WAAS-Based Threat Monitoring for a Local Airport Monitor (LAM) that Supports Category I Precision Approach

Transcription

1 WAAS-Based Threat Montorng for a Local Arport Montor (LAM) that Supports Category I Precson Approach Jason Rfe*, Sam Pullen*, Todd Walter*, Erc Phelts*, Bors Pervan and Per Enge* *Stanford Unversty; Palo Alto, CA 9435 Illnos Insttute of Technology; Chcago, IL 6616 Abstract The Federal Avaton Admnstraton has sponsored the development of a Local Arport Montor (LAM) prototype desgned to enable GPS-based precsonapproach by leveragng the exstng capabltes of the Wde Area Augmentaton System (WAAS). The LAM transmts a lumped WAAS correcton va a Local Area Augmentaton System (LAAS) message. The broadcast error bounds for the LAM are strcter than those for WAAS n order to enable Category I Precson Approach wth a 1 m Vertcal Alert Lmt (VAL). The LAM ensures ntegrty of these tghtened error bounds by leveragng both local montorng and WAAS montorng. Ths paper descrbes the use of WAAS montorng to protect LAM users from onosphere, code-carrer dvergence and sgnal deformaton threats. Although the LAM rebroadcast slghtly delays the arrval of WAAS alerts to users, montor ntegrty can nonetheless be ensured by restrctng the allowed desgn space for user recevers. I. INTRODUCTION The Local Arport Montor (LAM) effort ams to develop a GPS-based precson-approach system by leveragng the exstng capabltes of the Federal Avaton Admnstraton s Wde Area Augmentaton System (WAAS). The proposed LAM archtecture retransmts WAAS pseudorange correctons usng the standard VHF Data Broadcast (VDB) message defned for the Local Area Augmentaton System (LAAS). Ths archtecture explots the exstng pseudorange correctons from WAAS but tghtens the WAAS error bounds to support a 1 m Vertcal Alert Lmt (VAL) by valdatng the WAAS correctons wth local measurements. Because the LAM archtecture explots operatonal technologes n the WAAS system and already certfed LAAS user equpment, LAM has potental for nexpensve and rapd deployment when compared to CAT I LAAS. LAM ntegrty requres that error bounds apply not only under nomnal condtons but also under fault scenaros. Among the most dangerous fault condtons are those whch ntroduce large dfferental rangng errors that are ether fully or partally unobservable to LAM. (Examples of these nclude steep onosphere gradents, GPS C/A-code sgnal deformaton, and satellte code-carrer dvergence). Rather than ncorporatng specalzed hardware and montorng algorthms to detect these fault modes locally, the LAM system reles on external montorng algorthms that ether already exst wthn WAAS or that wll be added to WAAS by the end of 28. The use of external montorng ntroduces both benefts and labltes for the LAM archtecture. On the postve sde, substtutng WAAS-based montors for specalzed local montors keeps LAM complexty low. Furthermore, the wde baselnes and dense montorng network of WAAS provde greater senstvty for fault-mode detecton than an solated local montor could provde. Not all of the features of external montorng are advantageous to LAM, however. In partcular, the tme delay assocated wth the recepton and rebroadcast of the WAAS message ntroduces a sgnfcant challenge n meetng the 6-second tme-to-alarm requrement for Category I approaches. Also, because WAAS does not broadcast specfc montor flags but only more general ndcatons of system health, LAM contnuty and avalablty suffer slghtly. Ths paper detals WAAS-based montors for three sgnfcant fault-modes that mpact LAM ntegrty: anomalous onosphere gradents, satellte Sgnal Deformaton (SD), and satellte Code-Carrer Dvergence (CCD). In order to detect these fault modes, the LAM ground faclty montors WAAS ntegrty parameters ncludng the User Defned Rangng Error (UDRE) and the User Ionosphere Vertcal Error (UIVE). Analyss and data presented n the paper demonstrate that the WAAS-based montors provde full ntegrty to LAM users even n the event of severe threats. Ths montorng approach, moreover, s vald for both Poston-Doman Montorng on the Ground [1] and Poston-Doman Montorng n the Ar [2].

2 II. THREAT DESCRIPTION Ths secton descrbes three major threats for whch LAM reles on external montorng: (1) onosphere gradents, (2) CCD, and (3) SD. A. Ionosphere Threats Ionosphere spatal decorrelaton anomales have been studed n great detal by both WAAS and LAAS snce unusually large decorrelatons were dscovered n WAAS supertruth data from the onosphere storm of Aprl 6 7, 2 [3]. Under actve onospherc condtons, anomalous onospherc gradents may exst that result n errors large enough to cause loss of ntegrty for the user arcraft. Under these crcumstances onosphere montorng s deemed necessary n LAAS and LAM. A threat model for onospherc gradents was developed based on WAAS Super Truth data analyss. The threat model represents anomalous spatal onospherc delay dfferences wth a pecewse lnear functon, shown below. Note that ths lnear model of the wavefront s a smplfcaton of realty. Although nonlnear effects appear n the tme seres of the anomaly, ths model suffces to estmate the threat. Max. Iono. delay dff. (D: gven by slope and wdth): D = wg Gradent Slope Fg. 1. Threat Model of Anomalous Ionosphere Gradent Ths pecewse lnear model s descrbed by three parameters. Gradent speed ( v ) measured n m/s Gradent wdth (w) measured n km Gradent slope (g) measured n mm/km Wave Front Speed ( v ); Gradent Wdth (w) The maxmum delay (D) ntroduced as a result of ths gradent s defned as the product of the gradent wdth and slope (D = wg). Bounds for each value, as of August 25, are gven by [4]. These parameters reflect a ratonal analyss of observed gradents n all data currently analyzed wth some conservatsm added. It s recognzed that safety of lfe operatons requre contnued characterzaton of ths phenomenon. LAM mtgates the onospherc gradent threat by explotng the wde-baselne onosphere montorng capabltes of WAAS. Analyss of data for days wth nomnal and actve onosphere condtons ndcates that threatenng gradents only arse durng severe onosphere storms. Thus, f WAAS detects a storm-affected regon, LAM can protect ts users by denyng satelltes that le n the storm regon. B. Code-Carrer