Ephemeris Type A Fault Analysis and Mitigation for LAAS

Transcription

1 Ephemeri Type A Fault Analyi and Mitigation for LAAS Haochen Tang, Sam Pullen, and Per Enge, Stanford Univerity Livio Gratton and Bori Pervan, Illinoi Intitute of Technology Mat Brenner, Joe Scheitlin, and Paul Kline, Honeywell Aeropace ABSTRACT The Local Area Augmentation Sytem (LAAS) ha been developed by the FAA to enable preciion approach and landing operation uing the Global Poitioning Sytem (GPS). Each LAAS intallation provide ervice through a LAAS Ground Facility (LGF) which i located at the airport it erve. By monitoring the GPS ignal, meaurement, and navigation meage, the LGF i able to exclude unhealthy atellite and broadcat real-time range-correction meage for healthy atellite to uer via a VHF data link. Airborne uer apply thee correction to remove error that are common between the LGF and the aircraft. The LGF i alo reponible for warning the aircraft of any potential integrity threat that cannot eaily be reolved by excluding unhealthy atellite. One ource of potential error i the atellite broadcat ephemeri meage, which uer decode and ue to compute GPS atellite poition. In LAAS, potential GPS ephemeri fault are categorized into two type, A and B, baed upon whether or not the fault i aociated with a atellite euver. Thi work focue on aviation navigation threat caued by Type A fault. To detect and mitigate thee threat, we invetigate two LGF monitor baed on comparing expected range and range rate (baed on broadcat ephemeri) with thoe meaured by the LGF. The effectivene of thee monitor i analyzed and verified in thi paper. INTRODUCTION Numerou algorithm and upporting ytem have been developed to meet the tringent requirement of preciion approach and landing operation. One of them i the FAA Ground Baed Augmentation Sytem (GBAS) implementation, the Local Area Augmentation Sytem (LAAS). Each LAAS intallation include a LAAS Ground Facility (LGF), which i located at the airport it erve and alo include multiple reference receiver, a central proceing facility, and a VHF data broadcat tranmitter. By monitoring the received GPS ignal and navigation meage, the LGF i able to detect and exclude faulty atellite while broadcating real-time peudorange correction meage for healthy atellite to uer within it ervice volume [11]. Airborne uer apply thee correction to remove the majority of GPS meaurement error that are completely (or motly) common between the LGF and the aircraft. Thee error ource include atellite ephemeri error, atellite clock error, ionopheric delay, and tropopheric delay. The LGF i alo reponible for detecting and excluding hazardou GPS atellite fault and warning the aircraft of any potential integrity threat that cannot be reolved imply by excluding the affected meaurement. Thi paper focue on LGF mitigation of ephemeri fault that are related to atellite euver, which i a ubject that ha not received ignificant attention in the pat. Protection i achieved by monitor that difference the computed and the meaured range and range rate and compare the reulting tet tatitic to predefined threhold, which are baed on the fault-free behavior of the tet tatitic. The reult in thi paper demontrate that implementation of thee monitor i ufficient to meet repreentative LAAS integrity and continuity requirement allocation for euver-baed ephemeri fault. EPHEMERIS THREAT MODELS A hown in Figure 1, GPS atellite ephemeri fault are categorized into two type, A and B, baed upon whether or not the fault i aociated with a atellite euver. For a Type B threat, no atellite euver are involved, but the pacecraft broadcat an anomalou ephemeri that produce large error in atellite poition when the ephemeri i propagated. To mitigate Type B threat, the LGF tore validated ephemeride from previou day and ue them to project forward an independent ive etimate of the current ephemeri for comparion. The LGF monitor that perform thi function i called the Ephemeri Type B Monitor, and it ha been decribed in detail in [1,2]. In Type A fault, ephemeri data i erroneou following a atellite euver. Thu, the Type /1/$ IEEE 654

2 Hazardou Uer Error due to Erroneou Satellite Ephemeri Type A Threat: Satellite euver (orbit change) Type B Threat: no atellite euver Type A1: error after atellite euver Type A2: error during atellite euver Error in generating or updating ephemeri parameter Erroneou (or unchanged) ephemeri after euver completed Type A2a: intentional OCS euver, but atellite flagged healthy Type A2b: unintentional euver due to unplanned thruter firing or propellant leakage Mitigation not required for CAT I op. Figure 1: LAAS Ephemeri Failure Categorie B monitor i not effective againt uch threat becaue the ive capability of the monitor i compromied by the intervening euver. Type A fault are further ubdivided into two eparate clae: A1 and A2. In the A1 cae, the atellite euver i cheduled and intentional, but the euver i followed by the broadcat of erroneou ephemeri data. Thu, the potential hazard to LAAS occur after the euver i completed, where euver i defined a the initial ΔV impule (which typically take le than one minute) followed by the everal hour needed for the atellite to drift into the deired new orbit. When a cheduled euver i performed by the GPS Operational Control Segment (OCS), an unhealthy flag i normally broadcat by the atellite. After the euver i completed, the flag i reet to healthy. If the euver i in view