Integrity monitoring of navigation systems using Baye's rule

Navigation system errors, which result from a bias or error in a transmitter's data or timing, are detected and isolated. The transmitters may be ground based or they may be in a satellite. The least square error residual is calculated using the information received from the transmitter and the last estimate of the aircraft's position. Using Baye's Rule, the residual is used to calculate the a posteriori conditional probability of each transmitter being in error. The a posteriori conditional probabilities, and an estimate of each transmitter's error or bias are used to estimate the system loss associated with the elimination of a particular transmitter's information from the calculation of the aircraft's position. The faulty transmitter is identified by determining which transmitter's elimination will result in minimal system loss. In some instances, the system loss is minimized by eliminating no transmitters. Once the configuration that produces minimal loss is determined, the aircraft's position is calculated using the information from the transmitters that compose the minimal loss configuration.

BACKGROUND OF THE INVENTION 
1. Field of the Invention 
The present invention relates to fault detection and isolation in any 
system whose system state is observed with an overdetermined set of 
measurements. More particularly, the present invention relates to fault 
detection and isolation in navigation systems. 
2. Description of the Related Art 
Navigation systems, such as those used in aircraft, determine position 
through the use of ranging systems. Ranging systems ascertain an 
aircraft's position by simultaneously determining the aircraft's distance 
from several transmitters, where the location of each transmitter is 
known. 
The ranging systems can be either passive or active. An active ranging 
system uses distance measuring equipment (DME) to determine a distance 
from a ground based transmitter. The DME transmits a signal to the ground 
station and then after a fixed delay, the ground station transmits a 
signal to the DME. By measuring the round trip time of the signal, the DME 
determines the aircraft's distance from the ground station. 
An example of a passive ranging system is the global positioning system 
(GPS). In this system the aircraft GPS equipment passively receives 
transmissions from a global positioning satellite to determine the 
aircraft's distance from the satellite. The distance from the satellite is 
determined by the amount of time that it takes for the signal to travel 
from the satellite to the aircraft. The GPS system in the aircraft is not 
synchronized to the satellite, and therefore does not know precisely when 
the satellite transmitted its signal. As a result, the range measured by 
the aircraft's GPS equipment contains an offset that corresponds to the 
amount of time by which the satellite and aircraft GPS equipment are out 
of synchronization. The range measurements containing this offset are 
called pseudorange measurements. The offset as well as the position is 
determined by taking several pseudoranges and solving the resulting 
simultaneous algebraic equations in accordance with well known procedures. 
Whether using an active or passive ranging system, the navigation system 
uses the range measurements to determine the aircraft's position. The 
range measurements are used to determine lines of position (LOP), where 
each LOP is a portion of a circle having the satellite or ground station 
at its center. In a two dimensional navigation system a LOP defines a 
line, and in a three dimensional navigation system a LOP defines a 
surface. In the case of an active system, the radius of the circle is 
equal to the aircraft's distance from the satellite or ground station. In 
a passive system the radius measurement includes the above described 
offset. FIG. 1 illustrates three LOPs. LOPs 2, 4 and 6 were determined by 
calculating the distance from the aircraft to three different 
transmitters. Point 8 corresponds to the intersection of the three LOPs 
and indicates the aircraft's position. 
FIG. 2 illustrates three LOPs that do not intersect in a single point. The 
three LOPs do not intersect in the same point because one of the LOPs 
contains an error resulting from an incorrect determination of the 
aircraft's distance from the ground station or satellite transmitter. This 
error could result from an excessive delay in the retransmit from a ground 
based transmitter or it could result from a satellite transmitter being 
out of synchronization with other satellite transmitters. In reference to 
figure two, LOP 12, 14 or 16 could be incorrect. This results in three 
possible aircraft positions shown by intersecting points 18, 20 and 22. 
Since it is not known which LOP is incorrect, the aircraft's position is 
estimated to be somewhere within area 24 which is bounded by the three 
LOPs. The distances from the estimated position to the several LOPs are 
called error residuals. In the past, the integrity of this type of 
navigation system was monitored by measuring the size of the residuals. 
When the RMS (root means square) of the residuals became greater than a 
threshold, an integrity alarm was sent to a pilot. Unfortunately, there 
was no fault isolation to identify the LOP that was in error. 
SUMMARY OF THE INVENTION 
The present invention detects and isolates the bias in a transmitted signal 
that results in an incorrect LOP. Multiple biases in several signals can 
also be detected and isolated. The error introduced by the bias is 
corrected or the error producing transmitter is eliminated from the 
navigation system's receive schedule. 
A navigation system receives signals from a plurality of transmitters and 
identifies an error producing transmitter. The navigation system comprises 
means for receiving transmitted signals from the plurality of 
transmitters, means for determining ranges from the transmitters, means 
for computing a least square residual error using the ranges, means for 
determining a conditional probability that a transmitter is the error 
producing transmitter using the least square residual error and Bayes 
Rule, and means for choosing a maximum conditional probability to identify 
the error producing transmitter.

DESCRIPTION OF THE PREFERRED EMBODIMENT 
FIG. 3 is a block diagram of a GPS system containing the present invention. 
