospherc correctons (GIVE). For the Check After subset not only fault detecton, but also fault solaton s possble, because of the less lmted allocated tme nterval. The hgh performance requred necesstates statstcal tests that are not only user-lke. For the UDRE check, all measurements to one sngle satellte are combned to obtan maxmum statstcal nformaton of ths satellte and the qualty of the correcton to ts pseudorange. The UDRE check therefore s partally userlke, n that the EGNOS correctons are appled to the pseudoranges, but then devates from the user concept by makng use of the whole RIMS network. The GIVE check s even less user-lke than the UDRE check. It combnes all onospherc nformaton (from dual-frequency GPS measurements) n a sngle estmaton for the onospherc delay at the EGNOS onospherc grd ponts (s). Ths estmaton s then compared aganst the value gven by the PS and ts error bound. If the CS GIVD (grd onospherc vertcal delay) estmaton devates sgnfcantly from the PS GIVD estmaton and ts error bound lmt, a don t use wll be rased. The GIVE check s thus not at all user-lke, but more PS-lke. The reason for ths approach s, that not only falure detecton but also solaton s requred, so the best way s to re-compute the value that should be checked (wth ndependent RIMS data). Note that a sngle EGNOS message can not be tested per se, because ts content s only vald and useful n the context of the set of already transmtted EGNOS messages. Therefore, no EGNOS message can be checked for ntegrty at a stand-alone bass, but can only be checked when the EGNOS message context (hstory of prevous messages) s avalable. CHECK SET ARCHITECTURE A top-level vew of the CS archtecture and ts man nternal nterfaces between CS subsets as well as external nterfaces to RIMS, NLES and PS s pented n Fg.. In prncple the CS also has nterfaces to CCF for commandng the operatonal CS, archvng data etc, but focus s gven to performance relevant parts concernng the core algorthms rather than operatonal ssues. The CS s desgned to check up to three dfferent GEO NOF lanes. Therefore, for each of the operatonal NOF lanes there s an nstance of one Check After and one Check Before subset (named CKAOpX and CKBOpX n the fgure). Addtonally, there are three unque subsets: Pre-processng & Valdaton (Pre&Val), Check After of the nternal lane (CKAInt) and the Qualty of Servce (QoS) subset. In the followng the four dfferent types of CS subsets Pre-processng & Valdaton Check After Check Before Qualty of Servce are brefly explaned. RIMS NOF Lane GEO 3 NOF Lane GEO 2 NOF Lane GEO CS CKAOp3 CKAOp2 Pre-proc. Data & Satellte Pos. NM/DU Flags for each Lane CKAOp Internal Lane NOF CKAInt Pre-proc. Data Satellte Pos. PS NOF Lane 3 NM/DU Flags NOF Lane 2 NM/DU Flags NOF Lane NM/DU Flags Internal NOF Pre&Val CKBOp3 NOF Up GEO 3 NOF Up GEO 2 CKBOp2 Pre-proc. Data & Satellte Pos. CKBOp NOF Up GEO QoS Satellte Pos. Fgure : CS top-level archtecture Pre-Processng & Valdaton Integrty Flag Integrty Flag Integrty Flag Integrty Flag The man task of the Pre-processng & Valdaton subset s to provde pre-processed measurements to the Check After and Check Before subsets. These measurements have to be as clean as possble to enable the checkng subsets to decde whether NOF ntegrty s ensured or not. Therefore, many plausblty checks on the raw measurements have to be performed. These nclude valdaton of pseudorange and carrer-phase measurements (range varaton checks as well as range cross-checks), multpath detecton and excluson, cycleslp detecton and repar. Moreove all nput data receved from RIMS have to be valdated. Ths ncludes valdaton of navgaton data (ephemers data as well as almanac data), valdaton of tme, valdaton of onospherc parameters (for the GPS Klobuchar model), UTC and GLONASS tme offsets etc. Measurement data have to be pre-processed and prepared for nput to the check subsets. Ths ncludes correcton of tropospherc and other effects. To reduce recever nose to a mnmum, a carrer-smoothed pseudorange s computed. Fnally, the onospherc-free combnaton as well as the onospherc observable (delay) are computed Qos Fg. NLES 22

