FAA Grant 2001-G-35

Final Report

28 February 2006

## Sigma Overbound and Change Detection in LAAS

Pratap Misra

MIT Lincoln Laboratory

244 Wood Street

Lexington, MA 02420

Summary

The objective of the grant was (i) to develop overbounding techniques
based on analysis of data from the LAAS Test Prototype and to address
issues related to LAAS commissioning and operations, and (ii) to explore
new approaches to integrity monitoring during GPS-guided precision
approaches.

We performed an extensive analysis of data from the LAAS Test Prototype
  provided by the FAA, and examined ways to identify outliers to make
the distribution more compact and reduce the size of sigma inflation
factor. While such approaches were successful in a narrow sense, they
also highlighted problems underlying the basic LAAS model for integrity
monitoring: (i) A zero-mean Gaussian model is inappropriate for the
error data, and change detection is unlikely to be quick enough to meet
LAAS\' requirements. (ii) The concept of overbounding the statistics of
a non-stationary process is an ill-posed problem.

We proposed and analyzed two promising new approaches to integrity
monitoring. The first is based on the GPS receiver clock. We have shown
that if the clock can meet certain requirements of \"smoothness,\" it
can serve as a source of reliable error bound on the vertical position
estimate. The second approach exploits the richly redundant set of
pseudorange measurements which would become available when the European
system Galileo becomes operational in a few years. Both approaches have
been documented in papers to be published.

## 1. Integrity Monitoring for GPS-based Precision Approaches: A Novel Approach Based on "Smooth" Receiver Clock

### 

The errors in the vertical position and clock bias estimates obtained
from GPS pseudorange measurements are highly correlated. Therefore, the
error in a vertical position estimate can be predicted if we know the
clock bias estimation error. The latter can be estimated if the clock
bias changes smoothly and, therefore, predictably. The current
technology appears capable of manufacturing clocks which can meet this
smoothness requirement within the constraints of size, weight and cost
for airborne use. We discuss the theoretical basis and present empirical
data from laboratory and field experiments with a commercial Rubidium
standard to explore the benefits of integrity monitoring for precision
approaches based on the receiver clock.

### 1.1 Introduction

In safety-of-life applications of satellite navigation, integrity
monitoring deals with the all-important, bottom-line question: Is the
error in a given position estimate less than a certain preset threshold?
The question must be answered in real time, and the consequences of a
wrong answer can be disastrous. This requirement is what separates the
FAA's Wide Area Augmentation System (WAAS) and Local Area Augmentation
System (LAAS) from the many differential GPS (DGPS) services now
available. WAAS and LAAS have not had an easy time of integrity
monitoring for precision approaches. We describe a novel approach to the
problem based on an overlooked resource: GPS receiver clock.

At present, GPS receivers do not ask much of a clock beyond a loose
requirement on phase noise so as to maintain carrier tracking. The
manufacturers have focused on building clocks to minimize size, power
consumption and cost. Frequency stability has not been a performance
criterion because the benefits of stability have not been clear.
Actually, there are substantial benefits to be derived in aviation
applications if a receiver clock can meet modest stability requirements
in airborne use. Examples of other applications now exploring the
benefits of receiver clock stability are assisted GPS (AGPS) \[1\] and
GPS-INS integration \[2\].

In order to answer the question of integrity raised above, we need an
algorithm for generating a tight, high-confidence upper bound on the
error in a position estimate given the pseudorange measurements from
satellites in view and differential corrections from WAAS or LAAS. The
current method of integrity monitoring is based on modeling the
remaining error in the differentially corrected pseudorange measurements
as zero-mean Gaussian with a known standard deviation. While the
Gaussian model simplifies analysis, it's a challenge to demonstrate in
real time that the data conform to this model. The proposed approach is
tolerant of deviation of the uncompensated pseudorange errors from a
Gaussian distribution, but it requires that the receiver clock exhibit a
certain smoothness for which we can test in real time.

### 1.2 Precision Approaches and Integrity Requirements

An instrument approach consists of a predefined procedure to be executed
when the pilot can't see the runway and must be guided toward it by
instruments in the cockpit that display the aircraft's deviation from
its intended path. A precision approach is an instrument approach in
which the pilot receives both lateral and vertical navigational guidance
from the cockpit instruments to descend to anywhere between 200 feet
above the ground (for Category I) and all the way to touchdown (for
Category III) without the benefit of visual reference to terrain. There
are specific certification criteria for the navigation system, the
aircraft and the pilot training for each category of precision approach.
In the U.S., precision approaches have been flown for the past 50 years
using the instrument landing system (ILS), a terrestrial radio
navigational aid serving a specific runway end. LAAS has the potential
of offering a significant economic advantage over the ILS.

LAAS for Category I precision approaches, now under development,
provides for multiple reference receivers sited on the airport surface.
Pseudorange measurements from these receivers are processed centrally to
determine the pseudorange corrections that are broadcast to approaching
aircraft. Associated with these corrections is an estimate of the
standard deviation of their error. There are, however, additional errors
that are introduced into the measurements at the aircraft by sources not
common to those at the reference receivers on the ground. The avionics
use models to account for these error sources and generate an estimate
of the standard deviation of the remaining pseudorange error.

The accuracy of GPS-based position estimates is excellent, in general,
but not assured in each instance. Accuracy requirements are typically
stated in terms of aggregate behavior: error statistics (e.g., rms
error) or an error distribution (e.g., 95^th^ percentile). Both GPS/WAAS
and a prototype of GPS/LAAS have demonstrated the ability to meet the
vertical accuracy requirement for Category I precision approaches, which
is 4 meters (95^th^ percentile). Integrity monitoring, on the other
hand, deals with the individual outcomes, requiring that *each* position
estimate offered to the pilot come with a guarantee in the form of an
error bound.

The basic objective of integrity monitoring is to warn the pilot when
the navigational guidance provided by a system may be erroneous to the
point of being hazardous. The source of faulty navigational guidance may
be an undetected malfunction or out-of-tolerance condition in the
system, or it may be a poor position estimate due to weak satellite
geometry or a rare combination of the usual random errors. Integrity
requirements are stated in terms of maximum error allowable, called
*alert limit*, and the permitted rates of false alarm and missed
detection in recognizing that the actual position error exceeds this
threshold. As expected, the alert limit varies with the phase of flight.
A horizontal position error of 1 kilometer is acceptable during the en
route phase, when the aircraft is flying at 30,000 feet, but the limit
is 40 meters when the aircraft is executing a Category I precision
approach and has descended to an altitude of 200 feet. The real
challenge of precision approaches, however, lies in vertical guidance,
and the vertical alert limit (VAL) is 10 meters for Category I precision
approaches and lower for Category II and Category III approaches.