Dvergence Threats Code-Carrer Dvergence (CCD) occurs when the clock reference for the GPS code drfts away from that of the underlyng carrer sgnal. Nomnal onosphere actvty causes mld CCD. Although the LAM error bound s desgned to account for ths actvty, a rare satellte fault could ntroduce much larger CCD errors. In ths fault mode, t s hypotheszed that the satellte code generator could drft away from the underlyng carrer sgnal. Ths falure has not been observed n GPS operatons to date, but satellte-nduced CCD s consdered a suffcent hazard to warrant fault montorng. The CCD error transent s ted to the desgn of carrersmoothng flters mplemented n WAAS, n the LAM ground faclty and n the user recever. The standard form of the carrer-smoothng flter for these systems s gven by the followng equaton, whch blends measurements of pseudorange, ρ, wth accumulated carrer-phase, φ, to produce a smoothed pseudorange estmate, P, at each epoch, n. Carrer-phase measurements are scaled by the carrer wavelength, λ, and fltered by a weghtng coeffcent, α =.5, whch gves a nomnal flter tme constant of 1 s for 2 Hz samplng. λ P = αρ + 1-α φ φ 2π ( ) P + ( ) n n n-1 n n-1 When dvergence occurs, the transmtted code and carrer sgnals may drft away from the nomnal clock reference. If the drft rate for the code s d n,ρ, and f the drft rate for the carrer s d n,φ, then these errors mpact pseudorange smoothng as follows. ( + n ρ Δ ) P = α ρ d t n, CCD n, ( α) ( φ φ ) λ Pn-1 + n n-1 + dn, φ Δt 2π The error from ground smoothng at each tme step s Δg n. ( α) +1- Δ g = P P = αd Δt+1- d Δ t (3) n n, CCD n n, ρ n, φ The magntude and sgn of the dvergence terms, d n,ρ and d n,φ, depend on the source of the CCD. The physcs of onospherenduced CCD, for nstance, produces equal and opposte dvergence terms (d n,ρ = -d n,φ ). For satellte-nduced CCD, the code-phase generator s assumed to drft at a constant rate relatve to the satellte clock (d n,ρ s constant and d n,φ = ). For analyss purposes, t s both conservatve and convenent to convert the CCD error model from the dscrete doman, as (1) (2)

3 descrbed by (3), nto the contnuous doman. The followng dfferental equaton bounds the tme evoluton of the CCD ground-flterng error, g. Here the satellte-nduced CCD drft starts at tme zero wth a constant rate, d= d n,ρ. The carrersmoothng flter tme-constant (nomnally 1 s) s labeled τ cs. t τ cs g + g = (4) t d t > For the case of a 1-s tme constant, ths frst-order LTI flter results n the ramp response llustrated n Fg. 2. In the fgure, the fltered and raw error values are normalzed by the dvergence magntude, d. At steady-state, the fltered error converges to a constant offset, dτ cs, below the nput measurement ramp. The CCD threat model allows the parameter d to take any postve value. Error transents that result from dfferences n carrersmoothng flter desgn or from a trackng restart are llustrated n Fg. 3. In each plot, the dotted functon represents the nomnal ramp error caused by CCD. The blue sold functon represents the ground CCD ramp response, descrbed by (4). The red dashed functon represents modfed user responses both for an unmatched flter desgn (left) and for a flter restart (rght). All curves have been normalzed by the dvergence rate, d. The dfferental error, E(t), between the ground staton and the user s llustrated n Fg. 4. Because the user flter, u, s requred to match the nomnal LAAS flter, g, wthn a 1 s perod after a restart event (see Secton V), CCD faults are only consdered threatenng shortly after a user flter restart (t a > -1 s) Ramp Nomnal User: Unmatched Ramp Nomnal User: Restart E(t)/d Error(t) / d Tme (s) Tme (s) Fg. 3. Smoothng-Flter Dfferental Error due to User-Flter Desgn Dfferences (left) and User-Flter Restarts (Rght) 1 Raw Measurement Error Flter Response Tme (s) Fg. 2. Smoothng-Flter Response to Ramp Dvergence Error Input In prncple, the user flter response, u(t), would be dentcal to the ground response, g(t), such that the net dfferental error, E(t), would be zero for the CCD fault mode. In practce, these two terms do not necessarly cancel, and they may leave a dfferental error gven by the followng equaton, whch conservatvely assumes full convergence for the ground flter. E(t)/d Tme (s) Tme (s) Fg. 4. Unobservable Dfferental Errors due to Unmatched User-Flter Ramp Response (left) and due to User-Flter Restart (Rght) Et () = ut ( t) gt () (5) a In ths equaton, the user transent may not match the ground s because of a trackng restart (at a tme, t a ), transmsson latency, or the desgned ramp response of the user flter. The dfferences between u and g may be decomposed nto two parts whch are ether observable or unobservable to the LAM ground staton. Errors caused by desgn dfferences of the user recever or by a user trackng restart are unobservable at the LAM ground staton. Errors assocated wth the sx-second latency of the dfferental correcton transmtted by WAAS, by contrast, are observable n the WAAS decson statstc. Although observable CCD errors may reach several meters n magntude, LAM nherently protects observable errors through ts Vertcal Protecton Level (VPL) expresson. Thus, WAAS montorng s necessary only to protect those errors otherwse unobservable at the ground staton. C. Sgnal-Deformaton Threats SD events occur when the electroncs onboard a GPS satellte dstort the shape of the chps n the broadcast code sequence. These dstortons change the shape of the correlator peak observed by a GPS recever and, n effect, lengthen or shorten the measured pseudorange. Dfferent GPS recevers experence dfferent correlator peak dstortons when exposed to the same threat. Consequently, a dfferental correcton system, such as LAM, cannot ssue pseudorange correctons that completely remove the SD perceved by dfferent users. Fortunately, SD s rare. To date only one SD event has ever been detected. Ths fault was observed for satellte SV19 n October of It s not known when the fault frst occurred, and t s possble that the fault was present from the tme the satellte was launched. To be conservatve, however, the threat model assumes that an nstantaneous transton between faulted and unfaulted condtons s possble.