4 and provded to the Check After. Non-onospherc-free pseudoranges are provded to the Check Before, because n ts user-lke desgn ths subset apples onospherc correctons from the NOF to be checked. Check After As already mentoned, the Check After s the heart of the CS. Its task s to verfy the ntegrty of the broadcast correctons. Therefore, two man statstcal tests are mplemented. One test s desgned to check the correctness of the satellte correctons (called UDRE check), whle the other one s desgned to check the onospherc correctons (called GIVE check). These two tests are the core of the CS and ther algorthms as well as ther performance wll be detaled n the next sectons. For both (satellte as well as onospherc) types of correctons fault detecton and solaton s requested. Therefore the algorthms have to be desgned approprately. Check Before Due to the lmted allocated computaton tme for the Check Before, only rough checks on the ntegrty of the NOF (ncludng the next NOF message to be up-lnked) can be made. Currently, there are two man tests foeen for the Check Before: a poston doman VPL (vertcal protecton level) test as well as a rough UDRE/GIVE combned pseudorange dual test s performed. Due to the lmted tme, fault detecton, but no fault solaton s performed here. Due to the severe consequences of a faled Check Before test (CPF non-ntegrty flag s rased), t can only serve as a rough check that detects bg errors. In the pent paper the focus s lad upon the core algorthms of the CS, whch are mplemented n the Check After. Therefore, no detals wll be gven on the Check Before algorthms. Qualty of Servce The Qualty of Servce module s ponsble for generatng a Qualty of Servce fgure. Ths fgure gves a frst glance of the CPF ntegrty and qualty to NLES, easng the select CPF functon of the NLES. The Qualty of Servce fgure s computed based on a weghted mean of typcal vertcal protecton levels, as seen from arbtrary users at several pre-defned locatons (man arports wthn the servce area). As ths module s not of mportance for performance of the overall CS, t s not dscussed further n ths paper. UDRE CHECK ALGORITHM The task of the UDRE check s to verfy, whether the broadcast UDRE s boundng the dual orbt and satellte clock errors suffcently. As, howeve the true worst-user dual orbt and satellte clock error s not known, an estmaton has to be used. Fgure 2 llustrates the UDRE valdaton problem of the CPF CS. Potental Contnuty Rsk (False Alarm) Normal Mode of Operaton Potental Integrty Rsk (Mssed Detecton) Densty of CPF CS SREW Estmaton X [m] Broadcast UDRE (CPF PS) Instantaneous SREW Estmaton (CPF CS) Instantaneous SREW (True Error) Fgure 2: Illustraton of the UDRE valdaton task of the CPF CS It must be guaranteed that the true SREW s suffcently bounded by the broadcast UDRE of the CPS PS. Fg. 2 shows the normal operaton case, where the broadcast UDRE s above the true nstantaneous SREW, and also above the CPF CS estmated SREW. In ths case, no alarm wll be rased and ntegrty s ensured. The broadcast UDRE s consdered as fx at any nstant n tme and s therefore seen from an objectve pont of vew. The CS SREW estmaton s a random varable, as t depends on CS estmaton errors, ntroduced by measurement nose. In case that the SREW estmaton s above the broadcast UDRE, an alarm wll be rased, as t cannot be ensured that the true SREW s bounded suffcently. Whether ths s a false-alarm s dependent on the relaton of both values to the true SREW. On the other hand, f the CS SREW estmaton s below the broadcast UDRE, no alarm wll be rased, assumng that the own SREW estmaton s boundng the true SREW wth suffcent confdence. Ths, of course, leads to a potental ntegrty rsk, when the CS SREW estmaton s below the true SREW. For these reasons, t can be seen that there are two crtcal parameters for the CS UDRE check: the shape of the SREW estmaton dstrbuton and the conservatvty of the broadcast UDRE wth pect to the true SREW. To obtan maxmum nformaton from a statstcal UDRE test, all avalable data for a consdered satellte has to be gathered from the RIMS network. 222