of a particular LGF ite, a do-not-ue waiting period for that atellite i initiated after the atellite flag i et back to healthy to collect the neceary data for the Type B monitor to function. The waiting period i nominally two day [1]. The following analyi of the A1 fault will therefore focu on ituation in which euver occur out of view of an LGF. If, after an outof-view euver, the newly broadcat ephemeri data i unchanged from the pre-euver ephemeri, the new ephemeri will not repreent the actual atellite orbit. Thi i a pecial cae of the Type A1 fault cae. The Type A2 fault cenario can be defined a a fault poing a hazard during, intead of after, the euver period. There are two poible caue of thi. The firt (Type A2a) i a planned euver within view of the LGF, during which the SV health bit remain improperly et to healthy by the GPS OCS (note that thi wa previouly regarded a part of the A1 fault cenario). An incident matching thi decription took place on April 1, 27 [4]. The econd poible ource (Type A2b), albeit le likely, would be the atellite moving away from it broadcat orbit without being comded to by the GPS OCS. Thi could theoretically occur due to a pontaneou (un-comded) firing of a tation-keeping thruter or due to propellant leakage. In either A2 fault cae, the uer will erroneouly aume that the broadcat (pre-euver) ephemeri i valid. Alo note that, for either the out-ofview A1 or the A2 cae, the two-day wait for the Type B monitor data collection i not initiated, ince the LGF i not aware of the euver. Thi i a further reaon to provide a layer of detection for thee event. Baed on the nature of GPS tation-keeping euver, in our analyi of the Type A euver-related ephemeri fault, we will only conider tangential ΔV, which mean that the euver invetigated will intantaneouly change the pacecraft along-track velocity only. The upper bound of the euver velocity change i et at ± 1.8 m/, which i equivalent to a ± 2 deg/day euver [6]. Note that an un-comded euver may begin with an impule in any direction, but thi cae ha not been tudied in detail becaue it probability i mall enough that it need not be conidered for mot operation intended for LAAS, including CAT I preciion approach. The poibility of an intentional euver that erroneouly include a ignificant non-tangential component ha alo not been examined, a thi event would only become threatening if an additional failure 655

3 Type B Threat: No Satellite Maneuver Type A1 Threat: Error After Satellite Maneuver Completed Type A2a Threat: Error During Satellite Maneuver (after ΔV, during drift to new orbit) : ephemeri meage changeover Nominal ephem. Faulty ephem. Nominal ephem t (hr) SV rie into SV rie into view of LGF 1 view of LGF 2 Ephem. unhealthy during euver Faulty ephem. Nominal ephem t (hr) SV rie into view of LGF Nominal ephem. Faulty ephem. Ephem. unhealthy t (hr) SV rie into view of LGF SV euver begin (unflagged) SV flag updated to unhealthy Figure 2: Example Timeline for LAAS Ephemeri Failure Categorie of Type A1 or A2 occur. Scenario in which two independent wort-cae fault are required to threaten LAAS integrity are uually treated a ufficiently improbable to be neglected. The poibility of euver that intentionally (not erroneouly) include non-tangential component ha not been conidered to date. Figure 2 how the three primary ephemeri failure cae in (example) timeline form. The upper timeline how the typical pattern for Type B fault, where erroneou data appear at an ephemeri meage changeover ( ). Thee are eparated by 2 hour under normal OCS operation. The type of Type B tet performed depend on whether the atellite in quetion i already in view (and previouly validated) by the LGF or whether the atellite rie in view after the faulty data appear. In the former cae, a traightforward comparion of the newly-received ephemeri to the immediately previou (and healthy) ephemeri i ufficient to detect the fault [12]. In the latter cae, the previou valid ephemeri to compare to i from the previou pa(e) of the atellite in quetion; thu the Type B monitor mentioned above i ued [1,2]. The bottom timeline in Figure 2 repreent the Type A2a cae oberved in April 27, in which a planned atellite euver begin in view of an LGF but with the atellite till flagged a healthy. Note that the ituation doe not become faulty for LAAS until ome time after the initial ΔV, when the atellite ha drifted far enough from it original (and broadcat) orbit that the reulting ephemeri error i large enough to be potentially hazardou. The middle timeline in Figure 2 repreent the Type A1 cae, in which an intended euver wa properly conducted, but the new ephemeri uploaded after the euver wa ignificantly wrong. The atellite then rie into view of an LGF that doe not know that a euver occurred when the atellite wa out of view. Here, the potential hazard i immediate the LGF mut detect thi condition before the atellite i approved for ue. In thi cae, ince the new (faulty) ephemeri i uually different from the old (pre-euver) ephemeri, the LGF Type B monitor i ueful in detecting the change if it i large enough. However, a will be illutrated later in thi paper, the change between old and new can be mall enough to avoid Type-B detection but till large enough to be hazardou. The Type A monitor identified in thi paper i thu needed to inure detection of all potentially hazardou Type A1 error. One thing to note i that thi definition of the Type A1 cenario include the cae where the new ephemeri i unchanged from the old ephemeri. Becaue the Type B monitor i ineffective, thi pecial cae can be analyzed uing the impler Type A2 imulation approach decribed below, even though the hazard doe not occur until the euvered atellite in quetion i et healthy again. LGF MONITORS In LAAS, the mitigation of GPS ephemeri fault i the reponibility of the LGF. Since the LGF location i preciely pre-urveyed, the ed range to the atellite can be computed uing the atellite poition obtained from 656

