Bounding Continuity Risk in H-ARAIM FDE

Transcription

1 Boundng Contnuty Rs n -ARAIM FDE Yawe Za Illnos Insttute of Tecnology Mateu Joerger Te Unversty of Arzona Bors ervan Illnos Insttute of Tecnology BIGRAY Yawe Za obtaned a Bacelor s degree n Mecancal Engneerng from Qngdao Unversty of Scence and Tecnology Cna n 213. e s currently a.d. canddate and Researc Assstant n Mecancal and Aerospace Engneerng at te Illnos Insttute of Tecnology (IIT). s researc focuses on advanced recever autonomous ntegrty montorng (ARAIM) fault detecton and excluson (FDE) usng mult-constellaton global navgaton satellte systems (GNSS). Dr. Mateu Joerger obtaned a Dplôme d Ingéneur n Mecatroncs from te Ecole Natonale Supéreure des Arts et Industres de Strasbourg France n 22 and a M.S. and a.d. n Mecancal and Aerospace Engneerng from te Illnos Insttute of Tecnology (IIT) n 22 and 29 respectvely. e s te 29 recpent of te Insttute of Navgaton (IN) arnson award and te 214 recpent of te IN s Early Acevement Award. e s currently an assstant professor at Te Unversty of Arzona worng on mult-sensor ntegraton sequental fault-detecton for mult-constellaton navgaton systems and relatve and dfferental recever autonomous ntegrty montorng (RAIM). Dr. Bors ervan s a rofessor of Mecancal and Aerospace Engneerng at IIT were e conducts researc on advanced navgaton systems. ror to onng te faculty at IIT e was a spacecraft msson analyst at uges Arcraft Company (now Boeng) and a postdoctoral researc assocate at Stanford Unversty. rof. ervan receved s B.S. from te Unversty of Notre Dame M.S. from te Calforna Insttute of Tecnology and.d. from Stanford Unversty. e s an Assocate Fellow of te AIAA a Fellow of te Insttute of Navgaton (IN) and Edtor-n-Cef of te IN ournal NAVIGATIN. e was te recpent of te IIT Sgma X Excellence n Unversty Researc Award (211 22) Ralp Barnett Mecancal and Aerospace Dept. utstandng Teacng Award (29 22) Mecancal and Aerospace Dept. Excellence n Researc Award (27) Unversty Excellence n Teacng Award (25) IEEE Aerospace and Electronc Systems Socety M. Barry Carlton Award (1999) RTCA Wllam E. Jacson Award (1996) Guggenem Fellowsp (Caltec 1987) and Albert J. Zam rze n Aeronautcs (Notre Dame 1986). ABSTRACT Future dual-frequency mult-constellaton advanced recever autonomous ntegrty montorng (ARAIM) s expected to brng sgnfcant navgaton performance mprovement to cvl avaton. Among te two ARAIM scemes tat are beng nvestgated orzontal ARAIM (-ARAIM) ams at provdng orzontal navgaton for arcraft en-route termnal ntal approac nonprecson approac (NA) and departure operatons. Because most of tose operatons cannot be easly aborted once started - ARAIM contnuty requrements are strngent and loss of contnuty (LC) for -ARAIM s consdered a serous safety event. In ts paper we address te mpact of detected faults and unsceduled satellte outages (US) on -ARAIM contnuty develop new metods to quantfy contnuty rs and nvestgate -ARAIM overall avalablty performance accountng for bot ntegrty and contnuty. Usng mult-constellaton global navgaton satellte systems (GNSS) te egtened lelood of te user encounterng a fault or US could sgnfcantly ncrease contnuty rs. In response our prevous wor explored mplementng an excluson functon to mprove contnuty after fault detecton and separately analyzed crtcal satelltes to assess te mpact of US on -ARAIM contnuty. In ts wor we derve a more rgorous contnuty rs equaton tat quanttatvely accounts for te LC contrbutons from bot measurement faults and US. Ts new approac unfes te separate crtcal satellte analyss nto one ntegrty rs equaton wc caracterzes te ntegrty treat under US condtons. Moreover ts approac allows us to determne weter an excluson functon s stll needed followng a US event. Wt ts new metod fully descrbed and derved te last part of te paper apples t to analyze -ARAIM avalablty performance. Te results ndcate tat dual-constellaton - ARAIM can provde g servce avalablty were bot ntegrty and contnuty requrements are met.

