An Overview of GBAS Integrity Monitoring with a Focus on Ionospheric Spatial Anomalies
Total Page:16
File Type:pdf, Size:1020Kb
Indian Journal of Radio & Space Physics Vol. 36, August 2007, pp 249-260 An overview of GBAS integrity monitoring with a focus on ionospheric spatial anomalies Sam Pullen & Per Enge Department of Aeronautics and Astronautics, Stanford University, USA E-mail: [email protected] Received 2 April 2007; accepted 14 May 2007 The Local Area Augmentation System (LAAS) or, more generally, the Ground Based Augmentation System (GBAS), has been developed over the past decade to meet the accuracy, integrity, continuity and availability needs of civil aviation users. The GBAS utilizes a single reference station (with multiple GNSS receivers and antennas) within an airport and provides differential corrections via VHF data broadcast (VDB) within a 50-km region around that airport. This paper provides an overview of GBAS integrity verification, explaining how integrity risk is allocated to various potential safety threats and how monitors are used to meet these allocations. In order to illustrate GBAS integrity monitoring in detail, this paper examines the potential threat of ionospheric spatial anomalies (e.g., during ionospheric “storms”) to GBAS and how GBAS protects users against this threat. In practice, the need to mitigate potential ionospheric anomalies is what dictates CAT I GBAS availability. Keywords : LAAS, GBAS, Ionospheric spatial anomalies, Civil aviation PACS No : 94.20.Vv; 94.20B6 1 Introduction navigation aids such as VOR/DME and the When the GPS standard positioning service (SPS), Instrument Landing System (ILS). As a result, the based on L1 C/A code, reached initial operational International Civil Aviation Organization (ICAO) capability 1 (IOC) in 1993, it was understood that SPS selected differentially-augmented GPS as the primary by itself could not meet the accuracy, integrity and basis for future aircraft navigation and landing continuity requirements of civil aviation users. At that systems 9 in 1995. time, SPS was intentionally degraded by selective One of the key aspects of GBAS development was availability (S/A), which made SPS ranging accuracy to determine as to how to protect users against GNSS insufficient for precision-approach applications. In or GBAS system failures that are rare but not so rare addition, while the GPS operational control segment that they can be neglected. Several classes of potential (OCS) does its best to maintain the performance of failures in this category exist 10-12 . Ranging source GPS, it does not have the mandate to prevent or detect failures (e.g., failures within the GPS SPS) include: failures at the levels required for civil aviation operations 2. Receiver Autonomous Integrity Monitoring (i) Excessive acceleration in GNSS ranging (RAIM) was developed to utilize satellite redundancy measurements (e.g., due to satellite clock to enhance user integrity, but for a variety of reasons, failures), it cannot be the sole means of providing integrity for (ii) GNSS navigation data failures (significantly civil aviation 3,4 . erroneous clock and/or ephemeris data), The use of differential GPS (DGPS) was originally (iii) Code-carrier divergence in GNSS satellite range developed as a means of defeating S/A and achieving measurements, metre-level accuracy 5. The Local Area Augmentation (iv) Low GNSS satellite signal power, System (LAAS) was developed from generic local- (v) Deformation of GNSS code signals 13,14 . area DGPS as a means to provide higher-accuracy differential corrections and integrity alerts via a radio The primary failure mode within the GBAS ground data link 6,7 . Early flight tests of prototype LAAS system is the failure of a single ground receiver out of systems 8 convincingly demonstrated the potential of the four receivers typically fielded at a GBAS site. this technology to replace and expand upon the Two potential atmospheric-propagation anomalies capabilities of existing ground-based aircraft exist, i.e. ionospheric and tropospheric ones. Finally, 250 INDIAN J RADIO & SPACE PHYS, AUGUST 2007 RF interference occupies a category of its own, of remaining usable throughout an operation is below because it tends to be localized in impact, but is not the continuity risk requirement for that operation 13 . part of GNSS or GBAS. Details on these protection level calculations are This paper describes the methods used by GBAS to covered in Sec.4. mitigate these potential threats and briefly discusses how future upgrades to GBAS will allow for better 3 GBAS architecture overview and required fault mitigation of worst-case ionospheric impacts on user monitors errors and thus provide higher availability. The fundamental system element for both GBAS and SBAS is the reference station, comprising one or 2 