Sigma Overbounding using a Position Domain Method for the

Sigma Overbounding using aPosition Domain Method forthe Local Area Augmentaion ofGPS

JIYUN LEE

SAM PULLEN

PER ENGE, Fellow, IEEEStanford University

The local area augmentation system (LAAS) is a differential

GPS navigation system being developed to support aircraft

precision approach and landing navigation with guaranteed

integrity and availability. While the system promises to support

Category I operations, significant technical challenges are

encountered in supporting Category II and III operations. The

primary concern has been the need to guarantee compliance with

stringent requirements for navigation availability. This paper

describes how a position domain method (PDM) may be used to

improve system availability by reducing the inflation factor for

standard deviations of pseudo-range correction errors. Used in

combination with the current range domain method (RDM), a

30% reduction in the inflation factor is achieved with the same

safety standard. LAAS prototype testing verifies the utility of the

PDM to enhance Category II/III user availability.

Manuscript received June 30, 2006; revised December 4, 2006 andMarch 25, 2008; released for publication June 16, 2008.

IEEE Log No. T-AES/45/4/935092.

Refereeing of this contribution was handled by M. Braasch.

This work was supported by the Federal Aviation AdministrationSatellite Navigation LAAS Program Office (AND-710).

Authors’ current addresses: J. Lee, Dept. of Aerospace Engineering,Korea Advanced Institute of Science and Technology, Deajeon,Republic of Korea, Email: ([email protected]); S. Pullen and P.Enge, Dept. of Aeronautics & Astronautics, Stanford University,Durand Bldg., Rm. 250, Stanford, CA 94305-4035.

0018-9251/09/$26.00 c° 2009 IEEE

I. INTRODUCTION

An aircraft navigation system must guaranteeflight safety by assuring the position solution at areliable level with protection bounds. The local areaaugmentation system (LAAS) is being developed asa ground-based augmentation of GPS by the FederalAviation Administration (FAA). As such, navigationintegrity is quantitatively appraised using the positionbounds that assure an acceptable level of integrityrisk. In this regard, aircraft compute the verticalprotection level (VPL) and the horizontal protectionlevel (HPL) as position error bounds using integritydata. These are then compared with the vertical alertlimit (VAL) and the horizontal alert limit (HAL),respectively, to determine whether the system providessafety for each user.One key integrity parameter used in the

computation of these protection levels (PLs) isthe standard deviation of pseudo-range correctionerrors (¾pr gnd) that is broadcast for each satelliteapproved by the LAAS ground facility (LGF) alongwith the correction message [1—3]. User integritythus relies on these “sigmas.” The prescribedmethods for the generation of the PLs assume azero-mean and normally distributed, fault-free errormodel for the broadcast pseudo-range corrections.However, the true errors are neither necessarilyzero-mean nor Gaussian. The standard deviation ofthe correction error is further assumed to be equal tothe broadcast value of ¾pr gnd. If the broadcast errormodel does not overbound the true (unknown) errordistribution, a serious threat to the aircraft may result.Thus, special care must be taken to validate theseassumptions.A great deal of prior work has been done to

ensure that the zero-mean Gaussian distributionbased on the broadcast ¾pr gnd overbounds thetrue distribution, which may be non-Gaussian andnon-zero-mean. There are two principal approaches.The first approach taken in LAAS is to transmitinflated values of the standard deviations whichcompensate for the uncertainty of the true errordistribution. The main sources of statistical uncertaintyare site installation errors due to the limited size ofdata and nonstationary error distributions caused bymultipath variation. Pervan and Sayim [4] investigatedthe estimation error due to the finite sample sizes usedto generate the model and error correlation acrossmultiple reference receivers and derived the minimumacceptable inflation parameters for the value of thebroadcast sigma. Their work implicitly assumed azero-mean Gaussian error model associated withthermal noise and diffuse multipath. However, othererror sources, such as ground reflection multipathand systematic reference receiver/antenna errors,may not be zero-mean Gaussian distributed. Shivelyand Braff [5] derived inflation factors to deal with

1262 IEEE TRANSACTIONS ON AEROSPACE AND ELECTRONIC SYSTEMS VOL. 45, NO. 4 OCTOBER 2009

this non-Gaussian effect using a synthetic modelof a Gaussian core and Laplacian tails. Rife [6]introduced a modified overbounding technique,called core overbounding. His Gaussian core withGaussian sidelobe (GCGS) approach mitigatesoverconservatism associated with bounding heavytails by providing an allowable envelope of taildistributions.The second approach used in LAAS detects

violations of the resulting overbound using thesigma monitor in failure events, where the truesigma exceeds the broadcast sigma or the truemean becomes substantially non-zero. Sources ofunexpected anomalies in corrected pseudo-rangescan be multipath error increases due to varyingenvironmental conditions, receiver noise erroramplifications due to any natural system failure, orall other possible malfunctions. Lee [7] developedthe two sigma monitor algorithms, direct estimationand cumulative sum (CUSUM) methods, and showedthat real-time protection against sigma failures wasachievable.While the sigma overbounding techniques

described above promise to support Category Ioperations, significant technical challenges areencountered in supporting Category II/III operations.This is due to the tightened VAL (a bound onmaximum tolerable VPL) of 5.3 m and highavailability requirements (0.999 or higher, dependingon the airport). In addition, the maximum permissibleintegrity risk is on the order of 10¡9 (i.e., the PLsmust overbound the true position error, which isunknown in real time, with a probability of 1¡ 10¡9.)Thus, high levels of sigma inflation (with which thesystem may meet Category I requirements) cannotbe tolerated for Category II/III approaches. Thisconcern led to the application of a position domainmethod (PDM). Markin and Shively [8] originallyintroduced the concept of position domain monitoringin the mid-1990s as an alternative to range domainmonitoring. The computed protection levels in therange domain may be conservative, since the rangedomain method requires a transformation frompseudo-range correction errors to position errorestimates. In contrast, this alternative technique avoidsthe conservatism by performing a safety check directlyin the position domain. An extended benefit fromthe PDM has been shown by Braff [9]. In this work,the method was found to be effective to reduce aconservatism that was applied to protect againstthe event that the pseudo-range correction errordistribution was not modeled properly.The PDM performs the integrity check by

