A probabilistic assessment on the Range Consensus (RANCO) RAIM Algorithm

Transcription

1 A probabilistic assessment on the Range Consensus (RANCO) RAIM Algorithm Markus Rippl, German Aerospace Center Georg Schroth, Technische Universität München Boubeker Belabbas, German Aerospace Center Michael Meurer, German Aerospace Center BIOGRAPHY Markus Rippl received his Diploma in Electrical Engineering and Information Technology from Technische Universität München (TUM) in Since then, he has been a research fellow in the Institute of Communications and Navigation (IKN) at the German Aerospace Center (DLR) in Oberpfaffenhofen near Munich. His field of work is the integrity of GNSS based navigation using receiver-side algorithms. Georg Schroth is a Ph.D. candidate working in the Institute of Multimedia Technology at Technische Universität München (TUM). His research focuses on localization methods based on visual information. He holds a Bachelor of Science degree (2007) and a Diplom-Ingenieur degree (2008) in Electrical Engineering and Information Technology from Technische Universität München. He also participates in the graduate program on Technology Management of the Center for Digital Technology and Management (a joint venture of both Munich Universities), which is part of the Elite Network Bavaria. During the fall of 2007 he joined the Global Positioning System (GPS) Laboratory at Stanford University as a Visiting Researcher. Boubeker Belabbas is a research fellow in the IKN at DLR in Oberpfaffenhofen. He is a PhD student at ENPC (École Nationale des Ponts et Chaussées) in Paris and an external PhD student at TUM. He works in the field of GNSS integrity and its applications in augmentation systems and for Safety of Life receivers. Michael Meurer received a Ph.D. degree in Electrical Engineering and in 2005 became an Associate Professor (PD) at the University of Kaiserslautern, Germany. Since 2006, Dr. Meurer has been with the IKN at DLR, where he is currently the director of the Department of Navigation. ABSTRACT The Range Consensus Algorithm (RANCO) is a new RAIM method capable of detecting multiple satellite failures at reasonable computational effort. RANCO was first introduced at ENC 2008 []. Enhancements of the RANCO algorithm have been presented at the ION GNSS 2008 [2]. Up to now, optimal parameters with respect to the overall performance denoted by the probability of missed detection have only been found by means of simulation. The following work presents an analytical assessment of the detection probabilities in RANCO, making it possible to denote integrity parameters such as missed detection probability (P MD ) and false alarm probability (P FA ). The analysis done in this paper allows a proof of the algorithm s ability to correctly detect multiple failed satellites, and a comparison against other existing RAIM algorithms well established in the integrity community and SoL applications. RANCO bases its decision about a satellite failure on multiple pseudorange comparisons referring to different satellite reference subsets (RS) of 4 SVs each. These subsets return a position solution without a pseudorange residual, thus no a-priori knowledge about the correctness of the RS can be assumed at this point. In the first step, a fault free RS is assumed, which leads to a reference position solution with an uncertainty derived from the estimated Gaussian noise on the 4 individual measurements. The range comparison between the satellite under test (SUT) and the reference subset contains both the error coming from the position projected into the line of sight (LOS) and the measurement error of the SUT itself, including a potential bias. Given the previously assumed probability of a fault free RS, the decision with respect to a bias detection on the SUT can now be performed using hypothesis testing based on the combined estimated noise variances from both the position solution mapped into the LOS, and the SUT measurement. For this step of the algorithm, detection probabilities can be determined both for the assumption that the RS contains a faulty satellite, and that it consists only of unbiased measurements from healthy satellites. The protected bias (Minimum Detectable Bias, MDB) for each satellite can therefore be given iteratively, first for the fault free assumption, and then for the assumption of a faulty RS.

