CUSUM-Based Real-Time Risk Metrics for Augmented GPS and GNSS

Transcription

1 CUSUM-Based Real-Time Risk Metrics for Augmented GPS and GNSS Sam Pullen, Jiyun Lee, Gang Xie, and Per Enge Department of Aeronautics and Astronautics, Stanford University ABSTRACT Sigma monitoring is a key component of the real-time integrity verification capability demonstrated by the Stanford University Local Area Augmentation System (LAAS) Ground Facility prototype known as the Integrity Monitor Testbed (IMT). The IMT has both sigma estimation and sigma Cumulative Sum (CUSUM) algorithms to detect small and large sigma violations, respectively. When combined with a prior probability distribution for the sigma parameter being monitored and the use of Bayes rule, the CUSUM can provide a realtime posterior distribution of sigma based on the current CUSUM state. This paper presents the methodology for this Bayesian CUSUM technique and shows how it could be used to enhance integrity monitoring while better preserving continuity and availability. 1.0 Introduction The key to real-time integrity verification in GNSS augmentation systems such as Ground Based Augmentation Systems (GBAS) and Space Based Augmentation Systems (SBAS) is the computation of real-time protection levels by aircraft. Protection levels provide bounds on position-domain error at the required integrity probabilities based on the quality of GBAS or SBAS corrections and the visible satellite geometry. The key input to these calculations is the standard deviation (or sigma ) of nominal GBAS and SBAS range-domain corrections, which must bound the actual distributions of nominal errors with a zero-mean Gaussian distribution derived from that sigma. Since the tails of the underlying distribution are not well known and may change over time, the only way to do this is to broadcast conservative nominal sigmas and continually monitor them so that violations are detected within a reasonable time [1]. Two different sigma monitor algorithms have been implemented in the Stanford University Integrity Monitor Testbed (IMT), which is a prototype of a GBAS/LAAS ground facility. Both of these monitors use B-values as inputs. These B-values represent differences between multipath and receiver noise errors (after carrier smoothing) among the redundant LAAS Ground Facility (LGF) reference receivers (RRs), as illustrated in Figure 1 on the next page (see [3,4] for details). If a large and immediately-hazardous multipath error were to occur on one reference receiver, it would be observable in the B- values for that receiver and would be detected and excluded by the MRCC and EXM-IIA functions in Figure 1 [3]. Smaller anomalies which are not immediately hazardous need not be detected within the 3-second LGF time-to-alert. However, if they cause a Gaussian distribution with the broadcast sigma to no longer bound the true error distribution to the required integrity probability, they must be alerted and corrected within one hour to one day, depending on whether the resulting integrity risk increase is minimal or non-minimal [2]. As shown in Figure 2 on the next page, the sigma estimation algorithm, which simply estimates the sample standard deviation of the B-values for each satellite and reference receiver, can detect minimal sigma violations within the one-day requirement but cannot reliably detect non-minimal violations within one hour. A reliable estimate of sigma is not possible until at least 18 B-value inputs are collected over 1 hour (due to carrier smoothing and multipath, a 200-second interval between statisticallyindependent B-values is assumed). Because of the limited response time of sigma estimation, Cumulative Sum or CUSUM mean and sigma monitors have been added to the Stanford IMT. As Figure 2 shows, the CUSUM sigma monitor alerts large sigma anomalies (i.e., true sigmas greater than 1.7 times the broadcast sigma) more rapidly than sigma estimation. The CUSUM advantage is actually larger than what is shown in Figure 2 because the CUSUM responds immediately (rather than after one hour) and typically flags large sigma violations in less than one hour [4]. This paper extends the use of the CUSUM sigma monitor beyond simply alerting when a pre-set broadcast sigma value has been sufficiently exceeded. By combining the CUSUM with a straightforward application of Bayes Rule, we can infer the probability distribution of the true sigma as a function of the current CUSUM state. This gives GBAS and SBAS ground systems more

2 Figure 1: Sigma Monitors within Stanford University LGF Prototype; the Integrity Monitor Testbed (IMT) ground system as the most practical means of implementing a sigma CUSUM that meets the requirements of the Bayesian approach. Section 6.0 shows how this approach can be used in real time to respond to sigma anomalies with temporary increases in the broadcast sigma and/or measurement exclusions while warning of possible continuity loss ahead of time. Figure 2: Response Times (until P MD 0.001) for IMT Sigma Estimation and Sigma CUSUM Monitors flexibility in responding to sigma increases before an alert (possibly causing loss of user continuity) is required. Section 2.0 of this paper introduces the CUSUM sigma monitor technique, and Section 3.0 describes the Bayesian CUSUM approach in detail and discusses the selection and significance of the prior distribution of sigma. Section 4.0 illustrates this approach for an example prior sigma distribution and discusses how to evaluate and use the results. Section 5.0 proposes the addition of a remote Position Domain Monitor (PDM) to the GBAS/LAAS 2.0 Cumulative Sum (CUSUM) Sigma Monitor An effective means of detecting non-minimal sigma violations within the required one hour is the technique of Cumulative Sum (CUSUM) monitoring [4,5,6]. As implemented in the IMT, the sigma CUSUM monitor maintains cumulative sums (C + n ) of squared and normalized (by the broadcast sigma, which represents an upper bound on the nominal or in-control sigma) B- values (Y n ) for each receiver channel tracking a GPS satellite: Y n = BPR σ 2 µ 0, B (1) 0, B Because the CUSUM updates must be statistically independent in time, these updates are separated by 200 seconds, or twice the LGF carrier smoothing time constant. Note that incrementing a CUSUM with highlycorrelated inputs greater than the k factor will cause it to quickly exceed the threshold as similar values are added one after another; thus the CUSUM will also detect anomalous low-frequency multipath with a temporal