2 INTRDUCTIN Global navgaton satellte system (GNSS) measurements are vulnerable to faults ncludng satellte and constellaton falures wc can potentally lead to maor ntegrty treats for users. To mtgate ter mpact fault detecton algortms suc as recever autonomous ntegrty montorng (RAIM) can be mplemented [1 2]. Te core prncple of RAIM s to explot redundant measurements to aceve self-contaned fault detecton at te user recever [3]. Wt te modernzaton of GS te full deployment of GLNASS and te emergence of Galleo and Bedou a greatly ncreased number of redundant measurements ave become avalable wc as recently led to a renewed nterest n RAIM. In partcular due to ts potental to aceve worldwde coverage wt a reduced nvestment n ground nfrastructure dual-frequency mult-constellaton advanced RAIM (ARAIM) as attracted consderable attenton n te European Unon and te Unted States [4 5]. Currently two versons of ARAIM correspondng to two operatonal scenaros are beng nvestgated: orzontal ARAIM (- ARAIM) ams at provdng orzontal navgaton for arcraft en-route termnal ntal approac non-precson approac (NA) and departure operatons and vertcal ARAIM (V-ARAIM) s ntended for arcraft approac [6]. ARAIM s sceduled to frst provde orzontal servce wt mproved avalablty performance as compared to exstng RAIM [6]. Terefore -ARAIM s of prmary nterest and s te focus of ts paper. RAIM became operatonal n te md-9s as a bacup navgaton tool to support arcraft en-route flgt usng GS only [7]. - ARAIM may be consdered an evoluton of RAIM tat taes advantage of GNSS modernzaton and of newly deployed GNSS. - ARAIM also serves for operatons wt more strngent navgaton requrements. For example orzontal alert lmts (AL) as low as.1 nautcal mles are consdered for -ARAIM NA operatons; n ts case wen -ARAIM s used as prmary navgaton tool loss of contnuty (LC) becomes a more serous safety event. Tese dfferences n target level of safety must be accounted for n te desgn of -ARAIM and motvate te reassessment of fault detecton and excluson (FDE) metods as compared to conventonal RAIM. Most ARAIM wor to date as focused on developng teoretcal metods to reduce ntegrty rs and false alarms are typcally regarded as te only contnuty concern. owever for -ARAIM operatons contnuty requrements are strngent and oter sources tat cause LC must also be properly accounted for. Ts s because -ARAIM mssons cannot be easly aborted once started and addtonal navgaton means must be found wen LC occurs. As a consequence plots would face ncreased worloads and more stress would be brougt to ar traffc controllers (ATC). In partcular for te cases wen oter navgaton metods are not avalable LC durng -ARAIM operatons can lead te arcraft to be n a dangerous stuaton. In response ts wor ams at precsely quantfyng and boundng te overall -ARAIM contnuty rs. Future mult-constellaton GNSS wll provde greatly ncreased measurement redundancy wc mproves ARAIM detecton capablty. owever te accumulated lelood of te user encounterng a fault or unsceduled satellte outage (US) wll also ncrease leadng to a rse n contnuty rs. In addton newly deployed constellatons may be subect to larger pror probabltes of satellte fault and US. Terefore -ARAIM LC due to detected satellte faults and US are te prmary concerns of ts paper. To mprove contnuty after fault detecton an excluson algortm was desgned and te assocated predctve FDE ntegrty rs was bounded n our pror wor [8]. Te excluson functon s called once an alarm s trggered and t autonomously dentfes and removes te cause of te alarm tereby preservng contnuty of servce. owever te gan n contnuty comes at te cost of ncreased ntegrty rs [9 1]. Ts s due to te fact tat (a) excludng satelltes may weaen te satellte geometry and (b) te possblty of excludng te wrong satellte ncreases te ntegrty rs. Terefore excluson ntroduces a tradeoff between ntegrty and contnuty. ur prevous wor also separately analyzed crtcal satelltes to address te mpact of sngle-satellte US on - ARAIM contnuty. A crtcal satellte s one wose loss wll result n te ntegrty rs exceedng requrements. To be more general n ts wor we extend te crtcal satellte approac to nclude US condtons wt more tan one satellte. Ts approac presumes a requred capablty of stll beng able to perform detecton and excluson usng te remanng satelltes after satellte(s) s unexpectedly lost. owever t wll be sown tat te resultng -ARAIM contnuty rs bound s overly conservatve especally wen an excluson functon s mplemented. In response we develop a new metod tat rgorously quantfes te mpact of measurement faults and US on -ARAIM contnuty and unfes te FDE ntegrty evaluaton and te crtcal satellte analyss n one step. In ts new approac te overall -ARAIM contnuty rs equaton s frst expressed n terms of mutually exclusve (and exaustve) US scenaros and ten