2 Given the above considerations, a probability of missed detection for the overall decision on failed satellites, as well as the probability of false alarm, can be given. Similar to classic RAIM [3], the detection rates depend on the decision thresholds which can be adjusted according to fixed requirements. With assignable detection rates, the thresholds and thus the detectable biases for each satellite test can be projected into the position domain which gives a bound on the position error. Multiple failed satellites pose the danger of unobservable biases also for RANCO, and this threat has to be considered separately. However, the nature of RANCO, which analyzes satellites multiple times with different references, minimizes this threat. INTRODUCTION RANCO, the Range Consensus Algorithm, utilizes an uncommon approach to decide on the fault state estimates of the examined satellites. As opposed to classic RAIM, a range comparison is done basing on a reference position derived from the minimum number of measurements to solve the navigation equation. With only four satellites used for the compuatation of the estimate, it is guaranteed that any measurement error introduced by any of those four Space Vehicles (SV) does reliably affect the position estimate. All remaining satellites are then tested in a range comparison step by comparing their pseudorange residual in connection with the chosen reference subset against a threshold that is individual for the combination of Satellite Under Test (SUT) and Reference Subset (RS). The range consensus algorithm does not assume that a single examined RS is fault free in the first place; instead, it performs the range comparison against all remaining SVs independent from the assumed error state of the RS satellites. Because of the large number of combinations that are checked, the probability of an unobservable error combination is decreased with respect to RAIM methods that use a single, scalar test statistic such as a sum of the squared pseudorange residuals only. For the range comparison step, this paper derives both a method to denote a detection probability for the assumption of a fault free reference subset, as well as a method for reference subsets that are assumed to be faulty. By mutually checking satellites and using them as references, this approach allows the computation of an overall detection probability for specific biases for every satellite in view, assuming a maximum number of failed satellites not exceeding the number in view minus four. The main difference between the two methods is the magnitude of the satellite bias the algorithm can protect against. The information about the assumed fault state of all satellites, including those used as a reference and those being tested, is introduced only after the range comparison step by choosing the set of references and measurements that fits best, commonly described as the Best Consensus. For an analytical determination of detection probabilities, it is often helpful to introduce an additional constraint limiting the maximum number of possible simultaneous faults first. Where applicable, this has been done in this paper to allow an analytical approach for this simplified case; however, this is especially pointed out at the corresponding parts of the work. This work further assumes the following error model for satellite measurements: First, an unbiased (and therefore not faulty ) satellite measurement is subject to a random error process with Gaussian distribution of zero mean and with known variance. This a priori estimation of the error variance can, for example, be derived from elevation dependent models such as in [3]. Second, a faulty satellite is defined as a satellite where the measurement is biased in addition to the measurement noise. This assumption models additional errors such as undetected onboard clock or ephemeris deviations, large undetected ionospheric delays and similar effects. Since none of these errors affect the noise variance of the measurement, it is assumed that the existence of a bias does not change the noise variance, but only the mean of the measured random variable. In order to gain knowledge about the overall probability of a correct fault detection, the probabilities of every step in the algorithm are determined independently first. Since these steps are arranged sequentially within the algorithm, the overall probability of correct detection can then be derived from these components by an and -combination. Special attention has to be paid to conditional probabilities that result from an interaction between the single steps. The main decision in RANCO is done in the range comparison step, which is performed for either the complete set of combinations of RS and SUT, or a pre-filtered subset of them. The following section discusses the probability of a missed outlier detection within this step, depending on the assumption whether the individual RS includes a biased SV or not. The subsequent section shows how the probability of an overall correct detection corresponding to a single RS is determined. The following section investigates on degradation of the missed detection probability by the final range comparison step. The last section elaborates on the enhancements of RANCO that have been introduced in [2]. These enhancements reduce the set of reference subsets that are tested throughout the algorithm by selecting only those with a good geometry, and further by deselecting more subsets to reduce redundancy concerning possible failure modes.