3 correlation significantly exceeding 200 seconds. The CUSUM starts at zero or a head-start value of H + > 0 and then increments each epoch by the size of the monitored input Y minus the desired failure slope k that is based on a target out of control sigma (σ 1 ) that represents failed performance: C C n = = 0 max (or use ' head start': H + ( 0, C + Y k ) n 1 ln n ( σ ) ln( σ ) + ) (2) k sigma = (3) ( 2σ ) ( ) 1 1 2σ 0 If the CUSUM falls below zero on a given epoch, it is reset to zero or to the head-start value. If the sum is above zero at any update epoch, the CUSUM is compared to a fixed threshold (h) that does not vary with time. If it accumulates to above the threshold, an alert is issued. Provided that the individual B-value inputs are statistically independent over time, CUSUMs follow the Markov property (since a running sum is incremented every epoch, the distribution of the CUSUM state at epoch i depends only on its state at the previous epoch i 1 and the distribution of the incrementing value at epoch i), which makes them straightforward to analyze via Markov Chains (MCs) [5,6]. Under either nominal or specified failure conditions (e.g., a given value of the true sigma), a "one-step" MC transition matrix P can be derived to give the probability of going from each discretized CUSUM state between zero and the threshold h on epoch i to each possible state on epoch i+1. From P, one can compute the steady-state distribution of the MC and thus determine how long, on average, it takes for the MC to exceed a given value (for the threshold h, this gives the average run length (ARL)). Multiplying P by itself d times (e.g., computing P d ) gives the transition probabilities between epoch i and epoch i+d, which allows one to determine, from the failure-state MC, the number of epochs required to exceed the threshold with a given missed-detection probability (see [4] for details). The normal process for designing a mean or sigma CUSUM monitor is to guess a threshold value h, form the nominal MC, and then solve for the nominal ARL, iterating on h until the nominal ARL is the inverse of the desired fault-free alert rate (based on a sub-allocation of the LGF continuity requirement). Then, changing the MC to represent the failed or "out-of-control" state, we compute the out-of-control ARL (or mean time to detect), and we successively multiply the P matrix by itself until it shows a probability of exceeding the threshold that is one minus the desired missed-detection probability [2,5]. The steady-state distribution of the CUSUM is defined by a vector x that satisfies xp = x, meaning that the distribution does not change from one epoch to the next. Figure 3: IMT CUSUM Sigma Monitor Response under Nominal Conditions Figure 4: IMT Sigma CUSUM Response with Injected Failure on SV 2, Reference Receiver 2 This vector can be found by solving the following matrix equation [5,7]: (I P P) x = 0 (4) where I P is the identity matrix with the same dimensions as P, and 0 denotes a corresponding vector of all zeros. This is equivalent to finding the null space of the matrix (I P P) and is straightforward in numerical computer applications such as MATLAB [8].

4 Note that if the MC has an absorbing state, such as the CUSUM state that exceeds the detection threshold and results in termination of the CUSUM, the steady-state (long-term) probability of being in that state will be one for any sigma greater than zero. In other words, for any positive sigma, the CUSUM will eventually cross the threshold and alert if one waits long enough. To avoid this result in practice, the transition matrix for the Bayesian CUSUM to be described in the next section is such that the CUSUM resets to zero (or to the head-start value) when the threshold is violated rather than terminating. In addition, the threshold for this purpose is assumed to be twice that of the actual threshold h so that the probability of re-setting after an alert is negligible. Figures 3 and 4 show typical responses of the CUSUM sigma monitor built into the Stanford IMT [4]. In this monitor, σ 1 = 2.0 and thus k = from (3). The detection threshold is h = 36, which gives a mean ARL of 10 7 epochs when the true σ = σ 0 = 1.0. The head-start value is H = h/2 (i.e., the CUSUM is reset to half of the threshold value every time it goes below zero and resets). Under nominal conditions in Figure 3, the k value exceeds the normalized, squared B-value input for most updates; thus a pattern of re-setting at h/2 and then drifting down to zero repeats endlessly. In Figure 4, an estimate of the code-phase error on satellite 2 and reference receiver 2 is made using a code-minus-carrier calculation (with an estimate of ionosphere delay removed). This estimate is then doubled and added to the original code-phase measurement on that channel, which simulates an increase in code-phase error by a factor of 3. The result is that most normalized, squared B-value inputs to the CUSUM significantly exceed the k-value, and the CUSUM alerts in three updates, or about 10 minutes (each B-value input is separated by 200 seconds to make them statistically independent under normal conditions). 