3 accounts for all fault modes under te correspondng US condtons. As a result te LC contrbutons from tose events can be controlled by settng FDE tresolds n order to meet te contnuty requrement. In ts paper we nvestgate two ways to allocate te overall contnuty budget nto eac specfc US and fault mode scenaro. Frst te same budgets are used to set FDE tresolds over all US condtons. Terefore to execute te FDE functons durng operaton te recever does not need to now weter tere s a US present or not because of te same requrements wen computng tresolds. In contrast f te users are always aware of te current US status ncludng te tme epocs wen US occurs and ends dfferent contnuty budgets can be appled under US condton. Accordngly te performance requrements on te FDE functons may cange dependng on weter tere are unexpected satellte losses. Snce te pror probabltes of US also need to be accounted for to meet te same allocated budget te FDE tresolds wll become tgter under US condtons tan te outage-free (F) case tereby resultng n smaller contrbutons n te ntegrty rs equaton. Moreover ts approac enables us to dentfy weter an excluson functon s even needed or not after US as occurred. Usng baselne dual-constellaton GS/Galleo tere are cases wen - ARAIM operaton only requres te detecton functon to be avalable after a satellte loss snce te accumulated ont probabltes of smultaneously encounterng measurement faults and US are well below te contnuty rs requrement. To quantfy te ntegrty rs assocated wt ts new approac ntegrty treats under US condtons also need to be properly accounted for. For example te user may be exposed to a azardous stuaton after a satellte s lost and no alarm occurs usng te remanng satelltes. In response we derve a predctve ntegrty rs equaton tat caracterzes all te condtons tat te user may be n ncludng bot US and satellte fault. As n our prevous wor n [8] a computatonally effcent upper bound s derved to elp evaluate ntegrty rs. We wll sow tat overall contnuty rs can be controlled by settng FDE tresolds under F and US condtons and tat te -ARAIM operaton s avalable f te resultng ntegrty rs meets ts requrement. Te last part of te paper compares te crtcal satellte approac and new metod n regard to addressng te mpact of US on - ARAIM contnuty and presents a performance analyss. Requred navgaton performance (RN).1 and RN.3 operatons are used as examples to sow te acevable -ARAIM performance. (RN.1 s te most strngent navgaton requrement for - ARAIM operatons.) Two separate analyses correspondng to bot approaces are carred out usng a baselne GS/Galleo combned constellaton [6]. In addton we analyze te two ways to allocate te contnuty budget usng te new metod. Usng te crtcal satellte approac tat conservatvely accounts for te US mpact on -ARAIM contnuty te results sow lmted avalablty for bot RN.1 and.3 especally wen crtcal satellte pars are consdered. In comparson by mplementng te new metod ntroduced n ts wor te results ndcate tat g avalablty can be aceved were bot te contnuty and ntegrty requrements are met. IMACT F FAULT AND US N -ARAIM CNTINUITY In avaton navgaton contnuty measures te capablty of te system to perform ts functon wtout unsceduled nterruptons durng te ntended operaton. Contnuty rs or probablty of LC s te probablty of a detected but unsceduled navgaton functon nterrupton after an operaton as been ntated. Te occurrence of -ARAIM LC s regarded as a maor falure condton wen bacup navgaton systems are not avalable [11]. ur pror wor as nterpreted and dscussed te -ARAIM contnuty rs requrement C REQ [8] wc s specfed on a per-our bass n a range from 1 8 /our to 1 4 /our by te Internatonal Cvl Avaton rganzaton (ICA) [12]. Te range of C REQ accounts for te number of arcraft tat smultaneously use te same navgaton servce. Terefore te actual -ARAIM C REQ used durng operaton may be varable and s gly dependent on te traffc densty and arspace complexty. In ts paper we use C REQ = 1 6 /our as an example to nvestgate - ARAIM performance. Ts value corresponds to te conservatve assumptons tat 1 arcraft are smultaneously usng te same GNSS navgaton servce and possble mtgaton means are avalable f LC occurs. Measurement fault s one of te man sources tat leads to -ARAIM LC because most faults wll be nstantaneously detected by te detecton functon. Accordng to te commtment of te GS constellaton servce provder (CS) GS s expected to ave less tan 3 faults per year [13]. Ts commtment corresponds to a falure rate of 1 5 /our/space vecle (SV) wc already exceeds -ARAIM C REQ. New constellatons may be subect to larger fault probabltes tan GS especally n te early stage of ter deployments. In addton for -ARAIM operaton a conservatve value 1 4 /our/constellaton must be assumed for constellatons oter tan GS to account for te constellaton-wde fault [14]. Terefore usng mult-constellaton GNSS te accumulated lelood of fault occurrences must be mtgated to meet te -ARAIM contnuty requrement.

4 Te excluson functon can dentfy and exclude te faulted measurement after a detecton event occurs so tat te user can use remanng satelltes for postonng. We ave desgned an excluson algortm n pror wor to reduce -ARAIM contnuty rs due to fault detecton [8]. Wt an excluson functon beng mplemented LC occurs only f a fault s detected but cannot be excluded. Te probablty of suc event occurrng s controllable by settng excluson tresolds wc ensure te post-excluson LC probablty s smaller tan te allocated contnuty budget. In oter words te excluson functon sould be desgned to lower te LC probablty due to measurement fault to te desred level. Satellte outage s anoter source tat nterrupts operaton and can sgnfcantly ncrease -ARAIM contnuty rs. Tere are two types of outage: sceduled satellte outage (SS) s announced at least 48 ours n advance to te user and US typcally results from sudden system malfunctons or mantenance occurrng outsde te sceduled perod [13]. Snce SS s nown before te operaton t mpacts avalablty rater tan contnuty. Terefore we only account for te mpact of US on -ARAIM LC. GS standard postonng servce performance standard (GS SS S) as specfed tat te pror probablty of US occurrence s less tan /our/sv [13]. Assumng te oter constellatons can aceve te same probablty as GS te total probablty of te -ARAIM user undergong US exceeds C REQ sgnfcantly. In response we nvestgated sngle crtcal satellte to quantfy ts mpact n pror wor [8] and develop a new metod n ts paper by accountng for US n bot te contnuty and ntegrty rs equatons. Tese two metods wll be descrbed n te followng sectons. As comparson bot metods are used to analyze te overall -ARAIM avalablty performance. CRITICAL SATELLITE ARAC Ts secton descrbes a modfed crtcal satellte approac from te one n our pror wor [8] and addresses ts drawbacs. In partcular we account for te contnuty rs contrbutons of more tan one satellte US. A sngle crtcal satellte s one wose loss wll result n te ntegrty rs exceedng te requrement durng an operaton. In oter words after one satellte s unexpectedly lost f te remanng satelltes cannot support te FDE functons te lost satellte s a crtcal satellte. Smlarly f te smultaneous loss of multple satelltes causes LC ten tose satelltes are consdered a crtcal satellte group. At one specfc locaton and tme epoc te contrbuton of US to -ARAIM contnuty rs US can be evaluated by: * n n (1) US c out p 2 out rare were n c out : number of sngle crtcal satelltes at one snapsot. 4 : pror probablty of sngle-satellte US occurrence 21 /our/ SV. n p rare out : number of crtcal satelltes pars.e. te smultaneous loss of te correspondng two satelltes results n LC. : te sum over all crtcal satellte groups of te probabltes of losng more tan two crtcal satelltes smultaneously. Snce ter pror probabltes are very small tere s no need to go over all te combnatons. It s wort clarfyng tat te superscrpt * n equaton (1) corresponds to te crtcal satellte approac. To ensure te overall - ARAIM contnuty requrement a separate analyss s needed to compute n c and n p. In ts wor we use USREQ = 1 7 /our as an example allocaton of te contnuty budget to te mpact of US. Te requrement of US < USREQ can be expressed n terms of n c and n p as follows: US REQ rare 4 US REQ rare n c 51 SVs and n p 2.5ars (2) 2 out Snce n c and n p are ntegers C REQ can only be met wen tere are no sngle crtcal satelltes (n c = ) and te number of crtcal satellte pars s less tan 2 (n p < 2). Te followng algortm can be appled to determne n c and n p n order to assess -ARAIM contnuty: out