The GPS system includes receiver 30, base band processor 32, controller 
34, position/velocity/time (PVT) computer 36, flight manager 38 and 
Bayesian classifier 40. Receiver 30 includes the antenna and a down 
converter that converts the high frequency signals received by the antenna 
to a base band frequency. Base band processor 32 receives the base band 
signal from receiver 30. Base band processor 32 extracts the satellite 
data from the base band signal by performing an autocorrelation function 
between the received signal and a code that corresponds to the satellite 
being received. This code is changed to select the satellite that is being 
monitored. Base band processor 32 is given the schedule of satellites to 
monitor by controller 34. Controller 34 receives the satellite data from 
base band processor 32 and calculates a pseudorange which is passed to PVT 
computer 36. Controller 34 also receives fault isolation information from 
computer or Bayesian classifier 40. The controller uses this information 
to instruct base band processor 32 as to which satellites should be 
monitored. For example, if a particular satellite is found to be the 
source of an error, that satellite is removed from the list of satellites 
monitored by base band processor 32. Typically a plurality of satellites 
are monitored at one time, therefore a satellite can be removed from the 
monitoring schedule while still providing a sufficient number of monitored 
satellites for determining an aircraft's position. 
PVT computer 36 receives the pseudoranges from controller 34, calculates 
the aircraft's position and velocity, and then provides that information 
to flight management unit 38. PVT computer 36 also provides flight 
management unit 38 with the reference time received from the satellite. In 
addition to calculating position and velocity, PVT computer 36 calculates 
the residuals which are provided to Bayesian classifier 40. Bayesian 
classifier 40 uses the residuals to detect faults or a bias in the 
satellite's data. Bayesian classifier 40 then calculates a least squares 
solution to correct for the bias and provides that information to PVT 
computer 36. If the detected bias becomes too great, Bayesian classifier 
40 notifies controller 34 that a particular satellite is the source of the 
bias. Controller 34 then removes the faulty satellite from the monitoring 
schedule carried out by base band processor 32. Bayesian classifier 40 
also provides an integrity alarm to flight management unit 38. 
Flight management unit 38 provides the pilot interface to the navigation 
system. This interface provides the pilot with position, velocity and time 
data as well as information regarding the integrity of the navigation 
system. The pilot can also provide commands to the navigation system 
through flight management unit 38. 
Bayesian classifier 40 uses Baye's Rule to provide early detection 
identification and compensation of a measurement bias in an overdetermined 
set of equations, that is when an excess number of transmitters is 
available to make range measurements. This technique is applicable to 
integrity monitoring of satellites in a GPS navigation system as well as 
to any system whose system state is observed with an overdetermined set of 
measurements. 
The problem of determining an aircraft's two dimensional position using an 
overdetermined set of measurements can be expressed with the following 
equations. 
##EQU1## 
where D.sub.1, D.sub.2 and D.sub.3 are the observed distances to a 
transmitter, and a.sub.1 and b.sub.1 are the coordinates of the 
transmitter associated with D.sub.1, a.sub.2 and b.sub.2 are the 
coordinates of the transmitter associated with D.sub.2 and a.sub.3 and 
b.sub.3 are the coordinates of the transmitter associated with D.sub.3. 
To linearize the problem, the above equations can be differentiated to 
produce the following. 
##EQU2## 
where the differentials dD.sub.1, dD.sub.2 and dD.sub.3 are the difference 
between an estimated range from the corresponding transmitter and the 
observed range, and where the partial derivatives are constants that 
result from evaluating the partial derivative at the x and y coordinate 
corresponding to the estimated range. The dx and dy in each equation 
corresponds to the difference between the estimated x and y coordinates of 
the aircraft, and the coordinates of the aircraft that correspond to the 
measured range. The preceding set of equations can be rewritten as 
##EQU3## 
using matrix notation this can be rewritten as 
##EQU4## 
this can be rewritten to define the linear least square problem as shown 
by 
EQU Ax=d (1.1) 
where x and d represent vectors, and where A represents a matrix that 
performs a linear transformation. 
More generally, A is a m by n matrix that maps R.sup.n into R.sup.m where m 
is greater than n. M is the number of rows in matrix A and corresponds to 
the number of satellites or transmitters being monitored, and n is the 
number of columns in matrix A and corresponds to the number of variables 
being determined by monitoring the transmitters. In the case of a GPS 
navigation system, there are typically four variables being determined. 
These variables correspond to the aircraft's position in terms of the x, y 
and z coordinates and the user's clock offset b. The space R.sup.m is 
known as the requirements space and the R.sup.n is known as the solution 
space. 
If we let {a.sub.j : 1.ltoreq.j.ltoreq.n} denote the columns of A in 
R.sup.n, so that 
EQU A=(a.sub.1 a.sub.2 . . . a.sub.n), (1.2) 
then (1.1) may be cast as a linear relationship in the requirements space: 
EQU .SIGMA.a.sub.j x.sub.j =d. (1.3) 
We can also introduce the nxm measurement matrix H, defined by 
EQU H=A.sup.T. (1.4) 
The columns {h.sub.i : 1.ltoreq.i.ltoreq.m} of H are the normal vectors in 
R.sup.n for the various hyperplanes defined in R.sup.n by the individual 
component equations in (1.1): 
EQU h.sub.i.sup.T x=d.sub.i, 1.ltoreq.i.ltoreq.m. (1.5).sub.i 
Thus h.sub.i.sup.T is the i.sup.th row of A. We can assume without loss of 
generality that A is row-normalized, i.e. there is a constant c.sub.o such 
that 
EQU .vertline.h.sub.i .vertline..sup.2 =h.sub.i.sup.T h.sub.i =c.sub.o.sup.2, 
1.ltoreq.i.ltoreq.m. (1.6).sub.i 
Each equation in (1.5).sub.i is known as a measurement on the state x of 
our system. 