monitoring position solutions from combined setsof satellites [10]. In this concept, the PDM collectsmeasurements with a remote receiver and derivesposition solutions by applying LGF correctionsto all visible satellites approved by the LGF and

all possible subsets of satellites. The positionsolutions are then compared to the known (surveyed)location of the PDM antenna, and errors exceedingdetection thresholds are alerted. This method wasconsidered an alternative to the range domainmethod (RDM), which monitors each pseudo-rangemeasurement individually and approves eachsatellite for aircraft use. However, relying on onlyPDM turned out to be impractical due to limiteddata-link capacity and flexibility because it wasthought that the PDM required generating everypossible combination of satellites that may be usedto compute the position solution and approvingusable sets on a combination-by-combinationbasis. Thus, the current LGF is based on the RDM.However, given that an enhanced LGF architecture isrequired to meet Category II/III requirements, sigmaoverbounding using the PDM may be considered.This paper investigates how the PDM may beused to improve system availability by reducingthe inflation factor for the standard deviationof pseudo-range correction errors and presentsa method of sigma overbounding for CategoryII/III approaches. Section II introduces the PDMalgorithm to compute position error estimates (thealgorithm of monitoring is not described in thispaper because it is irrelevant to the calibration ofthe inflation factor). Section III then discusses thecharacteristics of error distributions in the positiondomain. Section IV describes the unique, detailedapproach to estimate ¾pr gnd inflation factors anddemonstrates that the PDM supports a smaller¾pr gnd inflation factor needed for Category II/IIIoperations. Section V presents field-testing resultsshowing improved system performance. Section VIsummarizes the paper and suggests a direction forfuture research.

II. POSITION DOMAIN METHOD

PDM position solutions are computed using theapproach required of LAAS airborne receivers–asspecified in the LAAS Minimum OperationalPerformance Standards (MOPS) [3]–to emulateLAAS aircraft conditions as much as possible (thesame method is used to obtain pseudouser positionestimates and evaluate performance in Section V).In order to reduce errors in raw pseudo-rangemeasurements for satellite n, ½n, we first applythe following carrier-smoothing filter [1, 3]. Thesmoothed pseudo-range ½s for satellite n at epoch kis

½s,n(k) =1Ns½n(k) +

Ns¡ 1Ns

(½s,n(k¡ 1)+Án(k)¡Án(k¡ 1)),

n= 1,2, : : : ,N (1)

where Á is the carrier phase measurement, and Ns isequal to 200 since this filter uses a time constant ¿s of

LEE ET AL.: SIGMA OVERBOUNDING USING A POSITION DOMAIN METHOD 1263

100 s and a sampling interval, Ts, of 0.5 s

Ns = ¿s=Ts = 100=0:5 = 200: (2)

Next we apply the set of LGF differential correctionsto these carrier-smoothed code measurements [3]. Thecorrected pseudo-range measurements are

½c,n(k) = ½s,n(k)¡ ½corr,n(k¡ 1)¡R½corr,n(k¡ 1) ¢Ts+TC(k)+ c ¢¢tn(k) (3)

where ½corr and R½corr are the pseudo-range correctionand the range rate correction from the LGF-approvedmessage [3]. The variable TC is the troposphericcorrection and is small enough to be neglected inthis application. The parameter c represents thevacuum speed of light, and ¢tn is the satellite clockcorrection computed using clock parameters insubframe 1 of the GPS navigation message. Basedon this set of differentially corrected measurements,we compute three-dimensional positions using alinearized, weighted least-squares estimation method.The linearized measurement model is

½c,n(k)¡ ½0,n(k)| {z }¢y

=G

264 ±x(k)

±y(k)

±z(k)±b(k)

375| {z }

¢x

+"̃ (4)

where ¢x is the four dimensional position(±x,±y,±z)=clock bias (±b) deviation vector, ¢yis an N-dimensional observation deviation vectorcontaining the corrected pseudo-range measurements(½c) minus the expected ranging values (½0) based onthe location of the PDM antenna and satellites, "̃ isan N-dimensional vector containing the remainingerrors in the corrected measurements, and G isthe observation matrix consisting of N rows ofline-of-sight vectors from each satellite to the PDMantenna, augmented by a “1” for the clock. Thus, thenth row of G corresponds to the nth satellite in viewand can be written in terms of the azimuth angle (Azn)and the elevation angle (Eln). This matrix is unitlessand is defined as

G =

266664¡cosEl1(k)cosAz1(k) ¡cosEl1(k)sinAz1(k) ¡sinEl1(k) 1

¡cosEl2(k)cosAz2(k) ¡cosEl2(k)sinAz2(k) ¡sinEl2(k) 1

......

......

¡cosElN(k)cosAzN(k) ¡cosElN(k)sinAzN(k) ¡sinElN(k) 1

377775 : (5)

We find the weighted least-squares solutions for theestimate of the states by

¢x̂= S ¢¢y, S ´ (GTWG)¡1GTW (6)

where S is the weighted least square projection matrix,and the inverse of the least-squares weighting matrix

is

W¡1 =

2666664¾2PR,1 0 ¢ ¢ ¢ 0

0 ¾2PR,2 ¢ ¢ ¢ 0

......

. . . 0

0 0 0 ¾2PR,N

3777775 : (7)

Here, ¾PR,n is the fault-free error model associatedwith satellite n:

¾2PR,n = ¾2air,n+¾

2tropo,n+¾

2iono,n:+¾

2pr gnd,n: (8)

The airborne error ¾air is determined from the receivernoise estimate and the specified multipath model.The second and the third terms are introduced bythe residual tropospheric and ionospheric errors,respectively. The ground error, ¾pr gnd, includes theground station receiver noise and multipath error (seeAppendix for details). Although the purpose of thePDM is to imitate aircraft operations, the PDM isstill a ground-based system with ground-reflectionmultipath. Thus, we need to replace the airborneerror sigma, ¾air, with the ground facility error sigma,¾pr gnd. The choice of ¾air being equal to ¾pr gnd isalso made for a pseudouser as well as for the PDMreceiver in Section V as a representative example.Comparing the position solutions (x̂) with the knownlocation of the PDM antenna (xsurveyed), we havethe position error, Â, which is equivalent to ¢x̂ in(6):

Â= x̂¡ xsurveyed| {z }¢x̂

: (9)

Here, the vertical component of Â in an East, North,up (ENU) coordinate system is the vertical positionerror, which is used to calibrate an inflation factor forthe broadcast ¾pr gnd.