In practical terms, integrity monitoring consists of attaching an upper
bound to the error in each position estimate. Such an error bound,
called *protection level*, is to be computed in the avionics on the
basis of its pseudorange measurements, differential corrections,
satellite geometry, and certain parameter values characterizing the
quality of the measurements and differential corrections. If the
computed protection level is below the applicable alert limit, the
approach can proceed; if not, the pilot must be alerted within the
specified time-to-alarm, and the approach must be aborted. The
horizontal and vertical components of the position error are treated
separately. In this paper, we focus on the specific example of
generating the vertical protection levels (VPLs) for Category I
approaches.

The *false alarms* raised by an integrity monitoring algorithm must be
kept below a specified value for reasons of safety and economy and, more
importantly, *missed detection* of an alert limit violation ("*integrity
failure*") must be extremely rare. For Category I approaches, an
integrity failure will result if the true vertical error in a position
estimate exceeds 10 meters but the computed error bound is lower. Such
failure is allowed no more than once in 10 million approaches:

Prob {vertical position error \> 10 m \| computed error bound ≤ 10 m} \<
10^--7^.

The requirements for Category II and Category III precision approaches,
now under discussion, will be even more stringent, with lower alert
limits and lower tolerance for integrity failure.

It's a challenge to "prove" that an integrity monitoring scheme meets
the stringent requirement on missed detections stated above. Clearly, we
don't have the option of building a system and flying 10 million
approaches to evaluate it. The integrity monitoring performance must be
demonstrated with mathematical models, which are developed and validated
using limited amounts of empirical data and validated models.

### 1.3 Gaussian Error Models for Integrity Monitoring 

We outline below the conventional approach to integrity monitoring based
on Gaussian error models.

-   If the pseudorange error is Gaussian, the three components of the
    resultant position error are also Gaussian. Specifically, if the
    pseudorange error is distributed as zero-mean Gaussian with a known
    standard deviation ![](media/image1.wmf), which we represent as
    **N**(0,![](media/image2.wmf)), the vertical position error will be
    distributed as **N**(0,![](media/image3.wmf)), where
    ![](media/image4.wmf) can be written in terms of
     ![](media/image5.wmf) and the direction cosine terms in the user's
    satellite geometry matrix \[3\]. (For simplicity, we have modeled
    the pseudorange error distribution to be common to all satellites in
    view.)

-   The VPL (i.e., vertical error bound corresponding to the missed
    detection probability of 10^--7^) can be determined easily from
    Gaussian probability tables as 5.3![](media/image6.wmf). Therefore,
    the approach can be executed only if 5.3![](media/image7.wmf) ≤ 10
    meters for each position estimate during the approach lasting two to
    three minutes.

There are two problems associated with the above model. First, real-life
data almost never follow a Gaussian distribution exactly, especially
deep into the tails. Measurements over extended periods at multiple test
sites show that the empirical distribution functions of the pseudorange
errors have longer and fatter tails than those of a Gaussian
distribution with the same standard distribution \[4\]. Apparently, this
deviation from Gaussianity stems from the nature of multipath, a
dominant source of error in differential GPS. The issue of accounting
for such deviation in the calculation of the VPL remains unresolved. One
approach is to define a Gaussian distribution
**N**(0, ![](media/image8.wmf)) which would dominate or "overbound" the
observed pseudorange error distributions. Inflating σ~0~, however, has
an obvious price in terms of system availability. The second problem is
that the model requires *a priori* knowledge of the two parameters of a
Gaussian distribution, even though the environment is inherently
nonstationary

While we too adopt a Gaussian model, there are important differences. We
don't require that the pseudorange error be Gaussian with known mean and
variance. Our VPL calculation described below is based on a Gaussian
model for a conditional probability distribution of the vertical
position error. This conditional distribution appears much closer to a
Gaussian even if the distribution of pseudorange errors has long, fat
tails. This would be the subject of a future paper.

### 1.4 Receiver Clock-Based Integrity Monitoring

### Benefits of a "Perfect" receiver clock

There is a common misconception that the price we pay for using an
inexpensive GPS receiver clock is that we have to "sacrifice" one
pseudorange measurement to estimate its instantaneous bias relative to
GPS Time (GPST). This misconception, combined with the everyday
observation that the vertical dilution of precision (VDOP) is invariably
larger than the corresponding horizontal dilution of precision (HDOP)
\[3\], leads to the erroneous conclusion that the vertical position
estimates obtained from GPS are inherently less accurate than the
horizontal position estimates.

Consider the hypothetical case of a receiver equipped with a clock that
keeps GPS Time. How can we exploit this perfect clock? We know *a
priori* that the clock bias (*b*) is zero, and we only need to estimate
the three unknown position coordinates (*x*, *y*, *z*). Thus, we need
measurements from only three satellites (versus four when *b* is
unknown). While true, this benefit is hardly worth pursuing, given that
there are typically six to nine satellites visible to the aircraft.
Actually, we have shown in earlier papers \[5, 6\] that the rms vertical
estimation error from GPS could be cut by more than half if estimation
of *b* were not required (i.e., if we could measure ranges to the
satellites rather than pseudoranges). Interestingly, the horizontal
position error is substantially unaffected. If we redefine the dilution
of precision parameters for the problem of position estimation with
range measurements, and call them HDOP3 and VDOP3 to keep them separate
from the conventional HDOP and VDOP, then HDOP3![](media/image9.wmf)
HDOP, but VDOP3 \< 0.5 \* VDOP.

Returning to estimation of ![](media/image10.wmf) from pseudorange
measurements, we can illustrate the basis for the claims of the previous
paragraph by noting that the errors in the estimates of vertical
position and clock bias are highly correlated (correlation coefficient
*r* \> 0.9). Figures 1.1 and 1.2 give two representations of this
relationship. Note that clock bias is presented in units of length (1
nanosecond = 0.3 meters). The horizontal position error is essentially
uncorrelated with the clock bias estimation error, and is not shown. The
main point, which we pursue below, is that the quality of the vertical
position estimates can be improved greatly if the clock bias can be
estimated from the past measurements and only the position (*x, y, z*)
is estimated from the current pseudorange measurements \[5\]. But, as
noted previously, the horizontal and vertical position estimates
obtained from WAAS and LAAS prototypes easily meet the accuracy
requirements for precision approaches and there is little incentive to
sharpen them further. The real challenge is to find a basis to "prove"
in real time that the error in *each* vertical position estimate doesn't
exceed the specified alert limit.