For simplicity, we assume that the measurements are corrupted by zero mean 
Gaussian noise and possibly by the presence of a single-axis bias. The 
treatment is amenable to more general noise environments and multiple 
biases. In particular, the analysis remains valid for the "3 layer" model 
of Gaussian noise used to represent the noise environment associated with 
the Selective Availability characteristic of the GPS system, i.e. the 
total error is the sum of a random constant (very slowly changing random 
variable), the output of a Gauss Markov process with a two minute 
correlation time and white Gaussian noise (correlation time less than 1 
second). 
More precisely, if x.sub.o is the nominal state of our system in R.sup.n 
and d.sub.o =Ax.sub.o is the set of associated nominal measurements in 
R.sup.m, we assume that the actual measurements have the form 
EQU d=d.sub.o +b+.nu.. (1.7) 
Here .nu. represents the Gaussian noise with mean .mu.(.nu.) and covariance 
C(.nu.) given by 
##EQU5## 
where I.sub.m is the mxm identity for R.sup.m. Also for simplicity in this 
presentation the bias b is assumed to have the single-axis form 
EQU b=f.sub.i b (1.9) 
for some fixed i, 1.ltoreq.i.ltoreq.m, where F.sub.m =(f.sub.1 f.sub.2 . . 
. f.sub.m) is the standard basis for R.sup.m, i.e. f.sub.i is the i.sup.th 
column of the identity matrix I.sub.m. 
2. Least Squares Tools 
We now introduce some important matrices associated with A. First, we 
define the nxn information matrix D: 
EQU D=A.sup.T A. (2.1) 
Next, we introduce the nxm pseudo-inverse matrix A.sup.# : 
EQU A.sup.# =CH, C=D.sup.-1 and H=A.sup.T. (2.2) 
Let S=Im(A) be the subspace denoting the range of A in R.sup.m, and 
T=S.sup..perp. be the orthogonal complement of S in R.sup.m. Then T is the 
kernel or nullspace of A.sup.T and R.sup.m may be written as the direct 
sum of S and T: 
EQU R.sup.m =S.sym.T. (2.3). 
We now introduce the orthogonal projection P onto the range of A in 
R.sup.m, defined by 
EQU P=AA.sup.#. (2.4) 
P satisfies 
##EQU6## 
The mxm complementary projection Q, defined by 
EQU Q=I-P, (2.6) 
satisfies 
##EQU7## 
Note: The orthogonal projections P and Q are symmetric, positive 
semidefinite idempotent matrices, i.e. P=P.sup.T, y.sup.T Py.gtoreq.O and 
PP=P, with similar statements for Q. 
The least squares solution of (1.1) is returned by 
EQU x.sup.# =A.sup.# d. (2.8) 
The error dx.sup.# =x.sup.# -x.sub.o in the least squares solution is 
itself the least squares solution of the problem 
EQU Ax=e, (2.9) 
where e=d-d.sub.o is the error in the measurement vector d. The mean and 
covariance of dx.sup.# are given by 
##EQU8## 
We shall refer to C=D.sup.-1 as the .sigma..sub..nu..sup.2 -normalized 
covariance matrix for our system. The GDOP (geometric dilution of 
precision) for our system is given by 
##EQU9## 
When no bias is present, the GDOP can be used to get the rms value of the 
system error: 
##EQU10## 
We also have the following result that may be of interest, if we wish to 
compute the system GDOP without completing the inverse computation implied 
in C=D.sup.-1 : 
The system GDPO.sub.o can be computed from the determinant .DELTA. of the 
information matrix D, according to the relation 
##EQU11## 
NOTE: In practice, the real importance of (2.13) is that it serves as a 
stepping stone in establishing a formula for estimating the GDOP of a 
reduced system A.sub.r x=d.sub.r, obtained by dropping measurements from 
the original system Ax=d. (See (3.2).sub.r below.) 
3. GDOP and Fault Detection 
If a bias b.sub.i appears on axis i, we shall say that there is a fault 
associated with that measurement. The measurement redundancy in the 
information matrix can be used to detect the presence of such faults. In 
particular we can detect a single-axis bias b provided m&gt;n. If m&gt;n+1, then 
the redundancy can be used to isolate the particular axis on which the 
bias occurs. 
To describe some of the important ideas in this program it will be helpful 
to let r {1,2, . . . m} denote a subset of the measurement indices. The 
size of r will be denoted by .vertline.r.vertline.. If we drop the 
equations indexed by r from the system Ax=d, we get the r-reduced system 
EQU A.sub.r x=d.sub.r. (3.1).sub.r 
We shall see that to detect a bias in our original system along the axis 
f.sub.i in R.sup.m, it is necessary that the r-reduced system (3.1).sub.r 
have a good GDOP.sub.r, where r={i}. To be assured of detecting an 
arbitrary single-axis bias b, we must have a good GDOP.sub.r for every 
r-reduced system, where .vertline.r.vertline.=1. 