III. ERROR DISTRIBUTION IN POSITION DOMAIN

This section investigates how range domainerror statistics are converted into position domain

error statistics. The purpose here is to show thatthe error distribution has thinner tails than beforethe conversion, which is a key factor supportinga smaller sigma inflation factor and consequentlyimproving navigation availability. From (6) and (9),the relationship between pseudo-range correction


errors and position errors is

Â= S1("̂1¡ b1| {z }¢y1

) + S2("̂2¡b2| {z }¢y2

) ¢ ¢ ¢+ SN("̂N ¡bN| {z }¢yN

)

(10)

where the pseudo-range correction errors for eachsatellite n (which is equivalent to ¢yn) can beexpressed with the pseudo-range correction error withzero-mean "̂n, and the mean bias of the correctionerrors bn, for each satellite n. The position error, Â,is the sum of mean-biased correction errors, whichare also weighted by the coefficients of the projectionmatrix (Sn). We now develop the connection betweenerror distributions in the range and position domains.The probability density function (pdf) f of the sum ofthe weighted and mean-biased independent variablesis the convolution of their respective scaled andmean-shifted pdfs fr [11].Based on this theorem and (10), the pdf of position

errors f(Â) is

f(Â) =1jS1j

fr

μ"̂1¡ b1jS1j

¶¤ 1jS2j

fr

μ"̂2¡ b2jS2j

¶¢ ¢ ¢

¤ 1jSN j

fr

μ"̂N ¡ bNjSN j

¶: (11)

Since "̂n is weighted by Sn and biased by bn, thepdf of "̂n is scaled by Sn and shifted by bn. We takeconvolutions of these pdfs to obtain f(Â).An empirical model of pseudo-range correction

errors ("̂n) is developed as described in Section IVB.Using this model, shown in Fig. 1 as a dashed curve,we transform the error distribution in the rangedomain into the position domain. This is done byconvolving the correction error pdfs, which are scaledand mean-shifted. The given weighting parametersSn, and mean-bias parameter bn, make the establishedposition error model into a good representation of theexperimental data (which is shown in Fig. 3). It isclear that the tails of the position error distribution(the solid curve in Fig. 1) are thinner than thoseof the individual correction error distributions (thedashed curve in Fig. 1). The thinner tails of the errordistribution in the position domain are caused bythe averaging effect of correction errors throughthe convolutions and common mode cancellation ofcorrection errors. Note that the sum of weightingparameters is zero,

PNn=1 Sn = 0, and thus the common

correction errors across ranging sources cancel out in(10).

IV. SIGMA INFLATION FACTOR ESTIMATION

As addressed in Section I, the true sigma mayexceed the broadcast ¾pr gnd due to the uncertaintyof the true error distribution. The main sources ofthis uncertainty are mean and sigma estimation

Fig. 1. Error distributions in position domain and in rangedomain.

error during site installation and nonstationary errordistributions caused by environmental changes thataffect multipath. Thus, the LGF needs to broadcastan inflated ¾pr gnd such that the broadcast distributionoverbounds all reasonable error distributions out tothe probabilities assumed in the computation of theprotection levels (PLs). The inflation factor, finflation,is defined as the ratio of the broadcast sigma tothe theoretical sigma of a zero-mean and normallydistributed correction-error model

finflation =¾Broadcast¾Theoretical

: (12)

Although a great amount of work has been doneregarding sigma inflation that accounts for eachindividual cause of the uncertainty [4, 5], an inflationfactor that copes with all of the uncertainty sources atonce has not yet been investigated.This section introduces a comprehensive method of

determining the inflation factor covering the followingthree sources of uncertainty: finite sample size,process mixing, and the limitation of sigma monitors.Section IVA considers the effect of sigma estimationerror due to the limited number of samples. A basicassumption of the PL is that pseudo-range correctionerrors are zero-mean Gaussian distributed. However,in practice, the tails of the true error distributionmay not be exactly Gaussian due to time-varyingenvironmental conditions. In addition, even thoughwe assume a stationary condition, mixing of Gaussianerrors with different sigmas may cause the fattenedtails. Section IVB deals with mixing of time-varyingerrors–such as ground reflection multipath–andmixing of different Gaussian distributions. Aninflation factor is derived for the non-Gaussian tailsin both the range and position domains. Section IVCthen reviews the performance of the existing sigmamonitors and provides a factor to overcome itslimitations. Lastly, Section IVD presents a method tocombine all factors and determine the inflation factorsfor the broadcast ¾pr gnd in the range and positiondomains, respectively. These induced inflation factorsare evaluated by computing PLs of a pseudouser inSection V.


Fig. 2. Probability density function of normalized B-values (errordistribution in range domain).

A. Finite Sample Size

In determining the broadcast sigma of theground facility error, we must account for specificenvironmental conditions (antenna siting, gainpatterns, and system configuration) of each LGFsite. Even though these conditions are factored veryaccurately into sigma estimation and the environmentis assumed to be stationary, the estimated sigma mayhave a statistical noise due to finite sample size.Previous research on this subject has been doneby Pervan and Sayim [4]. They investigated thesensitivity of integrity risk to statistical uncertaintiesto which the correction error standard deviation anderror correlation between multiple reference receiversare susceptible. Based on their work, the minimumacceptable inflation factor for the broadcast ¾pr gnd isapproximately 1.2 (see [4] for details).

