# Impact of Temporal Correlation of Errors on GPS Receiver Autonomous Integrity Monitoring

Junesol Song, Carl Milner, Christophe Macabiau

<figure><img src="image_1.png" /></figure>

## To cite this version:

Junesol Song, Carl Milner, Christophe Macabiau. Impact of Temporal Correlation of Errors on GPS Receiver Autonomous Integrity Monitoring. IEEE Access, 2024, 12, pp.166188-166199. 10.1109/access.2024.3494863. hal-04901398

HAL Id: hal-04901398

https://enac.hal.science/hal-04901398v1

Submitted on 20 Jan 2025

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Received 4 October 2024, accepted 1 November 2024, date of publication 11 November 2024, date of current version 19 November 2024.

Digital Object Identifier 10.1109/ACCESS.2024.3494863

RESEARCH ARTICLE

# Impact of Temporal Correlation of Errors on GPS Receiver Autonomous Integrity Monitoring

JUNESOL SONG<sup>1,2</sup>, CARL MILNER<sup>1,2</sup>, AND CHRISTOPHE MACABIAU<sup>1,2</sup>

Corresponding author: Junesol Song (junesol song@suwon.ac.kr)

This work was supported in part by European Union Agency for the Space Programme (EUSPA) “GSA Engineering Support to SBAS DFMC Standardization Activities (GESTA)” under Project WP2-SC4-1000; and in part by the research grant of The University of Suwon, in 2023.

**ABSTRACT** Receiver Autonomous Integrity Monitoring (RAIM) is widely adopted in commercial aircraft to support integrity monitoring for aircraft navigation safety in en-route and Non-Precision Approach (NPA) phases. Recently, Advanced RAIM (ARAIM) has been developed, which further considers the simultaneous satellite failures in multi-constellation systems and supports multi-frequency signals. Standards provide a test procedure for onboard RAIM, offering a means to demonstrate compliance with integrity risk requirements for civil aviation. Based on this requirement, the aircraft computes the protection level that bounds the position error. Unlike the integrity risk requirement, which is defined over the entire operational period, the protection level is computed on a per sample or per-epoch basis. To properly interpret the requirement defined over the operation period to a single time instance, the temporal correlation of error sources within the operational period must be considered and quantified by the number of effective samples (NES). While recent work has evaluated NES for ARAIM, the NES for RAIM has not been thoroughly investigated. Based on the test procedure recommended in the Minimum Operational Performance Standards (MOPS), this paper focuses on estimating and bounding the NES for RAIM under different scenarios of measurement errors. Moreover, to address the limitations of these test procedures in light of the results obtained, representative test procedures are proposed to account for worst-case fault bias and address the impact of temporal correlation.

**INDEX TERMS** Global positioning system (GPS), receiver autonomous integrity monitoring (RAIM), temporal correlation, aircraft safety.

## I. INTRODUCTION

ICAO standards define navigation requirements for accuracy, continuity, integrity, and availability to achieve safe and efficient flight operations. The continuity and integrity requirements are defined over a period of operation. For example, the integrity requirement for en-route and Non-Precision Approach (NPA) is defined as $1 - 1 \times 10^{-7}$ per hour according to ICAO's Standards And Recommended Practices (SARPs) [1]. Any navigation algorithm implemented at the airborne side should comply with those requirements to provide the intended services. Among various navigation

algorithms, Receiver Autonomous Integrity Monitoring (RAIM) was proposed to ensure integrity for en-route and NPA phases of flight under the presence of a single fault [2], [3], [4], [5]. In order to support more stringent phases of flight, Advanced RAIM (ARAIM) has been proposed to initially meet Required Navigation Performance (RNP) 0.1 NM, and in the longer term to support localizer performance with vertical guidance (LPV) operations down to a 200 ft decision height [6]. Autonomous integrity monitoring includes Fault Detection and Exclusion (FDE) to alert the presence of an unacceptably large position error [7].

Both RAIM and baseline ARAIM algorithms are implemented on a per sample basis, computing a protection level based on an integrity requirement applied at each

The associate editor coordinating the review of this manuscript and approving it for publication was Rosario Pecora.

<footnote n="1">¹Department of Mechanical Engineering, The University of Suwon, Hwaseong 18323, South Korea</footnote>

<footnote n="2">²Fédération ENAC ISAE-SUPAERO ONERA, Université de Toulouse, 31055 Toulouse, France</footnote>
sample [6], [8], [9]. However, recent studies have argued that it might underestimate the impact of temporal decorrelation of the error sources, especially over a long period of operation. Milner et al. [10] and Pervan et al. [11] assessed the impact of temporal correlation on the integrity performance of ARAIM and Ground-Based Augmentation System (GBAS) monitors, respectively. Milner et al. [10] addresses the key concept of mapping the continuity and integrity requirements from the operational (per period of operation) to the algorithmic (per sample). In this context, it introduces the number of effective samples (NES), which represents the ratio of the risk of hazardously misleading information (HMI) during an operation to the risk of HMI at a single epoch. In addition, it showed that the NES can be bounded by the ratio of the period of operation and the time-to-alert (TTA), yielding a value of 450 of NES for 1 hour of exposure time and an 8-second TTA. Bang et al. [12] further evaluates the NES considering the actual risk by performing first order Gauss-Markov Monte Carlo runs. Pervan et al. [11] recommended the NES for each GBAS ground and airborne monitors in terms of continuity and integrity.