To isolate the axis f.sub.i for the bias b, it must further be true that 
every r-reduced system (3.1).sub.r have a good GDOP.sub.r where r={i,j} is 
an index subset of size 2 containing the bias index i. Thus to isolate an 
arbitrary single-axis bias b, we must have a good GDOP.sub.r for every 
r-reduced system, where .vertline.r.vertline.=2. 
In connection with these observations it will be convenient to have an 
efficient means of computing the numbers GDOP.sub.r. To this end we state 
the following 
Let Q.sub.rr be the square 
.vertline.r.vertline.x.vertline.r.vertline.-sized matrix gotten by 
extracting from Q the elements whose rows and columns are indexed by r. 
Let .DELTA..sub.rr be the determinant of Q.sub.rr. Then 
##EQU12## 
If r={i} is an index subset of size 1, then .DELTA..sub.rr =Q.sub.ii where 
Q.sub.ii is the i.sup.th element along the diagonal of Q. Hence 
(3.2).sub.r reduces to 
##EQU13## 
In light of (3.3).sub.i, we might be tempted to search for systems Ax=d 
where the numbers Q.sub.ii are as large as possible. The following result 
shows that the Q.sub.ii are bounded between 0 and 1 and that whenever 
there is some Q.sub.ii above a well defined average value 
(Q.sub.ii).sub.avg, there must also be a Q.sub.ii below that average: 
Theorem 
The following bounds hold on the numbers .DELTA..sub.rr : 
##EQU14## 
Here the binomial coefficient C(n,r) counts the number of possible 
combinations of n objects taken r at a time. In particular, this means 
that the elements Q.sub.ii along the diagonal of Q satisfy 
##EQU15## 
NOTE: The most desirable set of circumstances is when all the Q.sub.ii 
"crowd" up near their average value Q.sub.ii =1-n/m. This will tend to 
happen when the "tips" of the normals h.sub.i for the various measurement 
hyperplanes are symmetrically distributed on the sphere of radius c.sub.o. 
Notice that as the number of measurements m becomes large with respect to 
the number of elements n in the state of the system, 
(.DELTA..sub.rr).sub.avg .fwdarw.1. 
As a further result along these same lines, we also have the following: 
Let A.sub.r.sup.# be the columns of A.sup.# indexed by r. Then the 
r-reduced covariance matrix C.sub.r is given by 
EQU C.sub.r =C+A.sub.r.sup.# Q.sub.rr.sup.-1 A.sub.r.sup.#T. (3.6).sub.r 
NOTE: For a GPS application, x=(x y z b).sup.T, where the clock offset b is 
not to be confused with a measurement bias. The result (3.6) is especially 
helpful if we are interested in computing just the HDOP (horizontal 
dilution of precision) for the reduced system--see the topic System 
Availability in Section 4 below. In fact, to obtain the system HDOP we 
need only compute the first two diagonal elements in C.sub.r. If 
.vertline.r.vertline.=1, then Q.sub.rr.sup.-1 is just the reciprocal of 
the scalar element Q.sub.ii along the diagonal of Q. Also the matrix 
product A.sub.r.sup.# A.sub.r.sup.#T reduces in this case to the dyadic 
product of the i.sup.th column a.sub.i.sup.# of A.sup.# with itself. 
4. Bayes' Rule, Bias Detection, System Availability and Fault Isolation 
Bayes' Rule: 
For single axis bias detection and isolation, we will suppose that the 
probability of a fault on the i.sup.th axis is given by .alpha., and that 
.alpha. is so small that there is a negligible possibility of simultaneous 
faults on two or more axes. We will let .theta..sub.i denote the 
hypothesis that there is a fault on the i.sup.th axis, 
1.ltoreq.i.ltoreq.m, and .theta..sub.o denote the null hypothesis, i.e. 
there is no fault on any axis. Under these assumptions, it should then be 
clear that exactly one of these m+1 hypotheses is true at all times. We 
may then express the a priori probability function for the hypotheses in 
the form 
##EQU16## 
We introduce the .sigma..sub..nu. -normalized least squares error residual 
e.sub.t, defined by 
EQU e.sub.t =.sigma..sub..nu..sup.-1 Qd. (4.2) 
Then the .sigma..sub..nu. -normalized least squares estimate b.sub.i.sup.# 
of a bias b.sub.i on the i.sup.th axis is given by the i.sup.th component 
of the vector 
EQU b.sup.# =diag(Q.sub.ii.sup.-1)e.sub.t. (4.3) 
Here diag(Q.sub.ii) is the matrix whose diagonal elements agree with those 
of Q and whose off-diagonal elements are zero. 
We form up the associated normalized least squares noise residuals 
r.sub.i.sup.# defined by 
EQU r.sub.i.sup.#2 =e.sub.t.sup.T e.sub.t -Q.sub.ii b.sub.i.sup.#2, 
1.ltoreq.i.ltoreq.m, (4.4).sub.i 
EQU and 
EQU r.sub.o.sup.#2 =e.sub.t.sup.T e.sub.t. (4.4).sub.o 
The conditional probability f(e.sub.t .vertline..theta..sub.i) of observing 
the error e.sub.t =.sigma..sub..nu..sup.-1 Qd, given the hypothesis 
.theta..sub.i, is provided by the expression 
EQU f(e.sub.t .vertline..theta..sub.i)=c*exp(-r.sub.i.sup.#2 /2), 
0.ltoreq.i.ltoreq.m, (4.5).sub.i 
where * represents multiplication. 