B. Process Mixing

As noted above, the true LGF error distributionmay change with time, as environment conditionsvary. In addition, mixing of the time-varyingerrors–ground reflection multipath and systematicreceiver/antenna errors–makes the characteristicsof the error distribution complex. Even if stationaryGaussian error distributions are assumed, some degreeof the mixture problem is expected. The standarddeviation of the true error distribution varies as afunction of the elevation angle of each satellite. Ifpseudo-range correction errors are normalized bythe theoretical sigma which depends on the rangingsource elevation angle but which is not perfect, thisnormalization mixes Gaussian distributions withdifferent sigmas. The process mixing may result innon-Gaussian tails.Fig. 2 shows the distribution of the LGF B-values

collected by the Stanford Integrity Monitor Testbed(IMT)–an LGF prototype designed by StanfordUniversity–for a period of 5 hr. The B-valuesare ground broadcast differences between the

pseudo-range corrections derived from subsets of themultiple LGF reference receivers (typically 3 or 4).The precise mathematical formation of these B-valuesis defined in the LGF system specification [1]. Sincethe B-values represent pseudo-range correctiondifferences across reference receivers–ideally, thepseudo-range corrections from all reference receiversshould be the same for a given satellite–the B-valuesare best thought of as the estimates of pseudo-rangecorrection errors under the hypothesis that a givenreference receiver has failed. The B-values arenormalized by their theoretical sigma which dependson the elevation angles, and those normalizedB-values which are mixed over all elevations areused to configure the range error distribution. Asaddressed earlier, this mixing which results fromthe normalization may cause the fattened tails ofthe error distribution as mixing of time-varyingerrors does. In Fig. 2, we can clearly see that thecorrection error distribution (the dotted curve) hasnon-Gaussian tails (note that the scale of its verticalaxis is logarithmic). Thus we should inflate thenominal 1¾ Gaussian distribution (shown as thedashed curve) to overbound the error distribution withnon-Gaussian tails. However, this error distributionmodeled with experimental data is not sufficientto represent the true error distribution. In otherwords, a reliable estimation of the tail probabilitiesis impossible because their small magnitude (on theorder of 10¡10) requires a huge sample size (greaterthan 1010) that cannot be collected in a realistic timeframe. Hence, the limited number of samples makesan empirical model necessary for estimating the errordistribution. We use the following Gaussian-mixturedistribution as the empirical model to represent thedata better than the simplest and most common modelof a single Gaussian pdf:

fGM = (1¡ ") ¤N(¹0,¾0)+ " ¤N(¹1,¾1)"= 0:15, ¹0 = ¹1 = 0

¾0 = 0:75, ¾1 = 1:82

(13)

where N(¹,¾) is a normal distribution with mean ¹and sigma ¾. Thus this function is the weighted sumof two normal distributions with one nominal sigmaand one relatively large sigma. This model (the innersolid curve) shown in Fig. 2 well characterizes theactual distribution of Gaussian-core and non-Gaussiantails. Again, the nominal sigma should be inflated inorder to cover the non-Gaussian tails of the actualdistribution with a normal distribution. For CategoryI approaches, the tails need to be overbounded so thatthe probability of the error exceeding protection levelsis less than or equal to 6£ 10¡9 under the hypothesisof fault-free conditions (H0); for Category II/IIIapproaches the required probability is 1:2£ 10¡10. Tomeet the integrity requirement, we need to inflate the


Fig. 3. Probability density function of normalized verticalposition errors (error distribution in position domain).

sigma by a factor of 2.32 or greater. We can see thatthe 2:32¾ Gaussian distribution (the outer solid curve)well overbounds the empirical model (the inner solidcurve). As a result the minimum tolerable inflationfactor is 2.32 if the LGF is based on range domainmonitoring. Note that test statistics highly depend onsystem configurations; thus, this analysis should beconducted at each LGF site.The result from Section III implies that the PDM

allows us to reduce the inflation factor for broadcast¾pr gnd because its error density has thinner tails. Fig. 3shows the distribution of vertical position errors,computed using the PDM algorithm for a periodof 5 hr. The actual position error distribution (thedotted curve) is well characterized by the empiricalmodel (the solid curve) also shown in Fig. 1. Notethat this distribution has a shifted mean due to themean biases of pseudo-range correction errors. Againsince we assume a zero-mean normally distributederror model in the computation of PLs, we need toinflate the nominal sigma of a zero-mean Gaussiandistribution to cover the non-Gaussian tails of thenon-zero actual distribution. Thus, we inflate sigmato meet the H0 integrity risk allocation (1:2£ 10¡10for Category II/III [1]). Fig. 3 shows that the 1:56¾Gaussian distribution (the outer-solid curve) welloverbounds the empirical model (the inner-solidcurve). Consequently the minimum tolerable inflationfactor to mitigate integrity risks due to process mixingis 1.56 if the LGF is based on the PDM. Again thisanalysis should be performed at each LGF site toaccount for different system configurations. Sigmaoverbounding has been shown in this paper using thepdfs in order to illustrate that empirical models wellrepresent the actual distributions while demonstratingthe overbounding. However, sigma overboundingmust also be shown using cumulative distributionfunctions (cdfs) to ensure integrity as stated in [6].Thus, we performed cdf overbounding for the casesshown in Figs. 2 and 3 and confirmed that the cdfoverbounding was in a good agreement with the pdfoverbounding.

Fig. 4. Failure-state average run lengths for CUSUM and sigmaestimation monitors.