In the case of RAIM, if the protection level is calculated following an approach similar to that of Lee et al. [8], an NES of 1 is implied. Considering recent findings on the impact of a temporal correlation in ARAIM and GBAS, this study focuses on evaluating a more representative NES for RAIM through simulations based on the test procedure recommended in MOPS DO-229E [13], DO-316 [7], and DO-384 [14]. As shown in the results herein, these procedures could be designed more conservatively and may be optimistic. In fact, through simulation, we show that the current test procedure could potentially underestimate the actual integrity risk for all receiver classes. In addition, we argue that the range domain ramp error (5 m/s), used in the current test procedure, may not cover the worst-case scenario. Previous studies on ARAIM [15], [16], [17] have already emphasized the use of the worst-case fault bias and proposed methods for determining it. Based on the analysis, advancements to the current RAIM test procedure are proposed, along with support for the definition of the ARAIM test procedures. In this paper, only the Fault Detection (FD) is considered, with Fault Detection and Exclusion (FDE) left as future work.

In Section II of the paper, a brief background on how to compute the NES is provided. Section III introduces the test procedure defined in the MOPS. Section IV describes the methodology used to evaluate the NES for RAIM in this study, and the comparison of the current and proposed representative test procedure is addressed. In Section V and VI, the NES results for Class 1 and Class 2+ receivers, through the current and representative test procedures, are provided. Various levels of temporal correlation of errors are considered, and representative simulation scenarios are defined. We show that the representative test procedure could avoid the underestimation of risk. In addition, the simulation results

confirm that the NES is bounded by the analytical upper bound introduced in [10]. Finally, the summary and conclusions of this work are presented in Section VII.

## II. INTEGRITY EQUATION FOR RAIM

### A. INTEGRITY EQUATION FOR RAIM

The probability of HMI can be expressed as the sum of the probabilities of HMI over all possible fault hypotheses [15], [16], and shall be less than the integrity risk requirement, $IR_{req}$:

$$P_{hmi} = \sum_{j=0}^{n} P_{hmi,j} < IR_{req} \quad (1)$$

where, n denotes the number of fault hypotheses, and $P_{hmi,j}$ represents the probability of HMI under hypothesis $H_j$. The multiple hypotheses account for all faulty satellite and faulty constellation combinations. In the ARAIM context, this list is exhaustive and presents a partition of all possible states, while in RAIM it is limited to single satellite failures [7]. The HMI event for hypothesis $H_j$ occurs when the position error exceeds the alert limit, the test statistic(s) fails to detect the fault, and the hypothesis $H_j$ is true. Accordingly, $P_{hmi,j}$ can be expressed by the probability of hypothesis $H_j$ and the conditional probability of HMI under this hypothesis:

$$P_{hmi,j} = P(|e| > l_{al} \cap q < T|H_j) \cdot P_{H_j} \quad (2)$$

where $P_{H_j}$ denotes the probability of occurrence of the hypothesis $H_j$. The symbols of e, $l_{al}$, q and T indicate the position error, the alert limit, the test statistic and threshold. Note that multiple test statistics may be used in both RAIM and ARAIM, in which case this condition refers to all test statistics being below their respective thresholds. The conditional probability on the right-hand side of (2) is also known as the Probability of Missed Detection (PMD) under $H_j$, which can be concisely denoted as $P_{MD,j}$.

For en-route and NPA flight phase, the ICAO SARPs define the signal-in-space integrity risk requirement as $1 \times 10^{-7}$ per hour [1]. In RAIM, this required integrity risk is fully allocated to the single-fault hypothesis ($j = 1$) [8], as the risk from the fault-free hypothesis may be neglected and the probability of the occurrence of multiple faults hypotheses is considered insignificant [10]. Notably, the probability of constellation failure was not accounted for during RAIM development but is now set to $1 \times 10^{-8}$ per hour for GPS [18]. Given these points, (2) can be rearranged to define $P_{MD,1}$ as follows, used to determine the protection level ($l$). Note that in (3), the subscript '1' in $P_{MD,1}$ is omitted for simplicity:

$$P_{MD} = P(|e| > l \cap q < T|H_1) < IR_{req}/P_{H1} \quad (3)$$

The term $IR_{req}/P_{H1}$ in (3) is defined as $P_{MD,req}$. In fact, (3) is an under-specified equation since it also depends upon the magnitude of the fault bias which is explicitly expressed. By specifying the fault bias ($f$), $P_{MD}$ is given as

$$P_{MD}(f) = P(|e| > l \cap q < T|f) \quad (4)$$
$P_{MD}$ is a function of the fault bias magnitude $f$ as shown in Fig. 1 for a fixed protection level. In Fig. 1, the worst-case fault bias ($f^*$) denotes the bias magnitude when the $P_{MD}$ reaches its maximum. The protection level must ensure that the maximum $P_{MD}$ value, denoted as $P_{MD}(f^*)$ remains below the requirement $P_{MD,req} = 1 \times 10^{-3}$ [8]. Because the horizontal component is of interest in this work, a 2D integration is employed to compute the probability on the right-hand side of (4), implemented as in [19].

