1. INTRODUCTION
Multi-constellation Global Navigation Satellite Systems (GNSS) will provide users with a large number of satellites, which can potentially lead to significantly improved navigation performance. This is especially true for systems using Receiver Autonomous Integrity Monitoring (RAIM), which relies on satellite redundancy for fault detection. A significant amount of research has been focused in recent years on exploiting this extra redundancy to help ensure integrity for vertical guidance of aircraft for precision approach. The methods and algorithms intended to serve this purpose are collectively referred to as Advanced RAIM (ARAIM).
To guarantee that the underlying assumptions made by airborne ARAIM algorithms are valid, an Air Navigation Service Provider (ANSP) ground network must monitor the performance of each GNSS constellation. Each Constellation Service Provider (CSP) may have its own ground monitoring infrastructure to ensure consistency to its own performance commitments, but this will not necessarily be sufficient to satisfy ARAIM algorithm requirements. For example, the Global Positioning System (GPS) currently does not intend to guarantee specific limits on certain key ARAIM parameter values. The ANSP commitment, on the other hand, may be tailored as needed to specific aviation requirements.
ANSP ground monitoring architectures can generally be categorised as either “online” or “offline.” These monitor systems both communicate with aircraft by means of an Integrity Support Message (ISM). The main difference is the update frequency of the ISM, with online systems typically requiring the refresh of certain parameters in the timescale of hours, and offline architectures in the order of many days (or even months). Offline ANSP systems would perform long term monitoring to validate that the CSP performance meets ARAIM requirements. This method is particularly useful for ISM parameters that describe nominal GPS errors and biases. However, it is doubtful that such methods would be sufficient for parameters relating to satellite faults, which are too rare to validate by empirical means alone. Online monitors, in contrast, can be designed expressly to ensure the validity of these ISM parameters.
This work focuses on two critical ISM parameters: P sat, which designates the prior probabilities of satellite faults, and b max, which is a range domain bound on small faults that may occur at probabilities higher than P sat. We describe an online ANSP ground monitor architecture that directly validates b max and P sat. A fundamental principle behind the architecture is that the ISM parameter b max is directly related to the value of P sat. We quantify the ground monitor performance by its Mean Time To Detect (MTTD), with large faults being easier to detect and consequently having smaller MTTDs. When detection occurs, the aircraft is notified in the next regularly scheduled ISM broadcast, which happens at the Time to Integrity Alert (TIA) interval. We then show that, given the presence of the ANSP ground monitor function, the state probability of the aircraft being exposed to a satellite fault at any arbitrary time is related to the MTTD, TIA and Mean Time Between Failures (MTBF). As an example ground monitor implementation, we design a ground monitor to detect Inter-Frequency Bias (IFB) faults and Code-Carrier Divergence (CCD) faults using Cumulative Sum (CUSUM) monitoring techniques. We show how the performance specifications of the ground monitor can be used to establish values for b max and P sat that the aircraft may safely use.
2. GROUND-BASED DETECTION TO SUPPORT AIRBORNE INTEGRITY MONITORING
As discussed above, the purpose of the ARAIM ground architecture is to establish and validate the ISM parameters needed to compute meaningful protection levels at the aircraft. The airborne Vertical Protection Level (VPL) equation that ARAIM uses under the hypothesis of a satellite fault is (EU-US Report, 2012)
$$VPL_f = T\left( {b_{nom}, \sigma _{URE}} \right) + \left\vert {\bi S} \right\vert b_{max} + K_{md} \left( {P_{sat}} \right)\sigma _v (\sigma _{URA} )$$where {T, b nom, σURE, bmax, σ URA, and P sat} are parameters carried in the ISM. (Typically an additional parameter, P const, the prior probability of a constellation wide fault is also included in this list. In this work we conservatively assume that the P const = P sat, so it does not need to be explicitly represented.) In Equation (1), T is the ARAIM (aircraft) detection threshold, which is related to the bound on nominal bias (b nom) and to the user range error standard deviation (σ URE). The matrix S is the least squares estimator matrix which is computed from the pseudo inverse of the observation matrix for the subset solution, σ v is the vertical estimate error standard deviation which is related to the user range accuracy standard deviation (σ URA). For more details on the derivation of Equation (1) and on the terms included in Equation (1), the reader is referred to EU-ES Report (2012).