C. Limitation of Sigma Monitors

The possibility of sigma violations exists becauseof not only the nominal sigma uncertainty but alsounexpected anomalies. Thus, the sigma monitoris needed to provide necessary integrity in theevent that the true sigma significantly exceeds thebroadcast sigma. Lee [7] developed two differentsigma-monitoring algorithms: the sigma estimationmethod and CUSUM method. The former detectsrelatively smaller violations faster, while thelatter detects larger violations faster. These twosigma-monitoring algorithms together are able todetect any size of sigma violation that is hazardousto users. However, the current sigma monitor hasa limitation on mean time-to-detect which must beovercome with an additional inflation factor. First, wederive the additional parameter assuming that the errordistribution is Gaussian. Second, we assume a specificnon-Gaussian error distribution and then derive theinflation factor.1) Gaussian Assumption on Error Model: Let

us review the performance of the sigma monitorimplemented in the Stanford IMT (see [7] fordetails.) Fig. 4 shows the mean detection time fordifferent sigma monitoring methods to detect certainfailure-states–out-of-control sigmas (¾1)–given thecondition that the error distribution is Gaussian. Thefailure state is denoted as ¾1 (out-of-control sigma)which is the ratio of an actual sigma to a theoreticalsigma

¾1 =¾Actual¾Theoretical

: (14)

We now turn our attention to the LGFrequirements specified in [1] and reexamine thecapability of this monitor. Based on the time-to-alertrequirements, if the actual integrity risk is greaterthan the total allocation but the resulting risk increase


Fig. 5. Probability density function of sample standard deviation.

is minimal (i.e., is no greater than one order ofmagnitude), it is defined as “minimal-risk-increase.”Since degraded performance due to such sigmafailure is minimal according to the specification,we need not detect it immediately but insteadwithin a day. Note that if sigma failure causes“nonminimal-risk-increase” (i.e., the integrity riskis increased by more than one order of magnitudefrom the total allocation), it should be detected withinan hour. The limitation of the sigma monitor is nowdefined: Assuming that we can continuously collectdata in one satellite pass for 5 hr on average, theminimum out-of-control sigma detectable withina day is 1.41. Out-of-control sigmas (¾1) greaterthan the inflation factor (finflation) are categorized as“minimal-risk-increase” (i.e., the actual sigma exceedsthe broadcast sigma), by definition of (12) and (14). Ifthe inflation factor is less than 1.41, sigma violationswith minimal risk–between the inflation factor and1.41–cannot be alarmed within a day. Accordingly,in order to meet the LGF requirements, the inflationfactor should be at least 1.41.2) Non-Gaussian Assumption on Error Model: As

pointed out in Section IVB, the error distributionmay not be precisely Gaussian. Thus, we also needto consider the restriction of the sigma monitor giventhe assumption that the errors are non-Gaussiandistributed. Results corresponding to Fig. 4 aregenerated using the non-Gaussain model described in(13). This model is an example used to represent theactual distribution. From this distribution we collect90 independent samples to compute a sample standarddeviation. Note that 90 is the number of independentsamples that we can collect continuously in 5 hr,since 18 independent samples correspond to 1 hr(the interval between independent B-values is takento be equal to 200 s, which is twice as long as thetime constant of the carrier-smoothing filter [1, 7].)Repeating this process randomly, we then generate10,000,000 sample sigmas. As a result, the pdf ofa sample sigma is shown in Fig. 5. Based on thespecified fault-free alarm rate, 10¡7 (a sub-allocationof Category I continuity risk allowed per 15 s interval

Fig. 6. Inflation factors for broadcast ¾pr gnd with RDM only andRDM+PDM.

[1, 12]), the minimum out-of-control sigma detectablewithin 5 hr is now 1.77. Consequently, to protect thisparticular non-Gaussian error model, the inflationfactor should be at least 1.77.

D. Total Inflation Factor

So far we have investigated three major sources ofsigma uncertainty and derived an inflation factor foreach source. The final step is to determine the totalinflation factor for the broadcast ¾pr gnd considering allconditions discussed in Sections IVA, IVB and IVC:

1) The theoretical (or preestimated) sigma is to beinflated by a factor of 1.2 to account for finite samplesize (Section IVA).2) The inflation factors to overbound the tails of

the non-Gaussian distribution derived from IMT dataare 2.32 in the range domain and 1.56 in the positiondomain (Section IVB).3) The inflation factor should be at least 1.77 to

overcome limitations of the existing sigma monitor(Section IVC).

In Fig. 6, we present the inflation factordetermination method for the broadcast ¾pr gnd. Sincethe conditions described in Sections IVA and IVB areindependent, we multiply the two parameters (1.2and 2.32) for the range domain case. The resultingfactor (2.78) already exceeds what is required by thesigma monitor (which is 1.77) satisfying the thirdcondition. Thus, the total inflation factor is 2.78 whenthe LGF is based on the RDM only. Using the samemethod, we obtain the total inflation factor for theposition domain case. We multiply the two parameters(1.2 and 1.56) derived in Sections IVA and IVB, andthen take the maximum of the resulting factor (1.87)and 1.77 derived in Section IVC. Note that amonginduced parameters to cope with each error source,only the second one–the inflation factor to coverprocess mixing–changes; the others remain the samein the position domain. The total inflation factor is1.87 when a PDM is added to the current RDM (asaddressed earlier, the LGF cannot rely solely on the


Fig. 7. Stanford LAAS performance test-bed IMT-PDM-userhardware configuration.

PDM due to limited data-link capacity and complexityand thus the LGF may augment the existing systemby adding the PDM). These total inflation factorsare used to compute vertical protection levels in thefollowing section.

V. PERFORMANCE ANALYSIS

To demonstrate that the position domain methodprovides users with sharper confidence bounds dueto the reduced inflation factor and consequentlyimproves system availability, this section evaluatesthe system performance by computing a pseudouser’sprotection levels. The two postprocessing runs areconducted to compare performance: the first runusing the augmented system with the position domainmethod and the second run with the current StanfordIMT (range domain monitoring only).

A. Performance Testbed Architecture

To evaluate whether the LGF can meet its integrityrequirements, Stanford University researchers havedeveloped an LGF prototype known as the IntegrityMonitor Testbed (IMT) [13]. The LGF requiresthat redundant differential GPS reference receiversbe able to detect and exclude failures of individualreceivers. Fig. 7 shows the configuration of thethree IMT antennas on the Stanford HEPL (HansenExperimental Physics Laboratory) rooftop. Theexisting IMT antennas are connected to three NovAtelOEM-4 reference receivers which are connected tothe IMT computer by a multiport serial board. Theseparations between these three NovAtel Pinwheel(survey grade) antennas are limited to 20—65 m bythe size of the HEPL rooftop but are sufficientlyseparated to minimize the correlations betweenindividual reference receiver multipath errors (thishas been demonstrated by previous work) [13, 14].Each receiver can track as many as 12 satellitessimultaneously. Each receiver samples GPS signalsevery 0.5 s and provides receiver measurementpackets, which contain pseudo-range measurements,carrier-phase measurements, and navigation messages.These GPS measurements are fed into the IMTprocessor for further calculations.