<figure><img src="image_3.png" /><figcaption>FIGURE 1. The definition of the worst-case fault bias ($f^*$) based on the PMD.</figcaption></figure>

## B. NUMBER OF EFFECTIVE SAMPLES

As previously mentioned, the integrity requirement in standards is defined for a specific duration of operation. However, as seen in (2), protection level computations in the literature are typically developed on a per sample basis [2], [3], [4], [5], [6], [8]. Additionally, the system must also meet the Time-To-Alert (TTA) limit. HMI occurs when the position failure remains undetected for longer than the TTA [1], and can be expressed as follows [10]:

$$ P_{MD} = P\left[ \bigcup_{i_0=1}^{n_s-n_a} \left( \left( \bigcap_{j=0}^{n_a-1} |e_{i_0+j}| > l \right) \times \bigcap \left( \bigcap_{j=0}^{n_{ad}-1} q_{i_0+n_{dj}} < T_{i_0+n_{dj}} \right) \right) | f^* \right] \quad (5) $$

where, $n_s \equiv T_E/T_s, n_a \equiv T_a/T_s, n_d \equiv T_{FD}/T_s, n_{da} \equiv T_a/T_{FD}$. The symbol of $i_0$ denotes the initial epoch in the TTA test window within the exposure time. The symbols of $T_E, T_a$, and $T_s$ represent the operation exposure time, the TTA, the interval of the receiver's position, velocity, and time (PVT) output, set to 1 hour, 8 seconds and 1 second (MOPS DO-316, 2009). The receiver FD interval, denoted as $T_{FD}$, is tested for 1 and 8 seconds to evaluate both cases: when the fault detection is performed at the same rate as the PVT output rate and when it is performed at the minimum rate allowed by the requirement. Fig. 2 illustrates the relationship between these parameters. In (5), a Missed Detection (MD) is declared if the following condition occurs at least once during the exposure window: for any TTA period, the position failure persists while the test statistic fails to detect the fault at each FD within the TTA interval. Milner et al. [10] stated that the PMD in (5) depends on the number of PVT samples during

the exposure time ($n_s$) and fault detection trials ($n_d$). The NES ($n_{es}$) is defined by the following equation [10]:

$$ n_{es} (n_s, n_d) = \frac{P_{MD} (n_s, n_d)}{P_{MD} (1, 1)} = \frac{PMDT}{PMD0} \quad (6) $$

where the denominator on the right-hand side represents the PMD computed for a single epoch, denoted as PMD0 in this paper, as in (4). The numerator represents the PMD computed over an exposure time, denoted as PMDT, which can be computed from (5). The NES is known to be bounded by the ratio of the exposure time to the TTA [10], and it could serve as a mapping factor in future implementations when applying the integrity requirement in the standards (defined per operation) to the onboard algorithms (runs per sample). It allows the aircraft to retain the onboard algorithm with only a minor modification regarding the NES, without requiring the implementation of assessing (5) in real-time.

However, proposed protection levels in RAIM literature assume an NES of 1 [8], [20], [21], [22] which indicates that the probability of missed detection computed on a per sample basis is the same as that computed over an exposure time. To assess whether such RAIM protection levels do not underestimate the actual integrity risk, the NES of RAIM is evaluated in this paper. In addition, since NES is determined for exposure time, the impact of temporal correlation of error sources on position error and test statistics becomes a key factor. This point will be investigated in later sections.

<figure><img src="image_4.png" /><figcaption>FIGURE 2. Timeline within the exposure time.</figcaption></figure>

## III. CURRENT AND REPRESENTATIVE MOPS TEST PROCEDURE

The test procedure is a recommended means to demonstrate compliance with the minimum acceptable performance parameters specified in the MOPS [7], [13], [14], [23]. Most up-to-date recommendations can be found in MOPS DO-229, DO-316 and DO-384 according to the supported airborne equipment: DO-316 for Aircraft Based Augmentation System (ABAS) airborne equipment, such as those providing RAIM capability; DO-229E for Satellite Based Augmentation System (SBAS) airborne equipment; DO-384 for Global Navigation Satellite System (GNSS)-aided inertial system. The detailed steps of the test procedures are not mandated, meaning other test procedures may be also acceptable. In this manner, we focus on refining the test procedure using the recommendations in the MOPS as a baseline.

### A. CURRENT MOPS TEST PROCEDURE

MOPS standards provide test procedures for off-line FDE tests to demonstrate compliance with the missed alert probability of $1 \times 10^{-3}$. The missed alert includes both the
missed detection and wrong exclusion. To focus on the capability of the fault detection function, only missed detection is considered in this paper. Accordingly, the missed alert probability is fully allocated to the missed detection probability. In this paper, the least-square residual method [21] is used as the test statistic. Based on DO-229E and DO-316 [7], [13], the recommended sampling interval shall not exceed 1 second.

For the test procedure, as stated in the MOPS, 20 different geometries need to be selected to provide an approximately uniform range of Horizontal Protection Level (HPL) from 0.1 NM to the maximum Horizontal Alert Limit (HAL) supported by the equipment. In our test, 20 geometries are selected with HPL ranging from 0.1 NM to 4 NM, as shown in Fig. 3. The 20 geometries are chosen randomly from all possible geometries observable from the reference epoch defined in DO-229E [13] over 24-hour period at user locations. These locations cover all latitude and longitude ranges with 5-degree intervals, using the optimized 24 GPS constellation [13]. The geometry index in Fig. 3 indicates an index of the selected geometry. Once geometries for test procedure are selected, the simulation is conducted over a total of 1,650 Monte Carlo runs for each of the 20 geometries. According to DO-229E, during all runs, satellite velocities are set to zero to ensure that the HPL remains constant. Additionally, a GPS satellite malfunction is simulated as a ramp error in the range domain with a slope of 5 m/s [13]. This failure is injected into the pseudorange of the satellite that is most difficult to detect, as detailed in Section III. For each run, the test is terminated when either a correct exclusion, failed exclusion or a missed alert occurs. To consider only missed detection, the termination condition is modified according to DO-208 [23], such that the test terminates when either a missed detection or a successful detection occurs. The number of missed detection cases are cumulated over all Monte Carlo runs and geometries. Finally, based on the total number of missed detection cases and the number of total runs, it can be determined if the equipment is compliant to the missed alert requirement of $1 \times 10^{-3}$.