σ URA and σ URE are derived from nominal error distributions and can be established and monitored using offline monitoring. The same is true for b nom, which captures errors due to nominal effects such as signal deformation, code-carrier divergence, inter-frequency biases, etc. As an alternative to offline monitoring of these three parameters, the ground architecture can be designed to perform orbit ephemeris re-estimation and overlay (by providing the aircraft with new, precise ephemerides in the ISM). This would undoubtedly require greater computational complexity at the ground system, but the potential benefit would be that the ISM parameters b nom, σURA, and σ URE can be directly controlled by the ANSP.
In Equation (1), b max represents small faults (not nominal errors like b nom) that are more likely to be observed at the aircraft than P sat. Given any ground monitor, ANSP or CSP, small faults will be more difficult to detect than larger faults. Therefore the probability that the aircraft is exposed to a fault of a given magnitude will decrease as the magnitude of the fault increases. The airborne ARAIM monitor cannot protect against faults that have higher prior probabilities than the ISM value of P sat, so the impact of these smaller faults is directly accounted for in the position domain in Equation (1) using the projection matrix S. P sat is the upper bound probability of failure that the airborne ARAIM algorithm uses for all faults larger than b max.
In the EU-US Report (2012) the following satellite faults are identified as specifically relevant to ARAIM: satellite clock and orbit ephemeris faults, CCD faults, IFB faults, antenna bias faults, and signal deformation faults. To address these faults, in this work an online ground monitor system is considered. The probability of the ground monitor not alerting the aircraft (P f) is related to the fault magnitude b f. For example, the ground monitor may detect larger bias faults much faster than small faults. The meaning of P sat can be directly interpreted as an upper limit on the probability of a fault of magnitude larger than b max impacting the aircraft without having been alerted by the ground. The online ground monitor is designed to guarantee a specific value of P sat for faults larger than b max.
Given the VPL equation in Equation (1), Figure 1 illustrates that any ground monitor, regardless of being online or offline, must satisfy the step-shape requirement curve in Figure 1 in order for the airborne VPL equation to be meaningful. Next, we will derive a formula that relates P f to b f.
Illustration of the acceptable ground system performance requirement for P sat and b max.
3. ONLINE GROUND MONITORING
The exponential distribution is widely used in the field of reliability engineering as a model of the time to failure of a component or system (Montgomery, Reference Montgomery2008). If we consider the Poisson distribution as a model of the number of faults (x) in the time interval (0, T] with a fault rate of (1/MTBF), then the probability of x occurrences is
$$p\left( x \right) = \displaystyle{{\left( {\displaystyle{T \over {MTBF}}} \right)^x \exp \left( { - \displaystyle{T \over {MTBF}}} \right)} \over {x!}}$$The choice of MTBF is a foundational assumption, so it is important that a conservative value be chosen. The specific value used for the examples in this work is 104 hr/SV for satellite faults of all kinds, which is consistent with the fault rate used in the Local Area Augmentation System (LAAS) Minimum Aviation System Performance Standards (MASPS) (RTCA, 2004). It is more conservative by a factor of ten than the integrity fault rate specified in the GPS Standard Positioning Service Performance Specification (GPS-SPS PS) (U.S. Department of Defence, 2008). However, the GPS-SPS PS fault rate is only guaranteed for ranging faults greater than ten metres.
Let Y be a random variable representing the interval to the first occurrence of a fault. The probability of at least one fault occurring in the interval (0, T] is equivalent to the probability of Y < T, which can be expressed using Equation (2) as
$$P\left( {Y \lt t} \right) = 1 - P\left( {Y \gt t} \right) = 1 - p\left( 0 \right) = 1 - \exp \left( { - \displaystyle{T \over {MTBF}}} \right)$$Equation (3) is used as a basis to describe the relationship between P f and b f.. For any given satellite, P f is a state probability that there exists a fault of magnitude b f and that the aircraft is not alerted of that fault. Let the mean time to detect a fault of magnitude b f by the ground monitor be referred to as MTTD. P f can be evaluated using Equation (3) by replacing the period T with the total time the aircraft is exposed to the fault, which can be expressed as the sum of MTTD and TIA:
$$P_f (b_f ) = 1 - \exp \left( { - \displaystyle{{MTTD\left( {b_f} \right) + TIA\;} \over {MTBF}}} \right)$$Notice that although the ground monitor requires time to detect the failures and alert the aircraft, the ARAIM time to alert requirement is implicitly satisfied by the airborne detection algorithm (i.e., the delay between airborne detection and alert is negligible). The purpose of the ground monitor layer is to ensure that the airborne assumptions on b max and P sat are satisfied.