> ![](media/image11.png){width="3.767361111111111in" height="2.825in"}

Figure 1.1. Scatter plot of the vertical position error and clock bias
error in estimates obtained over a 24-hour period (1-minute samples)
from a surveyed location using an external Cesium standard with a GPS
receiver used in differential mode. Note that the clock bias is
expressed in units of length (1 nanosecond = 0.3 meters).

Our approach to integrity monitoring is summarized as follows. Given a
perfect receiver clock, we can estimate four parameters (*x, y, z,*
*b*), as before, but now take advantage of the fact that we know a part
of the answer (i.e., *b* = 0). The knowledge of the error in the clock
bias estimate can serve as a quality check on the vertical position
estimate. If the error in the clock bias estimate is small, the error in
the vertical position estimate will be small, and vice versa. Below we
develop a decision rule for smooth clocks based on this statement,
defining a value of the vertical protection level (VPL) given the error
in the current clock bias estimate.

![](media/image12.png){width="3.5993055555555555in"
height="2.6993055555555556in"}

Figure 1.2. Temporal plots of (a) errors in estimation of vertical
position and clock bias obtained from code measurements in differential
mode, as in Figure 1.1, and (b) the corresponding correlation
coefficients.

### Smooth Clocks

A receiver clock is not required to keep GPS Time perfectly in order to
derive the benefits described above. We could have defined our perfect
clock simply as one whose bias is known or is perfectly predictable. In
practice, we can't know or predict the clock bias perfectly. But the
bias can be estimated on the basis of its past values if the changes are
smooth -- without jumps or corners. With such a clock, we can
extrapolate a trend based on the past measurements to predict clock bias
over the next few seconds. We'll refer to such clocks as "smooth."

Note that smoothness doesn't require that the clock frequency hold
constant. Frequency drift is allowed, but not frequency jumps. What's
required is that the frequency drift rate remain essentially constant in
the short term (over minutes, as we'll see). As we show below, the
smoother the clock, the more accurate the predicted clock bias, and the
greater the benefit.

Commercial Rubidium and Cesium standards typically behave smoothly in
the controlled environment of a laboratory. The challenge, of course,
comes from the physical environment of the avionics bay in an aircraft
where a receiver clock is subject to vibrations and changes in
temperature, pressure, humidity, magnetic field, etc. The current
technology appears capable of producing clocks for GPS avionics which
would demonstrate the requisite stability of the frequency drift rate,
and which would also meet the usual requirements of size, weight, and
cost. The clock manufacturers, however, have had no incentive to develop
such clocks.

We present below data from experiments with a commercial Rubidium
standard that met our requirements for smoothness in road tests. But
first we outline the proposed algorithm for integrity monitoring, given
a smooth clock.

### 1.5 Integrity Monitoring Algorithm for a Smooth Receiver Clock

The proposed integrity monitoring algorithm consists of the following
steps:

-   Model the receiver clock bias adaptively on the basis of recent
    measurements, and predict its value ![](media/image13.wmf) in the
    future. Estimate the rms error associated with this prediction. This
    measure forms the basis for deciding if the clock is smooth enough
    for this approach to work. Examples are shown in the next section
    where we present empirical data.

-   Estimate ![](media/image14.wmf)on the basis of the current
    pseudorange measurements, as usual. Below we'll be concerned only
    with ![](media/image15.wmf), the vertical position estimate, and
    ![](media/image16.wmf), the clock bias estimate, and we'll refer to
    them as conventional estimates. Compute the error in the
    conventional clock bias estimate as

> ![](media/image17.wmf) (1)

-   Model the joint distribution of ![](media/image18.wmf) and the
    vertical position error ![](media/image19.wmf)

> ![](media/image20.wmf) (2)
>
> as jointly Gaussian with means zero, standard deviations
> ![](media/image21.wmf) and ![](media/image22.wmf), respectively, and
> correlation coefficient *r*. Actually, this is more than we need. The
> main assumption we require is that the conditional probability density
> of ![](media/image23.wmf) given ![](media/image24.wmf) is Gaussian
> \[7\]
>
> ![](media/image25.wmf) (3)
>
> In this formulation, ![](media/image26.wmf) is estimated from the
> recent measurements of ![](media/image27.wmf)using a moving
> window-type screen, and is the rss of errors in estimating *b* and in
> predicting it on the basis of a curve fit. ![](media/image28.wmf) is
> estimated from
>
> ![](media/image29.wmf) (4)

and the correlation coefficient *r* is computed from the instantaneous
geometry matrix *G* \[3\] as

![](media/image30.wmf)

> where ![](media/image31.wmf).

-   The conditional mean of the vertical position error is

> ![](media/image32.wmf) (5)

The attraction of this approach becomes clear when we look at the
conditional variance

> ![](media/image33.wmf) (6)

which is only about a quarter of the unconditional variance of the
conventional vertical position estimate.

-   Refine the vertical position estimate and define an error bound
    (VPL) corresponding to a missed detection (i.e., integrity failure)
    level ![](media/image34.wmf).

> ![](media/image35.wmf) (7)
>
> ![](media/image36.wmf) (8)

where *k* = 5.3 for![](media/image37.wmf) = 10^-7^, as noted previously.
The above expression (8) for VPL offers a direct comparison with the
conventional definition. With *r* \> 0.9, a smooth clock can cut VPL by
more than half.

The above implementation is intended only as an example. Results from
limited tests are given below. Full-scale validation of this type of
algorithm will be based on extensive Monte Carlo simulations with tens
of millions of trials using actual satellite geometries, realistic
models of pseudorange error distributions, and empirical models of
clocks developed to exhibit the requisite smooth behavior.

### 1.6 Empirical Data from Laboratory and Road Tests

Below we present results from laboratory and road tests using a
commercial, off-the-shelf Rubidium standard: Model AR-61A, Militarized
Rubidium Standard (including an optional feature of low phase noise
under vibrations) manufactured by AccuBeat Ltd., Jerusalem, Israel. The
main purpose of these tests is to offer an "existence proof" that the
requirements for smoothness in an avionics bay-type environment can in
fact be met.

### Test Setup

Our laboratory setup is straightforward: A stationary antenna on the
roof at a surveyed spot, a civil GPS receiver with the provision to
accept an external clock input, and the Rubidium standard AR-61A. The
road test setup is more interesting: an old diesel truck with a bad
suspension to carry an antenna on a tripod tied down on the bed, and the
receiver, clock, power supply, and several uninterrupted power supply
(UPS) units riding in the cab. The clock sits behind the power supply in
Figure 1.3, next to the laptop computer.