3.0 CUSUM-Based Real-Time Risk Assessment As noted above, using the MC model, if the true system state (in this case, the normalized sigma being monitored) is given, one can compute the steady-state probability of being in any given CUSUM state between zero and the detection threshold (provided that detection is not modeled as an absorbing state). From an LGF standpoint, it would be very useful to reverse this probabilistic inference to give a real-time estimate of the probability distribution of the true sigma given the current CUSUM state. In addition, if we assume that the CUSUM state is a complete picture of the total risk picture and that the tails of the error distribution modeled by sigma are sufficiently close to Gaussian (or otherwise of known shape, if not Gaussian), we could combine this posterior sigma distribution with a Gaussian extrapolation to estimate the real-time probability of exceeding the computed protection level given knowledge of the current CUSUM state. The resulting probability would be an approximation of the likelihood of a user hazard due to anomalous multipath errors in the LGF pseudorange corrections. Bayesian probabilistic inference provides us a natural means to do this if we can define the prior (premonitoring) distribution of the true sigma value. In its simplest form, Bayes Rule is a modification of a wellknown conditional probability identity: i ( B) Pr B A Pr ( A ) Pr A B Pr = (5) Dividing both sides by Pr(B) gives the most common expression of Bayes Rule for discrete probabilities [9]: i i Pr ( Ai ) ( B) Pr B A Pr Ai B = (6) Pr In our context, A i represents a specific value of sigma from among a continuous or discrete set of candidate sigmas, and B represents the CUSUM state. In other words (denoting the true LGF multipath and receiver noise sigma as σ pr_true and the discretized sigma CUSUM state as C): ( C) i ( σ ) Pr C σ pr _ true Pr pr _ true Pr σ pr _ true C = (7) Pr The left-hand side of this equation represents the desired probabilistic inference result (the probability of sigma given the current CUSUM state). The first term in the numerator of the right-hand side is the steady-state MC result derived from (4). The key thing that must be added to use (7) is an assessment of the prior distribution of the true LGF multipath and receiver noise error sigma prior to sigma monitoring. As described in [10], a combination of theoretical error modeling and empirical data collection and analysis of each intended LGF site is needed to establish broadcast σ pr_gnd values (as a function of satellite elevation and azimuth) that bound the true error distributions under all (or almost all) foreseeable circumstances. Since the true value of σ pr_gnd (or σ pr_true ) will vary with time and cannot be known exactly, using theoretical and experimental results to assign a probability distribution to σ pr_true is a reasonable step in the process of selecting the broadcast σ pr_gnd. The calculations needed to use (7) are most naturally done discretely (i.e., numerically); thus no specific form of the prior distribution is required it simply needs to be a valid probability distribution. Given a distribution for Pr(σ pr_true ), the marginal (non-conditional) distribution of the CUSUM state C in the denominator of (7) can be computed directly from the two terms in the numerator: Pr ( ) = Pr Pr ( σ ) C i C i pr _ true, j pr _ true, j j σ (8)

5 Figure 5: Example Prior Distribution of LGF σ pr_true where C i represents a specific discrete CUSUM state i between 0 and the threshold h, and σ pr_true,j represents a particular discrete value j of σ pr_true. Before exploring the utility of the Bayesian approach, it should be noted that the use of Bayesian statistical inference is controversial and is not universally accepted. The key dispute is not so much about the mathematics as about the philosophical implications of combining a partially subjective distribution (Pr(σ pr_true ), in this case) with one derived directly from mathematical analysis (the steady-state MC result Pr(C, σ pr_true ) in this case). On the other hand, the fields of decision-making under uncertainty and probabilistic risk assessment view Bayesian techniques as indispensable tools. For more discussion of the issues behind this debate, see [11]. 4.0 Bayesian CUSUM Results for Example Prior Sigma Distribution In this section, we will demonstrate the process of making Bayesian CUSUM calculations and the utility of the results based on an example prior probability distribution of σ pr_true shown (in semilog 1-CDF form) in Figure 5. This distribution was selected as broadly reasonable for practical LGF sites and is derived from a two-parameter Gamma(a,b) distribution with a = 20.5 and b = based on the MATLAB definition of the Gamma distribution [12]. Note that the Gamma distribution definition in [9] is Gamma(α,β), where β = 1/b. The mean of this distribution is a b = 0.492, which means that the broadcast σ pr_gnd of 1 is just over twice the mean sigma. The standard deviation is (a b 2 ) 0.5 = 0.109, so the broadcast σ pr_gnd is about 4.7 standard deviations above the mean sigma. However, the tail evolution of the Gamma distribution is significantly different from Gaussian. As shown in Figure 5, the probability of the true sigma exceeding σ pr_gnd is about 10-4, and the proba- Figure 6: Steady-State CUSUM Distributions as Functions of True Sigma bility of the true sigma exceeding 2σ pr_gnd is negligible (less than ). While this is not unreasonable, a morerealistic prior distribution might have a lower probability of exceeding σ pr_gnd (perhaps ) while having a higher probability of exceeding 2σ pr_gnd (perhaps ). It would be difficult to make a single Gamma distribution do this, but any valid probability distribution that best models the true sigma uncertainty in the system designer s mind could (and should) be used. Figure 6 shows the steady-state distribution (in probability density function or PDF format) of the CUSUM state (see Section 2.0) for a zero-start (H + = 0) version of the range-domain CUSUM monitor in the