4 The sze of the SD error vares over the user-recever desgn space and the sgnal-deformaton threat space. The user desgn space s restrcted for LAM, as dscussed n Secton V. The sgnal-deformaton threat space s dentcal to that for LAAS and WAAS and s modeled usng three parameters [5]. These three parameters consst of damped natural frequency (f d ), dampng constant (σ), and dscrete lead/lag (Δ). The standard threat model assumes f d falls n the 4-17 MHz range for analog faults or n the 8-12 MHz for combned analog/dgtal faults. The threat model bounds the dampng constant, σ, n the range of nepers/chp. If a dgtal fault s present, Δ s lmted to a lead/lag of ±.12 chp. Based on specfc models for the user and threat spaces, the maxmum user-to-ground dfferental error can be computed n smulaton, and verfed n experment. Ths document reles on a smulaton that uses a detaled model of recever physcs to derve the steady-state recever error assocated wth any pont n the combned threat and user parameter spaces [5]. As wth the case of the satellte CCD fault, these errors may be partally observable. Deformaton errors that result from dfferences n the user and ground recevers or from a user trackng restart are not generally observable. In theory, SD errors could be substantally reduced by matchng the ground and user recevers; however, matchng s generally not practcal, as SD errors are hghly senstve to precse desgn tolerances for the analog components of GPS recevers. As such, all dfferental errors between the WAAS correctons and the user recever are treated as unobservable to the LAM recever. Fg. 5 llustrates the magntude of the LAM dfferental SD errors, E ss. Each pont on the fgure represents one of approxmately 15, dscretzed regons from the SD threat space. These error levels nclude nflaton that compensates for latency between the broadcast of the WAAS dfferental correctons and ther arrval at the user recever. Inflaton s mnmal, snce the user and LAM ground staton both update broadcast measurements wth a range-rate correcton [6], [7]. E ss (m) Steady-State Dfferental Error Based on WAAS Bound (m) Threat Index, Sorted by Sze of WAAS Error Fg. 5. SD Threat Space: Dfferental Error Accountng for Transmsson Delay and Range-Rate Extrapolaton Based on these values of steady-state error, a bound on the dfferental-error transent, E(t), s defned as a frst-order LTI flter step response, where the steady-state error from Fg. 5 s E ss and the flter tme constant s τ cs. -t/ τ cs ( ) Et () = E 1-e for t> (6) ss Ths dfferental error bound s based on the assumpton of contnuous satellte trackng. In practcal operatons, the user carrer-smoothng flter may start or restart when a satellte s rsng above the horzon, when a cycle slp occurs, or when an arcraft maneuvers n such a way as to occlude one or more satelltes n vew. If such a restart occurs, the full sgnaldeformaton error s mmedately absorbed nto the navgaton soluton. Thus the carrer-smoothng flter does not delay the onset of HMI f a user-flter restart occurs. Et ( ) = E for t> (7) ss Fortunately, the probablty of a user restart occurrng wthn a few seconds of the onset of SD s extremely low. III. WAAS MONITORING ALGORITHMS A. WAAS Ionosphere Montor To date, the only onosphere montor developed for conventonal LAAS that detects all hazardous onosphere gradents s a long-baselne montor that requres reference statons sted km apart along the arcraft approach path [8]. Although ths type of montor s not practcal for conventonal LAAS, LAM can obtan the benefts of longbaselne montorng by leveragng WAAS. WAAS nterpolates measurements from ts network of reference statons to defne a grd-based onosphere model for CONUS. An onosphere storm detector checks each Ionosphere Grd Pont (IGP) correcton for nsuffcent planarty. IGPs for whch the degree of non-planarty crosses a pre-set ch-square threshold have ther Grd Ionosphere Vertcal Error (GIVE) set to a 3.29 σ GIVE value of 45 meters and ther GIVE Index (GIVEI) set to a value of 14, on a scale between and 15. Ths value s too hgh to be useful for precson-approach applcatons. IGPs wth nsuffcent measurements to assure the consstency of a planar ft have ther GIVEI value set to 15, or not montored, to ndcate that the onosphere correcton for ths IGP cannot be guaranteed (see [7] for more detals of the WAAS ISD algorthm). To protect LAM users from severe onosphere gradents, IGPs wth GIVEI values of 14 or 15 should be excluded by LAM. These classfcatons should be revsted n the future, when WAAS ntroduces ts new Extreme Ionosphere Storm Detector (EISD). In partcular, t should be verfed that the only onosphere storms threatenng to LAM are those deemed to be extreme storms by the WAAS EISD.

5 B. WAAS CCC Montor Conventonal LAAS ground statons each mplement a specalzed measurement montor to detect CCD. LAM smplfes certfcaton by leveragng an exstng montor wthn WAAS desgned for ths functon: the Code-Carrer Coherence (CCC) montor. The CCC montor measures the dfference between WAAS correctons fltered wth two dfferent tme constants, one short (25 s) and one long (2 hours). If the lack of coherence between the two sgnals grows larger than the montor threshold, the CCC montor trggers a flag that excludes the alarmed satellte. Dvergence faults are modeled as ntroducng a ramp functon nto both the short and long-duraton flters. Because the long-duraton flter response s neglgble durng the ntal mnutes of the dvergence event, the CCC montor transent s modeled as the ramp response for a frst-order LTI flter wth a 25-second tme constant. The rato of the montor statstc transent, m ccc (t), to the dvergence rate, d, s a functon of the faster smoothng tme, τ ccc = 25 s. t / τ ccc ( 1 e ) mccc () t = t τ ccc (8) d A flag trps f the montor statstc exceeds a preset threshold. The CCC montor threshold s dfferent for each satellte, wth a value that depends on the number of WAAS Reference Equpment (WRE) recevers trackng that satellte. The number of WREs s reflected n the WAAS broadcast parameter called the User Defned Rangng Error (UDRE). The UDRE Index (UDREI) ranges