5 Step 1 : Evaluate te ntegrty rs MI usng all-n-vew satelltes. If MI s smaller tan te ntegrty requrement I REQ ten go to te next step. terwse set n c = and n p =. Step 2 : Remove one sngle SV (or SV par) and reevaluate te ntegrty rs. If te reevaluated ntegrty rs exceeds I REQ ten te removed SV (or SV par) s regarded as a crtcal one. terwse t s not crtcal. Step 3 : Repeat step 2 for all te SVs and SV pars. Count all te crtcal SVs and SV pars to obtan n c and n p. Usng te crtcal satellte approac we can conservatvely account for te mpact of US on -ARAIM contnuty rs. An operaton s declared to be avalable only f te all-n-vew ntegrty rs obtaned n step 1 s smaller tan I REQ and US < USREQ. owever tere are tree man ssues wt ts approac. Frst ts metod requres a separate analyss to get n c and n p wc sgnfcantly ncreases te computatonal load and complcates -ARAIM servce. Second n step 2 te reevaluated ntegrty rs s condtoned on te loss of SV(s) but te pror probabltes of tose events are neglected wen comparng wt te requrement I REQ. Terefore te avalablty results of ts approac are overly conservatve. Trd wen reevaluatng te postoutage ntegrty rs te same requrements on FDE functon performance as n te F case are mplctly assumed. owever snce te US pror probabltes also need to be accounted for to set te post-outage FDE tresolds te requrements on te FDE functons under US condtons can be less strngent. VERALL -ARAIM CNTINUITY RISK In response to te drawbacs of te crtcal satellte approac a new metod tat rgorously quantfes and tgtly bounds te mpact of US on -ARAIM contnuty s developed n ts wor. Te prncple of ts approac s unfyng all te LC contrbutons from bot measurement fault and US n one contnuty rs equaton and lmtng tose contrbutons by settng FDE tresolds. Accordngly te assocated predctve ntegrty rs also accounts for te treats under US condtons and te operaton s avalable wen te overall MI meets te requrement. Wt te new metod te total -ARAIM contnuty rs s frst dvded nto two man groups: (a) LC due to not excluded (NE) detecton events and (b) all oter contrbutons ncludng onosperc scntllaton and rado frequency nterference.e.: LC (3) D NE ter In ts paper we employ an example allocaton of te overall C REQ to account for te two terms n equaton (3) and te requrements are DNEREQ = /our and terreq = 1 7 /our respectvely. Te mtgatons of te causes of LC n ter are beyond te scope of ts paper so we assume te contrbuton of ter s always smaller tan te allocated contnuty budget. To address te mpact of US on -ARAIM contnuty te frst component of equaton (3) can be expressed as: were D E ter LC (4) : outage occurs on satellte subset were = 1 used to denote all possble US combnatons ncludng te F condton ( ) sngle-satellte US dual-satellte US etc. : pror probablty of te event. D : detecton occurs usng te remanng satelltes wen tere s a US event = denotes all satelltes are n vew. E : no excluson can be made usng te remanng satelltes under te condton. Moreover under eac US condton all te fault ypoteses for te remanng satelltes need to be caracterzed. By accountng for te fault modes of eac specfc scenaro equaton (4) becomes:

6 were LC D E ter (5) : multple fault ypoteses for te remanng satelltes under te US condton = 1 wc accounts for all faulty SV combnatons ncludng fault-free (FF) ( = ) sngle-satellte faults dual-satellte faults etc. : pror probablty of te fault ypotess. Equaton (5) expresses DNE over all te US condtons and assocated fault modes wc enables us to lmt tose contrbutons. Under te scenaro a detecton event s a false alarm (FA) wen tere s no fault present.e. =. Te probablty of ts occurrence can be lmted by settng te detecton tresolds. In addton wen te user s exposed to a fault condton ( ) te probablty of not successfully excludng te fault can be controlled by settng te excluson tresolds. Terefore usng ts metod te contrbutons of LC from bot measurement fault and US can always be reduced untl tey meet ter correspondng contnuty budget allocatons. Fg. 1 -ARAIM LC Tree Fgure 1 provdes a -ARAIM contnuty tree tat vsually expresses equaton (5). To furter address te metod for controllng eac contrbuton of te brances n ts LC tree te FDE algortm tat operates n real tme needs to be specfed. -ARAIM FDE ALGRITM Ts paper employs a soluton separaton (SS) FDE algortm desgned n our pror wor [8] and extends ts applcaton to US condtons. Fgure 2 sows te flow dagram of te real-tme -ARAIM FDE process and ts dagram s te same as te one n [8] under F case.e. =. owever durng operaton te user may be exposed to an outage condton were. In ts case te evaluaton of te real-tme ntegrty rs only depends on te vsble satellte geometry. If te ntegrty rs meets te