current IMT. Results are shown for several different values of σ pr_true, which represents σ 0 (the actual nominal sigma) in (3). The target out-of-control sigma (σ 1 in (3)) is 2.0, which gives a k value of from (3). Since the square of the normalized B-value is used to update the CUSUM in (1,2), it is instructive to compare the square root of k (k 0.5 = 1.359) to each possible value of σ pr_true. Recall that one definition of sigma is the average (or standard ) deviation of a given sample from the mean of the applicable distribution. Thus, if σ pr_true is less than k 0.5, the majority of CUSUM inputs Y n from (1) will be lower than k; thus the CUSUM will generally decrease toward zero and reset. The downward-trending PDF s for σ pr_true = 0.8, 1.0, and 1.2 in Figure 6 show this. The downward slope of the PDF decreases as σ pr_true approaches k 0.5 because the probability of a series of inputs exceeding k increases. Once σ pr_true exceeds k 0.5, the situation changes. Since the majority of inputs now exceed k, the CUSUM will generally increase toward the threshold and alert; thus the steady-state CUSUM PDF becomes essentially flat (each state between 0 and the threshold h is roughly equally likely, although state zero

6 Figure 7: Posterior Distribution of Sigma Given CUSUM State is more likely because it is the reset state). The degree to which σ pr_true exceeds k 0.5 determines the speed with which this occurs. The steady-state CUSUM distributions derived from (3) are used to fill in Pr(C σ pr_true ) in the Bayesian update equation (7). Since the prior probability of σ pr_true has also been selected, the calculations called for in (7) and (8) can be carried out to give the posterior distribution of σ pr_true given the CUSUM state. Figure 7 shows this result (in PDF format) for the prior distribution in Figure 5 and the steady-state CUSUM distributions given in Figure 6. The leftmost curve in Figure 7 gives the sigma distribution when the CUSUM is in its zero state. This distribution is similar to the prior distribution shown (in 1 CDF form) in Figure 5 but improves upon the prior more and more as σ pr_true increases. In other words, given that the CUSUM is in state zero, the probability that σ pr_true significantly exceeds σ pr_gnd is much lower than that given by the prior distribution of σ pr_true (when the CUSUM state is not known). As the CUSUM state increases toward the threshold h (the rightmost curve in Figure 7 represents that CUSUM state just below h), the distribution of σ pr_true shifts steadily to the right, meaning that values of σ pr_true greater than σ pr_gnd become more and more likely. Figure 8 shows the intermediate result from (8) the marginal probability distribution (over all possible values of σ pr_true ) of the CUSUM state in cumulative distribution or CDF format. The overall probability of being in CUSUM state zero is ; thus the CUSUM spends almost all of its time at or close to zero. The probability that the threshold h is exceeded is , which is below the design probability of 10-7 (1/ARL) because the actual σ pr_gnd is usually below the in-control sigma (σ 0 = 1) assumed in setting the CUSUM threshold. Note that this is a long-term average and is different from continuity Figure 8: Marginal Distribution of CUSUM State risk. Given a known current CUSUM state j and a known sigma, the probability of exceeding the CUSUM threshold after the next update is directly given by the (j, M+1) entry of the one-step MC transition matrix P for the given sigma (M+1 represents the discrete CUSUM state where the threshold h is exceeded) and is based on the assumed distribution of the normalized B-value input. (a Bayesian posterior transition matrix given the prior sigma distribution could be derived on a matrix element-byelement basis and is the subject of future work). Because the CUSUM is updated every 200 seconds, whereas the continuity requirement is defined per 15 or 30-second interval, the CUSUM update can be timed to minimize the actual probability of user continuity loss given a CUSUM alert. A means for doing this is discussed in Section 5. Figure 9: Mean Posterior H0 Integrity Risk Given CUSUM State

7 Figure 10: CUSUM ARLs Given Initial State and True Sigma Value Figure 9 uses the results in Figure 7 and the assumption of Gaussian tail probabilities to derive the mean (over the posterior distribution of sigma) posterior LAAS user H0 integrity risk given the current CUSUM state. This is useful both in real-time and in assessing the capability of the CUSUM sigma monitor both in real-time and offline (with respect to the LGF sigma monitor requirements). Section of the LGF Specification defines a minimal risk increase (due to σ pr_true > σ pr_gnd ) as an integrity risk increase of up to one order of magnitude increases beyond that are defined as non-minimal [2]. What is not clearly defined is the baseline integrity risk above which the system enters a minimal risk increase condition. Two possibilities exist: 1. The RTCA LAAS MASPS sub-allocation to the H0 hypothesis ( per 150-second aircraft approach duration); 2. The total LAAS MASPS integrity allocation to Performance Type (Category) I approaches ( per 150-second aircraft approach duration) [13]. The first interpretation is clearly acceptable since it is limited to the H0 sub-allocation bounded by σ pr_gnd. The discrete CUSUM state above which the mean H0 risk exceeds the H0 integrity sub-allocation is C min,1 = 6, and the CUSUM state above which the system enters a nonminimal risk increase condition is C non-min,1 = 11. From Figure 8, the long-term probabilities of being above CUSUM states 6 and 11 are about and , respectively. Under the more-liberal second interprettation, the minimal and non-minimal CUSUM states are significantly higher: C min,2 = 15 and C non-min,2 = 26, respectively. The key to the acceptability of these results is the expected CUSUM response upon