4 the broadcat ephemeri. In imple term, the difference between the computed range and actual meaured peudorange i the LAAS peudorange correction magnitude. A precie definition for a particular atellite n (of atellite 1, 2,, N) i given in [11]: where PR corr (alo called PRC) i the reulting peudorange correction broadcat to uer, m i the reference receiver index, M(n) i the number of reference receiver providing valid meaurement for atellite n, and S C and N C define the et of common atellite and the number of atellite in that et, repectively. In mot cae, thi common et include all atellite tracked by all M approved reference receiver (note that N C N) [19]. The moothed peudorange correction PR c determined for each individual channel (atellite n, receiver m) i computed a follow [11]: Where PR i the 1-econd carrier-moothed peudorange meaurement, R(n,m) i the expected range from receiver antenna to atellite baed on the broadcat ephemeri meage for that atellite, and t v_gp i the atellite clock correction computed from the broadcat clock navigation data. PR corr (or PRC) from equation (1) i the firt tet tatitic ued in Type A ephemeri monitoring, and we will call thi quantity range error for implicity. The econd tet tatitic, which we will call range-rate error, can be generated in two way. The impler approach i to ue the broadcat range-rate correction RRC, which i imply the difference between the two mot recent PR corr value divided by the time interval between them (typically.5 econd between PR corr update). Note that, if the common et of atellite S C change over thi hort time interval, both current and previou PR corr mut be recomputed to correpond to the maximum atellite et that i common to both epoch [11]. Becaue RRC i given by the change in PR corr over the pat epoch, which i dominated by the change in carrierphae meaurement over that epoch, RRC i motly a carrier-phae rate meaurement with error at the carrier level (~ 1 cm/). However, a lightly more precie carrier-driven rate meaurement can be derived by computing carrier-phae correction in a ner analogou to equation (1) and (2) and then computing the (2) (1) rate of change in the ame ner a for RRC. Specifically, PR in equation (2) i replaced by the carrier phae (accumulated delta range) meaurement φ(n,m), leading to the per-channel correction φ c (n,m), which i ubtituted into equation (1) to derive φ ca (n,m) and φ corr (n) in a ner analogou to PR corr in (1). The carrier-baed rate-error tet tatitic (call it φ corr_rate (n)) i then computed in the ame ner a RRC by differencing the current and immediately prior φ corr (n) value over a atellite et common to both epoch and then dividing by the intervening time interval. Note that the unknown integer ambiguity in φ corr i contant over time for the ame common et (barring cycle lip or lo of lock) and thu diappear when the rate tet tatitic φ corr_rate i computed. Note that thee two tet tatitic are very imilar to the ue of the Meage Field Range Tet or MFRT for ephemeri monitoring, a decribed previouly in [12]. The original function of MFRT wa imply to inure that the moothed peudorange and range rate correction value (PRC and RRC, repectively) did not exceed the maximum value allowed in the Meage Type (MT) 1 field defined in the LAAS Interface Control Document, or ICD [18]. The MT 1 maximum for PRC and RRC are very looe: (±) m and m/, repectively. However, eparate and much tighter threhold (baed on nominal correction magnitude) can be applied to provide additional monitoring capability that, a explained below, i ueful againt potential Type A ephemeri fault. The range and range-rate tet tatitic defined above are generated every.5-econd meaurement update epoch and are compared with correponding eparate, fixed monitor threhold that are et to enure fault-free alarm probabilitie conitent with the LAAS Signal-in-Space (SIS) continuity rik requirement [11]. The reulting Minimum Detectable Error (MDE), conitent with LAAS SIS integrity rik requirement [11], are approximately 2 meter for the range error monitor and.4 m/ for the range-rate error monitor. Thee MDE are the um of the detection threhold ued to trigger monitor alert in real time and the mied-detection buffer ued in offline analyi to tranlate that threhold into the minimum error (or tet tatitic magnitude) that can be detected with the mied-detection probability derived from the underlying integrity allocation to ephemeri failure [19]. In thi cae, given an MDE for the range tet tatitic of 2 meter, the actual detection threhold would be about meter depending on the precie value choen for fale-alert and mieddetection probabilitie. Similarly, for range rate, the MDE of.4 m/ implie a threhold of.2.25 m/. Becaue the MDE add a mied-detection buffer to the detection threhold to meet the integrity requirement, the MDE i never le than the threhold by definition [13]. Therefore, atellite poition and velocity error induced 657