<figure><img src="image_5.png" /><figcaption>FIGURE 3. Horizontal protection level of each selected satellite geometry.</figcaption></figure>

## B. CURRENT MOPS ERROR MODELING

For the test procedures, time series of pseudorange residual errors need to be generated according to the Gaussian models

specified in MOPS DO-229E [13] and DO-316 [7]. The overall standard deviation of the combined error sources, or equivalently, pseudorange residual error for a non-failed GPS satellite can be modeled as follows:

$$ \sigma_i^2 = \sigma_{i,URA}^2 + \sigma_{i,UIRE}^2 + \sigma_{i,air}^2 + \sigma_{i,tropo}^2 \quad (7) $$

where the subscript *i* represents a satellite index. The symbols of $\sigma_{i,URA}$ and $\sigma_{i,UIRE}$ represent the values for the standard deviation of clock/ephemeris and the ionospheric errors, respectively. To generate the time series of each error source, it is recommended to use the Gaussian error models in DO-316 [7] and DO-229E [13]. On the other hand, for the GNSS/inertial integrated system it is recommended to use a first order Gauss-Markov (GM) process. Furthermore, the standards recommend considering the correlation induced by the carrier smoothing filter for the integrated system. TABLE 1 summarizes the recommendations in DO-229E [13] and DO-316 [7] and the additional information found in DO-384 [14]. The symbols of $f_{map}$, $el$ and $\tau$ denote the mapping function, elevation angle and time constant of the first order GM process. The term $\sigma_{i,divg}$ accounts for the steady-state error of the carrier smoothing filter with a 100-second smoothing time constant due to the ionospheric divergence [7]. The detailed equation for the standard deviation of ionospheric delay, tropospheric delay and airborne receiver model can be found in DO-316 [7], DO-229E [13], and DO-384 [14].

<table><caption>TABLE 1. Signal modeling in MOPS document.</caption><thead><tr><th>Error Sources</th><th>DO-229E [13], DO-316 [7]</th><th>DO-384 [14]</th></tr></thead><tbody><tr><td>Satellite orbit &amp; clock</td><td><ul><li>σ<sub>URA</sub> = 5.7 m for the FDE offline test</li><li>σ<sub>URA</sub> = 2 m and τ<sub>URA</sub> = 2 hr for tightly integrated GPS/inertial system</li></ul></td><td><ul><li>σ<sub>URA</sub> is determined according to URA index</li><li>τ<sub>URA</sub> = 2 hr</li></ul></td></tr><tr><td>Ionospheric delay</td><td><ul><li>σ<sub>UIRE</sub> is set based on GPS-based ionospheric correction (Klobuchar model)</li><li>International Reference Ionosphere (IRI) model for tightly integrated GPS/inertial system</li></ul></td><td><ul><li>IRI model for tightly integrated GPS/inertial system</li></ul></td></tr><tr><td>Tropospheric delay</td><td><ul><li>σ<sub>tropo</sub> = 0.12f<sub>map</sub>(el)</li><li>τ<sub>tropo</sub> = 30 min</li></ul></td><td>Same as DO-316 [7]</td></tr><tr><td>Receiver error (Noise &amp; multipath)</td><td><table><tbody><tr><td>Class 1</td><td>σ<sub>air</sub> = σ<sub>noise</sub> = 5m</td><td>-</td></tr><tr><td>Class 2+</td><td><ul><li>σ<sup>2</sup><sub>l,air</sub>(el) = σ<sup>2</sup><sub>l,multipath</sub>(el) + σ<sup>2</sup><sub>l,noise</sub>(el) + σ<sup>2</sup><sub>l,divg</sub>(el)</li><li>τ<sub>multipath</sub> = 25 s for tightly integrated inertial/GNSS system</li></ul></td><td><ul><li>A model related to C/N0 is recommended in addition to the models in DO-229E and DO-316</li><li>τ<sub>multipath</sub> = 25 s</li></ul></td></tr></tbody></table></td><td></td></tr></tbody></table>

To account for the temporal correlation, this paper uses the first-order GM process to generate the error sources shown in TABLE 1, based on the corresponding time constants found in the standards. For the Class 1 receiver, which does not employ
carrier-smoothing, this approach can be justified by Pervan et al. [11], who showed that less than 5% of the estimated time constants were less than the sampling interval (<1 s). Therefore, the majority of errors (95%), may be considered temporally correlated. For the noise and divergence error terms for Class 2+ receiver, DO-316 [7] recommends using the worst-case value of 0.36 m, which is adopted in this paper. For a Class 2+ receiver, the carrier smoothing filter is implemented, and the covariance of the input multipath must be determined according to DO-384 [14]. To account for the temporal correlation of the ionospheric residual error, time constants of 1 hour and 2 hours are used based on [24] and the data analysis shown in Fig. 8 in Section V.

### C. REPRESENTATIVE TEST PROCEDURE

Besides adopting the first-order GM model to generate the time history of error sources in the proposed representative test procedure, the following advancements were made in terms of considering a fault bias and a test period.

#### 1) WORST-CASE FAULT BIAS

In the current test procedure, a GPS satellite fault is simulated by injecting a 5 m/s ramp error into the pseudorange residual of the satellite that is most difficult to detect. This satellite is determined based on the slope (g) which is defined as the ratio of the impact of a fault on the position error to the impact of the fault on the test statistic [20] and is independent of the fault magnitude [16]. The slope of i^th^ satellite (g_i) in the horizontal plane is defined as follows for the residuals-based test statistic.

$$g_i = (g_{\text{east},i}^2 + g_{\text{north},i}^2)^{1/2} \quad (8)$$

where, $g_{\text{east},i} = |S_{1i}|\sigma_i/\sqrt{(I - B)_{ii}}$ and $g_{\text{north},i} = |S_{2i}|\sigma_i/\sqrt{(I - B)_{ii}}$. The matrix S can be expressed as $(G^T WG)^{-1} G^T W$, where G is an observation matrix and W is a weighting matrix, whose i^th^ diagonal element is defined as $1/\sigma_i^2$. The standard deviation of pseudorange residual error, $\sigma_i$ is defined in (7). In addition, the matrix B can be replaced by $G (G^T WG)^{-1} G^T W$. The subscript ii of matrix B indicates the i^th^ diagonal element of B. Equation (8) is computed for each visible satellite, and the satellite with the maximum $g_i$ is selected as the faulty satellite in the test procedure.