The road tests were conducted at Hanscom Air Force Base in January 2004.
A test typically consisted of driving the truck around for 30 minutes,
and then standing for an hour with engine running and chassis vibrating,
collecting GPS data all the while for post-processing. In order to
establish good ground truth, we needed differential corrections (code
and carrier) from a site employing a smooth clock. Fortunately, the MIT
Haystack Observatory, about 25 km away, provided measurements from a GPS
receiver connected to a hydrogen maser.

The results from laboratory and road tests are presented side by side,
where appropriate, to provide an indication of the performance
degradation due to the environmental factors.

![](media/image38.jpeg){width="2.7493055555555554in"
height="2.051388888888889in"}
![](media/image39.jpeg){width="2.7506944444444446in"
height="2.071527777777778in"}

Figure 1.3. Road test equipment

### Adaptive Clock Modeling

Prediction of clock bias and clock bias rate is at the heart of our
approach. As shown in Figure 1.4, code measurements provide relatively
noisy clock bias estimates epoch by epoch. Carrier phase-based
measurements offer precise estimates of the clock bias rate. The two can
be combined to obtain accurate carrier-smoothed clock bias estimates.
Figure 1.5 shows samples of these estimates for data collected in the
laboratory and the truck over 60-minute periods. While the scale for the
clock bias appears coarse for the road test, it's clear that the bias is
changing smoothly, and is predictable. (The road test shows a larger
frequency offset than the laboratory test. This is a consequence of
starting and stopping the clock several times in the days between the
two tests. )

![](media/image40.png){width="3.751388888888889in"
height="2.8131944444444446in"}

Figure 1.4. Estimates of clock bias based on pseudorange measurements
display the characteristic noise. Estimates of changes in the clock bias
based on Doppler frequency measurements are precise. The two can be
combined to obtain accurate carrier-smoothed clock bias estimates.

![](media/image41.wmf)

Figure 1.5. Change in receiver clock bias in (a) laboratory and (b) road
test.

Our scheme for clock prediction consists of fitting a quadratic function
to the best estimates of the clock bias over the previous 10 minutes and
extrapolating it over the next five to 60 seconds. The results obtained
in the laboratory and road test are shown in Figure 1.6. For 5-second
predictions, the results are very similar for the laboratory and the
road data, with rms errors of 0.07 meters and 0.11 meters, respectively.
We expect the prediction error to grow with the prediction interval. The
rms error for 60-second predictions nearly doubles but remains
acceptable for our approach to work: 0.13 meters in the laboratory, and
0.21 meters in the road test. The 60-second prediction is intended only
to demonstrate robustness of the scheme. In practice, we expect to
predict the clock bias several seconds ahead, and the results presented
in the next section are based on 5-second predictions.

> **Laboratory Test** **Road Test**

![](media/image42.png){width="4.399305555555555in"
height="3.2993055555555557in"}

Figure 1.6. Clock bias prediction error based on fitting a quadratic
function to the clock bias estimates over 10 minutes. Laboratory test:
(a) 5-second prediction interval and (b) 1-minute prediction interval.
Road test: (c) 5-second prediction interval and (d) 1-minute prediction
interval.

### Vertical Protection Level (VPL)

The actual error in the conventional vertical position estimates, *δz*,
is plotted in Figure 1.7 for measurements taken over 60-minute periods
in the laboratory and during a road test. Figure 1.7 also shows our
estimate of this error at each epoch, given the corresponding clock bias
error, *δb*. Removal of this error will make the vertical position
estimates much more accurate. This figure is our main result. It
demonstrates that the quality of the conventional vertical position
estimates can be improved dramatically. This improvement will be
reflected in the tightened values of error bounds (i.e., VPL).

The remaining error in the clock-aided estimates,
![](media/image43.wmf), corresponding to Figure 1.7(a) is shown in
Figure 1.8. The corresponding vertical protection levels obtained from
our algorithm (Equations (1) through (8)) are also shown in Figure 1.8
(for *k* = 5.3) for completeness. As noted previously, it would require
a much larger sample to "prove" the algorithm. Our purpose is simply to
demonstrate the promise of a new approach, and Figures 1.7 and 1.8 do
just that.

![](media/image44.png){width="4.159027777777778in"
height="3.1194444444444445in"}

Figure 1.7. Actual vertical position error in conventional estimates and
their conditional expectations, given the estimated clock bias error:
(a) laboratory data, (b) road test.

![](media/image45.png){width="4.159027777777778in"
height="3.1194444444444445in"}

Figure 1.8. Vertical position errors in conventional and clock-aided
estimates. Also shown are the vertical protection levels (VPLs) for the
clock-aided estimates.

### 1.7 Conclusions

We have presented a promising, new approach to integrity monitoring for
GPS-based precision approaches based on a smooth receiver clock. The
potential benefit is much 'tighter' vertical protection levels (VPLs)
than available from the conventional approach. In fact, the VPLs are cut
in half! The proposed approach requires that the receiver clock bias
change smoothly and predictably over a period of minutes, to be verified
in real time. In other words, the frequency drift rate of the clock must
remain essentially constant over several minutes. An informal survey of
clock manufacturers indicates that the requirement can be met in the
airborne environment within the reasonable constraints of cost, size,
and power. A commercial Rubidium standard was demonstrated to meet the
smoothness requirement in a rough-riding truck.

## 2. Robust Integrity Monitoring for Precision Approaches Using GPS+Galileo 

In safety-of-life applications of satellite navigation, integrity
monitoring deals with the all-important, bottom-line question: Is the
error in a given position estimate less than a certain preset threshold?
The question must be answered in real time, and the consequences of a
wrong answer can be severe. This requirement is what separates the FAA's
Wide Area Augmentation System (WAAS) and Local Area Augmentation System
(LAAS) from the many differential GPS (DGPS) services now available.
WAAS and LAAS have not had an easy time of integrity monitoring for
precision approaches. This would change when Galileo becomes
operational.

In order to answer the question above, we need an algorithm for
generating a tight, high-confidence upper bound on error in a position
estimate, given the pseudorange measurements from satellites in view and
differential corrections from WAAS or LAAS. The current method of
integrity monitoring is based on modeling the remaining error in the
differentially corrected pseudorange measurements in the avionics as
zero-mean Gaussian with a known standard deviation. While the Gaussian
model simplifies analysis, it's a challenge to demonstrate in real time
that the data conform to this model.