5 by ephemeri fault that yield range and range-rate error larger than thee MDE can be afely aumed to produce tet tatitic that exceed the monitor threhold. In operation, when a atellite rie into view of the LGF, the LGF will compute the range and range-rate tet tatitic for a certain period to detect potential out-of-view Type A1 failure before ending correction for that atellite to the uer. The need for and duration of thi waiting period i dicued in the following ection. After the broadcat of correction begin, thee tet continue to be executed to detect potential Type A2 failure. In the imulation conducted for thi paper, receiver meaurement and the reulting correction are not imulated, ince extenive random ampling would be needed to reproduce realitic meaurement error. Intead, theoretical error-free verion of the two tet tatitic are generated baed on the known geometry, including the actual and broadcat (potentially erroneou) atellite orbit generated by the imulation. The geometric, errorfree verion of the range and range-rate tet tatitic defined previouly are calculated a follow: Δr = ( x Δ where: true x ( x ) x xr ) x ( x xr ) r = x true x ) x xr ( (3) Δ r : Perfect LGF range correction x true : Actual atellite poition x : Broadcat atellite poition x : LGF receiver location poition r Δ r : true Theoretical LGF range rate correction x : Actual atellite velocity x : Broadcat atellite velocity The reult of equation (3) give what the real-time tet tatitic defined in equation (1,2) would be without nominal meaurement error. The MDE defined for thee tet tatitic expre the extent to which nominal error limit detection of faulty ephemeride. A box of dimenion given by the range and range-rate MDE can be drawn around zero to expre thee limit, and ephemeri fault that affect the reult of equation (3) are detectable (with the required mied-detection probability built into the MDE) if they fall outide thi box. Thi mean of comparing imulation reult to MDE will become clearer in the following ection. r The primary objective of thi paper i to determine the effectivene of the two monitor decribed above in mitigating Type A ephemeri fault by preventing the broadcat of peudorange correction for atellite that could generate Hazardouly Mileading Information (HMI). For ephemeri threat, an HMI ituation i defined a a cae in which the 3-D atellite poition error i hazardouly large. To quantify what hazardouly large mean, we begin with the undertanding that no ephemeri monitor can be perfect. For thi reaon, both the FAA LGF Specification [11] and the RTCA LAAS Minimum Operational Perforce Standard (MOPS) [14] pecify the ue of an ephemeri poition bound, which allow afe navigation depite potential undetected ephemeri (atellite poition) error magnitude of up to 3 meter [1,2]. Both requirement document permit that the bound be made tighter baed on the perforce of the ground monitor. For the purpoe of thi work, we aume a bound of 27 meter, which i a conervative perforce etimate for the Type B monitor decribed in [1]. Thu, in imple term, a Type A ephemeri error i conidered to produce potential HMI if it reult in a 3-D atellite poition error greater than 27 meter, which i the approximate perforce bound etablihed by the exiting Type B monitor. TYPE A2 ANALYSIS In the Type A2 fault hypothei, a atellite euver which i in view and the LGF i not aware of becaue the SV flag i healthy occur, but the pacecraft i till broadcating the unchanged pre-euver ephemeri to GPS uer. Thi in turn reult in an incorrect atellite poition computation on the part of the uer. Note that the pecial cae of an out-of-view Type A1 fault where the pot euver ephemeri remain unchanged i implicitly included in thi dicuion and analyi. The pre-euver and the pot-euver orbit hare a common tangential interection where the atellite euver occur (auming that we regard the initiating event a taking negligible time). It i poible to approximate the imultaneou atellite poition and velocity difference between the pre-euver and poteuver orbit by computing variation from the original orbit with the Euler-Hill method [12,15]. The example in Figure 3 how the poition error imulation repone following an increaing along-track (i.e., tangential) ΔV impule of 1 m/. From thi approximate analyi, it appear that the magnitude of the atellite poition difference can be a great a 1 km within 15 minute of the euver onet, which i evere enough to threaten the afety of civil aviation approach and landing procedure if not detected. To invetigate the perforce of the range and rangerate meaurement monitor againt Type A2 event, we 658

6 SV Poition Error (m) Total Time Since Delta V (hour) Alongtrack Radial Figure 3: Satellite Poition Error During Maneuver (Relative to Original Orbit) firt conducted a imulation for a pecific LGF location (the intallation at Memphi International Airport) by generating atellite-to-lgf Line-of-Sight (LOS) geometrie and projecting the atellite poition/velocity difference onto the LOS vector to produce the range and range rate error of interet. Two ditinct et of ephemeride were ued: one et decribing the orbit prior to the euver ( pre-euver ) and another decribing the orbit after the euver ( pot-euver ). The 24- atellite contellation from the GPS Standard Poitioning Service (SPS) Perforce Standard [16] wa ued to generate the nominal (pre-euver) orbit. The poteuver orbit were derived uing equation et (4). The ΔV