The proposed ground monitor operates continuously, but it only requires ISM update intervals in the order of an hour, as will be shown later. Because continuous communication with the aircraft is not necessary, a Geosynchronous Earth Orbit (GEO) satellite datalink may not be required, and a variety of other choices for data dissemination may be feasible, including existing ground-to-air communication data channels or VHF Data Broadcast (VDB) at the terminal airport. In this latter case, the ISM message itself may be rebroadcast through VDB more frequently than it is refreshed to provide continuous service to all incoming aircraft. Furthermore, the use of the VDB infrastructure may facilitate future upgrades, for example to CAT-III capabilities using the Ground Based Augmentation System (GBAS).
4. EXAMPLE GROUND MONITOR DESIGN AND IMPLEMENTATION
In this section, we develop an example set of ground monitors against satellite CCD and IFB step faults. Monitors to detect other satellite faults such as satellite orbit and clock faults, satellite bias faults and signal deformation faults will be addressed in future work. For CCD and IFB faults, a test statistic is formed by computing, for each satellite, the geometry-free, ionosphere-free measurement z′ obtained using the following equations:
$$\rho _{NL} = \left( {\displaystyle{{\rho _{L1}} \over {\lambda _{L1}}} + \displaystyle{{\rho _{L5}} \over {\lambda _{L5}}}} \right)\left( {\displaystyle{{\lambda _{L1} \lambda _{L5}} \over {\lambda _{L1} + \lambda _{L5}}}} \right)$$
$$\phi _{WL} = \left( {\displaystyle{{\phi _{L1}} \over {\lambda _{L1}}} - \displaystyle{{\phi _{L5}} \over {\lambda _{L5}}}} \right)\left( {\displaystyle{{\lambda _{L1} \lambda _{L5}} \over {\lambda _{L5} - \lambda _{L1}}}} \right)$$
$$z\hskip1pt\prime = \phi _{WL} - \rho _{NL} $$where ρ L1, ρ L5 and ρ NL are the pseudorange measurements for L1, L5 and for the narrow-lane combination, respectively; ϕ L1, ϕ L2 and ϕ WL are the carrier phase measurements for L1, L5 and for the wide-lane combination, respectively; and λ L1, and λ L5 are the L1 and L5 signal wavelengths (λ L1 = 19.05 cm and λ L5 = 25.48 cm).
Under fault-free conditions, the subtraction in Equation (7) eliminates all geometry-related, atmospheric and otherwise common error terms. It results in a widelane bias n WL that is related to the widelane carrier phase cycle ambiguities, and in a noise term ε z that is dominated by thermal noise and multipath errors (McGraw, Reference McGraw2009), (Misra and Enge, Reference Misra and Enge2001) and (Khanafseh, Reference Khanafseh2008). In the presence of an IFB or CCD fault, the IFB fault bias (b IFB), CCD fault bias in the L1 measurement (b CCDL1) and CCD fault bias in the L5 measurement (b CCDL5) can be directly observed by z′ as expressed in the following equation:
$$z\hskip1pt\prime = \lambda _{WL} n_{WL} - \displaystyle{{2\lambda _{WL}} \over {\lambda _{L1} + \lambda _{L5}}} b_{IFB} - \displaystyle{{\lambda _5} \over {\lambda _{L1} + \lambda _{L5}}} b_{CCDL1} - \displaystyle{{\lambda _1} \over {\lambda _{L1} + \lambda _{L5}}} b_{CCDL5} + \varepsilon _z $$If the satellites are continuously tracked (e.g., with overlap between successive ground stations), the bias term n WL in Equation (8) can be directly estimated by filtering and removed from z′ to provide the test statistic z in Equation (9).
$$z = z\hskip1pt\prime - \lambda _{WL} n_{WL} = \displaystyle{{2\lambda _{WL}} \over {\lambda _{L1} + \lambda _{L5}}} b_{IFB} - \displaystyle{{\lambda _5} \over {\lambda _{L1} + \lambda _{L5}}} b_{CCDL1} - \displaystyle{{\lambda _1} \over {\lambda _{L1} + \lambda _{L5}}} b_{CCDL5} + \varepsilon _z $$We assume that the likelihood of multiple simultaneous faults of different types on the same satellite (e.g., CCD and IFB) is negligibly small relative to the integrity risk requirement. It follows that the single test statistic z provides detection capability against all three faults.