Here the normalizing constant c is given by c=[1/2.pi.].sup.(m-n)/2. We can 
then use Bayes' Rule to get the a posteriori conditional probabilities 
EQU h(.theta..sub.i .vertline.e.sub.t)=f(e.sub.t 
.vertline..theta..sub.i)h(.theta..sub.i)/g(e.sub.t), 
0.ltoreq.i.ltoreq.m,(4.6).sub.i 
where g(e.sub.t) is the marginal distribution for e.sub.t defined by 
##EQU17## 
We remark that this application of Bayes' Rule may look a little 
unconventional in that we are mixing random vaiables with distributions 
characterized by continuous density functions with random variables with 
distributions characterized by discrete probability functions. Owing to 
the form of (4.6).sub.i and (4.7), the normalizing constant c used in 
(4.5).sub.i will cancel out, and hence need never be evaluated. Our 
criterion for bias detection and isolation will use the a posteriori 
probabilities indicated in (4.6).sub.i. 
Bias Detection: 
We will say that a bias has been detected with 3.sigma..sub..nu. certainty 
if 
EQU h(.theta..sub.o .vertline.e.sub.t)&lt;0.01. (4.8) 
From (4.5).sub.i and (4.4).sub.o, we see that h(.theta..sub.o 
.vertline.e.sub.t) will decrease as the magnitude of r.sub.o.sup.#2 
increases. This indicates that the Probability of False Alarm associated 
with (4.8) can be related to a condition of the form r.sub.o.sup.#2 
&gt;.lambda..sub.o.sup.2, where r.sub.o.sup.#2 is the test statistic 
introduced in (4.4).sub.o and .lambda..sub.o is some False Alarm 
threshold. (The threshold .lambda..sub.o will be related to the parameter 
.alpha. in (4.10) and (4.11) below.) Since the system noise is supposed 
Gaussian and r.sub.o.sup.#2 is the projection of the noise into a space of 
dimension m-n, it should be obvious that the test statistic r.sub.o.sup.#2 
has a .chi..sup.2 distribution with .nu.=m-n degrees of freedom. For a 
typical GPS application .nu. may lie between 1 and 4, although in some 
cases the upperbound 4 may be increased. A rough order of magnitude for 
the Probability of False Alarm in all these typical cases is afforded by 
taking .nu.=2. In this case, the .chi..sup.2 distribution can be 
calculated in closed form: 
EQU Prob.sub.FA =exp(-1/2.lambda..sub.o.sup.2). (4.9) 
More specifically, by substituting (4.6).sub.i together with the supporting 
definitions found in (4.1).sub.i -(4.5).sub.i into (4.8) and making a few 
more or less obvious approximations to recognize "worst case" estimates, 
.lambda..sub.o is related to the parameter .alpha. used in the definition 
of the a priori and a posteriori probabilities according to the relation 
##EQU18## 
If we accept the approximation (4.9), then we can combine (4.9) and (4.10) 
to obtain a relation between .alpha. and the probability of False Alarm: 
EQU .alpha.=(x.sub.o /m)/(1+x.sub.o); x.sub.o =Prob.sub.FA /0.01.(4.11) 
NOTE: Equation (4.11) is useful if we want to set a level for Prob.sub.FA 
and then find the parameter .alpha. that will cause the test criterion in 
(4.8) to realize that leve. Usually Prob.sub.FA &lt;, 0.01, in which case 
(4.11) reduces to .alpha.=Prob.sub.FA /(0.01 m). 
The minimum bias b.sub.i along the i.sup.th axis which can be detected with 
3.sigma..sub..nu. certainty is given by 
##EQU19## 
Hence the minimum bias b.sub.min.sup.det that can always be detected with 
3.sigma..sub..nu. certainity is given by 
EQU b.sub.min.sup.det =max b.sub.i.sup.det 1.ltoreq.i.ltoreq.m.(4.13) 
System Availability: 
Let e.sub.H denote the .sigma..sub..nu. -normalized maximum horizontal 
error allowed before a bias detection is made. Then, making use of (2.10), 
with b=f.sub.i b, we see that the maximum allowable bias b.sub.i.sup.alw 
along the i.sup.th axis is given by 
##EQU20## 
where a.sub.i.sup.# is the i.sup.th column of the pseudoinverse A.sup.#, 
and the inner product a.sub.i.sup.#T a.sub.i.sup.# is a "partial" inner 
product, summing only the first two components of a.sub.i.sup.#. 
