ARAIM Fault Detection and Exclusion

Transcription

1 ARAIM Fault Detection and Exclusion Boris Pervan Illinois Institute of Technology Chicago, IL November 16,

2 RAIM ARAIM Receiver Autonomous Integrity Monitoring (RAIM) uses redundant GNSS measurements for fault detection and exclusion (FDE). Today s RAIM uses single frequency GPS signals only, supports enroute and terminal phases of flight (e.g., RNP 1), and is based on fixed assertions (since 1995) regarding GPS nominal performance and fault rates. 2

3 RAIM ARAIM Advanced RAIM (ARAIM) will use multiple constellations and dual frequency signals meet more stringent navigation requirements (e.g., RNP 0.1 and LPV 200) involve deeper threat analysis (e.g., including multiplesatellite and constellation-wide faults) incorporate an Integrity Support Message (ISM) ISM parameters (e.g., P sat, P const, σ URA, ) based on constellation service provider (CSP) commitments and ANSP offline monitoring. ANSPs can add new constellations as they become available, and improve ISM parameters over time. 3

4 Future Multi-Constellation GNSS GPS Joint Constellation GLONASS Galileo 25 to 35 visible SVs at all times Beidou 4

5 Future Multi-Constellation GNSS Better accuracy and greater redundancy for integrity monitoring. Higher probability of having faulted satellites. 5

6 ARAIM Requirements For RNP 0.1, the actual continuity risk requirement is dependent on traffic density and airspace complexity /hour is suitable for areas where many aircraft use the same service and additional navigation tools are not available /hour can be used for the areas of high air traffic density and airspace complexity, but backup means exist to mitigate LOC impact. We assume this requirement in the examples that follow. 6

7 Integrity and Continuity The satellite fault rate for GPS is specified as R SAT = 10-5 /SV/hr = /SV/approach (where approach = 150 sec). Clearly fault detection is needed for integrity (requirement is 10-7 per hour or approach) for both RNP 0.1 and also for LPV-200. Q: After detection, is fault exclusion also needed for continuity? For horizontal navigation with RNP 0.1, yes, because even (1 SV) R SAT = 10-5 /hr > 10-6 /hr (the continuity requirement). For vertical + horizontal navigation with LPV-200, it s not as clear: requirement is /15 sec and R SAT = /SV/15 sec. So it depends on the number of visible SVs. Also on the prior probability of constellation faults. 7

8 Need for V-ARAIM Exclusion? Fault state probabilities P sat and P const are fault rates CSP meantime to notify users ( 1 hr for GPS). GNSS1 P sat = 10-5 P const = 10-4 Pconst GNSS2 P sat vs. P const Exclusion Required Exclusion Not Required 4.79* Psat 8

9 Need for V-ARAIM Exclusion? 3-GNSS 4-GNSS GNSS3 GNSS / 10-4 GNSS4 GNSS / / / / / 10-4 Assuming: 8 satellites in view for each constellation continuity risk requirement can be met: exclusion not needed continuity risk requirement cannot be met: exclusion is needed Exclusion is required in V-ARAIM to meet the LPV-200 continuity risk requirement when using 4 constellation (possibly 3 also). 9

10 Other Sources of LOC Radio-frequency interference, ionospheric scintillation a continuity risk allocation i.e., margin needs to be defined to account for these events (applies to SBAS and GBAS too) Scheduled satellite outages CSP notifies users in advance, so these need only impact availability (unless users choose not to check, then continuity) Unscheduled satellite outages (USO) Probability of an SV USO: P O = /SV/hr Can sometimes result loss of continuity (LOI) if it leaves an inferior SV geometry causing Protection Levels (PL) to exceed alert limits (AL) 10

11 Other Sources of LOC Monitor False Alarms (FA) Probability of FA (P FA ) is controllable by setting detection thresholds properly. At least this one should be easy, right? sadly, no. Autocorrelation (over time) of measurement error is critically important to P FA and LOC. Let s take a look at the P FA problem over an exposure interval of 1 hour. e.g., for RNP 0.1 H-ARAIM 11

12 User Error: Multipath and Noise Boeing 787 Flight Data: composite of autocorrelation traces: Raw code minus carrier (ionosphere removed) Traces with very long correlation are caused by antenna group delay. Average m U 0 s U 0.38 m t U 14 sec data courtesy of Matt Harris (Boeing) 12

13 User Error: Multipath and Noise Raw multipath and noise is affected by carrier-smoothing of the code. The assumed filter time constant is τ F = 100 sec. Iono-free scale factor: κ f L1 4 + f L5 4 f L1 2 f L5 2 2 User error autocorrelation function: τ 2 U R U t = κ σ U τ 2 2 τ F e t Τ τ F τ U e t Τ τ U F τ U 13

14 mean satellite elevation (deg) sigma tropo (m) Tropospheric Error From RTCA DO 229E, Appendix R, Section R.4.1 Tropospheric error shall be modeled using a first-order Gauss- Markov process with a 30 minute correlation time (t T ). The sigma shall be scaled per the tropo residual error sigma equation defined in Appendix A, Section A [see plot below] Note: The 30 minute correlation time representative of a typical storm system passing through. 36 satellite elevation: mean over time and longitude 1.4 DO 229E Tropo Error Model R T t = σ 2 T e t Τ τ T deg global mean elevation s T 0.22 m latitude (deg) satellite elevation (deg) 14