entering the nonminimal condition. Since C non-min for both interpretations above is lower than the CUSUM threshold h = 36, and this threshold is set based on the continuity sub-allocation to sigma monitoring, the LGF cannot simply alert above C non-min. Figure 10 shows the CUSUM ARL or mean time to alert (exceeding the threshold h = 36) for differing initial CUSUM states (at a given epoch) and σ pr_true values. For discrete CUSUM states under 15 or so, the mean time to alert exceeds 1 hour for true sigmas well over 1.0 that represent a non-minimal risk increase conditions. Thus, for the first interpretation, the Bayesian CUSUM results in 9 fall short of the requirement to alert non-minimal risk increase conditions within 1 hour. On the other hand, given the second interpretation, the CUSUM performance is likely sufficient since a starting CUSUM state C non-min,2 = 26 leads to a mean alert within one hour for σ pr_true > 1.6. From an overall-risk-assessment point of view, defining the baseline as the total SIS integrity risk (the second interpretation) is likely acceptable because an integrity violation during a Category I approach is deemed hazardous but not catastrophic [14]. Under one

8 IMT North A2 5.90m HEPL roof 19.1m meters 61.97m A1 5.52m A meters PDM DURAND roof High roof (antennas #1,2) gps-ground Low roof (antenna #3) antenna #4 Figure 11: Position Domain Monitor Implementation in Stanford Integrity Monitor Testbed Prior σ pr_gnd Distribution σ pr_gnd Hazard Definitions CUSUM Threshold to Meet Continuity Establish σ pr_gnd Model Select σ pr_gnd Inflation Factor Compute posterior distribution of σ pr_gnd given CUSUM state Compare result to CUSUM threshold and assess continuity impact Iterate as needed Derived from theoretical models and empirical data Derived from LGF Specification Calculation and results assessment Figure 12: Use of Bayesian CUSUM in LGF Sigma Establishment Process

9 interpretation, the probability of an aircraft accident given a hazardous condition is about Thus, at the boundary of a non-minimal risk condition, the total LAAS contribution to aircraft accident risk probability is about = per approach, which is a small fraction of the typical total accident risk probability per flight of [15]. Recall that the key input to the Bayesian CUSUM approach is the prior probability distribution of σ pr_true. If the posterior integrity risk result from (7) is too high to meet the LGF sigma monitoring requirements, the prior distribution of σ pr_true must be modified in one of two ways. If additional measurements or stricter siting requirements (to reduce the likelihood of anomalous multipath) are practical, the prior distribution can be modified to reflect a lower prior probability of σ pr_true > 1.0. If this is not practical, the prior distribution can be re-normalized by increasing the broadcast σ pr_gnd and paying an availability penalty. Figure 12 provides a depiction of this process and the requirements that drive it. One difference between the Bayesian CUSUM presented here and the range-domain CUSUM implemented in the Stanford IMT should be addressed. In the IMT CUSUM algorithm, a head-start of C 0 = H + = h/2 in (2) is used to improve response time as shown in Figure 2. This Bayesian analysis instead uses a zero-start CUSUM (C 0 = H + = 0) in order to avoid loss of information. With an h/2 head start, the CUSUM goes back and forth from h/2 to 0 under nominal conditions, as shown in Figure 3; thus no significant Bayesian inference can be made from any CUSUM state below h/2 (= 18 in this example). In other words, the resulting posterior CUSUM state distribution would be approximately flat between 0 and h/2 and would tell us little about the true sigma until h/2 is exceeded. However, under the second requirements interpretation, the CUSUM state above which action should be taken (C non-min,2 = 26) is well above h/2; thus it should be possible to combine the Bayesian CUSUM with an h/2 head start and get the best of both worlds. 5.0 Use of Position Domain Monitoring Position Domain Monitoring (PDM) has been studied recently as a potential addition to the LGF to improve σ pr_gnd establishment [16,17] and executive monitoring [18]. As shown in Figure 11, PDM is implemented by adding a (internally-redundant) reference receiver some distance from the existing reference receivers to serve as a LAAS pseudo-user. This pseudo-user does not participate in computing differential corrections. Instead, it uses the RTCA LAAS MOPS [19] airborne (user) algorithms (with the differential corrections broadcast by the other reference receivers) and generates position estimates that it compares to its known (pre-surveyed) position. Because there is no guarantee that users will Figure 13: PDM-CUSUM under Nominal Conditions Figure 14: PDM-CUSUM with σ pr_true Three Times Nominal Sigma on Reference Receiver 1, All Satellites track all satellites for which corrections are provided, the PDM generates position fixes for the all-sv-approved case, for all one-sv-unused cases, and for all two-svunused cases to cover practically all user conditions. Figures 13 and 14 show example results of the PDM implemented in the Stanford IMT. Figure 13 represents nominal conditions based on example data collected by the IMT. The PDM vertical position error estimate (normalized by the theoretical vertical position error sigma based on satellite geometry, which in this case is for all approved SV in view, and the broadcast σ pr_gnd to give VPE) [17], shown in the lower plot in Figure 13, feeds a PDM-CUSUM that monitors this statistic in a manner similar to the range domain IMT CUSUM (which uses normalized B-values as inputs) described in Section 2.0. Note that the sample standard deviation of the normalized VPE is , indicating that, on average, the broadcast σ pr_gnd (in this case, the theoretical GAD B3 curve from [20]) is conservative by a factor of about 1.5.