It should be obvious that the availability of integrity monitoring requires 
EQU b.sub.i.sup.det .ltoreq.b.sub.i.sup.alw, 1.ltoreq.i.ltoreq.m,(4.15).sub.i 
or using (4.12).sub.i and (4.14.sub.i in (4.15).sub.i, and rearranging, we 
see that we must have 
##EQU21## 
Consulting (3.6).sub.r, we see that the expression on the right here 
denotes the change dHDOP.sub.i in the system HDOP when the i.sup.th 
measurement is dropped: 
##EQU22## 
Thus we characterize the system availability in terms of the maximum 
change in HDOP: 
EQU max dHDOP.sub.i .ltoreq.e.sub.H /(.lambda..sub.o +3) 
1.ltoreq.i.ltoreq.m.(4.18) 
When navigating a GPS approach, the horizontal error should remain under 
0.3 nm or 556 m in the presence of a selective availability noise level 
whose overall .sigma..sub..nu. is 35 m. This corresponds to taking the 
.sigma..sub..nu. -normalized e.sub.H =16. A recommended probability of 
False Alarm is Prob.sub.FA =0.00005. Using (4.9), we see that 
.lambda..sub.o =4.5. Substituting in (4.14), we see that 
EQU max dHDOP.sub.i .ltoreq.2.1, (GPS approach) 1.ltoreq.i.ltoreq.m.(4.19) 
If we wish to extend the availability of the system monitoring at the 
expense of a greater Prob.sub.FA, we may choose .lambda..sub.o so small 
that b.sub.i.sup.det in (4.12).sub.i satisfies (4.15).sub.i for every i, 
1.ltoreq.i.ltoreq.m. We can then find the corresponding Prob.sub.FA and 
dHDOP.sub.max from (4.13) and (4.18) respectively. 
Fault Isolation: 
Next we address the issue of fault isolation. We will say there is a bias 
on the i.sup.th axis, with 3.sigma..sub..nu. certainty, if 
EQU h(.theta..sub.i .vertline.e.sub.t)&gt;0.99, 1.ltoreq.i.ltoreq.m.(4.20).sub.i 
The minimum .sigma..sub..nu. -normalized bias b.sub.i.sup.iso along the 
i.sup.th axis that allows identification of a fault along the i.sup.th 
axis with 3.sigma..sub..nu. certainty is given by 
##EQU23## 
Here .DELTA..sub.ij =.DELTA..sub.rr with r={i,j}. The number 6 arises 
naturally by requiring that the projections of 3.sigma..sub..nu. spheres 
centered on axis f.sub.i and f.sub.j not overlap in the space T=Im(Q). To 
find the minimum bias b.sub.min.sup.iso that can be isolated along any 
axis with 3.sigma..sub..nu. certainty, take the maximum of all the 
expressions given in (4.2).sub.i : 
EQU b.sub.min.sup.iso =max b.sub.i.sup.iso 1.ltoreq.i.ltoreq.m.(4.22) 
The user should abort attempts at Fault Isolation if any of the estimated 
biases b.sub.i.sup.# exceeds the corresponding maximum allowable level 
b.sub.i.sup.alw, 1.ltoreq.i.ltoreq.m, introduced in (4.14).sub.i for more 
than a few seconds. 
5. Early Detection 
One pitfall with the results stated so far is that there may actually be 
quite a large bias present in the system before we are ready to recognize 
with any certainty that such a bias is present. An undetected bias b.sub.i 
on the i.sup.th axis will introduce a non-zero mean least squares error, 
as indicated in (2.10), given by 
EQU .mu.(dx.sup.#)=a.sub.i.sup.# b.sub.i. (5.1) 
Thus before we are ready to announce the detection of b.sub.i, the presence 
of the bias may already have introduced an unacceptable level of error 
into the conventional least squares solution x.sup.#. The conventional 
least squares solution contains no recognition of the system modeling 
implied by the single-axis bias assumption. We would therefore like to 
provide a least squares solution x.sup.## that does recognize this 
assumption. In this section we describe how to go about this. 
While we don't actually know b.sub.i, we do have the estimate b.sub.i.sup.# 
provided by the i.sup.th component of (4.3). Accordingly, we introduce the 
loss vectors {L.sub.1 : 0.ltoreq.i.ltoreq.m}, defined by 
##EQU24## 
We then introduce the (m+1).times.(m+1) Bayesian Risk Matrix defined by 
EQU L.sub.ij =.vertline.L.sub.i -L.sub.j .vertline., 
0.ltoreq.i,j.ltoreq.m.(5.3).sub.ij 
NOTE: L.sub.ij.sup.2 =(L.sub.i -L.sub.j).multidot.(L.sub.i -L.sub.j). Here 
.multidot. represents the inner product of two vectors. If we are 
interested in the horizontal errors only, we can just let the summation 
index range over the x,y coordinates of the state vector x=(x y z b).sup.T 
when forming this inner product. 
NOTE: If we select hypothesis .theta..sub.j, and compensate the least 
squares solution x.sup.# returned by (2.8) with the estimated error 
dx.sup.## =a.sub.j.sup.# b.sub.j.sup.#, as suggested by (5.1), when the 
hypothesis .theta..sub.i is actually true, then (under good SNR 
conditions) L.sub.ij will measure the amount of error L(.theta..sub.j 
.vertline..theta..sub.i) incurred by this mistake. 
We now introduce the marginal risk M(.theta..sub.j 
.vertline.e.sub.t)=E[L.sup.2 (.multidot.,.theta..sub.j).vertline.e.sub.t ] 
(In this case .multidot. references a surpressed argument.) defined by 
##EQU25## 
It should be clear from this expression that M(.theta..sub.j 
.vertline.e.sub.t) is just the expected loss for our system when we have 
observed the statistic e.sub.t and made the decision to use hypothesis 
.theta..sub.j. Thus M(.theta..sub.j .vertline.e.sub.t) is just a 
"weighted" average of all the various possible losses L.sub.ij.sup.2 which 
could occur when a decision is made for the j.sup.th hypothesis 
.theta..sub.j. The weights w.sub.i, 0.ltoreq.i.ltoreq.m, are our "best" 
current judgements h(.theta..sub.i .vertline.e.sub.t) of the probabilities 
for the various hypotheses {.theta..sub.i : 0.ltoreq.i.ltoreq.m}. 