3 RANGE COMPARISON The core of RANCO is a range comparison (Figure ) that uses the computed position estimate from a chosen RS to obtain the difference between the measured pseudorange of the corresponding SUT, and its estimate. For every RS, all remaining satellites are tested in that way, and the result is saved in terms of the number of detected inliers and outliers. The whole step is repeated for every Reference Subset that has not been previously deselected by the RS preselection steps, described in a later section. This range comparison is based on the assumption that, in the case that all involved SVs are fault free, both the measurements from the RS and from the SUT are subject to Gaussian noise with zero mean. While the measurement noise on the SUT propagates directly into the range residual, the noise on the SVs contained in the RS is connected to the measured range residual by the geometry between each RS satellite and the Line Of Sight (LOS) to the SUT. Fig.. Range Comparison based on a 4 SV reference subset The measured pseudorange residual is a sum of these both error components: ξ = ξ RS + ξ SUT. () Given the geometry matrix of the RS, G RS, and the LOS vector g k corresponding to a single SUT k, the range residual error component introduced by the measurement errors of the RS satellites, is computed by ξ RS = g T k G RS y RS, (2) where the measurement errors on the reference satellites are defined as y RS = y y 2 y 3 y 4. (3) Range Comparison with a fault free Reference Subset If a set of fault free satellites in the RS is assumed at this time, their measurement errors y RS can be modeled as a vector of Gaussian distributed, zero mean random values with an individual standard deviation, which is a function of satellite elevation in the utilized model. The vector of measurement errors is a four-dimensional, Gaussian random process: Y RS N(0, σ 2 ) N(0, σ 2 2 ) N(0, σ 3 2 ) N(0, σ 4 2 ) (4) By transforming the pseudorange variances into the LOS between the estimated reference position and the SUT, we get σ ξ,rs = gk T ( ) G T RS WG RS gk, (5) where the variances of the RS satellites are contained in the weighting matrix W RS as σ W RS = 0 σ σ (6) σ 2 4 Note that in this particular case, the weighting matrix contains only the expected noise variances of the four reference satellites, which are arbitrarily numbered to 4. The same assumption of an unbiased, Gaussian random measurement error holds for the error component of the measured pseudorange residual that is introduced by the SUT, if the corresponding SUT is unbiased, or fault-free. We can denote the probability distribution of the random process Ξ SUT ff as follows: Ξ SUT ff N(0, σ SUT 2 ) (7) A SUT which is subject to a bias can be modeled by a biased Gaussian random process with bias B: Ξ SUT fail N(B, σ SUT 2 ) (8) The noise error contributions from all involved satellites are considered uncorrelated; thus it is valid to model the measured range residual ξ as an unbiased Gaussian probability density function with combined variance Ξ ff N ( 0, σ RS 2 + σ SUT 2 ) (9) if both the RS and the SUT are fault free, and Ξ fail N ( B, σ 2 RS + σsut 2 ) (0) if the SUT is biased. The common variance of this joint probability density functions is defined as

4 σ ξ = σ RS2 + σ SUT 2. () The decision whether a particular SUT should be considered as an outlier can therefore be done by comparing the range residual between the RS based reference position and the SUT pseudorange measurement with respect to a specific threshold T. Fig. 2. Hypothesis test when RS is fault free Figure 2 shows the estimated probability density function of ξ, if a fault free reference subset is assumed, as the unbiased Gaussian normal distribution with zero mean. The performed test decides in favor of the null-hypothesis, if the absolute value of ξ is less than the threshold T. The hypothesis is rejected in favor of the alternate hypothesis if the residual exceeds the threshold in any direction: H 0 : ξ T H : ξ > T (2) For an estimated standard deviation of the range residual of σ ξ, the false alert probability is then computed by P FA = 2π σξ +T T ( e x 2 σ ξ ) 2 dx (3) A range comparison using a fault free RS and a faulty SUT with bias B, however, results in a range residual that is Gaussian distributed around B, with an identical variance σ ξ. For a given threshold T defined through the specification of the false alarm probability, there exists a minimum bias on the SUT that can be detected with a given detection probability. The missed detection probability, P MD, equals to the area of the H probability distribution, which would not lead to the rejection of the null-hypothesis in spite of the existence of a bias. It can be given for any bias B as P MD (B) = 2π σξ +T T e 