5 After the satellte correctons have been appled to the onospherc-free pseudoranges provded by the Pre&Val subset, the basc observaton equaton can be wrtten n the followng form: R sm, r ρ r + δ r δ + δ Orb, + ν Rsm = () wth R sm, r smoothed pseudorange from RIMS r to satellte, ρ r r Orb, true geometrc range between RIMS r and satellte, δ clock error of RIMS δ dual clock error of satellte, δ dual orbt error of satellte, ν nose and other unmodelled effects. Rsm If only satellte dual clock errors were to be consdered, a (weghted) mean of all duals of the consdered satellte would gve a good montor wth qute smple probablty densty functon dependent on measurement nose and dual tropospherc effects. Howeve as n the UDRE bound orbtal errors should also be covered, some more sophstcated approach s necessary. Analysng the effects of some arbtrary (dual) satellte orbt error on a user at some locaton wthn the servce area, t turns out that the orbt error translates to a dual surface that can be approxmated by a smple plane. Fgu 3a and 3b show two examples of the effects of an orbt error on the pseudoranges of a montor wthn ECAC. Effect of Orbt Error on PR Resduals (Sat: Lat4, Lon, OrbErr: Lat4, Lon9) To obtan the true correcton duals, the RIMS-specfc clock bas has to be elmnated from the measurements. The RIMS clock bas can be easly computed as the mean of all pseudorange duals of the RIMS. Howeve ths mples that all (or at least most) of the correctons are correct and necesstates a certan solaton logc (see below). The ult then s: PR Error [m] Longtude [ ] Lattude [ ] n k ε r = ε clk ε clk = ε + ε Orb, + ε ν n k = (2) Effect of Orbt Error on PR Resduals (Sat: Lat4, Lon, OrbErr: Lat4, Lon-3).98 wth the defntons n = δ δ n k = k ε (3a) Orb, n = δ Orb, δ k = ε (3b) n k = ν R ν sm n k = k Orb, n ε ν (3c) Rsm and n beng the number of satelltes tracked at the consdered RIMS. As can be seen from equatons (2) and (3a-c), dual satellte orbtal errors and satellte clock errors can be montored nearly drectly n these correcton duals. PR Error [m] Longtude [ ] Lattude [ ] Fgure 3a,b: Effects of example orbt errors on pseudorange measurements of a montor wthn ECAC Ths plane has to be estmated and extrapolated to the worst user locaton. Ths worst user locaton must be wthn the EGNOS servce area and smultaneously n the consdered satellte footprnt. The value of the plane at the worst user locaton s called satellte dual error at worst user locaton (SREW). From all the pseudorange measurements (at dfferent RIMS locatons) to one sngle satellte the corpondng bas plane can be estmated. The plane wll be determned 223

6 by estmatng three parameters: the value of the plane at some arbtrary reference pont ( f λ, φ ) ) and two Bas ( gradents n lattudnal and longtudnal drecton (α and β ). Therefore, the plane can be repented by the followng formula (4): f Bas ( λ, φ) = f Bas ( λ, φ ) + α ( λ λ ) + β ( φ φ ) After havng solved the approprate lnear equaton system, the estmaton of the SREW value can then be wrtten n the followng form: SREW CS (4) ( f ( λ, φ) + k Var( f ( λ, ))), estmated = max Bas Bas φ λ, φ Lnked to the estmaton of ths bas plane s some uncertanty n the plane due to measurement nose. Note that the term Var ( f Bas ( λ, φ) ) s geometry dependent and some a pror measurement nose has to be assumed. Note furthe that the emprcal nose of the measurement cannot be taken as a pror nose, because smoothed pseudoranges are processed and over-optmstc precson values would be obtaned. It must be ensured that (dual) tropospherc and other unmodelled effects have to be bounded by ths a pror nose. Ths uncertanty (scaled to a sgma value) can then be multpled by some constant k for tunng the conservatvty of the CS UDRE estmaton. Ths parameter wll have severe consequences wth pect to false-alarm rates and mssed-detecton probabltes and, thus, the rsk apportonment between Integrty and Contnuty. An alarm ( don t use flag) for the satellte s rased, f the estmated SREW exceeds the broadcast UDRE. Ths flag s then transmtted to the PS and has to be ncorporated n the broadcast nformaton mmedately, to ensure the users ntegrty. Specal attenton must be pad to the case, when the UDRE check algorthm has ndeed detected a correcton error. In ths case, some specal solaton logc has to be appled. Note that a faulty satellte correcton has effects on many satellte correcton checks, not only on the sngle check for ths satellte. Ths s due to the fact that the RIMS clock errors can only be computed relably usng more than a sngle measurement from a sngle satellte,.e. several corrected satellte pseudorange measurements are used n the clock error computaton. A faulty satellte correcton thus could affect all satellte correcton checks, (5) whch are connected to the faulty satellte