7 requrement te FDE functons perform n te same way as f te lost satellte(s) were not vsble n te frst place. Tat s te remanng satelltes post-outage are regarded as a new all-n-vew satellte set. Fg. 2 Flow Dagram of Real-Tme -ARAIM FDE rocess Te detecton test statstcs for SS ARAIM s defned as te dfferences between te all-n-vew poston soluton and te subset solutons for all te montored fault ypoteses [3]. In addton snce te US condtons are also consdered n ts wor te test statstcs are expressed under te outage event : ˆ for d = 1. (6) d x xˆ d d were d xˆ xˆd : subscrpt of te number of detecton test statstcs under from 1 ; s te total number of montored fault modes. : least squares poston estmate usng all vsble satelltes after. : least squares poston estmate usng post-outage satelltes wtout te one(s) n fault mode d. : estmaton error usng all post-outage vsble satelltes.e. te dfference between te estmated poston and true poston. d : estmaton error usng te post-outage satellte subset wtout te one(s) n fault mode d. In te detecton step of Fgure 2 all te statstcs n equaton (6) are evaluated and compared wt ter correspondng tresolds T d wc can be obtaned by lmtng te FA probablty. In te scenaro a detecton event occurs (D ) f any of te statstcs exceed ts tresold.e. smaller tan T d.e. d1 d d d1 T. d T d. terwse tere wll be a no detecton event (D ) wen all te statstcs are Te excluson functon s a follow-up step once an alarm s trggered and te mecansm for determnng wc satellte(s) to exclude s te core of te FDE algortm. In our desgn te excluson functon s composed of two man sub-steps were te

8 detecton statstcs d are frst normalzed by ter standard devatons d : q d d d. Ten te excluson opton order s determned accordng to te magntudes of te absolute values of te normalzed detecton statstcs and te frst excluson opton corresponds to te ypotess tat results n te maxmum q d. Ts order wll be followed wen mang te excluson attempts. As a result te excluson functon always frst tres to exclude satelltes n te mode of maxmum q d and ten te second maxmum and so fort. Te bass of desgnng ts order s based on te dstrbutons of q d under a faulted condton. If te user as encountered an actual fault t s most lely tat te test statstc correspondng to tat fault mode s muc larger tan te oters because t accounts for te dfference between faulted and FF poston estmates. Ts desgn wll sgnfcantly smplfy te excluson process and also ncrease te probablty of correct excluson. ne may argue tat te statstc under a mult-fault ypotess may not be te maxmum due to te varous relatve fault magntudes wtn te mode. owever te goal of defnng ts order s only to provde a clue so tat te algortm nows wc satellte(s) t sould try to exclude. To ensure safety we also employ a second layer detecton test after eac excluson attempt. Te second layer detecton test confrms tat no alarm exsts n te satellte subset after excluson. Te normalzed second layer detecton statstcs under are defned as: q e l xˆ e xˆ e l e l e e l e l for l = 1 e. (7) were e l xˆe x ˆe l e e l e l : subscrpt of te fault mode beng excluded e = 1. : subscrpt of te second layer detecton test statstcs from 1 e ; e s equal to te number of overall fault modes n te new post-outage satellte subset excludng e. : least squares poston estmate usng te post-outage satellte subset excludng e. : least squares poston estmate usng new satellte subset after excluson except te one(s) n te second layer fault mode l. : estmaton error usng te post-outage satellte subset excludng e. : estmaton error usng te new satellte subset after excluson except te one(s) n te second layer fault mode l. : standard devaton of te second layer detecton test statstc Ts step of te excluson functon goes troug te excluson optons followng te order determned n te prevous step. For eac excluson opton te second layer detecton test s performed by comparng eac statstc n equaton (7) wt ts correspondng tresold wc s obtaned by lmtng te contnuty rs. Accordng to te desgn n te scenaro of US T e l e l event two condtons wll result n a satellte subset beng fnally excluded ( E excludng ts subset ( D ).e.: q T e l1 l l. ): (a) tere s no second layer detecton after ; and (b) ts subset corresponds to te maxmum detecton statstc among te subsets tat pass te second layer detecton test. No excluson ( E ) can be made f tere are always second layer detectons after e testng all optons: e1 l1 q e l T e l. SETTING FDE TRESLDS USING TE NEW METD Wt te FDE algortm fully descrbed te ont event of detecton and no excluson ( DNE ) can be caracterzed by te test statstcs and ter tresolds wc enables us to derve te equatons for computng FDE tresolds. In ts wor we ntroduce