2 ( x B σ ξ ) 2 dx, (4) which is depicted as the red shaded area in Figure 2. Because of the symmetry of Ξ ff, the probability for a biased SUT with B = B will be equal, and any missed detection probability for a bias higher than B will be lower. Given the above computation, each SUT can be protected against a bias higher than a certain value under the assumption that the reference subset is fault free. For a faulty subset, of course, this does not hold anymore. However, each satellite used in a RS is at least once tested as a SUT itself, thus it is guaranteed that its potential bias is less than a certain value. Biased reference subset as an a priori assumption are covered in the next section. Range Comparison with a faulty Reference Subset In the case that the reference subset contains a faulty satellite which produces a biased range measurement, the bias propagates into the reference position used to compute the range residual. If multiple biased satellites occur in the same reference subset, their biases can be combined to a common error in the position domain that affects the reference position estimate. The position error is then mapped into each line-of-sight pointing to each satellite under test by the respective part of the geometry matrix, or the line-of-sight vector g k. Generally speaking, the possibility of a generic bias in the measured range residual that is caused by a erroneous reference subset makes reliable outlier detection impossible. However, if all combinations of reference satellites are checked with all satellites, and there are at least four fault free satellites in view, each satellite is at least once compared to a fault free reference subset. As described in the previous section, this comparison can protect against a bias that is specific to the estimated variances used in this combination, and the geometry of the used reference satellites and the satellite under test. From all minimum detectable biases (MDB) that have been determined for a specific satellite k using all possible reference subsets, the satellite is at least protected against the largest MDB. The resulting maximum bias that can remain undetected may be used as a worst case bias for the satellite for all the range comparisons where it is used as a reference satellite. If multiple satellite faults within the RS are considered a threat, the maximum bias contribution to the range residual error produced by a combined failure of any of the RS can be determined by evaluating all combinations of biases: B RSmax = max gt k G RS a B a 2 B 2 a 3 B 3 a 4 B 4 ; (5) with a, a 2, a 3, a 4 { ; +} and the maximum positive undetectable biases B, B 2, B 3, B 4 for the individual

5 reference satellites. This worst case bias component can now be accounted for together with the Gaussian distributed noise component coming from the reference subset. The noise component is again modeled as a four-dimensional, zero mean noise on the individual reference satellite ranges, y RS,ff = y y 2 y 3 y 4 ; Y RS,ff N(0, σ 2 ) N(0, σ 2 2 ) N(0, σ 3 2 ) N(0, σ 4 2 ). (6) and it translates to a zero-mean, Gaussian random process on the SUT line-of-sight. Together with the bias component B RSmax, it results in a non-zero Gaussian error contribution on the measured pseudorange residual: denoted as B SUT, and B RSmax respectively. It can be seen in Figure 3 that in order to detect a SUT fault with the same probability of missed detection as in the faultfree RS case, the minimum bias is increased by the amount of B RSmax. The resulting probability density function of a residual under the influence of both biases is now defined by B SUT B RSmax, and we can assume the probability density function of the SUT contribution itself on the right edge of the figure. ξ RS,fault = gk T G RS y RS,ff + B RSmax a B = gk T G RS y RS,ff + a 2 B 2 a 3 B 3 (7) a 4 B 4 The PDF of this contribution can now be denoted as Ξ RS,fault N ( B RSmax, σ RS 2 ). (8) and the random process of the measured pseudorange residual is then again a combination of the above Gaussian process and the Gaussian error from the SUT, assuming statistical independence: Ξ fault N ( B RSmax, σ RS 2 + σ SUT 2 ). (9) The result is a maximum effective bias on any SUT line-of-sight that can remain undetected when using a specific set of reference satellites. Because the term is contained in the measured range residual (Eq. ()), it adds an additional uncertainty to the remaining SUT based range error that has to be considered if we assume a faulty RS. The worst case in terms of detection probability is in effect when the RS generated bias cancels out the SUT generated bias, e.g. their signs differ: sign(b RSmax ) = sign(b SUT ) (20) In this worst case, the measured pseudorange residual is a Gaussian