Summary of civil aviation requirements more reference receivers connected to antennas at Requirements for civil aviation operations fixed locations known (pre-surveyed) to within 1-2 supported by GBAS were derived from the cm. These reference receivers provide continuous requirements that apply to existing navigation 10,11,14 measurements for all GPS satellites in view, so that aids , such as ICAO Annex 10 for ILS. Detailed differential corrections can be formed. They typically listings of these requirements can be found have multiple receivers and antennas to provide the elsewhere 4,15 . The key parameters upon which 16 required availability and continuity and to allow requirements are placed can be defined as follows : failures of individual reference receivers which can be Accuracy: Measure of navigation output deviation detected and excluded before they corrupt the σ from truth, usually expressed as 1 or 95% differential corrections. Approved corrections and σ (approximately 2 ) error limits. error bounding sigmas (to support protection level Integrity : Ability of a system to provide timely calculations; see Sec. 4) are broadcast to users via the warnings when the system is unsafe to use for VHF data broadcast (VDB) at a 2-Hz rate 17,18 . navigation. Figure 1 shows a functional block diagram for the Integrity risk : It is the probability of an Stanford University LAAS ground facility (LGF) undetected (and potentially hazardous) navigation prototype known as the Integrity Monitor Testbed system state. (IMT). The functions shown in yellow boxes are those Continuity: Likelihood that the navigation signal- required to calculate DGPS corrections 10,19 . These in-space supports the accuracy and integrity algorithms are well understood and comprise perhaps requirements for the duration of intended operation. 10% of the IMT software. The functions shown in Continuity risk: It is the probability of a detected green boxes are groupings of integrity monitor but unscheduled navigation interruption after the algorithms that are designed to detect different failure initiation of an approach. modes as follows: Availability: Fraction of time navigation system usable (as determined by compliance with accuracy, integrity and continuity requirements) before SQM (Signal Quality Monitoring): Detects satellite signal deformation, low signal power and code-carrier approach is initiated. 14 divergence . These requirements are parametrized in such a way DQM (Data Quality Monitoring) : Detects that each aircraft is able to determine, before anomalies in satellite navigation data 20,21 (ephemeris beginning an operation, whether or not it can proceed. and clock data) . The aircraft does this by computing (i) position- MQM (Measurement Quality Monitoring): Detects domain ‘protection levels’, based on the GPS step, ramp and acceleration errors in reference satellites in view and approved by GBAS, (ii) the receiver measurements (may be due to satellite or ranging error standard deviations or ‘sigmas’ receiver faults). broadcast by GBAS and (iii) the ‘ K-value’ multipliers MRCC (Multiple Receiver Consistency Check): needed to achieve the required integrity and Computes B-values that compare measurements continuity risk probabilities based on a zero-mean across reference receivers and uses them to detect Gaussian distribution of nominal errors. For GBAS reference receiver failures. requirements, the integrity requirement dominates the σµ -monitor ( Sigma-Mean Monitor): Collects B- accuracy requirement; thus verification of integrity values over time and uses them to detect violations of also confirms accuracy. Continuity is covered by only the broadcast pseudo-range correction error sigma including the set of measurements whose probability (σpr_gnd ) and assumed mean of zero. PULLEN & ENGE: GBAS INTEGRITY MONITORING FOR CIVIL AVIATION 251 Fig. 1 — LAAS integrity monitor testbed (IMT) functional block diagram The IMT implementation of these functions is fault (H1) hypothesis. The vertical protection level elaborated elsewhere 19,22 . (VPL) for the H0 hypothesis is given in a simplified The remaining 30-40% of the code is dedicated to form 13 by Executive Monitoring (EXM), which collects the outputs from each monitor and determines which VPL H0 = KFFMD σvert,H0 …(1) measurements, if any, are flawed and must be excluded from the set used to compute the differential where σvert,H0 is derived by computing the weighted corrections sent to users. The EXM in IMT is pseudo-inverse matrix S based on the line-of-sight primarily based on Boolean logic. vectors to the satellites and the range error (after For example, monitor alerts (generated when a test corrections are applied) sigmas broadcast for each statistic exceeds its pre-set acceptability threshold) on approved satellite. A separate VPL for the H1 multiple