correcton va a common RIMS clock error. The solaton logc used n the UDRE check algorthm s based on the fact that the statstcal check of the true error wll provde a much worse test statstc than any other nfluenced check. Due to the accumulaton of statstcal nformaton n these checks, such a fault solaton s more relable than a sngle RAIM algorthm would be, when t were appled on a per RIMS bass. After ths worst test has been solated through a dependency analyss, an teraton n clock error computatons and a partal repetton of the remanng statstcal tests s necessary. Note that the UDRE and the GIVE check can be consdered as ndependent wth pect to detected falu, because the nput to the UDRE check are clean onospherefree pseudoranges, whle the GIVE check bases on the onospherc observables from dual-frequency measurements. In these potental clock errors cancel, and thus GIVE checks are ndependent from UDRE check ults. UDRE CHECK PERFORMANCE Due to the non-lnear and geometry-dependent operatons nvolved n the SREW determnaton, a statstcal analyss s very dffcult. For ths reason, ntensve smulatons have been carred out. The followng steps and parameters have been used for the smulatons: Number of smulaton runs: 5 Smulated satellte poston n lattude and longtude has been randomsed Vsblty has been computed and f the vsblty was between DOC (depth of coverage,.e. number of RIMS montorng the satellte) 3 and the smulaton run has been contnued. Otherwse, a new satellte poston has been determned. (The reason for ths decson s, that these cases of low DOC are the crtcal cases, where low performances must be antcpated.) True SREW was computed n each constellaton For each of these constellatons, runs have been carred out wth vared smulated measurements CS SREW estmaton performed for each case The effects of the followng key parameters have been analysed: Sze of dual orbt error Nose of pre-processed measurements (ncludng any dual tropospherc effects) Conservatvty factor k 224

7 Fgu 4 to 7 pent some of the ults Dstrbuton RIMS 4 RIMS 5 RIMS Dstrbuton RIMS 4 RIMS 5 RIMS (Estmated SREW - True SREW) / True SREW Fgure 4: Dstrbuton of estmated SREW (dual orbt error 5. m (one sgma), pre-processng nose.5 m (one sgma), conservatvty k = ) (Estmated SREW - True SREW) / True SREW Fgure 7: Dstrbuton of estmated SREW (dual orbt error 5. m (one sgma), pre-processng nose.2 m (one sgma), conservatvty k = 3.29) As the crtcal ults can be found n those cases, where only a few measurements to a satellte are avalable, the cases of havng 3, 4 or 5 RIMS are consdered especally. Dstrbuton RIMS 4 RIMS 5 RIMS All fgu gve dstrbuton curves of the CS SREW estmaton. The x-axs of the fgu depcts the relatve level of over-/under-boundng the true SREW (n percentage), whereas the y-axs gves the accumulated probablty for a ult beyond the gven x-axs value (Estmated SREW - True SREW) / True SREW Fgure 5: Dstrbuton of estmated SREW (dual orbt error 5. m (one sgma), pre-processng nose.2 m (one sgma), conservatvty k = ).9.8 So, from the fgu the condtonal probabltes for mssed detecton and false alarm can easly be derved. E.g. n fg. 4 the curve values at -.2 and -. are about.3 and.5 for all curves. Ths translates nto a condtonal probablty for mssed detecton of.2 (or 2 %) at relatve level of under-boundng between to 2 %. I.e., f the PS relatve level of under-boundng s about to 2 % of the true SREW, the condtonal probablty for mssed detecton wll be about 2 %. Dstrbuton RIMS 4 RIMS 5 RIMS (Estmated SREW - True SREW) / True SREW Fgure 6: Dstrbuton of estmated SREW (dual orbt error 5. m (one sgma), pre-processng nose.5 m (one sgma), conservatvty k = 3.29) Furthermore, e.g. n the same fgure, the curve values at.3 and.4 are about.98 and.99 for all curves. Ths translates to a condtonal false alarm probablty of. (or %) at relatve level of over-boundng of 3 to 4 %. I.e., f the PS relatve level of over-boundng s about 3 to 4 % of the true SREW, the condtonal probablty for false alarm wll be about %. As can be seen from fgu 6 and 7 (conservatvty factor set to 3.29), an under-estmaton of the true SREW s very unlkely. Howeve the false-alarm rsk s much hgher than n the case of conservatvty. In fact the false-alarm probablty wll become much too hgh consderng the number of checks that have to be performed each epoch. The fne-tunng and harmonsaton of the UDRE check behavour has to be performed thoroughly and n consderaton of the PS sde of the CPF algorthms. The probabltes that can be obtaned from the fgu as pented here are condtonal probablty fgu. To 225