FIG. 4 is a diagram of the various quantities involved in defining 
M(.theta..sub.j .vertline.e.sub.t). We see then that to minimize the 
Bayes' Risk associated with the loss function L.sub.ij we must use the 
decision rule 
EQU .theta..sub.j =D(e.sub.t), (5.5) 
where .theta..sub.j chooses the hypothesis that provides the minimal 
marginal expected loss M(.theta..sub.j .vertline.e.sub.t). 
NOTE: Once we have chosen hypothesis .theta..sub.j, it may also be of 
interest to record the worst case risk W(.theta..sub.j .vertline.e.sub.t) 
associated with that choice: 
EQU W(.theta..sub.j .vertline.e.sub.t)=max L.sub.ij. (5.6) 
In fact, if we were confirmed pessimists, we might use the numbers 
W(.theta..sub.j .vertline.e.sub.t) in place of M(.theta..sub.j 
.vertline.e.sub.t) to make our decision .theta..sub.j, thereby minimizing 
our maximum losses. In the theory of games, this policy is sometimes 
described as characterizing "nature" as a malevolent opponent. Where we 
have the a priori and a posteriori probabilities for each hypothesis 
.theta..sub.i, such a decision policy does not really make sense. 
NOTE: If we were to use the loss function defined by 
EQU L.sub.ij =1-.delta..sub.ij, (5.7) 
where .delta..sub.ij is the kronecker deltal function, we would obtain the 
Decision Rule that leads to selecting the hypothesis with the largest 
conditional probability h(.theta..sub.i .vertline.e.sub.t). 
To effect the compensation for the estimated error dx##=a.sub.j #b.sub.j #, 
we can simply modify the j.sup.th component of the data vector d by 
subtracting out the least square estimate of the bias b.sub.j # along the 
j.sup.th axis: 
EQU d#=d-f.sub.j b.sub.j # (5.8). 
We then use 
EQU x##=A#d# (5.9) 
in place of (2.8) as our least squares solution of Ax=d. 
NOTE: We point out that if m=n+1, fault isolation is not possible. The 
decision algorithm (5.5) automatically recognizes this and will always 
return the null hypothesis. It will not opt for assigning a bias b.sub.j # 
to the j.sup.th axis until m &gt;n+1. However, when m&gt;n+1 the excess 
redundancy will allow our decision algorithm to select a bias axis f.sub.j 
together with an estimated bias b.sub.j # before h(.theta..sub.j 
.vertline.e.sub.t) is near 1, provided the expected loss M(.theta..sub.j 
.vertline.e.sub.t) is smaller than M(.theta..sub.o .vertline.e.sub.t) 
This scheme works very well when the SNR is good, so that the estimated 
bias b.sub.i # is close to the true axial bias b.sub.i. This is in general 
the case when the GDOP.sub.r is quite good for every r={i}, 
1.ltoreq.i.ltoreq.m, or when Q.sub.ii is close to 1-n/m for every i, 
1.ltoreq.i.ltoreq.m. However, if some Q.sub.ii is close to O, so that the 
corresponding reduced system A.sub.r x=d.sub.r has poor GDOP.sub.r, then 
noise effects on the bias estimate b.sub.i (see the i.sup.th component of 
(4.3)) can become quite exaggerated. This means that the compensated data 
vector d# given in (5.8) may not be too reliable. Furthermore the loss 
numbers L.sub.ij will tend to be quite noisy. If these noise effects 
happen to reduce the value of L.sub.ij, we may come up with an overly 
optimistic picture of the expected loss M(.theta..sub.j .vertline.e.sub.t) 
and even of the worst case loss W(.theta..sub. j .vertline.e.sub.t). To 
prevent the Bayes' Risk picture from looking too rosy, we will add to 
L.sub.ij a 3.sigma..sub..nu. estimate of the standard deviation of 
L.sub.ij, so that L.sub.ij will quite generally be reported at least as 
large as the real expectation of L.sub.ij. 
For 1.ltoreq.i,j.ltoreq.m, the variance .delta.L.sub.ij.sup.2 of L.sub.ij 
is given by 
EQU .delta.L.sub.ij.sup.2 =.sigma..sub.84 .sup.2 (A.sub.ii Q.sub.jj -2B.sub.ij 
Q.sub.ij +C.sub.jj Q.sub.ii)/(Q.sub.ii Q.sub.jj), (5.10).sub.ij 
EQU where 
EQU A.sub.ii =a.sub.i.sup.#T a.sub.i.sup.#, B.sub.ij =a.sub.i.sup.#T 
a.sub.j.sup.#, C.sub.jj =a.sub.j.sup.#T a.sub.j.sup.#. (5.11).sub.ij 
We will take .delta.L.sub.oo.sup.2 =0. Also, we use .delta.L.sub.oj.sup.2 
=.sigma..sub..nu..sup.2 C.sub.jj,/Q.sub.jj, 1.ltoreq.j.ltoreq.m, and 
.delta.L.sub.io.sup.2 =.sigma..sub..nu..sup.2 A.sub.ii /Q.sub.ii, 
1.ltoreq.i.ltoreq.m. We observe that the variances indicated in 
(5.10).sub.ij vanish along the diagonal, when i=j, owing to the complete 
correlation of b.sub.i.sup.# with b.sub.j.sup.#. Heuristic arguments 
suggest using .delta.L.sub.ii.sup.2 =.sigma..sub..nu..sup.2 A.sub.ii 
/Q.sub.ii, 1.ltoreq.i.ltoreq.m. 