distributed noise with a bias equal to the difference between the RS bias and the SUT bias: ξ WC = ξ RS + ξ SUT = ξ RS,ff + ξ SUT,ff + B SUT B RSmax, (2) where the unbiased random processes ξ RS,ff and ξ SUT,ff denote the noise contributions from RS and SUT, and the biases are Fig. 3. Hypothesis test when RS is faulty with bias B RSmax The probability density function of the underlying SUT error component has therefore to be shifted to the right by the amount of B RSmax, in order to allow for a fault detection with the required P MD also in the worst case, when the SUT bias is canceled out to the maximum by a RS induced bias. The MDB RSfail can now be given as a function of B RSmax : MDB RSfail (B RS,max ) = MDB RSff + B RSmax (22) The above method is only valid for the assumption that any bias on the reference subset satellites is bounded correctly, i.e. that a possible bias on any reference satellite has been detected while the corresponding satellite was a SUT itself. This assumption is valid if a maximum number of simultaneous failed satellites smaller or equal than N 4 is assumed, and a complete constellation check (using all RS combinations) has been done for each of the satellites now used as an RS. DETECTION PROBABILITY OF OUTLIER SETS This section discusses the detection probability connected to the overall outcome of all satellites tested with one specific reference subset (RS). Up to now, each of the SUTs belonging to that RS has been considered either an outlier or an inlier, where we can specify a minimum detectable bias and a missed detection probability for this bias. Of course, all higher biases have a higher probability of being detected, so using the missed detection figures for the minimum bias is a worst case assumption. The set of inliers and the set of outliers constitute the result of all SUT satellites checked against a single specific RS. Each satellite can be either considered an inlier, or an outlier, in the context of a single test set using one RS. The set of all satellites

6 in view is the combination of the RS, the set of inliers and the set of outliers (Figure 4). With the Bayes theorem, the conditional probability of P (F j o i ) can be derived for N satellites in view from the probabilities determined above, and the overall probability of F satellites failing: P (F j )P (o i F j ) P (F j o i ) = N k= P (F, with (25) k)p (o i F k ) ( ) j N P (F j ) = P SVfail. (26) j where P SVfail is an assumed probability of a satellite fault. Fig. 4. Satellite Sets for a specifically chosen Reference Subset Given the previously assumed probabilities of false alert and of missed detection for each decision, we can now compute the probability that the overall decision on the resulting set is correct. This is achieved by taking into account every possible combination of correct detection or misdetection of every inlier or outlier. It can be done individually for each outcome of the decision and is purely based on the detection probabilities from the previous step. In the following, we assume that a total of o outliers have been detected out of N SUT SUTs, while the total number of F = satellites have really failed. The correct detection number would therefore be o =, but the detection is only valid if the correct faulty satellite has been detected. We can give the probability for each outcome of the decision: P (o 0 F ) = P MD ( P FA ) N F P (o F ) = ( P MD ) ( P FA ) N F + FINAL OUTLIER IDENTIFICATION PROBABIL- ITY After the best consensus detection, the decision on inliers and outliers is revised as a final step. As opposed to the initial range comparison, the reference position here is computed using a set of satellites which include both the RS satellites that were considered originally, plus all inliers that were found in the previous range comparison step. The new reference position may result in a different set of detected inliers and outliers after the second step. Especially if all newly incorporated measurements were to have a similar impact on the reference position, e.g. they all pull into the same direction, the new decision making process may be unreliable. Since the errors on all healthy satellites are considered uncorrelated, the probability for this effect can be assumed low if no misdetected outliers are in the first inlier subset. Figure 5 shows the possible outcomes after a revised decision using a all-inliers-in-view solution for the second reference position estimate. For simplification, the problem is reduced to a two-dimensional estimate of ˆx instead of the four-dimensional position estimate. Thus, the reference subset in the first step contains only a minimum number of two samples instead of four satellites. +(N F ) P MD P FA ( P FA ) N F (23) For an outcome of o = outliers, the probability of interest is included in the second line, which gives the probability for a single detection in case of a single fault. This value contains both the probability for a correct detection of the right outlier, as well as the detection probability for a missed detection of the outlier in combination with a false alert for an inlier. Both these outcomes would count one outlier, but only the first result is a correct detection. The same probabilities can be given for any other numbers of actually faulty satellites, e.g. F = 2 and o = : ( ) F P (o F 2) = ( P MD)P MD( P FA) N F + o ( ) N F + (N F )P 2 N F MD P FA( P FA) o (24) Fig. 5. Revision of inlier/outlier detection and detection faults The figure shows four satellites where the inlier/outlier decision has been altered after the second range comparison

7 step: Here, two satellites that have previously been detected as an outlier are now considered as an inlier on the upper left part of the figure. Two satellites which have originally been considered as an inlier, but now are considered as an outlier are shown in the lower right part. For each of these pairs of satellites, one satellite is truly an inlier, or a fault free satellite (H 0 hypothesis), and the other satellite is a faulty satellite with a bias. For all four satellites, the detection states for the first step and the second step are given as a subscript, where FA stands for false alarm, MD stands for missed detection, CI means a correctly detected inlier, and CO means a correctly detected outlier finally. Each of these four possibilities of a transition of a satellite between the set of inliers and the set of outliers affects a different performance metric of the algorithm: In the case of Satellite, the previous decision considered it an outlier, which was a correct decision. Because of the new estimate of the position (or linear equation, in the model example), it is now however detected as an inlier. This effect degrades the probability of missed detection with respect to the P MD that can be given without the final step. The second satellite, SV 2, was also previously detected as an outlier. However, it s error state is fault-free, making the first decision a false alarm. If it is detected as an inlier in the second step (correct decision) the overall false detection probability is lowered; however the transition does not affect the missed detection probability. In the third case, we show a faulty satellite SV 3 that was previously misdetected, and is now correctly identified as an outlier. The transition lowers missed detection probability of the overall detection algorithm because of an additional wrong decision. Case 4, finally, shows a satellite (SV 4) that was previously correctly identified as an inlier, but now is erroneously considered as an outlier. This decision increases the false alarm rate, but does not change the missed detection rate. If robustness concerning the missed detection rate is a design goal, the only case that needs to be considered is case (), which increases the missed detection probability. A conservative approach to avoid this case would be either to lower the second threshold in a way that it does not exceed the first inlier space at any point. However, this reduction affects the false alert probability in a drastic way, which could lead to continuity issues when applied, for example, in the field of aviation applications. Another measure to prevent any additional degradation of the missed detection rate is to prevent the algorithm from belatedly including any outlier satellites from the first step into the final inlier solution. This conservative approach is also a trade-off between false alert probability and missed detection probability, but may be more efficient than the first suggestion. IMPACT OF RANCO ENHANCEMENTS This section discusses the impact of the two subset selection methods introduced in [2], where the set of all possible reference subsets is reduced significantly in order to increase the algorithm s performance. By these selection steps, the set of subset is not only made smaller, but also its probabilistic properties are changed. The first of the two enhancement steps selects reference subsets (RS) with a good geometry from the overall set of possible satellite combinations that can be used to estimate a reference position. This is done by deselecting those subsets that contain any pair of satellites with a collinearity factor higher than a certain threshold. The collinearity is the dot product of the unit line-of-sight vectors, which varies between zero for fully orthogonal vectors, and one for a pair of parallel vectors. By deselecting those satellite pairs (and consecutively, those reference subsets that contain one