8 acheve the necessary overall performance at CPF level, the probablty densty functon of the broadcast UDRE wth pect to the SREW (over- or under-boundng probabltes) must be known n addton to the probabltes gven here. GIVE CHECK ALGORITHM An estmate of the vertcal delay at the grd pont s derved from one sngle measurement at the perce pont by assumng ~ d,r α d wth ( ) Model = (6) If the above condton s volated, the GIVE check sets the corpondng flag for ths to "Don't Use", otherwse t s set to "Montored". For N IPP, =,.e. no perce pont fulfls the mnmum weght condton, the GIVE check can not be performed at all for ths, and the corpondng flag for ths grd pont s set to "Not Montored". The followng table summarses the GIVE check ults wth corpondng condtons: Result f = "Montored" dˆ GIVD Condton GIVE IPP, > N d α = (7) ( d ) Model f = "Not Montored" N IPP, = beng the rato between the measured delay at the perce pont and the model delay at the perce pont. The estmated vertcal onospherc delay s then derved from a weghted mean of the sngle measurement estmates dˆ = ~ d (8) w IPP,,r NIPP, ( w ) IPP,,r,r NIPP, Wth N IPP, beng the number of perce ponts lyng "n the vcnty" of the grd pont and the weghts of the sngle measurement w. The weghtng factors w are derved from an a-pror functon for the spatal onospherc correlaton dvded by the standard devaton of the vertcal delay at the perce pont. w IPP,,r e = 2 ψ IPP,,r Ψ σ d ψ IPP,,r s the sphercal dstance between one perce pont and one grd pont. ψ IPP,,r = cos sn ϕ + cos ϕ cos ϕ cos ϕ cos( λ (9) λ ) () It s scaled by the spatal onospherc correlaton parameter Ψ. In the current desgn ths parameter s set to 2.9. The actual check s performed by comparng the dfference between estmated vertcal delay at the grd pont and GIVD wth the error bound (GIVE). f = "Don't Use" dˆ GIVD > GIVE IPP, > Fgu 8 and 9 depct the prncple of the GIVE check. In fgure 8 the GIVE contans msleadng nformaton because t does not bound the GIVD error. The red marked (hatched) area ndcates the msdetecton probablty of the GIVE check. In fgure 9 the GIVD error s also not zero, but bounded by the broadcast GIVE. In ths case the red marked (hatched) area on the left hand sde ndcates the false alarm probablty. Assumng a Gaussan dstrbuton, the probablty to have no alarm can be derved from P Non Alarm ( + GIVE) Φ( ε GIVE) = Φ ε (2) GIVD GIVD wth the ntegrated probablty densty functon of the normal dstrbuton 2 2σ Φ ( x) = e CS dt (3) 2π σ CS x 2 t The probablty of alarm s smply the alternate event. P Alarm ( Φ( ε + GIVE) Φ( ε GIVE) ) = (4) GIVD GIVD N dˆ GIVD GIVE () 226

9 Correct Detecton Area Mssed Detecton Area Cor. Det.. P(ε GIVD,CS ) εgivd - GIVE εgivd + GIVE Relatve Frequency [-] ε GIVD,CS Fgure 8: GIVE check msdetecton probablty False Alarm Area Correct Non Alarm Area False Alarm Area. - 2 ε GIVD,CS [m] Fgure : Sample dstrbuton of GIVD estmaton error.4.3 εgivd - GIVE εgivd + GIVE. P(ε GIVD,CS ) ε GIVD,CS Fgure 9: GIVE check false alarm probablty Probablty [-] An alarm, as well as a non alarm can ether be correct or not, accordng to the followng table. ε <= GIVE ε GIVE GIVD GIVD > P Alarm False Alarm P correct non alarm Non Alarm P Mssed Detecton GIVE CHECK PERFORMANCE P correct detecton Fgure has been derved from smulatons n the EGNOS end-to-end smulator usng the BENT model as true onosphere. It shows the hstogram of the GIVE check erro.e. the relatve frequency versus Check Set estmaton error. Computng statstcs of ths (sgnfcant non-gaussan) dstrbuton yelds: mean standard devaton.8 m.28 m ε GIVD,CS [m] Fgure : Cumulated probablty dstrbuton of GIVE check Due to the long-taledness of the dstrbuton, the Processng Set wll have to add some margn on the GIVE to avod too many false alarms. The non-zero mean s mostly due to an mperfect estmaton of the nterfrequency bases. Fgure shows the cumulated probablty dstrbuton. Fgure 2 has been derved analytcally under the assumpton of Gaussan dstrbuton. It shows the alarm probablty of the GIVE check, wth pect to the rato of true error (ε GIVD ) to error bound (GIVE). The curves are gven for varous ratos of Check Set accuracy to Processng Set conservatvty. 227