We analyze an alternate approach to integrity monitoring which needs no
assumptions regarding the distribution of the uncompensated pseudorange
errors but requires that the measurement set be "richly redundant." A
GPS-type constellation of about 40 satellites appears to be the minimum
needed for this approach to work. The combined GPS+Galileo constellation
of 50-plus satellites will be more than adequate. (Of course,
GPS+GLONASS would also be adequate, but this combination, though close
to the authors' hearts, doesn't seem to be in the cards.) We define a
test statistic which serves as a measure of the variability (or
"scatter") of the position estimates computed from "suitably selected"
subsets of the measurements, and show that a bound on the position error
can be based reliably on this statistic. Our approach is a
generalization of a scheme proposed earlier by Brown and McBurney for
use with GPS (see Further Reading).

The proposed approach works unchanged with or without differential
corrections, from en route navigation to precision approaches. The
derived position error bound adjusts itself with the quality of the
measurements.

### 2.1 Precision Approaches and Integrity Requirements

An instrument approach consists of a predefined procedure to be executed
when the pilot can't see the runway and must be guided toward it by
instruments in the cockpit which display the aircraft's deviation from
its intended path. A precision approach is an instrument approach in
which the pilot receives both lateral and vertical navigational guidance
from the cockpit instruments to descend to anywhere between 200 feet
above the ground (for Category I) and all the way to touchdown (for
Category III) without the benefit of visual reference to terrain. There
are specific certification criteria for the navigation system, the
aircraft, and pilot training for each category of precision approaches.
In the U.S., precision approaches have been flown for the past 50 years
using the instrument landing system (ILS), a terrestrial radio
navigational aid serving a specific runway end. LAAS has the potential
of offering a significant advantage over the ILS.

The LAAS for Category I precision approaches, now under development,
provides for multiple reference receivers sited on the airport surface.
The pseudorange measurements from these reference receivers are
processed centrally to determine the pseudorange corrections to be
broadcast to the approaching aircraft. Associated with the pseudorange
corrections is an estimate of the standard deviation of the error in
these corrections. This error, however, is only one component of the
overall uncompensated pseudorange error at the airplane. Additional
errors are introduced in the measurements at the airplane by error
sources which are not in common with those at the reference receivers on
the ground. The avionics use models to account for these error sources
and generate an estimate of the standard deviation of the remaining
pseudorange error.

The basic objective of integrity monitoring is to warn the pilot when
the navigational guidance provided by a system may be erroneous to the
point of being hazardous. The source of faulty navigation guidance may
be an undetected malfunction or out-of-tolerance condition in the
system, or just a rare combination of the usual random errors. The
integrity requirements are stated in terms of maximum error allowable,
called *alert limit*, and the permitted rates of false alarm and missed
detection in recognizing that the actual position error exceeds this
threshold. The alert limit varies, as expected, with the phase of
flight. A horizontal position error of 1 kilometer is acceptable in en
route phase when the aircraft is flying at 30,000 feet, but 40 meters is
the limit when the aircraft is executing a Category I precision approach
and has descended to an altitude of 200 feet. The real challenge of
precision approaches, however, lies in vertical guidance, and the
vertical alert limit (VAL) for Category I precision approaches is 10
meters.

In practical terms, integrity monitoring consists of attaching an upper
bound to the error in each position estimate. Such error bound, called
*protection level*, is to be computed in the avionics on the basis of
its pseudorange measurements, differential corrections, satellite
geometry, and certain parameter values characterizing the quality of the
measurements and differential corrections. If the computed protection
level is below the applicable alert limit, the approach can proceed; if
not, the pilot must be alerted within the specified time-to-alarm, and
the approach must be aborted. The horizontal and vertical components of
the position error are treated separately. In this paper, we focus on
generating the vertical protection levels (VPLs) for Category I
precision approaches.

The *false alarms* raised by an integrity monitoring method must be kept
below the specified value for reasons of safety and economy and, more
importantly, *missed detection* of alert limit violations ("*integrity
failure*") must be extremely rare. For Category I approaches, an
integrity failure would result if the true vertical error in a position
estimate exceeds 10 meters but the computed error bound is lower. Such
failure is allowed no more than once in 10 million approaches:

Prob {vertical position error \> 10 m/ computed error bound \< 10 m} \<
10^--7^.

The requirements for Category II and Category III precision approaches,
now under discussion, would be even more stringent, with lower alert
limits and lower tolerance for integrity failure.

Extensive tests with GPS/WAAS and a prototype of GPS/LAAS have shown
that the 95^th^ percetile of the vertical error distribution is less
than 2 meters, well below the alert limit for Category I approaches.
This observation on aggregate behavior, though encouraging, is of little
help with integrity monitoring which requires that *each* position
estimate offered to the pilot come with a guarantee that its vertical
error doesn't exceed 10 meters.

### 2.2 Integrity Monitoring 

It's a challenge to "prove" that an integrity monitoring scheme meets
the stringent requirement on missed detection stated above. Clearly, we
don't have the option of building a system and flying 10 million
approaches to evaluate it. The integrity monitoring performance has to
be demonstrated with mathematical models, to be developed and validated
using limited amounts of empirical data.

### Gaussian Error Model 

If the error in the differentially corrected pseudorange measurements at
the airplane were known to be Gaussian with known values of mean and
standard deviation, integrity monitoring would be easy.

(i) If the pseudorange error is Gaussian, the three components of the
    resultant position error would be Gaussian as well. If the
    pseudorange error is distributed as zero-mean Gaussian with standard
    deviation σ~0~, which we represent as **N**(0, σ~0~), the vertical
    position error would be distributed as **N**(0, σ*~P~*), where
    σ*~P~* can be written in terms of σ~0~ and the direction cosine
    terms in the user's satellite geometry matrix. (For simplicity, we
    have modeled the pseudorange error distribution to be common for all
    satellites in view.)

(ii) The vertical error bound corresponding to the missed detection
     probability of 10^--7^ can be determined easily from Gaussian
     probability tables as 5.2 σ*~P~*. Therefore, the approach can be
     executed only if: 5.2 σ*~P~* \< 10 meters, for each position
     estimate during the minute-long approach.

The empirical probability density functions of errors in LAAS
pseudorange corrections in fact appear "nearly" Gaussian, but have
longer and fatter tails than those of a Gaussian distribution with the
same standard deviation. We must account for this deviation from
Gaussian-ness in definition of error bound and estimation of the
probability of integrity failure, but that's not easy. A considerable
effort, therefore, has gone into defining a Gaussian distribution
**N**(0, σ~0~) which would dominate or "overbound" the observed error
distributions. Both WAAS and LAAS require comprehensive modeling of
specific threats, including unusual events (e.g., satellite peak
distortions and localized or traveling ionospheric disturbances), in
order to arrive at a conservative *a priori* estimate of σ~0~. Actually,
the errors constitute a nonstationary process, and it's unclear if a
dominating Gaussian distribution can be defined.