of these pairs), reference subsets that presumably result in a high position uncertainty are excluded from further processing. The second deselection reduces all unnecessary redundancy from the following range comparison steps by leaving just enough reference subsets to cover each failure mode at least once. A failure mode is here defined as a distinct combination of specific satellites that are allowed to fail simultaneously, and naturally, this step requires a further assumption of a maximum of simultaneous satellite faults. Typically, a limitation to four simultaneous faults results in a reduction of the RS combinations from some hundreds to a few tens of subsets that have to be checked. Both these deselection processes do not alter single reference subsets, but remove whole reference subsets completely. Ultimately, this results in a lower number of (redundant) checks for every single satellite, but does not affect the process of comparing the pseudorange measurement of each satellite with the estimated value, which is determined by computing the position solution from the reference satellites. The detection probabilities that have been derived above are therefore not affected by deselecting RS in this very first step. However, an effect on the consensus finding process can not be excluded, since the deselection of distinct RS is possibly correlated with their probabilistic properties, although it should assumably result in better detection robustness. CONCLUSION This paper shows that for the core algorithms within RANCO, a missed detection probability connected to a protected bias can be given. This has been done under assumptions that the measurement noise is modeled as Gaussian distribution and the bias is independent of the noise variance. The protected bias is specific to every combination

8 of tested satellite and reference subset, and can be iteratively computed by using an a priori assumption of a faulty reference subset first, and a fault free reference subset subsequently. The probability of a correct over-all decision can be derived by combining the computed probabilities from the tested satelltites. The final outlier definition step can be made robust against degrading the missed detection probability at the cost of a higher false alert rate. With the complete set of protected biases, it is also possible to compute a protection level using the very same approach that is also used in classic RAIM algorithms. Although some assumptions have been made regarding the measurement error models, this approach shows that in general, RANCO s performance in terms of integrity can be analyzed and determined. This paves the way for its application in a context where integrity parameters are an important part of the requirements. The enhancements that perform a pre-selection on the analyzed reference subsets do not impact the detection probabilities in the range comparison steps. However, it could not be shown analytically that the deselection of subsets based on geometry does not have an impact on the overall detection robustness, since this requires that the probabilistic properties of the subsets are uncorrelated with their geometrical aspects. As future steps, the authors plan to validate the proposed mechanisms by simulation, and investigate further on multiple faults; since the capability of detecting multi-satellite fault conditions is a key feature of RANCO. Also, the algorithm could be analyzed under the impact of non-gaussian, generalized noise distributions. Additionally, both the random error contribution and the bias on any satellite are considered uncorrelated between satellites in this paper. Various work on this topic has suggested that errors are in fact correlated to a certain point, which, in the proposed approach, means that errors on the reference satellites influence errors on the tested satellites, and vice versa. If this effect is taken into account, the variance of the combined residual can not be computed anymore by adding the individual component variances. Generalization of the approach to take the correlation of measurement noise into account is therefore another topic that could be investigated in the future. REFERENCES [] G. Schroth, A. Ene, J. Blanch, T. Walter, and P. Enge, Failure Detection and Exclusion via Range Consensus, in Proceedings of the ENC GNSS Conference, [Online]. Available: [2] G. Schroth, M. Rippl, A. Ene, J. Blanch, B. Belabbas, T. Walter, P. Enge, and M. Meurer, Enhancements of the Range Consensus Algorithm (RANCO), in Proceedings of the ION GNSS Conference, [3] T. Walter and P. Enge, Weighted raim for precision approach, in Proceedings of the ION GNSS Conference 995, ser. ION GPS-95, ION. ION, 995. [Online]. Available: wwu/papers/ gps/pdf/wraim tfw95.pdf