To monitor against CCD and IFB faults using the test statistic z, a Cumulative Sum (CUSUM) monitor is considered. The performance of CUSUM is generally better (providing the shortest MTTD) than that of a direct mean estimator to detect bias shifts (Lee et al., Reference Lee, Pullen, Xie and Enge2001; Pullen et al., Reference Pullen, Lee, Xie and Enge2003; Hawkins and Olwell, Reference Hawkins and Olwell1998).
CUSUM monitoring, introduced in the 1940s by Wald (Hawkins and Olwell, Reference Hawkins and Olwell1998), uses a log-likelihood ratio test to detect mean and variance shifts. It is widely used in quality control, operational research, and manufacturing engineering. Lee et al. (Reference Lee, Pullen, Xie and Enge2001) and Pullen et al. (Reference Pullen, Lee, Xie and Enge2003) proposed using the CUSUM monitor to detect mean and variance shifts in GPS reference receiver measurements (B-values) for LAAS. Readers interested in the theoretical background of the CUSUM monitor and its design are referred to Hawkins and Olwell (Reference Hawkins and Olwell1998) and Basseville and Nikiforov (Reference Basseville and Nikiforov1993).
The upward and downward mean shift monitor test statistics of the CUSUM monitor for satellite m at epoch j (z m(j)) are, respectively (Hawkins and Olwell, Reference Hawkins and Olwell1998):
$$C_m^ + \left( {\; j} \right) = {\rm max}(0,C_m^ + \left( {\; j - 1} \right) + z_m \left( {\; j} \right) - k_\mu ^{} $$
$$C_m^ - \left( {\; j} \right) = {\rm min}(0,C_m^ - \left( {\; j - 1} \right) + z_m \left( {\; j} \right) + k_\mu ^{} $$The initial values for C + and C – are selected to be zero in the standard CUSUM implementation. A CUSUM monitor can be defined to provide the fastest possible MTTD, but only for a specific fault magnitude b f*. So designed, the monitor would not guarantee the fastest MTTD for other fault magnitudes. To address this issue, let the constant k μ in Equations (10) and (11) be derived based on a designated value of b f*. k μ is given by (Hawkins and Olwell, Reference Hawkins and Olwell1998):
$$k_\mu = \displaystyle{{b_f^*} \over 2}$$In order to achieve short MTTD for a wide range of fault magnitudes, we design three CUSUM monitors for different values of b f* = [0.01, 0.2,1] σ z, where σ z is standard deviation of the error ε z in Equation (9).
The CUSUM monitor alarms when any one of the six test statistics (either 
$C_m^ + $ or 
$C_m^ - $, for any of the three values of b f*) exceeds a detection threshold T. The threshold for the CUSUM is computed based on the assumption that z is a white sequence under fault free conditions. Due to multipath, the measurement noise is actually correlated in time. However, the time-correlation of measurements taken at intervals of twice the multipath autocorrelation time constant is extremely small, so that these measurements can be treated as independent. In this work, we assume an example time constant of 100 sec for multipath, implying that measurements taken 200 sec apart are assumed independent.
When the input observables to CUSUM are independent, 
$C_m^ + $ and 
$C_m^ - $ are Markov processes—i.e., the current state is only dependent on the previous state. Therefore, the MTTD for the CUSUM monitor is computed using the transition matrix of process in conjunction with properties of Markov chains. The resulting MTTD computation is an iterative process, the details of which can be found in Hawkins and Olwell (Reference Hawkins and Olwell1998) and Basseville and Nikiforov (Reference Basseville and Nikiforov1993).
In addition, detection thresholds T are set to meet a required probability of false alarm of 3 × 10−5 (1 × 10−5per monitor). The values of T are [208, 38, 9.7] σ z for the three monitors targeting b f* values of [0.01, 0.2,1] σ z, respectively. A false alarm in the ground monitor does not cause a continuity event because TIA is much longer than the 150 sec approach period. Therefore, even if the ground monitor sounds a false alarm, it is unlikely to cause a continuity breach. However, if the monitor thresholds are allowed to be too tight, many alarms will occur, which will impact system availability. Post-detection exclusion and reinstatement will be discussed in future work. As a result, the ground false alarm probability requirement is set such that it is much smaller than a typical unavailability limit of 10−3 (corresponding to 99·9% availability). The false alarm probability requirement also has sufficient margin to account for the fact that multiple monitors are implemented against different faults.
Given the definition of z in Equation (9), pseudorange code measurement error standard deviations of 30 cm and 50 cm for L1 and L5, respectively, and carrier phase measurement error standard deviations of 3 and 5 mm, respectively, σ z was computed to be 39 cm. All parameter values for the three CUSUM monitors have now been determined.