### 2.3 An Alternate Approach Exploiting Redundant Measurements

Given a redundant set of pseudorange measurements without any prior
assurances regarding its quality, we compute a position estimate and ask
the question: How good is this position estimate? If we could somehow
generate estimates of bias and variance of this position estimate, we'd
have an idea of how large the position error might be. In order to
generate such measures, we can turn to the *jackknife* and *bootstrap*
methods, general techniques of computational statistics for assessing
the stability of the measures of variability of a parameter estimate.
Actually, given our stringent requirements on missed detection,
estimates of bias and variance wouldn't be enough. We have to go much
further and attempt to nail down the probability density function of the
position estimate. We adapt the bootstrap method to our purpose as
follows.

An intuitive approach to answer the question raised above ("How good is
a position estimate?") is as follows: Generate additional position
estimates based on appropriate subsets of the measurements (generated by
dropping one or more measurements in turn), and examine their
variability. If the position estimates form a "tight" cluster, this
would suggest that the measurements are "consistent" (i.e., the
measurements errors are all "small"). The tighter is the cluster of
position estimates, the greater would be our faith in the integrity of
the position estimate, and the lower would be the bound on position
error. If the position estimates are "widely scattered," our conclusion
would be less clear-cut: Either the measurements are "inconsistent"
(i.e., some or all of the measurements have "large" errors), or the
satellite geometry associated with one or more of the measurement
subsets is "poor." In the latter case, this approach would fail to
provide an answer.

Brown and McBurney evaluated this approach in pre-DGPS days for
integrity monitoring for en route phase (horizontal alert limit \> 1 km)
and non-precision approaches (horizontal alert limit ≈ 0.5 km). The
relatively large values of these alert limits notwithstanding, the GPS
constellation often didn't offer enough redundant measurements and a
significant proportion of the time the algorithm was unusable. The civil
aviation community instead adopted a different approach based on a
specific threat model centered on failure of one of the satellites.
Integrity monitoring, therefore, amounted to answering the question: Is
the error in one of the pseudoranges excessive? If the answer was no,
the position error was acceptable. Such an error model, however, is
irrelevant to a DGPS user who can count on a prompt notification of
satellite failure from the reference station. A DGPS user, therefore,
would like to accommodate all types of "ordinary" errors without undue
restrictions.

Given a richly redundant measurement set, the cluster of position
estimates generated by discarding one measurement at a time (à la
Brown-McBurney) turns out to be uninformative. Selecting satellite
subsets entirely randomly isn't effective either because it introduces
problematic subsets with poor satellite geometry. In order to tie the
size of the cluster reliably to a bound on position error, it is
necessary to select subsets so that each is associated with a "good"
satellite geometry. And with a richly redundant measurement set, we have
plenty of such subsets to choose from. We'll refer to this algorithm as
LGG1.

The algorithm consists of the following elements:

(i) a method to select satellite subsets with good geometries;

(ii) a metric to characterize the scatter of position estimates obtained
     from the measurement subsets; and

(iii) a rule to obtain the error bound or protection level based on the
      size of the scatter.

##  ![](media/image46.png){width="3.703472222222222in" height="2.765972222222222in"}

Figure 2.1. Distribution of the number of satellites in view from GPS-24
and GNSS-42 (elevation \> 5°)

In order to demonstrate that the algorithm generates usable protection
levels which meet the requirements of missed detection regardless of the
nature or distribution of the pseudorange errors, we have to conduct
extensive simulations to establish the joint distribution of the actual
position error and scatter for each candidate distribution for the
pseudorange error. It would take tens of millions of trials to get a
good handle on the tails of the distribution in each case. Fortunately,
that's not difficult in this day of cheap and fast computation.

### 2.4 Algorithm LGG1

To illustrate LGG1, consider a simple Galileo-like implementation
corresponding to 42 satellites arranged as a Walker 42/7/1 constellation
\[i.e., 42 satellites arranged uniformly in each of the seven evenly
distributed orbital planes with satellites in successive planes offset
by (360/42) x 1 deg\]. We call this satellite constellation GNSS-42. For
illustrative purposes, we set up a hypothetical problem as follows:
Develop a rule for a bound on 3-D position error for GNSS-42 users, and
evaluate it for an alert limit of 10 meters. This is an overly
conservative formulation of integrity monitoring problem for the
Category I precision approaches. But we can use it to demonstrate the
main ideas behind the algorithm.

The basic computational steps (to be implemented in the avionics) are as
follows.

(i) Determine satellites in view (elevation \> 5 deg): *K*. (11 ≤ *K* ≤
    18, see Figure 2.1)

Determine the corresponding pseudoranges.

Apply pseudorange corrections, if available.

Compute position: **x**

(ii) Divide satellites into bins depending upon location of each in the
     sky:

Characterize satellites as high (elevation \> 40 deg) or low.

Divide the low satellites into four bins by azimuth: E, W, N, and S

Divide the high satellites into two bins: E and W

\(iii\) Select 4*K* subsets with 8-9 pseudorange measurements each as
follows and compute corresponding position estimates:

Select one satellite randomly from each of the six bins defined above.
(The bins are rarely empty.)

Select two more satellites randomly from those remaining.

If PDOP \> 3, select one more satellite randomly from those remaining.

The specific definition above of bins in which to divide the satellites
and scheme for selection of 4*K* subsets of 8-9 satellites each are only
intended as a simple example. See Figure 2.2 for histograms of PDOP
corresponding to all available measurements, and PDOP~SUB-MAX~, the
largest PDOP for subsets defined as above. Figure 2.3 gives an example
of two 8-satellite subsets selected in accordance with the above scheme
out of the 15 that are in view. The satellites selected in a sample are
shown in a bright color; those not selected appear as gray.

Compute position: ![](media/image47.wmf)**,** *i* = 1, 2, ..., 4*K*.

(iii) Compute test statistic called "scatter":

Scatter = max ![](media/image48.wmf), 1≤ *i, j* ≤ 4*K*

We have adopted the Brown-McBurney metric of cluster size, though a
simpler statistic may work as well or better. (We intend to try next:
Scatter = max ![](media/image49.wmf), 1≤ *i* ≤ 4*K*.)