A prototype of PDM has been applied to theexisting Stanford IMT as shown in Fig. 7. We usethe Stanford WAAS Reference Station antenna(located on the Stanford Durand Building) for thePDM antenna, which is separated by approximately145 m from the IMT antennas. In order to test thecapability of meeting the high availability requirementfor Category II/III precision approaches, we havetested LAAS augmented with the PDM by installinga static “pseudouser” antenna/receiver on top of thenearby parking structure. The NovAtel Pinwheelantenna (“pseudouser” antenna) and the center ofthe IMT are approximately 230 m apart, and thedistance between the pseudouser antenna and thePDM antenna is approximately 360 m. The NovAtelOEM-4 receivers connected to the PDM antennaand the “pseudouser” antenna collect pseudo-rangemeasurements, carrier-phase measurements, andnavigation messages of GPS satellites (“pseudouser,”PDM, and IMT receivers are set up to collectmeasurements simultaneously). The measurements arepostprocessed in a single computer where the PDMalgorithm is developed and tested.

B. Experimental Result

In order to evaluate system performance, wefirst compute position errors, which are obtained bycomparing the surveyed location of the pseudouser’santenna to position solutions. Pseudouser positionsolutions are computed in the manner requiredof the LAAS airborne receivers to mirror LAASaircraft operations to the degree possible (thedetailed algorithm is specified in the RTCA LAASMOPS [3] and also in Section II). In this analysis,accuracy designator C (AD-C) is applied to thepseudo-range error model [15], as it correspondsto the hardware installation for Category II/III (seeAppendix). Second, we compute protection levelsthrough which the final quantitative appraisal ofthe navigation performance is realized. The VPLunder the hypothesis of fault-free conditions (H0)is

VPLH0 = Kffmd¾VerticalPositionError

= Kffmd

vuut NXn=1

S2vertical,n¾2PR,n (15)

where ¾VerticalPositionError is the standard deviation ofvertical position errors, Kffmd is a specified multiplierthat determines the probability of fault-free misseddetections (i.e., this multiplier is the quantile of aunit Gaussian distribution corresponding to 10¡9

for Category II/III operations and is equal to 6.441when the number of ground reference receiversis three) [3], Svertical,n is the projection of the local


Fig. 8. System performance in vertical direction with RDM and PDM.

vertical component for the nth ranging source, and¾PR,n is the fault-free error model associated withsatellite n. Since the vertical direction is the moststringent one and errors in this direction are generallyworse than those in the lateral direction, we onlypay attention to the vertical direction. From (8)and by applying the inflation factor, finflation, to thebroadcast ¾pr gnd to meet the integrity requirement(explained in Section IV), (15) can be expressedas

VPLH0 =Kffmd

vuuuuutNXn=1

S2vertical,n ¢ [¾2air,n+¾2tropo,n+¾2iono,n

+(finflation ¢¾pr gnd,n)2]:

(16)

We now proceed to verify that the inflation factorderived from the PDM can be substituted into (16).From (8) and (15), the standard deviation of thevertical position errors is

¾VerticalPositionError =vuut NXn=1

S2vertical,n[¾2air,n+¾

2tropo,n+¾2iono,n+¾

2pr gnd,n]:

(17)

Because the PDM receiver is located on the ground,we replace the airborne error sigma ¾air with theground facility error sigma ¾pr gnd. Here ¾air,n =p3¾pr gnd,n since ¾pr gnd,n is set based on three

reference receivers (see Appendix subsection A). Then

(17) becomes

¾VerticalPositionError =vuut NXn=1

S2vertical,n ¢ [3¾2pr gnd,n+¾2tropo,n+¾2iono,n+¾2pr gnd,n]:

(18)We also use the fact that ¾tropo,n and ¾iono,nare negligible because of the short distance(approximately 145 m) between the IMT and PDM.When (18) is multiplied by the inflation factor,

finflation ¢¾VerticalPositionError =vuut NXn=1

S2vertical,n ¢ 4(finflation ¢¾pr gnd,n)2: (19)

This indicates that we can directly apply the inflationfactor derived using the position domain errorstatistics to the broadcast ¾pr gnd in (16).Fig. 8 shows the performance of the

PDM-augmented system. For the purpose ofcomparison, we also produce the performanceresults with the RDM only and plot them in Fig. 9.Horizontal axes indicate the absolute value of verticalposition errors (jVPEj), while VPLs are plotted inthe vertical axes. Each bin represents the number ofoccurrences of a specific pair (error, protection level).The jVPEjs are always less than 2 m, which meansthat both types of LGF systems meet the accuracyrequirement for Category II/III approaches. Integrityrisk is defined as the probability that the positionerror exceeds the alert limit and no navigation systemalert occurs within the time-to-alarm. The event


Fig. 9. System performance in vertical direction with RDM only.