between and 15. A hgher UDREI ndcates a smaller number of WREs trackng a partcular satellte. The WAAS MOPS requre that UDREI be no greater than 11 for a satellte used n precson approach. The CCC threshold, T CCC, s defned n terms of the montor nose sgma, whch s σ mon,ccc =.7 m at UDREI = 11. T ccc = 12σ (9) mon, ccc C. WAAS Sgnal Deformaton Montor In LAAS, specalzed recevers wth multple correlator spacngs are requred to detect SD events. LAM sgnfcantly reduces costs by leveragng the Sgnal Deformaton Montor (SDM) scheduled for nstallaton as a WAAS upgrade n 28. Ths capablty wll leverage specalzed SD recevers nstalled at WAAS reference statons. Upon detecton of SD, WAAS wll transmt a message to warn users of the fault. The WAAS montor wll functon by computng metrcs to assess the level of deformaton n each satellte s correlatonpeak. These metrcs are compared to a threshold based on the number of actve SDM recevers n WAAS. For worst-case, nstantaneous SD, the montor statstc transent s modeled as the flter response to a step-nput functon. The rato of the montor statstc transent, m sdm (t), to the sze of the steadystate error, m ss, s a functon of the flter smoothng tme, whch s expected to be no slower than τ sdm = 5 s. m sdm m () t ss t / τ sdm = 1 e (1) A flag trps f ths montor statstc exceeds a preset threshold. As wth the CCC montor, the WAAS UDREI and threshold are functons of the number of WREs avalable. Two SDM threshold levels are consdered n LAM analyss. SD threats pose a greater rsk for LAM at hgher elevatons. Fortunately, more WREs are generally avalable to track hgher elevaton satelltes, allowng for more senstve fault detecton (gven a fxed false alarm rate). Ths tradeoff may be captured wth mnmal overconservatsm by analyzng two thresholds, a tghter threshold assocated wth UDREI = 8 (for hgh elevaton satelltes) and a looser threshold assocated wth UDREI = 11 (for low elevaton satelltes). Satelltes wth UDREI 11 are not consdered snce the WAAS MOPS forbds ther use n precson approach. Although the WAAS SDM threshold has not been fnalzed, t wll have a value no greater than sx tmes σ mon,sdm. T ( N ) = 6σ (11) sdm mon, sdm WRE As montor nose s averaged over multple WREs, the value of the montor nose sgma, σ mon,sdm, and hence of the threshold, T sdm, depends on the number of WREs, N WRE, vewng the faulted satellte. In ths analyss, t s assumed that the sgma value s mproved over the sngle-montor nose level by a factor of 2.12 n the case of UDREI = 11 and by a factor of 2.74 n the case of UDREI = 8. For SD ntegrty analyss, t s convenent to reduce the descrpton for each threat n the dscretzed threat space to a parameter par: E ss (for the worst user) and m ss. For any threat n the threat space, the value of m ss, lke the value of E ss, can be determned through a physcs-based smulaton. The smulated SD threat space for LAM s characterzed n Fg. 6 n terms of E ss and m ss. Ths threat space reflects the userrecever restrctons of Secton V. E ss (m) m ss / σ mon Fg. 6. Steady-State Error and Montor Statstc Values for WAAS SDM

6 IV. LAM MONITORING ALGORITHMS When a WAAS montor excludes an affected satellte, WAAS guarantees that ts users wll receve the warnng wthn sx seconds of the epoch at whch the fault-nduced error becomes hazardous. LAM users wll also receve ths warnng, though the sx-second alert tme s not nherently guaranteed. Ths secton descrbes two addtonal algorthms by whch LAM can guarantee a sx-second alert tme. The two algorthms are called the UIVE and UDRE montors. The UIVE montor protects aganst onosphere storms; the UDRE montor protects aganst CCD and SD events. The block dagram of Fg. 7 ndcates how these montors ntegrate nto LAM. A satellte must pass both montors to be processed by the LAM carrer-smoothng flter. A. UIVE Montor Although WAAS permts users to perform non-precson approach usng storm-affected satelltes, the LAM error bounds are too tght to permt operaton wth satelltes that mght be mpacted by an onosphere gradent. The LAM prevents users from navgatng wth these sgnals by applyng a threshold to the WAAS onosphere parameters for each satellte. Snce threatenng gradents only appear when GIVEI reaches the top of ts scale (values of 14 or 15), these ndex values could, n prncple, be used as a conservatve ndcator of the possble presence of severe onosphere gradents; however, standard WAAS recevers do not output grd data, but rather only a sngle, lumped onosphere parameter for each satellte. Accordngly, the LAM onosphere qualty threshold s defned usng ths lumped parameter: the User Ionosphere Vertcal Error (UIVE). UIVE 13. m; and IPP flag = "vald" (12) The UIVE s a lever-weghted average of the onosphere sgmas at the four corners of a geographc grd cell. The ratonale for the UIVE threshold and the IPP status flag test s developed n Secton VI. B. UDRE Montor WAAS does not provde dfferental correctons for satelltes on whch ts montors detect a CCD or SDM fault. The LAM nherently passes ths protecton on to ts users. Because of alert tme requrements, however, the LAM must apply addtonal screenng to prevent use of satelltes wth loose montorng thresholds. Loose thresholds ndcate rsng satelltes whch do not qualfy for precson approach. Thresholds become tghter as more WAAS recevers, abbrevated WAAS Reference Equpment (WREs), track a partcular satellte. Snce UDREI ncreases as the number of WREs trackng a satellte decreases, UDREI serves as a conservatve ndcator of WAAS montor thresholds. In order to ensure system ntegrty, the LAM must apply the followng UDREI cutoff, whch s elevaton dependent. 11, el 38 UDREI 8, el > 38 (13) The ntegrty mplcatons of (13), and of LAM restrctons on ground and user equpment, are dscussed n Secton VI. Range Reference, R σ pr_gnd,=ok PL H GPS Processng PR I=OK PRC I=OK Flter PRS =OK PRC =OK Range-Based or Poston-Doman Posn Montorng B =OK,k PL H1 Recever PRC =OK Posn WAAS Message Processng UIVE UIVE Montor = OK Key: PR: Pseudorange Measurement PRC: Pseudorange Correcton PRS: Smoothed Pseudorange UDRE UDRE Montor Fg. 7. LAM Block Dagram Includng UIVE and UDRE Montors