Note that an ideal protection level may be determined rigorously using (4) and under the worst-case fault vector, for both the direction and magnitude of the fault bias. Since RAIM assumes a single satellite failure, the direction of the fault vector can be easily determined: all elements in the fault vector are filled with zero, except for the faulty satellite. The search for the magnitude of the fault is performed to maximize (4) [21], [22] and as indicated by the green dot in Fig. 4(a) and (b). In contrast, the current test procedure does not consider the worst-case fault bias but rather employs a slope (r) of 5 m/s. The magnitude of the fault impact in the pseudorange residual, denoted as r · t, increases as the time elapsed (t) from the onset of the fault increases as shown

in Fig. 4 (a) and (b). Depending on the test duration, the magnitude of the fault bias due to the ramp error may not reach the worst-case magnitude of the fault, denoted as $f^*$ in Fig. 4(b). Furthermore, the magnitude of the fault bias is not maintained at the worst value throughout the test, meaning the worst-case conditions are not fully tested. Therefore, in the proposed test procedure, a fault bias at its worst value ($f^*$) at each instance is applied throughout the entire test period. In Fig. 4(a), the orange circles indicate the joint distribution of the test statistics and the position error when the ramp error occurs at t = 0, and the green circle denotes the joint distribution when the worst-case fault bias is present. The PMD corresponds to the integration of the joint distribution over the HMI region, the upper left quadrant.

<figure><img src="image_6.png" /><figcaption>FIGURE 4. Comparison between a ramp-type fault and the worst-case fault bias. (a) the joint distribution of test statistics and position error for two cases, and (b) the PMD for the worst-case fault bias and the ramp fault.</figcaption></figure>

#### 2) CONSIDERATION OF THE EXPOSURE TIME AND RE-ADMITTANCE OF THE FAULT

As mentioned in Section III-A, each Monte Carlo run in the current test procedure terminates if either a successful or missed detection is declared based on DO-208 [23], DO-316 [7] and DO-229E [13]. However, actual flight operations are conducted over a specific period, known as the exposure time, as specified in the standards. Therefore, the entire exposure time is simulated in the proposed test procedure. In addition, re-admittance of a faulty satellite is adopted at the following epoch [25]. Note that successful detection
<figure><img src="image_7.png" /><figcaption>**FIGURE 5.** Comparison of the test termination conditions between (a) legacy, and (b) representative test procedures.</figcaption></figure>

is declared when the following conditions are jointly satisfied: the test statistic exceeds the threshold and that this occurs within the specified TTA after the time at which the position error exceeded the alert limit. Fig. 5(a) shows the conditions for successful and missed detections in the current test procedure, and Fig. 5(b) depicts the fixed test period and associated re-admittance used in the proposed representative test procedure.

# IV. COMPARISON OF METHODOLOGY AND CORRESPONDING NES

## A. COMPARISON OF METHODOLOGY

This section compares the methodologies of the current and the representative test procedures according to the propositions described in the previous section. The complete flow charts of the two test procedures can be found in Fig. 6. The advancements made in the proposed representative test procedure are highlighted in bold. Once the 20 geometries are selected, the HPL is computed in the current test procedure. In the representative test procedure, the HPL is computed, and the worst-case fault bias is determined. The MOPS does not mandate specific models for generating the error sources, the representative approach uses a 1st order GM process to account for the temporal correlation of the errors. After generating the errors, the impact of the satellite fault is injected into the pseudorange residual error. As mentioned previously, the worst-case bias is injected for the representative test procedure instead of the ramp error. After that, the algorithm checks the missed detection for each Monte Carlo run and for the 20 geometries to compute the total of PMDT, which indicates the PMD over an exposure time. Finally, the obtained PMDT is checked to ensure it does

not exceed the missed alert requirement for GPS RAIM, $P_{MD,req} = 1 \times 10^{-3}$ [7], [13].

This paper aims to conduct a thorough analysis of the temporal correlation of errors in integrity monitoring, which can be quantified by the NES. As defined in (6), the NES can be determined by computing the ratio of the PMD over a test period (PMDT) and at a single sample (PMD0). This is of significant, since it is likely that the missed alert requirement is allocated to each sample when computing the HPL in RAIM [8], [20], [21], [22]. The overall flow chart to compute the NES is shown in Fig. 7. Note that the HPL is computed for the PMD0 = $1 \times 10^{-3}$, which could result in PMDT, obtained from Fig. 7, being larger than $1 \times 10^{-3}$. Since the objective of the flow chart in Fig. 7 is to obtain the NES, the resultant NES will be used to determine PMD0 while ensuring PMDT equals to $1 \times 10^{-3}$, the required value.