ued in the imulation ranged from.2 m/ to 1 m/ with a tep ize of.2 m/, while the orbit propagation time tep wa 3 minute. Maneuver time were elected every hour over a 24-hour period and were applied to each atellite individually. The tep ize choen here are believed to be accurate to cover all poible cae. Δv (or ΔV): velocity change due to atellite euver μ: Earth tandard gravitational parameter ( μ = 398, km 3 2 ) e: orbit eccentricity a: orbit emi-major axi The reulting determinitic repone (baed on geometry only) of the two monitor tet tatitic given in equation (3), pecifically the range error and range-rate error, are hown in Figure 4. Figure 4 include all cae imulated, and mot of thee produce tet tatitic that greatly exceed the MDE mentioned earlier (2 meter for range,.4 m/ for range rate). The 3-D plot in Figure 5 zoom in and how the correlation between pacecraft poition error, range error, and range-rate error that fall within the repective monitor MDE. From Figure 5, it i evident that cae exit that produce atellite poition error in exce of 27 meter yet are not detected by either of the Type A monitor. A h p e = r = nom h ( v = nom ( v μ 2 nom + Δv) + Δv) h μ r r (4) a p = 1 e 2 where: r: radial vector from center of Earth to SV v: atellite orbital velocity vector Figure 4: SV Range and Range-Rate Error Within Two Hour after Maneuver (Over All atellite and Burn Time) 659

7 A2 monitor output and SV poition error at rie SV Poition Error (m) SV Range Rate Error (m/) SV Range Error (m) Figure 5: SV Range, Range-rate, and Poition Error explained earlier, ince thee cae violate the Type B ephemeri bound without being detected, they repreent potential HMI. Detailed examination of thee cae howed that they were all due to euver that happened jut before the atellite came into view of the LGF. To mitigate thee HMI cae, we introduced a waiting period between the epoch the atellite rie into view (meaning that it i tracked on more than one reference receiver) and the epoch when the LGF i allowed to tart broadcating correction for that atellite. During thi time, both monitor are active. After ome trial and error, it wa determined that 2 econd wa a ufficient waiting period, a will be demontrated hortly. Note that a 2-econd delay period after the atellite rie doe not contrain the tart of correction broadcat, a the ame amount of time i needed for two moothing time contant to pa, which allow the 1-econd carriermoothing filter applied to the code-phae meaurement to fully converge [11,19]. The upper plot in Figure 6 how the relationhip between atellite poition error and monitor output at the epoch when it rie into view. A few potential threat are clearly illutrated in thi figure: the LGF monitor alarm i not triggered while the poition error for everal cae are already ignificant enough to caue HMI (above 6 meter in ome cae). The lower plot of Figure 6 how thee correponding reult after the propoed 2-econd waiting period. The potential HMI cae are all now outide the monitor MDE window indicated by the dahed red box in the figure and therefore would have been detected by the LGF monitor during the 2-econd creening interval (more preciely, they would have been detected by the range-rate monitor). Once an alert i iued by either of the LGF monitor, the affected atellite would be excluded from uing in the LGF ervice volume for two day (the reet time of the Type B monitor). 5 SV Poition Error (m) SV Poition Error (m).2 SV Range Rate Error (m/) Figure 6: HMI Elimination by Range Rate Monitor The above analyi wa retricted to a ingle LGF location at Memphi airport. To enure the global effectivene of the algorithm, a follow-on imulation wa performed over all poible LGF longitude and latitude with a 1-degree grid tep. In thi imulation, a 2-minute euver time pacing, a 2-econd ephemeri propagation time interval, and a.2-m/ tep ize for euver velocity change were ued. Note that the time interval ued here were much horter than thoe ued in the Memphi-only imulation (2 min v. 1 hour; 2 ec v. 3 min). Thi comprehenive imulation validated that the Memphi reult apply globally and with maller time tep. Uing the two monitor together with the 2- econd waiting time, no HMI event were oberved. The reult of thi imulation are hown in Figure 7. TYPE A1 ANALYSIS A2 monitor output and SV poition error at 2 after rie SV Range Rate Error (m/) In the A1 threat cenario, a introduced before, a atellite euver take place when the atellite i not viible to a particular LGF ite (e.g., Memphi). An example timeline of the atellite euver (ΔV) time conidered i hown in Figure 8. A with the A2 cae, when the euver i completed, the nominal ephemeri uploaded in the atellite before the euver no longer repreent the actual atellite orbit. In the Type A2 imulation, when the SV Range Error (m) 5 SV Range Error (m) 66