7 V. USER AND GROUND SEGMENT REQUIREMENTS To acheve the sx-second tme-to-alert requrement for Category I, LAM places certan restrctons both on the LAM ground faclty and on user recevers. No addtonal requrements (beyond those n the current LAAS MOPS [6]) are needed to mtgate the onosphere gradent threat; however, some addtonal requrements are necessary to protect users from SD and CCD faults. A. Ground System Requrements In addton to obeyng the UIVE and UDREI constrants (12) and (13), the LAM ground faclty must also meet the followng requrements n order to ensure system ntegrty. These constrants apply to parameters defned n pror papers [1, 2] and n the LAM Algorthm Descrpton Document [9]. The LAM ground faclty wll only approve satelltes that local recevers have tracked for at least 2 seconds. The Total-Transmsson-Tme (TTT) for a WAAS warnng message to reach the arborne user must not exceed 1 seconds. Ths budget ncludes the followng allowances. o Collect/process data at WAAS Master Staton: 4.8 s o From Master Staton to LAM through Geo: 1.4 s o o Process message at LAM:.8 s From LAM to User, allowng for mssed messages and user-recever processng: 3 s The LAM VPL must have a K bnd value of at least For CCD ntegrty, the mnmum value of the true user rangng error,σ pr,, must be at least.2 m. Ths error s the root-sum-square of the actual error assocated wth the ground montor, wth arcraft recever nose, and wth onosphere and troposphere decorrelaton nose. σ = σ + σ + σ + σ (14) pr, gnd, ar, ono, tropo, The evaluated user sgma must be large enough and the R max value small enough to support SDM ntegrty, as specfed by Table 1. The evaluated user pseudorange sgma, σ pr,, for any satellte,, s based on the broadcast values of the ground, onosphere and troposphere error terms. The tlde superscrpts ndcate broadcast values, whch may be nflated from the actual values of (14). σ = σ + σ + σ + σ (15) pr, gnd, ar, ono, tropo, The R max factor descrbes the rato of the true WAAS user error to the nflated user pseudorange sgma, σ pr, [1]. R max ( θ ) ( θ) σ true, = max over any θ of σ pr, (16) The true WAAS user error sgma, σ true,, s modeled n [11]. Mnmum σ pr, above 38 TABLE 1. CONSTRAINTS ON σ pr, AND R MAX Mnmum σ pr, at or below 38 Maxmum R max B. User Recever Requrements In order to ensure ntegrty for LAM users, the user recever desgn space must be constraned somewhat tghter than the LAAS and WAAS Mnmum Operatonal Performance Standards [6], [7]. These addtonal constrants are necessary for LAM to meet the tme-to-alert requrement for Category I. For SDM ntegrty, front-end flter bandwdth for the user recever must fall n the range of MHz; chp spacng, n the range of chp; and group delay n the range of ± 5 ns. Ths constrant s notably tghter than the user space for conventonal WAAS and LAAS. The step response of a tme-varyng user carrer smoothng flter must match the LTI flter descrbed by the LAAS MOPS (Secton ) wthn 1 seconds of a restart event and must have a step response bounded between the response of the nomnal LTI flter and the tme-varyng flter wth tme-constant equal to t t a. Ths restrcton lmts the sze of the error, E(t), from (5). The code-nose and multpath sgma term used for the arcraft recever must be as large or larger than the value gven by the AAD-B curve and must ncorporate a term that bounds nomnal dvergence errors. The requrement for a nomnal dvergence error term, σ dv,a, s consstent wth the LAAS MOPS [6]. The arborne error sgma that combnes the B-curve wth the dvergence sgma s gven below as a functon of elevaton, el. σ ar - el/1 - el/4 ( e ) + ( e ) + σ ( t t ) 2 dv, a a 2 2 (17) The dvergence error term s ntended to protect the user from nomnal onospherc dvergence n the event of a user smoothng-flter restart. Ths dvergence bound s dependent on the user carrer-smoothng flter step response, ut ( t a ), where t a s the flter restart tme. σ dv, a ( t ta ).18 1 u( t ta ) (18)

8 VI. MONITOR INTEGRITY For user recevers that meet the addtonal requrements of Secton V, t s possble to prove that the LAM UDRE and UIVE montors ensure the ntegrty of the user protecton level and the tme-to-alert requrement. A. UIVE Montor Integrty In valdatng the ntegrty of onosphere storm detecton va the LAM UIVE montor, the major ntegrty ssue nvolves the defnton of a threshold that operates on the lumped onosphere parameter, UIVE, rather than the grd vertex parameters (GIVEI) for each satellte. Tme-to-alert s a nonssue for onosphere montorng, snce onosphere storms develop slowly and snce WAAS publshes a conservatve onosphere descrpton whch s vald for the entre 5 mnute nterval between successve onosphere grd update messages. Hazardous gradents may occur f the GIVEI value at an Ionosphere Grp Pont (IGP) s 14 or 15. Fg. 8 shows an example of a potentally hazardous grd cell n whch one IGP has a GIVEI value of 14 (whch corresponds to a 45-meter GIVE sgma). Ths elevated GIVE level makes nearby LAM Ionosphere Perce Ponts (IPPs) unsafe to use [4]. In Fg. 8 the GIVE values were selected to llustrate a worst-case grd cell n whch all except the hazardous IGP have the mnmum-possble GIVE value. Ths floor value has an assocated GIVE sgma of 3. m (and a correspondng GIVEI = 9). For an IPP located roughly n the center of the cell, the resultng lumped UIVE s approxmately the average of the four GIVE values;.e., UIVE =.25 ( ) = 13.5 m. Therefore, a UIVE threshold of 13 meters excludes all IPPs that are n the grd cell quadrant closest to a stormregon IGP (GIVEI = 14). GIVEI values of 15 ( Not Montored ) represent cases where WAAS has nsuffcent measurements to guarantee the ntegrty of the onosphere correcton at an IGP. In ths case, the ablty of WAAS users to derve bounded onosphere error sgmas for nearby IPPs s governed by Secton A of the WAAS MOPS [7]. Brefly, that secton allows users to nterpolate ts onosphere correcton and UIVE for a gven satellte from three surroundng IGPs nstead of four f one (and only one) of the four has a GIVE of Not Montored. In ths case, nterpolaton from three IGPs s allowed f a trangle formed