10 CUSUM State 0 C min C non-min H Trial Inflation of σ pr_gnd Nominal State Wait for Sigma Estimator Confirmation Redo const. alert check Failure Exclusion or Alarm Required Success inflate σ pr_gnd Trial SV/RR Exclusion Success exclude SV/RR Redo const. alert check Failure Figure 15: Real-Time Use of Bayesian CUSUM Outputs to Preserve Continuity and Availability while Protecting Integrity The PDM CUSUM response (the upper plot in Figure 13) shows the same pattern of repeated trips from h/2 to zero as the range-domain CUSUM under nominal conditions in Figure 3. Figure 14 shows the case where, in a manner similar to that done to generate Figure 4 in Section 2.0, an anomaly that triples σ pr_true (such that it is well above σ pr_gnd ) is injected into nominal IMT data at time zero on reference receiver 1 and all satellites tracked by that receiver. While the VPE statistic does not exceed its 6-sigma threshold until about 40 minutes have passed, the PDM-CUSUM flags earlier, after about 27 minutes. Alerting occurs in much less than one hour, as is expected for a sigma anomaly of large magnitude that represents a nonminimal risk increase. However, in general, the PDM tests do not flag earlier than the existing range-domain B- value and CUSUM sigma monitors. The reason is that, when an anomaly affects a subset of the measurements used by the LGF to generate differential corrections, the remaining nominal measurements (in this case, all measurements on reference receivers 2 and 3) help cancel out the anomaly impact when range-domain measurements are combined into a position estimate. Thus, one advantage of the PDM-CUSUM is selectivity the ability to separate anomalies which can be tolerated (thus preserving availability and continuity) from those which must be alerted to protect LAAS user integrity. Because the PDM-CUSUM operates on an estimate of vertical position error rather than individual range-domain measurements, it is much closer to meeting the Bayesian CUSUM requirement (discussed in Section 3.0) that the CUSUM statistics represent a complete picture of current user risk. Thus, it is a near-ideal monitor to apply the Bayesian CUSUM. Figure 15 shows how a Bayesian PDM CUSUM could be used to improve real-time LGF response to anomalies. The Bayesian CUSUM offline analysis results (like the example in Figure 9) provide a map relating CUSUM states to H0 integrity risk conditions. When the PDM-CUSUM exceeds the state that defines a minimal risk increase (C min ), no immediate action is required because this condition is allowed to last for one day before being alerted (and this alert will not be one that requires urgent attention) [2]. As shown in Figure 2, the sigma estimation monitor will separately detect this condition separately if it lasts long enough to be of concern. When the PDM-CUSUM exceeds the non-minimal risk increase state (C non-min ), action is taken that does not cause loss of user continuity. Two possible actions exist, in order of preference: (1) Increase the broadcast σ pr_gnd such that the H0 integrity risk becomes acceptable again; (2) Use the range-domain B-values and sigma monitor statistics to identify the measurements most likely to be affected and exclude them from use. As noted above, if C non-min < h, this situation will occur more often that the continuity requirement allows; thus care must be taken not to cause loss of continuity. To

11 confirm this, the constellation alert check procedure can be used. Section of the LGF Specification requires the LGF to compute H0 user protection levels (assuming use of all satellites approved by the LGF and not noted as unhealthy by the GPS Operational Control Segment) and provide advance warning ( constellation alerts ) if the predicted vertical protection level will exceed the 10-meter VAL [2]. Given that this procedure is already done in real time by the LGF for the current system configuration, it could also be used to confirm whether or not an increase in sigma or measurement exclusion would cause loss of continuity. To implement this, when the PDM-CUSUM reaches C non-min, the constellation-check procedure is repeated assuming an inflated value of σ pr_gnd. If VPL remains under VAL, neither continuity nor availability will be lost; thus the inflation can be implemented. At the same time, the CUSUM must be recomputed based on the renormalized prior sigma distribution (remember that changing σ pr_gnd shifts the x-axis of the prior distribution) and B-value inputs to confirm that the revised CUSUM state is below C non-min. If inflation cannot be implemented without possible continuity loss (or if it does not reduce the CUSUM state below C non-min ), exclusion of problematic measurements would be tried next (using the same constellation-check and CUSUM-reset process). Because it would be difficult to quickly perform constellation checks and re-compute CUSUM test statistics on command, the LGF would maintain CUSUM and constellation-alert statistics on multiple LGF system states at any given