9 two ways to allocate DNEREQ among all te US condtons dependng on weter or not we are allocatng te same contnuty budget for FANE and FDNE over. Same Budget for FANE and FDNE over US Condtons Recall te overall -ARAIM LC equaton (5). Te frst component can be furter bounded by: D E D E NM Fault NM US D NE 1 (8) In equaton (8) te last term NMUS accounts for te cases wen US occurs on multple satelltes. It s smlar to rare n equaton (1): snce ter pror probabltes are very small ts term s regarded as a not montored component. Te LC sources under are furter grouped nto tree categores: (1) FANE (2) montored FDNE and (3) not montored fault modes. In ts paper we employ te followng allocatons n Table 1 to account for te LC contrbutons n equaton (8) and te sum of te values s equal to DNEREQ. Table 1. -ARAIM Contnuty Requrement Allocaton (Same for F and US Condtons) FANEREQ /our FDNEREQ /our NMFaultREQ 1 7 /our NMUSREQ 1 7 /our It can be observed tat te values n Table 1 do not depend on US condtons.e. for = 1. Terefore tere s only one requrement FANEREQ to set te detecton tresolds and one requrement FDNEREQ to set te excluson tresolds. peratonally ts allocaton does not requre te user to now weter tere s a US or not. Te frst term of equaton (8) can be bounded by elmnatng te nowledge of no excluson ( E ) and can be wrtten as: T (9) FA NE d d d1 d1 d T FA NE REQ (1) d Terefore te frst layer -ARAIM detecton tresolds T d can be computed: T T were d d d Td 1 FA NE Q 2 REQ (11) 1 Q s te nverse tal probablty functon n equaton (11). To evaluate te excluson tresolds te second term of equaton (8) s bounded by elmnatng te nowledge of frst layer detecton ( D ) and can be expressed as: e q e l T e l 1 e1 l1 (12) FD NE

10 (13) e q l T l 1 l1 e 1 l1 q l T l FD NE REQ Te bound from equaton (12) to (13) s wort mentonng were only one excluson opton assocated wt te fault ypotess s consdered.e. e =. Snce te fault s excluded te second layer detecton statstcs q l n equaton (12) are fault free and tey follow a zero-mean normalzed Gaussan dstrbuton. Tus (14) 1 FD NE REQ T l Q were 2 e FD NE REQ (15) FD NE REQ In summary of ts sub-secton by allocatng te same contnuty budget to FANE and FDNE over all US condtons equatons (11) and (15) ave been derved to compute FDE tresolds. Ts approac provdes sgnfcant beneft for real-tme operaton because t does not requre te recever to be aware of weter or not US as occurred. owever ts allocaton s not optmal and t may result n a large predctve ntegrty rs. Ts s due to te fact tat usng same budget n Table 1 does not dstngus te F and true US states and te resultng FDE tresolds under US condton are as large as F condton. Terefore we also explore dfferent allocatons among all US events by accountng for ter pror probabltes. Dfferent Budget for FANE and FDNE over US Condtons If te recever always nows weter tere s a US present at any tme epoc te allocated contnuty budget nto may vary. Dependng on te US condtons durng operaton te recever can use dfferent budgets to compute FDE tresolds. Terefore te total budget DNEREQ can be allocated optmally among te events n equaton (5) to mnmze te assocated ntegrty rs. Te optmzaton process s beyond te scope of ts paper and we only employ an example case n ts part to demonstrate te dea and to mae comparson wt te equal allocaton n te last part. Dependng on weter tere s a US present or not equaton (5) s dvded nto (a) FANE and FDNE under F ( = ) condton and (b) under US ( ) cases: D NE FA NE F FD NE F FA NE US FD NE US (16) D E D E D E D E (17) Table 2 lsts te requrements for te four components n equaton (16). Te equatons to compute te FDE tresolds are very smlar to equatons (9) to (15) and tey ave been derved n Appendx A. Table 2. -ARAIM Contnuty Requrement Allocaton (Dfferent under F and US Condtons) FANEFREQ /our FDNEFREQ /our FANEUSREQ /our FDNEUSREQ /our Usng ts approac te FDE tresolds under US condtons can be set muc tgter tan under te F condtons because te last two components n equaton (17) account for te US pror probabltes. Terefore ter correspondng contrbutons to te ntegrty rs can be reduced. In addton n FDNEUS te sum of te products of te fault and US pror probabltes s generally very small. Wen te sum s already smaller tan te requrement FDNEUSREQ tere s no need to perform te excluson functon under US condtons. owever ts approac assumes tat te recever always nows te US condtons durng flgt and te assumpton tself s wort dscussng. peratonally te user can recognze te cases n wc loc on a