from the corners of the three IGPs that do not report Not Montored encloses the IPP for the satellte n queston. The LAM should use the same algorthm to determne whether or not t can derve a vald UIVE n ths stuaton. Fg. 9 llustrates an example of ths stuaton. If an acceptable trangle cannot be formed or f more than one IGP has a GIVE of Not Montored, then the UIVE s not defned. For ths reason, the UIVE decson rule, (12), ncludes a condtonal statement that excludes any satellte for whch the IPP flag s deemed nvald. GIVE 2 = 3. m GIVE 1 = 3. m Long 1 LAM IPP for SV j GIVE 3 = 45. m Long o Lat o Lat 1 GIVE 4 = 3. m Fg. 8. Example of GIVE Values whch Requre IPP Excluson but Generate Small LAM UIVE IGP 1 (GIVE 1 ) IGP 2 (GIVE 2 ) Long 1 LAM IPP for SV j IGP 3 (GIVE 3 ) Lat 1 IGP 4 (GIVE 4 ) Long o Lat o Fg. 9. LAM IPP for whch Vald UIVE can be derved f ether IGP 2 or IGP 3 s Not Montored B. UDRE Montor Integrty For Hazardous Msleadng Informaton (HMI) to occur due to a CCD or SD falure, the WAAS montor must fal to alert the user wthn the requred alert tme relatve to when the actual navgaton error exceeds the user protecton level. In order to valdate these tmng and protecton level requrements, ths secton draws on the tme-varyng condtonal rsk analyss of [13]. In analyzng the WAAS CCC and SD montors, t s convenent to ntroduce several subsectons that descrbe the mportant parameters for condtonal rsk analyss. 1) Relatve Detecton Tme (RDT): When a hazardous threat occurs, the LAM must provde a tmely warnng to the user. The allowed tme precedng that warnng s referred to as the Tme-to-Alert (TTA). For Category I approach, the Tme-to- Alert s sx seconds from the onset of HMI, whch occurs at the moment the faulted error exceeds the user protecton level. Ths defnton ntentonally defnes TTA relatve to the tme of HMI and not relatve to the onset of the threat. If the duraton between the onset of the threat and the moment of HMI s called the Tme-to-Hazard (TTH), then the total tme

9 allowed before the user must process the alarm message s TTA + TTH. In order to meet ths requrement, the Tme-to- Detect (TTD) the fault plus the actual Tme-to-Transmt (TTT) the alert must not exceed ths lmt. TTD + TTT TTH + TTA (19) In LAM, the TTT (1 seconds) exceeds the TTA (6 seconds). To preserve ntegrty, the LAM must make up the dfference through rapd detecton of the threat. The amount of tme that the montor must make up s called the Relatve Detecton Tme (RDT) [13]. RDT = TTA TTT = 4 second (2) 2) Integrty Rsk Allotment: Ths secton descrbes the ntegrty rsk allotment and the pror probabltes for the CCD and SD threats. The rsk allotments for each threat are a fracton of the total Category I ntegrty rsk tree budget of per 15 seconds. For both the SD and CCD threats equal allotments are assgned n the horzontal and vertcal drectons. Because the ntegrty rsk s greater n the vertcal drecton, the fact that the allotments are equal mples that system ntegrty can be ensured smply by demonstratng vertcal ntegrty. The system ntegrty tree assgns a vertcal rsk allotment, P a, of to SDM and to CCD montorng [1]. The rsk allotment, P a, must exceed the combned rsk that a fault occurs, that the fault-nduced error exceeds the user protecton level, and that a fault alert fals to reach the user wthn the requred RDT. Furthermore, the rsk of a user flter restart must also be consdered snce SD faults are more hazardous under restart condtons, as descrbed by (7), and snce CCD faults may only ntroduce HMI after a trackng restart. Relevant event probabltes are noted wth abbrevatons: F, fault occurs; MD, montor msses detecton; PL, error exceeds protecton level; R, user carrer-smoothng flter undergoes a hazardous restart; NR, user flter undergoes no restart or a non-hazardous restart. (,, ) (, ) PMD = P MD PL NR F PPL = P PL NR F PR = P( R F) P = P( NR F) = 1 P 1 NR R (21) The allotment allowed by the LAM ntegrty tree for ether CCD or SD must exceed the assocated condtonal rsks: ( ) P P P P + P P. (22) a MD PL NR R F Table 2 summarzes the rsk parameters for (22) assocated wth the CCD fault; Table 3, wth the SD fault. Values n each table are justfed n the remander of Secton VI. TABLE 2. SUMMARY OF CCD EVENT PROBABILITIES Descrpton Value P A Integrty Allotment for CCD P F Rsk of CCD on any vsble satellte per 15 s P R Rsk of hazardous user restart P LOI =P MD P PL Rsk of mssed detecton when error exceeds protecton level TABLE 3. SUMMARY OF SD EVENT PROBABILITIES Descrpton Value P A Integrty Allotment for SDM P F Rsk of SD on any vsble satellte per 15 s P R Rsk of hazardous user restart P LOI =P MD P PL Rsk of mssed detecton when error exceeds protecton level ) Restart Probablty, P F : The LAM does not use the standard LAAS fault pror probablty [14]. Rather, the LAM analyss uses a P F derved emprcally usng the methods descrbed n [9] and [15]. 4) Restart Probablty, P R : When a user recever starts or restarts trackng for a partcular satellte, carrer-smoothng s rentalzed. If such a restart occurs shortly after an SD event, then the navgaton soluton s mmedately affected by the full SD error. In the case of a CCD fault, no hazard wll result unless a user-flter restart also occurs. Not all user starts or restarts are hazardous. The restart probablty, P R, descrbes the lkelhood of only those restart events whch mght cause HMI. Restart events whch retan full ntegrty are lumped n wth the non-hazardous restart (NR) classfcaton. In fact, most trackng starts and restarts are non-hazardous because they occur durng the tme before the ground recever has frst approved the satellte. Accordng to the requrement of Secton V, the LAM ground faclty cannot approve any satellte whch has not been tracked for a 2 s duraton. Even restart events that occur for moderate or hgh-elevaton satelltes (because of a cycle slp or an arcraft maneuver) may be classfed as NR, as long as ther assocated errors do not exceed the protecton level and result n a montor mssed detecton. In fact, as demonstrated later n ths secton, only a certan range of user restart tmes pose an ntegrty hazard.