8 A2 monitor output and SV poition error at rie 4 SV poition error (m) Range error (m) Range-rate error (m/) A2 monitor output and SV poition error at 2 after rie SV poition error (m) Figure 7: Global Mitigation of HMI atellite become viible to the LGF, the LGF tart receiving the broadcat of the nominal (pre-euver) ephemeri from the atellite. In the Type-A1 imulation decribed here, the pot-euver ephemeri broadcat error are modeled a random with error magnitude bound baed on minimum and maximum hitorical ephemeri parameter value determined by Paul Kline [8], which are hown in Table A1 in Appendix A. The euver imulation for the A1 cae i executed in a imilar method a the A2 cae. A hown in Figure 8, the euver time are retricted to interval when the correponding atellite i out-of-view. The erroneou broadcat ephemeri i imulated from the combination of ΔV time conidered toe-26 hr 1 Range error (m) -1 Yeterday -2 Figure 8: Poible Maneuver Time Interval for a Single Satellite toe.5 Today.1 Range-rate error (m/) SV viible egment Figure 9: FOH Tet Statitic (in meter) Before and After Scaling the nominal pre-euver ephemeri (obtained from the RTCA DO-229 alac [14]) parameter and an ephemeri parameter error et (the detail of thi procedure are given in Appendix A). Uing thi error et, the atellite poition error between the pre-euver nominal and received pot-euver erroneou ephemeri are generated, and a Type B Firt Order Hold (FOH) tet i performed. Briefly, thi tet compare the current ephemeri parameter received by the LGF with thoe received during the previou viibility period for the atellite in quetion (detail of the Type B FOH tet can be found in [1]). Becaue the FOH tet examine the conitency of the previou and current ephemeride, it will alo alert Type A1 fault cae whoe pot-euver ephemeride are ignificantly different from before. With thi in mind, a caling factor (SF) for the ephemeri parameter error et i calculated baed on equation et (5), and the randomly generated ephemeri error vector i accordingly caled o that the FOH tet will not be triggered. The intention i to produce the maximum atellite poition error caued by a Type A1 fault that will not trigger a Type B FOH alert. An example of the poition error etimate produced by the Type B monitor before and after caling i hown in Figure 9. Thi caling proce make the randomly-generated ephemeri error more ignificant, a they are all converted to the ize that i mot likely to lead to HMI. X = X Δ p+ δp SF = MDE / max( ΔX ) δp = δp SF X MDE = 27m p (5) 661

9 Monitor output and SV poition error at rie Monitor output and SV poition error at 2 after rie 3 3 SV poition error (m) Range error (m) Range-rate error (m/) SV poition error (m) Range error (m) Range-rate error (m/) Monitor output and SV poition error at 6 after rie Monitor output and SV poition error at 4 after rie 3 3 SV poition error (m) Range error (m) Range-rate error (m/) SV poition error (m) Range error (m) Range-rate error (m/) Figure 1: Type A1 Fault Mitigation Reult at Memphi where: δp : the pre-caled ephemeri error vector δp : the pot-caled ephemeri error vector X p : the atellite poition etimate obtained by propagating the nominal, non-corrupted ephemeri X p+δp : the atellite poition etimate obtained by propagating the pre-caled erroneou ephemeri The parameter value in the pot-caled erroneou ephemeri mut alo be compliant with the ephemeri dynamic range lited in Table A1 in Appendix A [9]. If any element exceed it range, that element will be et to be equal to the maximum value. Moreover, one of the error et parameter, the quare root of the emi-major axi, i alo bounded by the euver detection monitor given in equation (6) [1]. The purpoe of thi monitor i to detect euver that occurred while out-of-view of the LGF. It i baed on the fact that, when no euver occur, the change of the monitor tet tatitic hould be within a certain able range. Note that equation (6) ha two different threhold depending on whether the Type B tet mentioned above i baed on the tandard FOH tet tatitic or a impler Zero Order Hold (ZOH) tet tatitic. The ZOH tet compare the current received ephemeri parameter with thoe projected from the ephemeri received up to 24 hour ago. The FOH tet make more-accurate projection baed on two day of prior ephemeride; thu it i ued when two day of prior ZOH tet, failure of the euver detection monitor for a given newly-rien atellite reult it excluion from ue. Δ a a < (FOH) Should be (6) < (ZOH) An example of ephemeri A1 fault mitigation for an LGF at Memphi i hown in Figure 1. From thi figure, it i demontrated that potential HMI event exit when a faulty atellite firt become viible to the LGF, although the degree of HMI i limited to atellite poition error not far above 27 meter due to the impact of the Type B monitor. Within the 2-econd waiting time before correction can be broadcat, all potential HMI cae are detected by either the range or range-rate tet tatitic. After the 2-econd waiting period end, any newlyemerging threatening cae will be immediately excluded by the LGF monitor. Plot for potential waiting time of 4 and 6 econd are alo hown, although thee longer waiting time are not needed. The reult for the A1 fault effect on the LGF monitor output are imilar to the A2 cae that we tudied before. However, becaue of the large imulation parameter pace 662