<figure><img src="image_8.png" /><figcaption>**FIGURE 6.** Difference between current and representative test procedure.</figcaption></figure>

<figure><img src="image_9.png" /><figcaption>**FIGURE 7.** Flow charts of the NES evaluation.</figcaption></figure>

The same procedure as given in Fig. 6 is conducted to compute the PMDT for a total of $10^5$ Monte Carlo runs and 20 geometries. To compute the PMDT, the total number of missed detection cases, denoted as $num_{MD}$, is divided by the number of geometries, $n_{geo}$, and by the number of Monte Carlo runs, $n_{runs}$. Note that the increased number of Monte Carlo runs of $1 \times 10^5$ is used to account for low values of the PMDT under various simulation conditions of the temporal correlation.
## B. COMPARISON OF NES

To investigate the impact of the worst-case fault bias and the exposure time, this section evaluates the PMD and resulting NES of the current and representative test procedures. The exposure time and TTA are set to 1 hour and 8 seconds, respectively [10]. For comparison, each error source is modeled as a 1st order GM process with time constants given in [7] and [14]. The NES is computed according to the flow chart as shown in Fig. 7 for both the current and representative test procedure using conditions defined in Fig. 6. The ramp error or the worst-case fault bias are injected from the first epoch for a Class 1 receiver, while for a Class 2+ receiver the fault is injected after the carrier smoothing filter reaches the steady state, which corresponds to 360 seconds after the carrier smoothing filter initialization time [13].

TABLE 2 summarizes the NES computed using the methodology described in the previous section. Values of 1 s and the TTA are tested as the FD interval ($T_{FD}$). RAIM HPL computations typically assume implicitly an NES of 1 [8], [20], [21], [22], while the NES evaluated in simulation under the current test procedures may be significantly lower for Class 1 receivers. The representative test procedure finds that the actual risk (and NES) is much higher, with a ratio of approximately 500 and 100 for the FD intervals of 1 s and TTA respectively. This suggests a non-compliant HPL implementation in Class 1 receiver could pass the current test procedure while considerably underestimating the true risk. The ratio for Class 2+ receivers is less alarming on the order of 10.

<table><caption>TABLE 2. NES result for the current and representative test procedure.</caption><thead><tr><th rowspan="3">Receiver</th><th rowspan="3">PMD0</th><th colspan="6">Current test procedure</th><th colspan="6">Representative test procedure</th></tr><tr><th colspan="2">T<sub>FD</sub> = 1 s</th><th colspan="2">T<sub>FD</sub> = TTA</th><th colspan="2">T<sub>FD</sub> = 1 s</th><th colspan="2">T<sub>FD</sub> = TTA</th></tr><tr><th>PMDT</th><th>NES</th><th>PMDT</th><th>NES</th><th>PMDT</th><th>NES</th><th>PMDT</th><th>NES</th></tr></thead><tbody><tr><td>Class 1</td><td>0.001</td><td>4.55e-5</td><td>0.05</td><td>2.78e-4</td><td>0.28</td><td>2.64e-2</td><td>26.4</td><td>3.90e-2</td><td>39.0</td></tr><tr><td>Class 2+</td><td>(fixed)</td><td>8.08e-4</td><td>0.81</td><td>1.10e-3</td><td>1.1</td><td>7.00e-3</td><td>7.0</td><td>7.40e-3</td><td>7.4</td></tr></tbody></table>

## V. ANALYSIS ON THE IMPACT OF TEMPORAL CORRELATION ON THE NES

The previous section established that the current test procedure may not accurately reflect the true risk over the period of operation. In this section, we analyze further the impact of temporal correlation assumptions related to the representative test procedure proposed.

### A. TEMPORAL CORRELATION OF ERROR SOURCES

The temporal correlation can be reflected in the time constant of an assumed 1st order GM process [11], [12]. The time constants tested for all error sources in the simulation are shown in TABLE 3. The values in bold indicate a nominal error condition defined in this study. The nominal values can be found in the MOPS [7], [13], [14]. For satellite orbit and clock errors, a 2-hour time constant is considered, as recommended

by the MOPS and evaluated in [26]. Three values of time constants for tropospheric delay, 1800, 900, and 300 seconds, are tested including the recommended value in MOPS. The noise error for Class 1 receiver is modeled as a 1st order GM process to account for the temporal correlation due to multipath. A 25-second time constant is selected as the nominal condition, which is the same as the MOPS recommendation for Class 2+ receivers. In addition, 8, 25, 60 and 100 second time constants are tested for Class 1 receivers. The 8-second time constant is chosen to test the condition when the temporal correlation is the same as the TTA period. The 25-second time constant can be found in the MOPS. The remaining values are chosen within the range of estimated time constants for Boeing aircraft in [11]. In case of Class 2+ receiver, only the value recommended in the MOPS is considered for modeling multipath because the temporal correlation introduced by the carrier smoothing filter with a 100 second time constant will be dominant unless the time constant of the multipath is much longer than 100 seconds, as shown in [11].

<table><caption>TABLE 3. Time constant of 1st order GM process test for simulation (Values in Bold Indicate the Nominal Condition).</caption><thead><tr><th>Error Sources</th><th>Time constant (second)</th></tr></thead><tbody><tr><td>Satellite orbit &amp; clock (τ<sub>URA</sub>)</td><td>7200</td></tr><tr><td>Ionospheric delay (τ<sub>Iono</sub>)</td><td>7200, 3600</td></tr><tr><td>Tropospheric delay (τ<sub>Tropo</sub>)</td><td>1800, 900, 300</td></tr><tr><td>Receiver error (noise &amp; multipath)</td><td>Class 1 (τ<sub>noise</sub>) 8, 25, 60 100<br>Class 2+ (τ<sub>mp</sub>) 25</td></tr></tbody></table>

In the case of ionospheric delays, there is no recommended time constant provided by the MOPS. In this paper, a 2-hour time constant is considered as the nominal condition for ionospheric delay, according to [24]. To verify this, we have analyzed the ionospheric residual errors when the ionospheric delay is corrected by the Klobuchar ionospheric model [27]. To compute the ionospheric residual error, the slant Total Electron Contents (TEC) estimates based on real data collected from more than 300 global distributed reference stations equipped with receivers from different receiver manufacturers such as Trimble, Ashtech and Leica, were used. This data was provided by the Joint Research Centre (JRC). The analyzed TEC was estimated for February 28th, 2014, which corresponds to the day with the highest solar activity of solar cycle 24. The analysis showed that the maximum time constant of the ionospheric residual for all latitudes can be bounded by 2 hours, as shown in Fig. 8. For the sensitivity analysis, a 1-hour time constant is also considered, which corresponds to a lower bound for the median time constant.