10 The hazardous restart probabltes, P R, descrbed by Table 2 and Table 3 are defned based on an assumed maxmum wndow of hazardous restart tmes, W, equal to 6 s for SD faults and 24 s for CCD faults. The relatonshp between W and P R s descrbed by the followng equaton, whch estmates the rate of user restarts (that occur outsde the 2 s wndow allowed for ground approval) to be once per day per channel. PR hour seconds = W day hour 1 (23) 5) Montor Probablty of Mssed Detecton, P MD : The WAAS CCC and SD montors detect faults wth a bounded mssed-detecton rsk, P MD. Ths rsk s a functon of tme, snce the fltered montor statstc generally grows larger as a functon of tme from the onset of the fault event. The P MD transent s dentcal for WAAS and for LAM, except that the transent s delayed n the case of LAM by the RDT. P MD s related to the relatve sze of the expected montor statstc m(t), the montor threshold T, and the montor nose level σ mon. These parameters were defned n Secton III by (8) (11). Assumng Gaussan overbound statstcs, P MD can be defned as follows by usng a Q functon, whch descrbes the cumulatve dstrbuton functon for a Normal dstrbuton. Note that the mssed detecton probablty s shfted n tme by the RDT. () () T m t T m t Pmd ( t RDT) = Q Q σ mon σ mon (24) Ths equaton represents the area of the Gaussan probablty dstrbuton ntegrated between postve and negatve thresholds. A graphcal representaton of P MD s depcted n Fg. 1. As the determnstc component of the montor metrc, m(t), grows larger than the threshold, the area of the ntegral becomes vanshngly small. PDF PDF(X mon -m(t)) Threshold Expected Montor State, m(t) Decson Statstc, X mon Fg. 1. Graphcal Representaton of P MD 6) Vertcal Protecton Level: For HMI to occur the faultnduced error must exceed the user error bound called the protecton level. Because the random component of the montor transent s ndependent from the fault-free user error the probablty of error exceedng the protecton level, P PL, s ndependent from the mssed-detecton probablty, P MD [13]. Because the vertcal ntegrty requrements are strcter than the horzontal, only the Vertcal Protecton Level (VPL) need be consdered. In LAM, the VPL s usually equal, and never less than, the user-evaluated expresson for the fault-free (H) case. Ths fault-free expresson s labeled VPL H. In LAM, by desgn, the user VPL s also always at least as large as a second error expresson labeled VPL LAM. Ths expresson reflects local montor operaton, whch estmates the dscrepancy between local measurements and WAAS correctons. Snce the user VPL s equal to or larger than both the VPL H and VPL LAM expressons, ether expresson may be used to evaluate P PL. In general, the VPL H expresson provdes more tolerance for large unobservable errors; however, the VPL LAM error bound offers the advantage that t tolerates larger observable errors and that t places no requrements on the ntegrty of the assumed WAAS error dstrbuton. LAM makes use of both the VPL H and VPL LAM error bounds. The VPL H expresson ncorporates a K ffmd factor whch represents the sgma multple boundng the rsk level permtted for fault-free navgaton. The K ffmd parameter value s specfed by the LAAS Interface Control Document (ICD) [16]. The sgma for the vertcal navgaton error, σ v, s the root-sum-of-squares of the broadcast pseudorange error sgmas, σ pr,, weghted by the lnearzed vertcal-poston soluton coeffcents, S v,. VPLH = K ffmdσ v (25) σ = S σ (26) 2 2 v v, pr, The VPL LAM expresson s smlar to the VPL H equaton, wth a reduced K-factor, K bnd, defned by the LAM ntegrty tree [1], and a sgma based on the actual error rather than the broadcast error sgmas. In addton, VPL LAM ncorporates a decson-statstc term, DS, whch descrbes the local montor s assessment of the qualty of the WAAS correctons. VPL = K σ + DS (27) LAM bnd v σ = S σ (28) 2 2 v v, pr, The decson statstc s the sum of the WAAS dscrepances, δ, measured for each satellte. DS = S δ (29) v, These dscrepancy values dfference the WAAS corrected pseudorange measurement, CPR, and the known range between the satellte and the LAM ground faclty, R. δ = CPR R (3)

11 7) Probablty of a Protecton Level Volaton, P PL : Under faulted condtons, CCD and SD errors are modeled as determnstc, transent bases, E(t), superposed wth fault-free Gaussan nose. Ths error can be compared to ether of the two protecton level expressons defned n the prevous secton, VPL H or VPL LAM, snce the arcraft uses a VPL that s as large as or larger than ether of these expressons. Dervng P PL usng the VPL H expresson requres a bound on the fault-free WAAS user error per satellte, descrbed by a Gaussan sgma, σ true, [11]. Usng ths user error bound, the one-tal probablty that the WAAS error exceeds VPL can be expressed n terms of a Q functon. Here, the determnstc rangng error, E(t), s projected through the senstvty weghtng, S k, for the faulted satellte, k. P pl VPLH + Sv, k E() t = Q 2 2 Sv, σ true, (31) In order to smplfy ths equaton, t s convenent to substtute the R max parameter for σ true, usng the notaton of (16). 2 2 Sv, σ true, R maxσ v (32) Applyng bound (32) and defnton (31), the followng P PL results. P pl K ffmdσ v + Sv, k E() t Q R maxσ v Ths equaton represents the rsk of exceedng VPL H. (33) It s also possble to derve P PL usng VPL LAM. Ths approach dstngushes between observable errors, whch appear n DS, and unobservable errors, whch do not appear n DS. The total vertcal error, E v, s the sum of the observable error, E v,o, and the unobservable, E v,u. E = E + E (34) v v, o v, u The LAM decson statstc, DS, estmates the vertcal observable error subject to montorng nose. Ths error s bounded by the normal dstrbuton, N, wth devaton, σ v [9]. ( ) ( vo,, v) p DS = N E σ (35) The fault s not hazardous f VPL LAM exceeds the total vertcal error. An expresson for ths ntegrty condton s VPL = K σ + DS E + E. (36) LAM bnd v v, o v, u Applyng the trangle nequalty, a strcter form of ths condton may be derved. DS E + E K σ (37) v, o v, u bnd v Based on the probablty dstrbuton (35), the one-tal rsk that condton (37) s not met s E Ppl Q Kbnd + σ v vu,. (38) Because of the low probablty of a satellte fault, the unobservable error need only be consdered on a sngle satellte. Thus the unobservable vertcal error may be expressed n terms of the unobserved rangng error, E u (t), for a sngle faulted satellte. Ppl Q Kbnd + Svk, Eu() t σ v (39) In both the VPL H and VPL LAM cases, (33) and (39), geometry can be removed from the P PL expresson by fndng the worst-case value of P PL over all geometres. In both cases ths worst-case occurs when the random error on the faulted satellte domnates over all other random error terms [13], [17]. In ths case, the P PL expressons may be smplfed as follows. P pl Kffmd + E()/ t σ pr, k Q R max ( ()/, ) pl bnd u pr k for VPL H (4) P Q K + E t σ for VPL LAM (41) 8) Loss of Integrty Rsk, P LOI : For a loss of ntegrty to occur, the product P MD P PL must not exceed the rsk allocaton specfed by Table 2 and Table 3. Ths rsk allocaton s referred to as the Loss of Integrty Probablty, P LOI. The P LOI requrement can ether be evaluated as a probablty test or as a test based on the Maxmum Allowable Error n Range (MERR) as descrbed n [13]. Both tests are equvalent. As a frst step n testng that the product P MD P PL does not exceed P LOI, t s convenent to consder cases n whch no user-flter restart occurs. In these cases, SD faults can cause HMI, but CCD faults cannot. To valdate montor ntegrty, P MD P PL must be tested for every threat n the SD threat space. Ths computaton s sgnfcantly smplfed usng the MERR methodology of [13], whch allows drect computaton of the worst allowable steady-state error, E ss, for any value of the montor statstc, m ss. The resultng contour s plotted for UDRE 8 (all elevatons) n Fg. 11 and for UDRE 11 (low elevatons) n Fg. 12. Because the MERR contour s greater than all the threat ponts on ths plot of E ss vs. m ss, ntegrty s verfed for all threats n the SD threat space at least for all cases wthout a user-recever restart.