\(v\) Compute error bound from the decision rule:

3-D Error Bound =  ![](media/image50.wmf) Scatter

For simplicity, we define the decision rule as linear in scatter.
Limited simulation results for GNSS-42 (discussed below) obtained with
the above algorithm lead to α = 4.5, but we expect this value to
increase somewhat. We also expect that higher redundancy offered by a
larger satellite constellation (e.g., GPS+Galileo) can be exploited more
effectively to yield a tighter bound (i.e., lower α).

##  ![](media/image51.png){width="3.6395833333333334in" height="2.7354166666666666in"}

Figure 2.2. Cumulative distribution functions for GNSS-42 of (i) PDOP
for satellites in view (elevation \> 5°), and (ii) PDOP~sub-max~, the
largest PDOP among the satellite subsets chosen for computation of
scatter.

### 2.5 Performance of LGG1

We have evaluated the performance of LGG1 for GNSS-42 by simulations in
which pseudorange measurement errors are drawn from different
probability distributions. The results are presented in Figures 2.4 and
5. Our main purpose in each case is to define the bivariate probability
density function (actually, bivariate histogram) of the 3-D position
error and scatter computed in accordance with LGG1, paying special
attention to the tails. As noted earlier, it would require tens of
millions of trials to define the tails adequately to verify that the
requirements of missed detection are being met. Our simulations are
relatively modest in size and are intended only to show the potential of
this approach. Each simulation consists of about five million
independent trials in which the user position and time are selected
randomly for each trial and the errors are independent from satellite to
satellite. Note the color coding of the histograms in Figures 2.4 and
2.5: A dark blue pixel represents the outcome of a single trial, and a
dark red pixel represents the common outcome of several thousand
independent trials.

(i) (Figure 2.4) Idealized Gaussian errors, **N**(0, 1  m). As discussed
    previously, the remaining error in differentially corrected
    pseudoranges is commonly modeled as zero-mean Gaussian. Standard
    deviation of 1 meter is chosen as a convenience for establishing the
    shape of the joint distribution, and is not a constraint. The axes
    can be scaled appropriately to account for a different value of the
    standard deviation. If the pseudorange error is cut in half, both
    position error and scatter are cut in half as well. The shape of the
    distribution remains unchanged.

Our simple decision rule (3-D error bound = 4.5 x Scatter) is based on
Figure 2.4a.

If the error in differentially corrected pseudoranges actually conformed
to **N**(0, 1  m), most of the aircraft attempting Category I precision
approaches would be disallowed because their position error bounds would
exceed 10 meters, the alert limit. This level of pseudorange error is
simply too high for precision approaches. If the actual error were lower
and could be modeled as **N**(0, 0.5  m), about 40% of the aircraft
attempting Category I approaches would be allowed to proceed. In other
words, the *availability of service* would be about 40%. This is seen in
Figure 2.4b, where we have also delimited and labeled areas
corresponding to false alarm, missed detection, and service unavailable.
The thin sliver of unlabeled area with green crosshatching corresponds
to "service available." The availability of service would be nearly 98%
if the errors could be reduced to **N**(0, 0.25 m), as shown in Figure
2.4c. Actually, economic considerations dictate a much higher
availability and, therefore, the errors have to be lower.

##  ![](media/image52.wmf){width="2.001388888888889in" height="4.429166666666666in"}

Figure 2.3. A sky view of two satellite subsets chosen for the
computation of scatter ensuring good geometry for each.

> ![](media/image53.png){width="3.6in" height="2.7in"}
> ![](media/image54.png){width="3.591666666666667in" height="2.6875in"}
> ![](media/image55.png){width="3.6395833333333334in"
> height="2.723611111111111in"}

Figure 2.4. Joint distribution for GNSS-42 of 3-D position error and
scatter for pseudorange errors drawn from (a) **N** (0, 1m), (b) **N**
(0, 0.5 m), and (c) **N** (0,0.25 m)

The main point of Figure 2.4 is that the algorithm accounts for the size
of the errors automatically without asking for a value of sigma. If for
any reason the pseudorange errors grow and sigma doubles, the position
error bound would double as well. The availability suffers but the
probability of missed detection is not affected. Note also in Figure 2.4
that while our position error bound seems tight for small values of
scatter, it's too loose for large values.

(ii) (Figure 2.5a) Error distribution closer to what's observed in
     practice: Gaussian-like except for long, fat tails, simulated as a
     Gaussian mixture 0.9 **N**(0, 1 m) + 0.1 **N**(0, 3 m), i.e., the
     errors are drawn randomly from **N**(0, 1  m) in 90% of the cases
     and from **N**(0, 3  m) in 10% of the cases. Actually, this model
     of pseudorange errors exaggerates the tails beyond what has been
     observed. As expected, the bivariate distribution spreads out more
     and service availability is lower than that in Figure 2.4a. The
     remarks above about error size and availability apply to Figure
     2.5a as well. The main conclusion is that the decision rule for
     position error bound continues to hold even when the error
     distribution deviates somewhat from the Gaussian.

(iii) (Figure 2.5b) Errors freed up even more: Uniformly distributed
      between --5 meters and +5 meters, represented as **U**(-5 m, 5 m).
      We use this overly demanding and unrealistic model for the
      pseudorange errors to make our main point that the position error
      bound can be based on scatter without regard to the size or
      distribution of the pseudorange errors. That's what "robust" in
      the title of this paper refers to. The bivariate distribution
      spreads out a lot more but the triangular white space adjoining
      the *y*-axis remains inviolate and, what's more, our decision rule
      for the position error bound doesn't seem so loose anymore. With
      such large errors, it's no surprise that the availability of
      service is dismal. However, the availability exceeds 99.9% for
      error distribution **U**(-0.25 m, 0.25 m).

Several observations are in order. First, while our decision rule is not
violated in any of these 15 million trials, we can't be sure that the
missed detection requirement is being met. It would take 100 million
trials to establish the missed detection rate with confidence. Secondly,
as noted previously, a larger satellite constellation would allow a
tighter error bound and offer a higher availability of service. Thirdly,
the algorithm places a significant computational load on the avionics.
And, finally, having avoided making any assumptions about the
distribution of the errors has a price. We don't expect a general tool
to perform as well as a specialized tool for a task. In other words, if
the errors were indeed Gaussian, we'd be better off exploiting this fact
in our decision rule. On the other hand, the idea of adopting an
essentially open-loop approach and an error model with uncertain
parameter values has obvious flaws. The main benefit of the proposed
approach is that it closes the loop by introducing a conditioning
statistic. As the pseudorange errors change, scatter changes, and the
resultant position error bound changes.