11 partcular satellte s suddenly lost due to US but t s questonable weter te user nows US condtons at te startng pont of te operaton. In partcular t s more callengng to determne wen te lost satellte s renstated after sufferng from a US. Tese ssues wll be furter nvestgated n our future wor. REDICTIVE INTEGRITY RISK Integrty s a measure of trust tat can be placed n te correctness of te nformaton suppled by te total system [12]. Integrty rs s defned as te probablty tat an undetected navgaton error results n azardous msleadng nformaton (MI) wc s te stuaton were te poston error exceeds a predefned alert lmt (AL). Snce -ARAIM only provdes orzontal navgaton servce only te orzontal AL needs to be consdered. Te predctve FDE ntegrty rs needs to caracterze all possble stuatons tat te arcraft may encounter. Ts s wy all te excluson optons are accounted for n te predctve ntegrty rs equaton [9 1]. In ts wor te overall predctve ntegrty rs equaton assocated wt te new metod also needs to account for te ntegrty treat wen te user undergoes US: MI MI MI NM US (18) In equaton (18) above MI s te condtonal ntegrty rs of te US cases = 1 and t conssts of all te ntegrty rs contrbutons under : were I I E MI I D ) ( I E D ) 1 ( (19) : azardous nformaton exsts n poston estmate usng post-outage all-n-vew satelltes for postonng: were s AL. : azardous nformaton exsts n poston estmate usng post-outage satelltes except te one(s) beng excluded:. : satellte(s) wtn fault mode s/are cosen to be excluded. Tere must be no second layer detecton after excludng ( D ). To evaluate equaton (19) we ave ntroduced a computatonally effcent upper bound n [8 9 1] and te dervatons wll be brefly readdressed n ts paper. By accountng for all te fault ypoteses under equaton (19) becomes: MI I D I D D ( ) ( ) NM Fault 1 (2) Tere s a cange of notaton from equaton (19) to (2) were te excluson event E s replaced by D. Ts s a conservatve step snce te fact tat beng fnally excluded mples tere s no second layer detecton. Let MID denote te ntegrty rs contrbutons of te detecton functon.e. te frst term n equaton (2). Te followng steps are typcally used n SS ARAIM metod [3]:

12 D MI T T D I I (21) Defne MIE as te total ntegrty rs contrbutons from te excluson functon.e. te second term n equaton (2). It can be bounded and evaluated by te followng [8]: S S S S E MI T D I I ) ( ) ( (22) A correct excluson (CE) occurs wen te faulted satellte subset S belongs to te excluded subset S and te resultng poston estmate s fault-free. terwse excludng under wll result n wrong excluson (WE). Tose two events are bounded dfferently n equaton (22). Terefore te overall FDE ntegrty rs assocated wt te new metod can be evaluated by pluggng equatons (21) (22) nto (2). All te FDE tresolds n tose equatons ave been specfed n te prevous secton and an operaton s avalable wen MI n equaton (18) meets te ntegrty requrement I REQ. -ARAIM AVALABILITY ERFRMANCE Avalablty s defned as te fracton of tme te navgaton system s usable before te operaton s ntated. Ts secton nvestgates te -ARAIM FDE avalablty performance by usng te crtcal satellte approac and te new metod. In addton bot ways of allocatng te contnuty budget usng te new metod are appled n te analyss. Dual-frequency baselne GS/Galleo constellatons under nomnal smulaton condtons [6] are used as an example for two ntended operatons: RN.1 and.3. Table 3 lsts some ey parameters. Table 3. Baselne -ARAIM Smulaton arameters I REQ 1 7 / our Constellaton 24GS + 24GAL C REQ 1 6 / our sat 1 5 AL RN.1:.1nm (185m) RN.3:.3nm (556m) const GS: 1 8 / GAL: 1 4 VAL N/A σ URA 2.4m Coverage Range Worldwde b nom.75m Fgure 3 sows te overall -ARAIM avalablty performance for RN.1 n wc only sngle-satellte US s nvestgated. Te result reveals tat only a low coverage level can be aceved usng te crtcal satellte approac and te lmted avalablty performance s domnated by te cases wen n c. In contrast te avalablty performance can be sgnfcantly mproved usng te new metod.

13 Fg. 3 verall -ARAIM Avalablty for RN.1 by nly Accountng for Sngle SV US In comparson wt Fgure 3 te avalablty results n Fgure 4 account for multple-satellte US. Te avalablty s completely destroyed usng te crtcal satellte approac because of te mpact of crtcal satellte pars.e. n p > 3 at many snapsots. owever te same coverage level as n Fgure 3 can stll be mantaned wt te new metod. Fg. 4 verall -ARAIM Avalablty for RN.1 by Accountng for Multple SV US Table 4. Avalablty Coverage for RN.3 Crtcal Satellte Approac New Metod (Same Budget) New Metod (Dfferent Budget) nly Sngle SV US 46.38% 95.3% 95.71% Multple SV US.3% 94.39% 95.34% Table 4 summarzes te avalablty coverage for RN.3 n wc te same trend as been observed usng te tree approaces as for RN.1. As mentoned n pror sectons te man reason for te sgnfcantly dfferent performance level s te over conservatveness of te crtcal satellte approac. Snce te condtonal ntegrty rs MI s used to compare wt I REQ and te pror probabltes of US are elmnated te results of te crtcal satellte approac reflect a worst-case performance. In contrast te overall ntegrty rs of te new metod s obtaned by properly wegtng MI over dfferent scenaros so te correspondng results are more reasonable for predctng -ARAIM avalablty. Moreover te performance evaluated wt dfferent budgets over US condtons can be furter mproved by optmally allocatng te contnuty requrement even toug t may come at a cost n terms of computatonal load.