with VPL less than the VAL but error greater thanthe VAL–which leads to hazardously misleadinginformation (HMI), indicates a violation of integrity.In both plots, the errors are always less than the VPLand also VAL; thus, no points constitute integrityfailures.Now we turn our attention to LAAS availability,

which is defined as the fraction of time for whichthe system is providing position fixes to the specifiedlevel of accuracy, integrity and continuity. If computedPLs exceed the alert limit, then the system no longermeets the integrity requirement and thus losesavailability. The VAL for Category II/III precisionapproaches (indicated with horizontal and verticallines in Figs. 8 and 9) 5.3 m based on the RTCALAAS MASPS [16]. Without the PDM (and giventhe condition that available satellites in view aremore than five), the system availability achieved inthis analysis is only 89.258%, as shown in Fig. 9.Thus the RDM alone cannot meet the availabilityrequirement of Category II/III approaches, whichis 99.999%. In contrast, we can see in Fig. 8 thatthe system augmented with the PDM maintainsthe availability of 99.999% or greater in verticalpositioning (when the same GPS constellation isprovided as in the RDM only case). If we considera relaxed VAL of 10 m based on the most recentLAAS MASPS update, it appears from Fig. 9 thatthe RDM would have been good enough for the datapresented. However, in this assessment we computedthe availability over only a period of 5 hr instead ofa full day of geometries, and the GPS constellationswith satellite outages were not considered. Also notethat significantly less ideal sites may exist where

the benefits of the PDM in addition to the RDMmight make the difference between acceptable andunacceptable availability. Although further work isneeded to better estimate the availability with thePDM, it is clear that the PDM augmentation helpsmeet the high Category II/III availability requirements(or provide that tool for future LAAS systems, shouldit ever be needed) by supporting a smaller inflationfactor (finflation = 1:87 versus 2.78)–inserted in (16)to compute VPLs–and consequently providing sharpprotection bounds.

VI. CONCLUSIONS

This paper demonstrated that the PDM improvesthe performance of the existing Category I LGF,which is based on the RDM. We found that theperformance achieved by adding the PDM aidssignificantly in meeting the stringent availabilityrequirements of Category II/III operations. Thisimprovement is possible because the PDM supportsa lower inflation factor for the broadcast ¾pr gnd(i.e., there is no availability penalty due to theconservative inflation factor as there is with theRDM). The paper also provides a comprehensivemethod for determining the sigma inflation factor.The derived inflation factor includes partial parametersfor all sources of the sigma uncertainty and for thelimitation of the current sigma monitor. The empiricalperformance tests showed that the system augmentedwith the PDM provides a 25% reduction in VPLwith the same safety standard and enhances useravailability.Test statistics for determining a sigma inflation

factor depend heavily on antenna sites, gain patterns,


and the nearby environment. Thus, the inflationfactor derived in this paper is not applicable to allsituations. For example, a challenging airport site ora ground-based system with upgraded hardware wouldrequire different inflation factors. Future researchshould focus on constructing more PDM test statisticswith datasets collected from different environmentalconditions for longer periods of time. Analyzing thesestatistics may help better evaluate PDM performance.

ACKNOWLEDGMENTS

The constructive comments and advice regardingthis work provided by many other people in theStanford GPS research group are greatly appreciated.

APPENDIX. LAAS ERROR MODELS

This Appendix describes the LAAS AccuracyModels used in this paper. These models are requiredto compute protection levels. Working Group-4 ofRTCA Special Committee 159 developed standarderror models for LAAS differential processing[1]. The standard GPS interference environmentalconditions–the RF interference environment atand around L-band frequencies for LAAS airbornereceivers–assumed in the models are defined inAppendix D of the LAAS MOPS (RTCA/DO-253A[3]). This group defined ground accuracy designators(GADs) that reflect different performance levels ofGPS receiver technologies [15]. GAD-A representsa level of performance achievable with early andlow-cost LAAS installations using a standardcorrelator receiver and a single-aperture antenna.GAD-C was defined to characterize the performancerealizable with a narrow correlator receiver anda multipath limiting antenna (MLA). GAD-Cperformance is expected to be able to support LAASCAT II/III precision approaches. GAD-B representsan intermediate level of performance between GAD-Aand GAD-C. The performance of GAD-B is attainablewith advanced receiver technologies similar to GAD-Cbut with a single-aperture antenna instead of an MLA.

A. Model of Ground Facility Error

The ground facility error sigma ¾pr gnd, whichis broadcast to users by the LGF is a critical factorfor airborne users to compute their position andintegrity PLs. This error standard deviation for eachranging source should account for all equipmentand environmental effects, including receiver noise,local interference, and ground station multipath. Thestandard deviation of the ground facility error is [1]

¾pr gnd,n(k) =

s(a0 + a1e¡μn(k)=μ0 )2

Mn(k)+ (a2)2 (20)

TABLE IGround Facility Error Allocation Model

Ground AccuracyDesignator a0 meters a1 meters a2 meters μ0 deg

GAD-A 0.50 1.65 0.08 14.3GAD-B 0.16 1.07 0.08 15.5GAD-C μn ¸ 35± 0.15 0.84 0.04 15.5

μn < 35± 0.24 0 0.04 –

where M is the number of reference receivers that areaveraged to obtain a differential correction, μn is thenth ranging source elevation angle, and a0, a1, a2 andμ0 for the applicable GADs are defined in Table I.

B. Model of Airborne Pseudo-range Performance

To define airborne pseudo-range error allocationsfor carrier-smoothed code processing, we consider twocomponents. First, ¾noise is the error due to widebandnoise and interference including receiver noise,thermal noise, inter-channel biases, extrapolation, andprocessing errors, and is modeled as

¾noise,n = a0 + a1e¡μn=μc , 5± · μn · 90± (21)

where μn is the nth ranging source elevation angle,and a0, a1 and μc for the applicable airborne accuracydesignator (AAD) are defined in [15]. The AADswere defined to reflect different performance levelsof GPS receiver technologies. Second, ¾multipath is theerror due to airframe multipath and is described by thedistribution, N(0,¾2multipath) where

¾multipath,n = 0:13+0:53e¡μn=10± : (22)

The overall airborne accuracy model is computed asfollows:

¾air,n =q¾2noise,n+¾

2multipath,n: (23)

C. Model of Tropospheric Residual Uncertainty

The standard deviation of the post troposphericcorrection error is defined as [3]

¾tropo,n = ¾Nh010¡6q

0:002+ sin2(μn)(1¡ e¡¢h=h0 )

(24)

where ¾N is the refractivity uncertainty, h0 is thetropospheric scale height from the LAAS type 2message, ¢h is the height of the aircraft above theLAAS reference point, and μn is the elevation angle ofsatellite n.

D. Model of Ionospheric Residual Uncertainty

Ionospheric temporal and spatial decorrelationcan lead to differential LAAS user range errors.