time. For example, when the governing PDM-CUSUM state is below C non-min, the LGF would be proceeding under the baseline condition with the standard pre-set σ pr_gnd values and all non-flagged measurements in use. This represents one set of constellation-check and CUSUM statistics. At the same time, the LGF maintains other sets of statistics for the case where one of the M active non-pdm reference receivers is excluded (with the baseline σ pr_gnd ) and the case where the broadcast sigma is inflated to, say, 1.5 and 2.25 times σ pr_gnd (with all M active non-pdm reference receivers). This would allow the LGF to transition seamlessly to the most-desirable fallback state if the baseline CUSUM grows to exceed C non-min. The most complicated element of PDM-CUSUM response logic is coordinating the multiple PDM statistics maintained for different sets of visible-and-approved satellites. If the CUSUM state corresponding to the allapproved-satellite geometry reaches the non-minimal risk increase level, a response is clearly advisable, but if this only occurs for one or two of the subset geometries (i.e., the ones that assume users are not tracking one or two of the visible and approved satellites), it is not obvious whether or not to respond. One basis for making this distinction is the elevation angles of the approved satellites removed from the PDM geometries that show a non-minimal risk increase. If the excluded satellites have low elevation angles (e.g., below 15 degrees), it is possible that some users (particularly those making banking turns on approach) might be without those satellites; thus the PDM should take action along the lines of Figure 15. Beyond this, further analysis, simulation, and testing are needed to optimize the PDM response. It should also be noted that, since each satellite/reference receiver measurement has its own σ pr_gnd value (which will, in general, be a function of satellite elevation and azimuth relative to the LGF antennas) and its own sigma CUSUM, the response procedure shown in Figure 15 could be applied on a measurement-by-measurement basis to the range-domain CUSUM test statistics. The primary difficulty would be attempting to perform constellation checks on all possible permutations of individual measurement exclusions or sigma inflations ahead of time (i.e., ahead of taking the proposed action) to insure that continuity is not lost. However, with sufficient LGF processing power, it may be possible to take advantage of the flexibility of Bayesian CUSUM anomaly response without requiring the addition of a PDM to the LAAS architecture. 6.0 Conclusions and Future Work This paper has demonstrated how, under certain assumptions, the existing LAAS CUSUM sigma monitor can be extended via Bayesian analysis to relate CUSUM monitor states to posterior distributions of the unknown true LGF correction error sigma. This allows the LGF to respond to error anomalies that are not immediately hazardous sooner than it could otherwise while protecting continuity by confirming that the action it is about to take preserves Category I precision approach service for almost all users. Position Domain Monitoring with an external pseudo-user LGF receiver is the most natural place to apply the Bayesian CUSUM in real time, but it can also be applied to existing range-domain CUSUM monitors that do not require this addition. Whether or not the Bayesian CUSUM is used in real time, it is a useful tool in the process of deciding upon the appropriate level of conservatism in the broadcast σ pr_gnd for a given LAAS installation. It provides a direct, straightforward numerical means to translate underlying sigma uncertainty into an appropriate level of conservatism in the broadcast sigmas. In addition, because it is possible to increase sigma in real-time when conditions warrant (and before user integrity is significantly compromised), the automated real-time sigma inflation procedure discussed in Section 5.0 should make it possible to reduce the baseline broadcast σ pr_gnd and thereby improve overall LAAS system availability. While this concept is clearly promising and will be of more value for Category II/III LAAS, a significant amount of work is needed to refine the real-time LGF

12 response technique depicted in Figure 15. In a practical LGF, a specific number of fallback values of σ pr_gnd must be selected and monitored at all times so that the LGF can seamlessly transition between the nominal state and one of several fallback states depending on the current PDM-CUSUM status. In addition to selecting these states, specific guidelines for which satellites should be considered as possibly untracked by users must be chosen so that the PDM-CUSUM responses appropriately (and conservatively) cover all users. The single most important step in applying the Bayesian CUSUM is selecting the prior probability distribution of σ pr_true. As specific LGF siting and sigma establishment guidelines are developed, a means for translating theoretical models and empirical