10 P Alarm ε GIVD /GIVE Fgure 2: Alarm probabltes vs. relatve GIVD error To acheve a reasonable false alarm rate ( -7 for a GIVD error of 3 % of the broadcast GIVE) the σ GIVE has to be at least twce as hgh as the standard devaton of the GIVE Check. Current smulatons show that the broadcast GIVE (ndex) has to be around 4, corpondng to.2 m error bound. CONCLUSIONS The core algorthms that have been developed for the EGNOS CPF Independent Check Set have been pented. These are the UDRE check algorthm and the GIVE check algorthm. Statstcal propertes and performance ults obtaned from ntensve smulatons have been pented. Note that the performance fgu wth pect to ntegrty and contnuty pented here are only condtonal fgu at set level. To obtan overall fgu at system level (or even at CPF sub-system level), smlar ults from the second set n the CPF, the PS, must be avalable. The followng conclusons may be drawn from the ults of the smulatons: There are two crtcal parameters concernng the UDRE bound check feasblty: the shape of the CS SREW nstantaneous estmaton dstrbuton and the a pror conservatvty of the CPF PS broadcast wth pect to the true SREW. Smlarly, for the GIVE check also two crtcal parameters are nvolved: the shape of the GIVD estmaton dstrbuton and the CPF PS broadcast GIVE conservatvty. Dffcult tunng of the conservatvty parameters between PS and CS s necessary at CPF level to optmse CPF, and hence, EGNOS overall performance. Of course, the number of tests that have to be performed n a sngle epoch as well as the correlaton tmes have to be consdered. The tunng wll affect three of the performance parameters: ntegrty, contnuty and avalablty. If the UDRE/GIVE values are too conservatve, there wll be no servce avalablty for the user. On the other hand, f the UDRE/GIVE values are too low, ether no ntegrty can be guaranteed, or the contnuty rsk due to CS false-alarms rses. Due to the demandng TTA requrement the excluson of long-term flters has to be compensated. Therefore, t s mportant for the CS to have good qualty nput measurement data from RIMS and as many measurements for each satellte to be montored as possble to obtan maxmum statstcal sgnfcance. Note that the demandng CAT I ntegrty requrement cannot be fulflled by each statstcal test per se, but that a rsk allocaton has to be made to dfferent components. Frst, there has to be a stuaton, where the user s ntegrty s not ensured, e.g. due to the CPF PS broadcast UDRE not boundng the true SREW, wth some small probablty p. Second, ths problem s not detected wth some condtonal mssed-detecton probablty p 2 at CPF CS. Therefore, by assumng statstcal ndependence between PS and CS computatons due to ndependent measurement data, the overall ntegrty rsk for ths stuaton wll be only p p2. Integratng all possble cases then leads to an overall ntegrty fgure for the sgnal-n-space. Note further that there s no possblty for the EGNOS ground segment to montor pure user-local effects. An approprate rsk budget has to be allocated to these cases at user-level (and system-level) therefore. ACKNOWLEDGMENTS The algorthms and ults pented n ths paper have been developed wthn the frame of the EGNOS project, funded by the European Space Agency (ESA). REFERENCES [] D. Da, T. Walte P. Enge, J. D. Powell, Satellte- Based Augmentaton System Sgnal-In-Space Integrty Performance Analyss, Experence, and Perspectves, ION GPS-99, Nashvlle, TN, Sept. 4-7, 999. [2] X. Derambure, J. M. Peplu, D. Flament, J. C. Levy, E. Sales, J. Ventura-Traveset, Assessment of 228

11 EGNOS contnuty from poston to range doman, ION GPS-99, Nashvlle, TN, Sept. 4-7, 999. [3] Mnmum Operatonal Performance Standards For Global Postonng System/Wde Area Augmentaton System Arborne Equpment, RTCA Document No. RTCA/DO-229, Prepared by RTCA Specal Commttee 59 (RTCA SC-59), RTCA, Inc., Washngton, D.C., January 6, 996 [4] Mnmum Operatonal Performance Standards For Global Postonng System/Wde Area Augmentaton System Arborne Equpment, RTCA Document No. RTCA/DO-229B, Prepared by RTCA Specal Commttee 59 (RTCA SC-59), RTCA, Inc., Washngton, D.C., October 6, 999. [5] Draganov, A.; T. Cashn; J. Murray (996): An Ionospherc Correcton Algorthm for WAAS and Intal Test Results, Proceedngs of ION GPS-96, pp , Kansas Cty, Mssour. 229