In section IV-B, $\sigma_{URA}$ is set to 5.7 m according to the recommendation in DO-316 [7]. To assess the impact of the URA, a value of 2.4 m, which corresponds to the upper bound of the range indicated by the URA index 0, is also tested. In addition, 0.0 m is also tested to consider the potential for near-perfect Signal-in-Space (SIS) errors. The motivation is that with regards to temporal correlation effects on the
<figure><img src="image_10.png" /><figcaption>**FIGURE 8.** Estimated time constant of the ionospheric delay residual on 28th of February 2014.</figcaption></figure>

NES, the worst case is when the local errors with short correlation times dominate the error budget. The simulation is conducted for the single-frequency (SF) and dual-frequency (DF) modes. For the ionosphere-free (IF) measurement error, the ionospheric term, $\sigma_{i,UIRE}$, is eliminated in (7), and the noise term, $\sigma_{i,air}$ is replaced to $\frac{\sqrt{\gamma^2+1}}{\gamma-1}\sigma_{i,air}$, where, $\gamma$ denotes the squared ratio of L1 over L5 frequencies. In addition, the recently recommended airborne receiver model for the IF measurement from The German Aerospace Center (DLR) [28] is also tested.

## B. SENSITIVITY ANALYSIS RESULTS

### 1) IMPACT OF THE TEMPORAL CORRELATION OF THE MULTIPATH ON NES ESTIMATION

Fig. 9 shows the impact of the noise error time constant for Class 1 receivers. In both SF and DF modes, the NES and the PMDT decrease as the time constant increases. Since an 8-second time constant provides the largest NES, this value is used for the analysis on the temporal correlation of errors in the following sections.

TABLE 4 summarizes the NES results under nominal conditions. For Class 1 receiver, the NES from the DF mode is much larger than that from the SF mode due to the elimination of the ionospheric error, which is the error source with the longest temporal correlation. This can be validated by TABLE 5, which shows the 50th percentile (median) of the estimated time constants for the combined errors, including noise, multipath, tropospheric delay, satellite orbit and clock error, and ionospheric delay in case of the SF mode. This can also explain the increase of NES when $T_{FD}$ is increased from 1 second to TTA for two modes. Because the DF measurement is less temporally correlated, the degradation of PMDT due to the increase of the detection interval is worse than the SF measurement case. For Class 2+ receivers, which employ carrier smoothing, the measurement error is more temporally correlated compared to that of Class 1, as shown in TABLE 5. This leads to a smaller NES for Class 2+ receivers, given in TABLE 4. In addition, the temporal correlation of the pseudorange residual is similar for the SF and DF modes for Class 2+ receiver due to the use of the carrier smoothing, the NESs for both modes are similar, and their increments

for the increased $T_{FD}$ are not as drastic compared to a Class 1 receiver.

<table><caption>**TABLE 4.** NES results under nominal condition (PMD0 = $10^{-3}$, $\tau_{URA} = 7200$ s, $\tau_{Tropo} = 1800$ s, $\tau_{Iono} = 7200$ s, $\tau_{noise} = \tau_{mp} = 25$ s).</caption><thead><tr><th rowspan="2">Receiver</th><th rowspan="2"></th><th colspan="2">$\sigma_{URA} = 5.7$ m</th><th colspan="2">$\sigma_{URA} = 2.4$ m</th></tr><tr><th>$T_{FD} = 1$ s</th><th>$T_{FD} = TTA$</th><th>$T_{FD} = 1$ s</th><th>$T_{FD} = TTA$</th></tr></thead><tbody><tr><td rowspan="2">Class 1</td><td>SF</td><td>26.4</td><td>39.0</td><td>34.4</td><td>54.6</td></tr><tr><td>DF</td><td>89.5</td><td>202</td><td>96.0</td><td>252</td></tr><tr><td rowspan="3">Class 2+</td><td>SF</td><td>7.0</td><td>7.4</td><td>7.6</td><td>8.2</td></tr><tr><td>DF</td><td>7.0</td><td>7.5</td><td>10.3</td><td>11.1</td></tr><tr><td>DF (DLR)</td><td>7.5</td><td>8.0</td><td>11.6</td><td>12.9</td></tr></tbody></table>

<table><caption>**TABLE 5.** Estimated time constant of the combined error under nominal condition.</caption><thead><tr><th rowspan="2">Receiver</th><th rowspan="2"></th><th colspan="2">Time constant of the combined errors at 50<sup>th</sup> percentile (second)</th></tr><tr><th>$\sigma_{URA} = 5.7$ m</th><th>$\sigma_{URA} = 2.4$ m</th></tr></thead><tbody><tr><td rowspan="2">Class 1</td><td>SF</td><td>1920</td><td>1918</td></tr><tr><td>DF</td><td>30</td><td>30</td></tr><tr><td rowspan="2">Class 2+</td><td>SF</td><td>2536</td><td>2539</td></tr><tr><td>DF</td><td>2018</td><td>1950</td></tr></tbody></table>