site data into a reasonable prior probability model must be established. There is no one right way to select a prior probability model, and reasonable people will differ on how best to translate deterministic information into probability distributions. Therefore, the qualitative judgments of several LAAS technical experts will likely be combined into a consensus prior sigma model, much as threat models are developed for specific anomaly classes today (for examples of threat models, see [21,22]). Finally, the robustness of the Bayesian CUSUM to cases where the actual distribution of pseudorange correction errors is non-gaussian (see [16]) must be evaluated. ACKNOWLEDGMENTS The authors would like to thank Ming Luo (Stanford), Todd Walter (Stanford), Boris Pervan (IIT), Ron Braff and Curt Shively (MITRE/CAASD), Ted Urda (FAA AND-710), Barbara Clark (FAA AIR-130), Victor Wullschleger and John Warburton (FAA ACT-360), Navin Mathur (AMTI), and Frank Van Graas (Ohio University) for their help during this research. The advice and interest of many other people in the Stanford GPS research group is appreciated, as is funding support from the FAA LAAS Program Office (AND-710). The opinions discussed here are those of the authors and do not necessarily represent those of the FAA or other affiliated agencies. REFERENCES [1] S. Pullen, T. Walter, P. Enge, System Overview, Recent Developments, and Future Outlook for WAAS and LAAS, Proceedings of GPS Symposium Tokyo, Japan, GPS Society/Japan Institute of Navigation, Nov , 2002, pp edu/~wwu/papers/gps/pdf/pullentokyo02.pdf [2] Specification: Performance Type One Local Area Augmentation System Ground Facility. U.S. Federal Aviation Administration, Washington, D.C., FAA-E- 2937A, Apr. 17, [3] G. Xie, S. Pullen, et.al., Integrity Design and Updated Test Results for the Stanford LAAS Integrity Monitor Testbed, Proceedings of the ION 57 th Annual Meeting, Albuquerque, NM., June 11-13, 2001, pp xieionam01.pdf [4] J. Lee, S. Pullen, et.al., LAAS Sigma-Mean Monitor Analysis and Failure-Test Verification, Proceedings of the ION 57 th Annual Meeting, Albuquerque, NM., June 11-13, 2001, pp /papers/gps/pdf/jiyunionam01.pdf [5] M. Basseville and I. Nikiforov, Detection of Abrupt Changes Theory and Application. Englewood Cliffs, N.J.: Prentice-Hall, ASIN: [6] D.M. Hawkins, D.H. Olwell, Cumulative Sum Charts and Charting for Quality Improvement. New York: Springer-Verlag, Inc., ISBN: [7] P.G. Hoel, S.C. Port, C.J. Stone, Introduction to Stochastic Processes. Prospect Heights, IL.: Waveland Press, Inc., ISBN: [8] J. Verschelde, Markov Chains with MATLAB, Notes for MCS 320, Introduction to Symbolic Computation, Univ. of Illinois/Chicago, Spring [9] H.F. Martz, R.A. Waller, Bayesian Reliability Analysis. Malabar, FL.: Krieger Publishing Co., ISBN: [10] I. Sayim, B. Pervan, et.al., Experimental and Theoretical Results on the LAAS Sigma Overbound, Proceedings of ION GPS 2002, Portland, OR., Sept 24-27, 2002, pp [11] G. D Agostini, Bayesian Reasoning in High Energy Physics Principles and Applications. CERN Yellow Report 99-03, July infn.it/~agostini/cern/ [12] gamstat.m help file, MATLAB Statistics Toolbox, MATLAB Release 13, The MathWorks Corp, Sept /stats/gamstat.shtml [13] Minimum Aviation System Performance Standards for the Local Area Augmentation System. Washington, D.C.: RTCA SC-159, WG-4A, DO-245, September 28, [14] NAS Modernization: System Safety Management Program. Washington, D.C.: U.S. Dept. of Transportation/Federal Aviation Administration, ASD- 100-SSE-1, Rev. 4.0, January 2002.

13 [15] R.J. Kelly, J.M. Davis, Required Navigation Performance (RNP) for Precision Approach and Landing with GNSS Application, Navigation, Vol. 41, No. 1, Spring 1994, pp [16] R. Braff, C. Shively, Revised CAT III PDM Feasibility Analysis with Application to Prototype, McLean, VA., MITRE/CAASD, May 1, [17] J. Lee, S. Pullen, et.al., LAAS Position-Domain Monitor Analysis and Failure-Test Verification, Proceedings of 21 st International Communication Satellite Systems Conference and Exhibit, Yokohama, Japan, AIAA , April 15-19, aiaa.org/downloads/2003/cdreadymicssc03_723/2003 _2418.pdf [18] S. Pullen, M. Luo, et.al., LAAS Ground Facility Design Improvements to Meet Proposed Requirements for Category II/III Operations, Proceedings of ION GPS 2002, Portland, OR., Sept , 2002, pp [19] Minimum Operational Performance Standards for GPS Local Area Augmentation System Airborne Equipment. Washington, D.C.: RTCA SC-159, WG-4A, DO-253A, Nov. 28, [20] G. McGraw, T. Murphy, et.al., Development of the LAAS Accuracy Models, Proceedings of ION GPS 2000, Salt Lake City, UT., Sept , 2001, pp [21] R.E. Phelts, D. Akos, P. Enge, Robust Signal Quality Monitoring and Detection of Evil Waveforms," Proceedings of ION GPS Salt Lake City, UT., Sept , 2000, pp ~wwu/ papers/gps/pdf/ericion00b.pdf [22] M. Luo, S. Pullen, et.al., LAAS Ionosphere Spatial Gradient Threat Model and Impact of LGF and Airborne Monitoring, Proceedings of ION GPS/GNSS 2003, Portland, OR., Sept. 9-12, 2003.