15 GPS Satellite Orbit/Clock Error We use radial-minus-clock autocorrelation data averaged over all GPS satellites. Examples below for two satellites: data courtesy of Todd Walter (Stanford University) s 0.5 m Cesium regions of interest Rubidium 15

16 How to compute P FA Define: n is the number of tests in the time interval nδt, where Δt is the sample interval. Then, P FA n, k FA = 1 1 2Φ k FA 1 P Δ k FA 1 2Φ k FA n 1 and P Δ k = 1 π exp k FA 2 2 acos R Δt R 0 For example, for Δt = 10 sec: ORB/CLK USER TROPO TOTAL R(0) [m 2 ] R(Dt)/R(0) [1] Pervan, B., et al., Test Statistic Auto- and Cross-correlation Effects on Monitor False Alert and Missed Detection Probabilities, Proc ION ITM, Monterey, CA, January

17 Prob of false alert over 1 hour P FA over 1 hour 10 0 R S (0) = (0.5m) 2 sigma-cont = sqrt(r S (0)+R U (0)+R T (0)) 0.5 sec sample interval x one sample all epochs independent actual P FA k *sigma-cont fa k FA 17

18 H-ARAIM P FA Observations Although time constant of dominant error source (SV orbit and clock) is > 6 hours P FA over 1 hour is much larger (about 200 times greater) than for a single test. Effectively independent samples come approximately every 15 sec! The results are nearly the same even if user and tropo and user errors are removed. 18

19 Continuity Risk Equation Account for all USO events [2]: Dk, Ek Ok PO POther O k : k = 0, 1 N O, means USO on satellite subset k. (k = 0 is outage-free.) Account for fault hypotheses under O k : P LOC N 0 PLOC P k N H k 0 i 0 k 0 0 k k, Ek Hi, Ok PH PO POther P D (Controllable by Setting FDE Thresholds) H i : i = 0, 1 H k, are all fault mode combinations under USO condition O k. i k [2] Zhai, Y., Joerger, M., Pervan, B., Bounding Continuity Risk in H-ARAIM FDE, Proc. of ION 2017 Pacific PNT Meeting, Honolulu, Hawaii, May 2017, pp

20 kikj Integrity: Predictive PL FDE Predictive Protection Level called Exclusion Level in WAAS MOPS DO-229E NH H PL FDE b PL j FDE bji T k kk, Dji k, kk, Q Q PPI k 2 s k kk s s isjs 0k k 00 j j i 1 ji, account for all fault conditions account for all outage conditions Hi ORE With this approach, the predictive PL FDE is computed by weighing all outage events with their prior probabilities. 20

21 be simultaneously met. However, the average VPL in Fig. 8 is decreased in comparison with Fig. RNP 0.1 Availability the cost of reducing continuity risk by exclusion function. Using GPS + Galileo with Detection and Exclusion Overall H-ARAIM Availability for RNP 0.1 by Only Accounting for Single SV USO re 3, the availability results in Figure 4 account for multiple-satellite USO. The availability is completely ical satellite approach because of the impact of critical satellite pairs, i.e.,!! > 3 at many snapshots. Fig. VPLas map four-constellation V-ARAIM detection age 8level in using Figure 3 can still be maintained with theand newexclusion. method. assuming no USO USO accounted for Coverage (0.995) = 96% Coverage -ARAIM availability map using dual-constellation ARAIM detection and exclusion. (0.995) = 90% 21

22 Summary and Way Forward Advanced RAIM (ARAIM) multiple constellations and dual frequency signals more stringent navigation reqts (e.g., RNP 0.1 and LPV 200) deeper threat analysis (e.g., multi-sv and constellation faults) Integrity Support Message (ISM) ARAIM Fault Detection and Exclusion Detection function is always needed for integrity Exclusion function is not always needed for continuity It depends on the operation, no. of satellites, and fault prior probabilities. Must also carefully account for additional integrity risk when exclusion is implemented. 22

23 Summary and Way Forward Unscheduled Satellite Outages must be accounted for: they affect ARAIM continuity and availability P FA is much higher than expected Time correlated errors can have a surprisingly large number of effectively independent samples for threshold crossing Integrity/Continuity Risk (and PL) equations are derived Availability simulations show excellent worldwide coverage for RNP 0.1 Next steps LPV 200 analysis accounting for all of the above ISM generation and offline motor architecture and algorithms Airborne and Offline Monitor ARAIM prototypes 23

24 Acknowledgement I would like to thank the U.S. Federal Aviation Administration for sponsoring this work. 24

25 Prob of false alert over 1 hour Example P(FA) Problem hour noise time constant 1st order GMRP 10-2 Actual Single test approximation k fa 25

26 P(FA) Simulation: 10 Runs 26

27 P(FA) Simulation: 10,000 Runs 27

28 Prob of false alert over 1 hour P(FA) vs. Noise Time Constant 10-2 P FA /hr versus noise correlation time 1st order GMRP 10-3 k = noise correlation time (hours) 28