The uncertainty of this residual ionospheric error isdefined as [3]

¾iono = Fpp£¾vert iono gradient£ (Xair + 2£ ¿ £ ºair)(25)

where Fpp is the vertical-to-slant obliquity factor for agiven satellite, ¾vert iono gradient is the standard deviationof a normal distribution associated with the residualionospheric uncertainty due to spatial decorrelation(a parameter provided by the ground subsystem inthe LAAS type 2 message), Xair is the distance (slantrange) between the aircraft and the LAAS referencepoint, ¿ is the time constant of the smoothing filter(100 s), and ºair is the horizontal speed of the aircraft.

REFERENCES

[1] FAASpecification: Performance Type One Local AreaAugmentation System Ground Facility.FAA, Washington, D.C., FAA-E-2937A, Apr. 17, 2002.

[2] FAASpecification: Category I Local Area AugmentationSystem Non-Federal Ground Facility.FAA, Washington, D.C., FAA/AND710-2937, May 31,2001.

[3] RTCAMinimum Operational Performance Standards for GPSLocal Area Augmentation System Airborne Equipment.RTCA, Washington, D.C., RTCA SC-159 WG-4A,DO-253A, Nov. 28, 2001.

[4] Pervan, B., and Sayim, I.Sigma inflation for the local area augmentation of GPS.IEEE Transactions on Aerospace and Electronic Systems,37, 4 (Oct. 2001), 1301—1311.

[5] Shively, C., and Braff, R.An overbound concept for pseudorange error from theLAAS ground facility.Proceedings of IAIN World Congress/ION 56th AnnualMeeting, San Diego, CA, June 26—28, 2000, 661—671.

[6] Rife, J.Core overbounding and its implications for LAASintegrity.Proceedings of ION GNSS 2004, Long Beach, CA, Sept.21—24, 2004, 2810—2821.

[7] Lee, J., Pullen, S., Xie, G., and Enge, P.LAAS sigma monitor analysis and failure-testverification.Proceedings of ION NTM 2001, Albuquerque, NM, June11—13, 2001, 694—704.

[8] Markin, K., and Shively, C.A position-domain method for ensuring integrity of localarea differential GPS (LDGPS).Proceedings of ION Annual Meeting, Colorado Springs,CO, June 5—7 1995, 369—380.

[9] Braff, R.A method for LAAS fault-free error overbounding usinga position domain monitor.Proceedings of ION National Technical Meeting, Anaheim,CA, Jan. 22—24 2003, 326—388.

[10] Braff, R.Position domain monitor (PDM) performance analysis forCAT III.MITRE/CAASD, McLean, VA, Oct. 1, 2002.

[11] Ziemer, R. E.Elements of Engineering Probability & Statistics(International ed.).Upper Saddle River, NJ: Prentice-Hall, 1997.

[12] Pullen, S., Luo, M., Pervan, B., and Enge, P.The use of CUSUMs to validate protection leveloverbounds for ground based and space basedaugmentations systems.Proceedings of ISPA 2000, Munich, Germany, July 18—20,2000, 355—371.

[13] Luo, M., Pullen, S., Zhang, J., Gleason, S., and Xie, G.Development and testing of the Stanford LAAS groundfacility prototype.Proceedings of ION NTM, Anaheim, CA, Jan. 26—28,2000, 210—219.

[14] Luo, M., and Pullen, S.LAAS Reference Receiver Correlation Analysis.Stanford University, Feb. 17, 1999.

[15] McGraw, G., Murphy, T., Brenner, M., and Pullen, S.Development of the LAAS accuracy models.Proceedings of ION GPS, Salt Lake City, UT, Sept. 19—22,2000, 1212—1223.

[16] RTCAMinimum Aviation System Performance Standards for theLocal Area Augmentation System (LAAS).RTCA, Washington D.C., RTCA SC-159 WG-4A,DO-245, Sept. 1998.


Jiyun Lee received the B.S. degree in astronomy from Yonsei University, Seoul,South Korea in 1997, the M.S. degree in aerospace engineering and science fromthe University of Colorado, Boulder, in 1999, and the M.S. and Ph.D. degrees inaeronautics and astronautics from Stanford University, Stanford, CA, in 2001 and2005, respectively.She is currently an assistant professor in the Mechanical Aerospace and

Systems Engineering School at Korea Advanced Institute of Science andTechnology. She is also a principal systems engineer at AMTI, Inc., and aconsulting assistant professor at Stanford University. From 2007—2008, sheworked at SiRF Technology, Inc. as a senior GPS systems engineer. She has beenactive in the Institute of Navigation (ION), serving as session cochair and trackchair. She has received the ION Student Award and the Best Presentation Awardfor her work.

Sam Pullen received the Ph.D. in aeronautics and astronautics from StanfordUniversity, Stanford, CA, in 1996.He is a senior research engineer at Stanford, where he is the manager of the

Local Area Augmentation System (LAAS) research effort. He supported theFAA in developing LAAS and WAAS system concepts, technical requirements,integrity algorithms, and performance models. He and his group have developeda LAAS ground facility prototype that utilizes innovative algorithms fordetection, exclusion, and recovery of system failures. He is now developingionosphere-anomaly-mitigation approaches for LAAS as well as improved systemarchitectures and algorithms for the next phase of LAAS to support Category IIIprecision landings.

Per Enge (S’78–M’82) is the Kleiner-Perkins, Mayfield, Sequoia CapitalProfessor in the School of Engineering at Stanford University. He is alsothe Director of the GPS Research Laboratory, which pioneers satellite-basednavigation systems for aviation and maritime use. Two of these systems arein widespread use today. Medium frequency beacons are used worldwide tobroadcast differential GPS corrections to some 1.5 million, mostly marine, users.The first satellite-based augmentation system came online for aviation in theUnited States in July of 2003, and similar systems are being developed in Europe,Japan and India.Dr. Enge has received the Kepler, Thurlow and Burka Awards for his work.

He is also a member of the National Academy of Engineering and a Fellow ofthe ION.


Documents

Sigma Overbounding using a Position Domain Method for the