10 involved (e.g., 15 ephemeri parameter error, atellite euver time, ΔV magnitude), it i not poible to directly evaluate the reult of every poible A1-fault-outof-view cae. Hence, a Monte-Carlo method i applied with the LGF located at Memphi to generate a large volume of error cenario to enure that the HMI probability requirement i meet. A total of 14,16, ephemeri error vector were generated, and all potential threatening event were detected by the monitor. Thi indicate that any GPS navigation integrity rik caued by a Type A1 fault will trigger the LGF monitor alarm either within the 2-econd waiting period after atellite rie or before the 3-D atellite poition error exceed the MDE (27 meter). Thee imulation reult ugget that the actual Mied Detection Probability, P md, i le than 1/14,16, = Given the likelihood that a atellite euver happen out-of-view of a particular LGF i le than 5%, thi etimated P md can be further reduced to In addition, remember that all failure ize were arbitrarily ipulated to create the wort-cae ize for each randomly-elected et of ephemeri parameter error. Comparing thi reult to the integrity rik requirement allocated to the A1 failure cenario, which in thi cae i per approach, ignificant margin exit. CONCLUSIONS AND FUTURE WORK In thi paper, the GPS atellite ephemeri fault model relevant to LAAS are defined, and the atellite poition and velocity error characteritic caued by Type A ephemeri fault (large error related to GPS atellite euver) are tudied. A mitigation trategy for Type A ephemeri fault, in which the LGF monitor the range and range rate meaurement correction, i examined in detail baed upon imulation of the 24-atellite RTCA DO-229 GPS contellation. In the Type A1 failure cenario, more than 14 million pot-euver ephemeri error et were randomly elected in an attempt to explore all poible pot-euver fault cenario. A imilar but exhautive earch method wa ued for the Type A2 failure cae. Thee imulation validated the ability of the propoed monitor to effectively mitigate both Type A1 and A2 ephemeri failure (not counting the extremely rare A2 cae where a atellite euver without being comded to) and meet the CAT I preciion approach integrity rik allocation to thee threat. The reult in thi paper ugget everal follow-up area of work, particularly a LAAS evolve to atify the more-deding integrity requirement of CAT II/III preciion approache and landing. Firt, the effectivene of the Type A monitor i motly due to the tight threhold and MDE applied to the range-rate tet tatitic. Thi i particularly true in the Type A2 fault cae. Recall that nominal error in range-rate tet tatitic are driven by carrier-phae noie difference over the.5 econd between adjacent meaurement epoch. If nominal error from the naphot tet tatitic derived on a given epoch are too large to meet the threhold and MDE propoed in thi paper, a hort moving average of the naphot tet tatitic can be implemented to reduce the noie. The key quetion are the definition of hort and the variability of carrier-phae error among LAAS ite. For implicity, it i preferable to ue a ingle rangerate monitor formulation (with a pecific averaging time, if any) at all ite. If averaging i needed to meet the required MDE, it impact on the required waiting time mut be conidered. The 2-econd waiting time derived in thi paper aume no averaging. If averaging over more than a few (~ 5) econd i implemented, thi would age the range-rate tet tatitic enough that a waiting period of lightly more than 2 econd might be needed. Thi would not affect LAAS perforce, but it might require a oftware change, ince the LGF currently implement preciely 2 econd of waiting for moothing convergence. Second, the tangential ΔV only imulation conducted here hould be expanded to better undertand the perforce of Type-A threat monitoring under a larger et of circumtance. The poibility of intentional OCS euver that include non-tangential component, by deign or by mitake, wa dicued in the ection on Type A2 imulation deign. A euver that mitakenly include a ignificant non-tangential component require the OCS to alo err in etting the atellite healthy again with an ephemeri that doe not reflect the unintended reulting orbit before the ituation could become hazardou to LAAS. A noted earlier, a cenario that require two independent failure normally can be neglected for CAT I operation, but in thi cae, an unexpected non-tangential impule make it more likely that the pot-euver ephemeri will be faulty. Thu, thee two fault are not completely independent and deerve further thought. Even if thi were not the cae, it i worthwhile to undertand the effect of non-tangential euver on the Type A monitor in cae the GPS OCS begin to execute uch euver intentionally in the future. When imulating non-tangential euver, the initial ΔV could theoretically have any direction in 3-D pace. For euver deliberately initiated by OCS, we would expect the tangential component to till be dominant, and any non-tangential component would be limited to certain dicrete ize baed on the capabilitie of GPS atellite thruter. However, thi i not true for uncomded, unintended euver that fall into the Type A2b cae. Here, the reulting ΔV could come from propellant leakage in addition to undeired thruter firing; thu any direction in 3-D and any magnitude (though likely very mall) i poible. Thi ugget that, unlike 663