In order to quantify the performance of these CUSUM monitors, the smallest MTTD among the three monitors (corresponding to the three b f* values) is evaluated for step fault magnitudes b f ranging from 1 mm to 3 metres. Figure 2 shows the resulting MTTD for the IFB fault versus fault magnitude b f for discrete values of TIA ranging from 0 min to 2 hours.
Performance of the CUSUM monitor for different IFB fault magnitudes and TIA values.
Similar plots are displayed in Figures 3 and 4 using the same method to monitor against CCDL1 and CCDL5 faults respectively. These figures illustrate the impact of TIA on P f. The higher the curve is, the higher P f becomes, which is intuitive because longer TIAs cause longer exposure periods of the aircraft to potential faults. For an example TIA of 30 minutes the P f curves for the three different fault types are compared in Figure 5. The figure shows that the monitor's performance to CCDL5 faults is driving the performance because it has the highest P f values for the same fault magnitude b f.
Performance of the CUSUM monitor for different CCDL1 fault magnitudes and TIA values.
Performance of the CUSUM monitor for different CCDL5 fault magnitudes and TIA values.
Overlay of the performance of the CUSUM monitor against three fault sources for TIA= 30 min.
Figure 5 can be used to select P sat and b max values for the ISM. For example, the figure illustrates that values for P sat of 10−4 and for b max of 75 cm, which were considered in the airborne ARAIM algorithm study in (EU-US Report, 2012), can be guaranteed by design of the ground CUSUM monitor with a TIA of 30 minutes. Figure 5 also provides flexibility in choosing different P sat and b max as long as these values conform with the figure and their impact on ARAIM availability is verified to be acceptable. For example, ARAIM availability may be more sensitive to changes in b max than variation in P sat. In this case, b max may be reduced at the expense of a slight increase in P sat to provide better availability.
Finally, it is important to recall that the monitor test statistic z in Equation (9) requires overlapping observations of each satellite by at least two ground stations to estimate n WL. Stations should be located globally with sufficient redundancy to meet this requirement. (Continuous two-station monitoring may also be required for monitoring of orbit ephemeris.) This could be achieved, for example, using a sparse worldwide network administered jointly by multiple ANSPs. Figure 6 shows one example ground station distribution that is sufficient to provide global two-station coverage. These stations are composed of 6 GPS US Air Force (USAF) ground stations and 11 National Geospatial-Intelligence Agency (NGA) stations. Figure 7 shows the number of ground monitor stations in view for each GPS and Galileo satellite (SVs PRN 16 and 63 removed), which shows that the example 17 station network provides continuous coverage by at least two or more stations per satellite at all times. The simulation is for illustrative purposes only. An ARAIM ground network would likely not be placed at these existing GPS ground installations. Nevertheless it is clear from the results that about 20 stations worldwide should be sufficient for continuous satellite coverage by two stations.
Global map showing example locations of ground stations to run the designed monitor.
Minimum, average and maximum number of ground stations that track each satellite simultaneously for GPS 27–1 and Galileo 24–1 constellations. (For specific details on these constellations see EU-US Report (2012).)
5. CONCLUSIONS
In this work, we introduced a new online ARAIM ground segment concept to validate the ISM message parameters b max and P sat used to compute protection levels at the aircraft. We established the relationship between b max, Psat, the Time to Integrity Alert (TIA), and the constellation service provider commitment on satellite failure rate (MTBF). We showed that, although the values of b max and P sat could be selected based on ARAIM availability analysis, they also had to correspond with the ground monitor's detection performance and with TIA. To illustrate the implementation of the concept, we designed an example CUSUM-based ground monitor to detect inter-frequency bias and code-carrier step divergence faults. It was found that for a TIA of 30 minutes, the proposed monitor could guarantee a b max of 75 cm and a P sat of 10−4, which are typical values that have been considered so far in the analysis of airborne ARAIM algorithms. For a TIA of 30 min, continuous data broadcast channels (e.g., provided by GEO satellites) would not be required. It may be sufficient to use a VHF Data Broadcast at the terminal airport for the dissemination of the ISM. In the future, we will design example monitors for satellite clock and ephemeris, antenna bias and signal deformation faults. In addition, we will investigate the impact of time varying faults on the relationship between P sat and b max.
ACKNOWLEDGMENT
The authors gratefully acknowledge the Federal Aviation Administration (FAA) for supporting this research. However, the opinions discussed here are those of the authors and do not necessarily represent those of the FAA or any other affiliated agencies.