We then add 3 times the square root of these variances to the elements in 
L.sub.ij to obtain a more realistic picture of potential losses in our 
bias estimation scheme. 
To round out the picture of the total loss in the system due to noise 
effects on all components of the data vector d, we can add to every 
L.sub.ij 3.sigma..sub..nu. times the general GDOP.sub.o given in (2.11). 
FIG. 5 illustrates the overall procedure for selecting the hypotheses that 
minimizes the margin of risk and provides a least squares solution for the 
aircraft's position. Computation 60 is used to create square matrix D. 
Matrix A is formed using pseudorange measurements as illustrated in 
equations 0.1 through 0.4. (In an active ranging system actual range 
measurements are used.) Computation 62 produces pseudo inverse matrix 
A.sup.#. Projection matrix P is provided by computation 64. Computation 66 
forms matrix Q by subtracting projection matrix P from identity matrix I. 
Computation 68 is used to provide the least square residual errors, where 
d is the difference between the estimated and observed ranges and where 
.sigma..sub..nu. is a normalizing noise factor that characterizes the 
noise environment. Computation 70 provides an estimate of the bias 
associated with each transmitter or satellite. The vector b.sup.# is 
formed by multiplying the diagonal matrix whose diagonal elements are the 
inverses of the diagonal elements of Q times the residual vector e.sub.t. 
Computation 72 is used to produce the sum of the squares of the least 
square residuals. Computation 74 is used to form an estimated sum of the 
squares of the least square residuals without a particular satellite or 
transmitter included in the computation. This corresponds to the sum of 
the squares of the residuals of a reduced system where the j.sup.th 
satellite or transmitter is omitted. Q.sub.jj is the j.sup.th diagonal 
element of Q and b.sub.j.sup.# is the j.sup.th component of b.sup.# 
computed in 70. Computation 76 is used to provide the conditional 
probability of having residual e.sub.t if hypothesis .theta..sub.j is 
true. Hypothesis .theta..sub.j corresponds to satellite or transmitter j 
being faulty. Computation 78 provides marginal distribution g(e.sub.t). 
The marginal distribution from computation 78 is formed by summing the 
products formed by multiplying the conditional probabilities by the 
corresponding a priori probabilities of satellite or transmitter j being 
in error. The a priori probabilities are obtained empirically or by using 
an assumed equipment failure rate. Computation 80 uses Baye's Rule to 
provide the conditional probability of transmitter j being in error for a 
particular residual e.sub.t. It is possible to identify the faulty 
transmitter by picking the transmitter with the greatest conditional 
probability of being in error, however it is preferable to include a loss 
factor before attempting to identify the faulty transmitter. Computation 
82 associates a loss vector with a particular satellite. It should be 
noted that a.sub.i.sup.# is the i.sup.th column of A.sup.# and 
b.sub.i.sup.# is the i.sup.th element of b.sup.#. A.sup.# and b.sup.# are 
available from computations 62 and 70, respectively. Computation 84 
provides L.sub.ij which associates a loss with the incorrect hypothesis 
that transmitter or satellite j is faulty when in reality transmitter or 
satellite i is faulty. Computation 86 is used to provide the expected 
system loss for the hypothesis that satellite j is in error by taking a 
weighted sum of the losses provided by computation 84. The sum is weighted 
by multiplying each loss by the conditional probability that transmitter 
or satellite i is in error for a particular residual e.sub.t. Computation 
88 minimizes system loss by indicating which hypothesis minimizes the 
overall loss. Decision 90 is used to decide whether the information 
provided by one of the satellites or transmitters should be removed from 
the aircraft position calculation. If the hypothesis .theta..sub.O is 
chosen, the aircraft position is chosen using the least square solution 
using all of the monitored satellites or transmitters. This computation is 
carried out in computation 92. If the decision indicates that a satellite 
or transmitter should be eliminated because of an error or bias contained 
in its data, computation 94 is carried out. Computation 94 provides an 
"early detection" least square solution to the aircraft's position and an 
estimate of the position that would be retrieved without using the data 
provided by a satellite or transmitter with erroneous or biased data. It 
should be noted that f.sub.j is the j.sup.th member of the standard basis 
for R.sup.m. It is also possible to eliminate the erroneous data by just 
removing the faulty satellite or transmitter from the receiver's schedule. 
Computation 60 through 72 are carried out in PVT computer 36, and 
computations 74 through 94 are carried out in computer or Bayesian 
classifier 40. The computations can be carried out using any convenient 
combination of hardware and/or software. All the calculations can be 
carried out in Bayesian classifier 40, or they can be carried out in any 
convenient computer. It is also possible to use specialized hardware to 
assist in performing or to perform these computations. 
There is a highly coupled computation going on between PVT computer 36 and 
Bayesian classifier 40. One computer or processor can be used in place of 
PVT computer 36 and Bayesian classifier 40, or multiple computers or 
processors can be used if a high throughput is desired.