14 CNCLUSIN In ts wor we address and compare two approaces to quantfy and bound te mpact of US on -ARAIM contnuty: te crtcal satellte approac and a new metod. In partcular tere are tree advantages of te newly derved approac. Frst bot te contnuty and ntegrty rs equatons explctly nclude US events so te overall mpact of US can be assessed n one analyss. Second dfferent FDE tresolds are set for specfc scenaros to lmt -ARAIM LC allowng for te US contnuty mpact to be more precsely quantfed. Trd ts approac enables us to rgorously account for all te possble US condtons ncludng mult-satellte outages and to determne weter an excluson functon s stll needed after a US event. In te performance analyss avalablty results usng new metod are compared to tose obtaned usng te prevously developed crtcal satellte approac. Te new results sow tat dual-constellaton -ARAIM can provde g avalablty for RN.1 and.3 were bot ntegrty and contnuty requrements are met. ACKNWLEDGEMENT Te autors would le to tan te Federal Avaton Admnstraton for sponsorng ts wor. owever te vews and opnons expressed n ts paper are tose of te autors and do not necessarly reflect tose of any oter organzaton or person. Te autors would also le to tan Mr. Ryan Cassel from te IIT navgaton lab for s careful revews of ts paper. REFERENCE [1] Lee Y. C. Analyss of Range and oston Comparson Metods as a Means to rovde GS Integrty n te User Recever roceedngs of te 42nd Annual Meetng of Te Insttute of Navgaton Seattle WA 1986 pp [2] arnson B. W. and Axelrad. Autonomous GS Integrty Montorng Usng te seudorange Resdual NAVIGATIN Wasngton DC Vol. 35 No pp [3] M. Joerger F.C. Can and B. ervan Soluton Separaton Versus Resdual-Based RAIM NAVIGATIN Vol. 61 No. 4 Wnter 214 pp [4] EU-U.S. Cooperaton on Satellte Navgaton Worng Group C ARAIM Tecncal Subgroup Interm Report Issue 1. December Avalable onlne at: ttp://ec.europa.eu/enterprse/newsroom/cf/_getdocument.cfm?doc_d=7793 [5] J. Blanc T. Walter T. Lee B. ervan M. Rppl and A. Spletter Advanced RAIM User Algortm Descrpton: Integrty Support Message rocessng Fault Detecton Excluson and rotecton Level Calculaton roc. of IN GNSS 212 Nasvlle TN Sept pp [6] EU-U.S. Cooperaton on Satellte Navgaton Worng Group C ARAIM Tecncal Subgroup Mlestone 3 Report February Avalable onlne at: ttp:// [7] RTCA Specal Commttee 159 Mnmum peratonal erformance Standards for Arborne Supplemental Navgaton Equpment Usng Global ostonng System (GS) RTCA/D [8] Za Y. Joerger M. ervan B. -ARAIM Excluson: Requrements and erformance roc. of IN GNSS+ 216 ortland R Sep 216 pp [9] Joerger M. Stevanovc S. Can F.-C. Langel S. and ervan B. Integrty Rs and Contnuty Rs for Fault Detecton and Excluson Usng Soluton Separaton ARAIM roc. of IN GNSS 213 Nasvlle TN September 213. [1] Joerger M. ervan B. Fault Detecton and Excluson Usng Soluton Separaton and C-Squared RAIM Transactons on Aerospace and Electronc Systems vol. 52 Aprl 216 pp

15 [11] FAA AC 2-138B Arwortness Approval of ostonng and Navgaton Systems September [12] ICA Annex 1 Aeronautcal Telecommuncatons Volume 1 (Rado Navgaton Ads) Amendment 84 publsed 2 July 29 effectve 19 November 29. [13] Assstant Secretary of Defense for Command Control Communcatons and Intellgence. Global ostonng System Standard ostonng Servce erformance Standard. Wasngton DC 28. Avalable onlne at: ttp:// [14] T. Walter J. Blanc Joerger M. ervan B. Determnaton of Fault robabltes for ARAIM roceedngs of IEEE/IN LANS 216 Savanna GA Aprl 216. AENDIX A Ts appendx derves te equatons to compute te FDE tresolds wen dfferent contnuty budgets are allocated to US condtons. Te frst term of equaton (16) n te text can be bounded by: FA NE F d T (A.1) d1 d d T FA NE F REQ d d1 (A.2) Based on te allocated FANEFREQ n Table 2 te frst layer -ARAIM detecton tresolds computed: T d under F condton can be 1 FA NE F REQ T T d d d were T d Q (A.3) 2 Te second term of equaton (16) can be bounded by: e FD NE F qe l T e l NM Fault 1 e1 l1 (A.4) e q l T l NM Fault (A.5) 1 l1 e 1 l1 q l T l NM Fault FD NE F REQ (A.6) Tus te excluson tresolds T l under F condton can be evaluated: 1 FD NE F REQ T l Q were 2 e FD NE F REQ FD NE F REQ NM Fault (A.7) A smlar approac to F condtons can be appled to compute FDE tresolds after US as occurred except te pror probabltes of US are muc smaller tan. Terefore te trd term of equaton (16) can be expressed as:

16 T (A.8) FA NE US d NM US d 1 d1 1 d1 d T NM US FA NE US REQ d (A.9) So te detecton tresold T d under US condtons can be evaluated by: T T were T d d d d FA NE US REQ 1 Q 2 NM US (A.1) Te last term of equaton (16) can be expressed as: e FD NE US qe l Te l NM Fault NM US 1 1 e1 l1 (A.11) e q l T l NM Fault NM US (A.12) 1 1 l1 e 1 1 l1 q l T l NM FaultNM US FD NE US REQ (A.13) Terefore te excluson tresolds T l under US condtons can be evaluated: 1 FD NE US REQ T l Q were 2 e FD NE US REQ NM FaultNM US FD NE US REQ (A.14)