11 the Type A2 (A2a) imulation in thi paper, imulation of the Type A2b threat would be of the Monte-Carlo type in that they would ample from a much larger pace of poible euver, and every poibility could not be covered. With o y poible variation, it i likely that a handful would be found that are not detected (with the required P md ) by the Type A monitor. However, the very mall number of thee event a a fraction of the total number of variation, combined with the very improbable nature of the Type A2b failure event in the firt place, hould be ufficient to meet the CAT II/III LAAS requirement. We plan to carry out Type A2b imulation to verify thi hypothei. ACKNOWLEDGMENTS The author appreciate the valuable help and feedback provided by the FAA/Honeywell Ephemeri Tiger Team that upported LAAS Sytem Deign Approval. Thi project wa funded by the FAA LAAS Program Office through a ub-contract from Stanford Univerity, and ponorhip of thi work by the FAA LAAS Program Office i greatly appreciated. However, the opinion provided in thi work are olely thoe of the author. REFERENCES [1] B. Pervan and L. Gratton, Orbit Ephemeri Monitor for Local Area Differential GPS, IEEE Tranaction on Aeropace and Electronic Sytem, Vol. 41, No.2, April 25. [2] L. Gratton, B. Pervan, and S. Pullen, Orbit Ephemeri Monitor for Category I LAAS, Proceeding of IEEE PLANS 24, Monterey, CA, April 26-29, 24. [3] J. M. Davi and R. J. Kelly, RNP Tunnel Concept for Preciion Approach with GNSS Application, Proceeding of the ION 49 th Annual Meeting, Cambridge, MA, June 21-23, [4] International Civil Aviation Organization (ICAO), International Standard, Recommended Practice and Procedure for Air Navigation Service Annex 1, April [5] Federal Aviation Adminitration GPS Product Team, Global Poitioning Sytem Standard Poitioning Service Perforce Analyi Report Report #58, June 31, 27. [6] K. Kovach, private communication, May 15, 27. [7] V. L. Piacane, Ed., Fundamental of Space Sytem. New York: Oxford Univerity Pre, 2 nd Edition, 25, Chapter [8] P. Kline, A1 corner cae, Unpublihed Briefing to the FAA, Feb. 2, 28. [9] Navtar GPS Space Segment / Navigation Uer Interface. El Segundo, CA., ARINC Reearch Corporation, ICD-GPS-2C Rev. 4, April 12, 2. Page 96, Table 2-III, [1] B. Pervan, L. Gratton, S. Langel, IIT Maneuver Detection Monitor, Unpublihed Technical Report, 28. [11] Specification: Perforce Type One Local Area Augmentation Sytem Ground Facility. U.S. Federal Aviation Adminitration, Wahington, D.C., FAA-E- 2937A, April 17, 22. [12] S. Matumoto, S. Pullen, M. Rotkowitz, and B. Pervan, GPS Ephemeri Verification for Local Area Augmentation Sytem (LAAS) Ground Station, Proceeding of ION GPS-99, Nahville, TN, Sept , [13] R. Braff and C. A. Shively, Derivation of Ranging Source Integrity Requirement for the Local Area Augmentation Sytem (LAAS), Navigation: Journal of the Intitute of Navigation, Vol. 47, No. 4, Winter [14] Minimum Operational Perforce Standard for GPS Local Area Augmentation Sytem Airborne Equipment. Wahington, D.C., RTCA SC-159, WG-4, DO-253C, Dec. 16, 28. [15] M. H. Kaplan, Modern Spacecraft Dynamic and Control, New York: John Wiley & Son, 1976, Section 3.6, pp [16] Global Poitioning Sytem Standard Poitioning Service Perforce Standard. Wahington, D.C., U.S. Department of Defene, 4 th Edition, Sept. 28, Section 3.2, pp [17] FAA Approve 1t U.S. Ground Baed Augmentation Sytem, FAA Wahington Headquarter Pre Releae, Wahington, DC, Sept. 21, 29. [18] GNSS-Baed Preciion Approach Local Area Augmentation Sytem (LAAS) Signal-in-Space Interface Control Document (ICD). Wahington, D.C., RTCA SC- 159, WG-4, DO-246D, Dec. 16, 28. [19] G. Xie, Optimal On-Airport Monitoring of the Integrity of GPS-Baed Landing Sytem, Ph.D. Diertation, Stanford Univerity, Dept. of Aeronautic and Atronautic, March ~wwu/paper/gp/pdf/thei/gangxiethei4.pdf 664

12 APPENDIX A Type A1 Fault Simulation Procedure Figure A1 below provide a graphical depiction of the A1 fault imulation technique. In the Erroneou Broadcat Ephemeri Generation ection, the pre-caled erroneou broadcat ephemeri i generated a the combination of the nominal ephemeri and a contaminating ephemeri error et. The ephemeri error et contain 15 parameter, each of which i randomly elected from a uniform ditribution with ditribution bound provided by the ephemeri parameter error bound table. In the Pot-Maneuver Ephemeri Generation ection, the SV euver time epoch i randomly elected from uniform ditribution with time interval deignated by the SV inviible time interval, meaning the period when the atellite in quetion i not viible to the LGF. The imulated atellite euver velocity change i alo randomly elected from a uniform ditribution with 1.8 m/ upper bound.the 15 parameter in Table A1 correpond to the atellite orbit propagation parameter tranmitted in the GPS navigation meage (the ephemeri data). The value in the Ephemeri parameter error bound column are derived from hitorical and tatitical obervation of atellite ephemeri broadcat error [8]. Thee value define the poitive and negative bound of a uniform error ditribution for each of the parameter in the ephemeri error et. To generate a contaminated ( blundered ) ephemeri error et, a value i picked randomly within thi range for each parameter in the et. Note that it i omewhat arbitrary to ue the maximum error oberved from previou broadcat ephemeri meage to limit what might occur in erroneou one. Thi i not the actual intent. While erroneou broadcat parameter might vary much more than what ha been een in the pat, limit baed on pat perforce are ued here a conervative underbound on thee much larger error. A the outer bound of thee error are made larger, the LGF Type B monitor ha an eaier tak becaue difference between the pre-euver and poteuver ephemeride become larger. Note that caling wa introduced into the analyi to conervatively minimize the impact of the Type B monitor. Since larger erroneou parameter range would make Type B detection eaier and thu neceitate more-aggreive caling, the range cited in Table A1 are ufficiently large to fully (but conervatively) exercie the Type A monitor. Figure A1: Ephemeri A1 Fault Simulation Flowchart 665

13 Table A1: Ephemeri Parameter Error Bound 666