12 To complete the threat analyss, P MD P PL must also be assessed consderng user flter restarts. The space of user flter restarts s descrbed by the restart tme, t a. Ths parameter descrbes the tme dfference from the ntal occurrence of the fault to the moment at whch the user recever re-ntalzes trackng on the faulted satellte. Snce the user flter s requred to converge to the nomnal flter wthn 1 s, the lowest restart tme whch need be consdered s t a = -1 s, whch corresponds to the case n whch the user flter converges at the same moment the fault occurs. The largest relevant value of t a corresponds to the moment (tme shfted by the RDT) at whch P MD falls equal or below P LOI. After ths moment, labeled t max, the montor assumes full responsblty for user ntegrty. For values of t a larger than t max, the user receves an alert mmedately after the restart occurs, such that no HMI results. Hence, the lmts for t a are the followng. (42) 1 ta tmax Restart events for whch P MD P PL does not exceed the P LOI allocaton are grouped n the NR category, whch descrbes both non-hazardous restarts and non-restart faults. Cases for whch P MD P PL exceeds P LOI for some perod of tme are deemed hazardous restarts and placed n the R category. In ths manner, restart threats can be classfed as ether R or NR. Fg Fg. 15 classfy the threat space for SD and CCD by category (NR or R). The frst two of these fgures llustrate the SD threat space for the case of UDRE 8, all elevatons (Fg. 13) and the case of UDRE 11, low elevatons (Fg. 14). Although the full threat descrpton s three dmensonal, consstng of E ss, m ss, and t a, these plots represent the NR and R classfcatons n two-dmensons, by llustratng the worst error for all possble values of montor statstc, m ss. Fg. 15 llustrates the threat space for the CCD fault. In contrast wth the SD fault, the parameter space descrbng CCD faults s unbounded, as the dvergence parameter, d, can take any postve value. Error ss (m) Dscretzed Threat Space Infnte-TTH Contour m ss / σ mon Fg. 12. Integrty for SD wth UDREI 11, Elevatons to 38, No Restart 9) Hazardous Restart Wndow, W: The probablty of a hazardous restart was derved assumng a bound, W, on the wndow of hazardous restart tmes. For SDM, the upper bound on W was taken to be 6 s. As seen n Fg. 13, the shaded wndow of hazardous restarts, R, has a 21 seconds duraton (-5 s t a 16 s). From Fg. 14, the wndow of hazardous restart events has a duraton of 24 seconds (-6 s t a 18 s). Thus for both UDRE cutoffs, the wdth of the R regon meets the W requrement by a factor of more than two. Error Magntude, E ss (m) NR Threat Space HMI Volatons Sgnal Deformaton Occurs R Restart Tme, t a (s) 4 35 Dscretzed Threat Space Infnte-TTH Contour Fg. 13. Classfcaton of SD Threats wth Restart and UDREI Error ss (m) Error Magntude, E ss (m) NR Threat Space HMI Volatons Sgnal Deformaton Occurs R m ss / σ mon Restart Tme, t a (s) Fg. 11. Integrty for SD wth UDREI 8, All Elevatons, No Restart Fg. 14. Classfcaton of SD Threats wth Restart and UDREI 11

13 Restart Tme, t a (s) NR R VII. AVAILABILITY IMPACT As shown n the prevous secton, the UDRE and UIVE montors, (12) and (13), provde full ntegrty for LAM users through onosphere, CCD and SD faults. Unfortunately, the UIVE and UDRE parameters are not drect ndcators of WAAS montor performance. Both the UDRE and UIVE parameters may ncrease because of poor data qualty or because of other WAAS real-tme montorng. For ths reason, the applcaton of the LAM UIVE and UDRE montors results n a sgnfcant number of false postve detectons. These false postves have a detrmental mpact on the contnuty and avalablty that can be acheved by LAM Wndow Duraton (s) Dvergence Rate, d (m/s) Fg. 15. Classfcaton of CCD Threats as NR or R Dvergence Rate, d (m/s) T a,max +1 Wndow Duraton Fg. 16. Duraton of Hazardous Restart Wndow for CCD Threats For CCD, the upper bound on W was taken to be 24 s. Fg. 15 shows that the restart wndow stretches as wde as 93 s at the far left of the plot, where d = 4 m/s. Although the wndow of hazardous restarts worsens for hgher values of d, t cannot be larger than 1 + t max, the range allowed for the t a parameter accordng to (42). As evdenced by Fg. 15 and Fg. 16, ths upper bound on the hazardous restart tme decreases wth ncreasng d. Thus, the wndow of hazardous restarts cannot exceed 1 + t max evaluated at the rght hand sde of the fgures (d = 4 m/s ). At ths pont, 1 + t max = 17 s. Thus for the CCD fault mode, the maxmum length restart wndow s at most 17 s, whch s better than a factor of two below the 24 s requrement. Snce all rsk budgets outlned n Table 2 and Table 3 are met for the SD and CCD threat space, the combned rsk probabltes satsfy (22). Accordngly, the ntegrty of the UDREI montor, (13), s valdated for all threats n the SD and CCD threat spaces. A set of nne normal days were nvestgated to assess the false-detecton performance of the UIVE and UDRE montors. These data were acqured by the Wllam J. Hughes FAA Techncal Center n Atlantc Cty, NJ. On typcal days, UIVE montor detectons generally occurred for satelltes at low elevatons, where WAAS had nsuffcent data to verfy onosphere condtons. Ths effect s partcularly pronounced on the East Coast of the Unted States, where many rsng satelltes are observed and where the coverage of the WAAS onosphere grd s sparse. UDRE montor detectons generally occurred for satelltes at hgh elevatons, when anomalous UDRE spkes were observed n the WAAS data. Characterstc hgh-elevaton UDRE spkes are llustrated n Fg. 17. A UDRE montor alert occurs whenever the sold blue curve (receved UDREI parameter) exceeds the dashed red curve (UDREI threshold for the satellte n queston). UDREI spke anomales have been observed and dscussed by the WAAS Integrty Performance Panel. These spkes are not necessary to ensure WAAS ntegrty and may be fxed n an optonal WAAS upgrade. Although these spkes have a neglgble mpact on WAAS performance, they result n a non-neglgble contnuty and avalablty penalty for LAM. PRN 4 PRN UDREI Tme (hours) Fg. 17. Normal UDREI Data (PRN 4) and UDREI Spkes (PRN 11)