This approach is also usable for precise relative navigation based on
carrier phase measurements with potential applications in docking of
spacecraft, formation flying, and landing aircraft on carriers. The
focus in these applications is generally on integer ambiguities, which,
if estimated correctly, can provide centimeter-level positioning
accuracy. Unfortunately, it isn't easy to prove in real time that the
integer estimates are correct. But what if a decimeter-level position
error is acceptable? The estimates of integer ambiguities no longer have
to be all correct, or even integers, in order to meet this integrity
requirement. The focus thus shifts from the integers to the quality of
the position estimates and integrity monitoring.

> ![](media/image56.png){width="3.6798611111111112in"
> height="2.7534722222222223in"}
>
> ![](media/image57.png){width="3.6798611111111112in"
> height="2.7534722222222223in"}

Figure 2.5. Joint distribution for GNSS-42 of 3-D position error and
scatter for pseudorange errors drawn from (a) Gaussian mixture 0.9 **N**
(0, 1m) + 0.1 **N** (0, 3 m), and (b) uniform distribution **U**(-5 m, 5
m)

This approach doesn't work well with GPS alone because a significant
number of users don't have enough redundant measurements (see Figure
2.1). Figure 2.6 presents the bivariate histogram of 3-D position error
and scatter for the baseline constellation GPS-24 corresponding to
pseudorange error of **N**(0, 1 m). The scheme used to generate the
scatter of position estimates consists of dropping one measurement in
turn, as proposed earlier by Brown and McBurney. Note in the histogram
that certain combinations of random errors result in near-zero

![](media/image58.png){width="3.6798611111111112in"
height="2.7534722222222223in"}

Figure 2.6. Joint distribution for GPS-24 of 3-D position error and
scatter for pseudorange errors drawn from Gaussian distribution **N**(0,
1 m).

scatter and large position error. These points, all of which correspond
to trials in which the number of satellites in view is low (*K* ≤ 7),
represent outcomes which are contrary to our basic premise.

### 2.6 Summary

We have discussed an approach to receiver-autonomous or self-contained
integrity monitoring applicable to a wide range of applications of
Global Navigation Satellite Systems involving safety-of-life
considerations. This approach requires that all users have richly
redundant measurement sets typical of constellations of 40-plus
satellites. The principal benefit is that we dispense with any
assumptions regarding the size or distribution of the uncompensated
pseudorange errors.

The results presented here are based on an idealized satellite
constellation, a simple implementation of the algorithm, and
modest-sized simulations to illustrate the approach. In order to *prove*
that the algorithm will meet the false alarm and missed detection
requirements of precision approaches, more extensive simulations must be
carried with a satellite constellation more representative of
GPS+Galileo.

##  

## References

\[1\] L. Vittorini and B. Robinson, "Receiver Frequency Standards:
Optimizing Indoor Navigation Performance," *GPS World*, November 2003,
pp. 40-48.

\[2\] D. Domey, J.C. Lanoue and J. Studenny, "The 'Digital Indirectly
Compensated Crystal Oscillator' (DICXO): A High-Performance Clock for
Aircraft Landing Applications," Institute of Navigation, *Proc. ON GPS
2002*, pp. 1619-1629.

\[3\] P. Misra and P. Enge, *Global Positioning System: Signals,
Measurements, and Performance*, Ganga-Jamuna Press, Lincoln, Mass.,
2001, pp. 178-188.

\[4\] Varner, C. C., "Gaussian and Mixed-Gaussian Methods of LAAS
Overbounding," Institute of Navigation, *Proc. National Technical
Meeting*, 2002, pp. 531-538.

\[5\] P. Misra, The Role of the Clock in a GPS Receiver, *GPS World*,
May 1996, pp. 60-66.

\[6\] S. Bednarz, Adaptive Modeling of Receiver Clock for Integrity
Monitoring During Precision Approaches, Master's Thesis, Department of
Aeronautics and Astronautics, Massachusetts Institute of Technology,
June 2004.

\[7\] C. W. Helstrom, *Probability and Stochastic Processes for
Engineers*, Second Edition, Macmillan Publishing Co., New York, 1991,
pp. 160-163, 190-193.

\[8\] R. Grover Brown and Paul W. McBurney, "Self-contained GPS
Integrity Check Using Maximum Solution Separation," *NAVIGATION*, Vol.
35, No. 1, 1988, pp. 41-53.

\[9\] Braff, Ron, "Description of the FAA's Local Area Augmentation
System (LAAS)," NAVIGATION, Vol. 44, No. 4, winter 1997-1998.

\[10\] Liu, Fan, Tim Murphy, and Trent Skidmore, "LAAS Signal-in-Space
Integrity Monitoring Description and Verification Plan," Proc. ION
GPS-97, pp. 485--497.

\[11\] Warburton, John, "Towards Validation of the Standards in SARPS
Section B," International Civil Aviation Organization (ICAO), Global
Navigation Satellite Systems Panel (GNSSP), Working Group B Meeting,
Working paper GNSSP/WG-B WP/51, Seattle, WA, 2000.

\[12\] Varner, Christopher C., "Gaussian and Mixed-Gaussian Methods of
LAAS Overbounding," *Proc. ION National Technical Meeting*, 2002, pp.
531-538

\[12\] RTCA, "Minimum Operational Performance Standards for GPS Local
Area Augmentation System Airborne Equipment, RTCA, SC-159, DO-253A,
2001.

\[13\] US DOT/FAA, "Category I Local Area Augmentation System Ground
Facility, Specification FAA-E-2937A," 2002.

\[14\] Efron, Bradley, *The Jackknife, the Bootstrap, and Other
Resampling Plans*, Society for Industrial and Applied Mathematics, 1982.

\[15\] F. Mosteller and J. W. Tukey, *Data Analysis and Regression*,
Addison-Wesley Publishing Co., 1977, pp. 133-162.

\[16\] Gerard Lachapelle, M. Elizabeth Cannon, Kyle O'Keefe, and Paul
Alves, "How will Galileo Improve Positioning Performance," *GPS World*,
September 2002, pp. 38-48.

\[17\] Sandra Verhagen, "Performance Analysis of GPS, Galileo, and
Integrated GPS-Galileo," *Proc. ION GPS 2002*, pp. 2208-2215.

\[18\] Arian Leonard, Helmut Blomenhofer, Isabel Izquierdo, "GPS and
Galileo: Interoperability and Synergies*," Proc. ION GPS 2002*, pp.
330-341.

\[19\] Marcus Burns, "Benefits and Issues related to the combination of
Galileo and GPS," International Civil Aviation Organization (ICAO),
Global Navigation Satellite Systems Panel (GNSSP), Working Group of the
Whole Meeting, Working Paper ICAO GNSSP WP-8, San Antonio, TX, 2002.