<figure><img src="image_11.png" /><figcaption>**FIGURE 9.** NES for Class 1 receivers for (a) single-frequency mode, and (b) dual-frequency mode.</figcaption></figure>

### 2) IMPACT OF THE SATELLITE CLOCK AND ORBIT ERRORS ON NES ESTIMATION

In this section the impact of the magnitude of the $\sigma_{URA}$ is analyzed rather than the time constants. This is because the temporal correlation of the satellite clock and orbit errors generally depends on the orbit determination and ephemeris generation, which limits the large variation in the time constant compared to those of the multipath and tropospheric errors, which depend on the environment. TABLE 6 summarizes the NES for Class 1 and Class 2+ receivers according to different modeling parameters. The time constants of the other error sources are set to nominal condition. Regardless of types of receivers, the NES is larger for small $\sigma_{URA}$. For Class 2+ receiver under DF mode, the NES values for different airborne models based on MOPS and DLR are similar.
<table><caption>**TABLE 6.** NES for class 1 and class 2+ receivers for SF and DF modes according to different modeling parameters for satellite clock and orbit errors ($T_{FD}$ = TTA).</caption><thead><tr><th rowspan="2">Receiver</th><th colspan="3">NES</th></tr><tr><th>σ<sub>URA</sub> = 5.7 m,<br>τ = 2 hr</th><th>σ<sub>URA</sub> = 2.4 m,<br>τ = 2 hr</th><th>σ<sub>URA</sub> = 0 m</th></tr></thead><tbody><tr><td rowspan="2">Class 1</td><td>SF</td><td>49.8</td><td>69.5</td><td>76.6</td></tr><tr><td>DF</td><td>216</td><td>268</td><td>282</td></tr><tr><td rowspan="3">Class 2+</td><td>SF</td><td>10.5</td><td>11.9</td><td>12.7</td></tr><tr><td>DF</td><td>7.5</td><td>11.1</td><td>120</td></tr><tr><td>DF (DLR)</td><td>8.0</td><td>12.9</td><td>136</td></tr></tbody></table>

### 3) IMPACT OF TEMPORAL CORRELATION OF TROPOSPHERIC ERROR

Fig. 10 and Fig. 11 show that the impact of changing the time constant of tropospheric error on the NES can be neglected. This is because the standard deviation of the tropospheric delay is much smaller than that of other errors, such as satellite orbit and clock, and ionospheric delay, making the contribution of the tropospheric error to the resultant temporal correlation of the combined errors relatively small.

<figure><img src="image_12.png" /><figcaption>**FIGURE 10.** NES for Class 1 receivers for (a) SF, and (b) DF mode according to time constant of tropospheric and ionospheric error.</figcaption></figure>

<figure><img src="image_13.png" /><figcaption>**FIGURE 11.** NES for Class 2+ receivers for (a) SF, (b) DF based on standard deviation from MOPS and DLR according to time constant of tropospheric and ionospheric error.</figcaption></figure>

### 4) THE NES FROM THE SENSITIVITY ANALYSIS

TABLE 7 summarizes the NES bound obtained from the analysis presented in Section V-B.1)-3) where various time constants for error sources are tested. In all cases, the NES is bounded by the theoretical limit of 450 [10], while the values of the evaluated NES values exceed 1, which is the assumed value of NES in the current RAIM.

<table><caption>**TABLE 7.** Worst-case nes from the simulation ($PMD0 = 10^{-3}$, $τ_{URA} = 7200$ s, $τ_{Iono} = 3600$ s, $T_{FD} = TTA$).</caption><thead><tr><th rowspan="2">Receiver</th><th colspan="3">NES</th></tr><tr><th>σ<sub>URA</sub> = 5.7 m</th><th>σ<sub>URA</sub> = 2.4 m</th><th>σ<sub>URA</sub> = 0 m</th></tr></thead><tbody><tr><td rowspan="2">Class 1<br>(τ<sub>noise</sub> =<br>8 s)</td><td>SF</td><td>49.8</td><td>69.5</td><td>76.6</td></tr><tr><td>DF</td><td>216</td><td>268</td><td>282</td></tr><tr><td rowspan="3">Class 2+<br>(τ<sub>mp</sub> =<br>25 s)</td><td>SF</td><td>10.5</td><td>11.9</td><td>12.7</td></tr><tr><td>DF</td><td>7.5</td><td>11.1</td><td>120</td></tr><tr><td>DF (DLR)</td><td>8.0</td><td>12.9</td><td>136</td></tr></tbody></table>

## VI. ERROR MODELING SCENARIO AND ASSOCIATED NES FOR TEST PROCEDURE

The purpose of the test procedure is to check if the PMD evaluated from the airborne RAIM algorithm during the exposure time exceeds the required integrity risk. To account for the risk over the operation, the HPL should ideally be computed accounting for the NES [29]. As seen in the results from the sensitivity analysis, the NES depends greatly on the time constants and standard deviations of each error source. Therefore, a representative simulation scenario with specified time constants for the errors and the associated values of the NES should be defined for the test procedure. This section defines the simulation scenario based on the simulation results in the previous section and the realistic time constants of the error sources from the references.

### A. DEFINITION OF SIMULATION SCENARIOS

To propose a test procedure that accounts for the temporal correlation of the errors, specified simulation conditions in terms of the temporal correlation of the errors and the associated NES should be defined. For this purpose, four different scenarios are defined in TABLE 8, based on the simulation results in the previous section and the realistic time constant of the error sources that can be found from the references. Scenario 1 is closest to the current standards [7], [13], [14]. It adopts time constants that are recommended in the MOPS except for the ionospheric error. For the ionospheric error, a time constant of ionospheric error from [24] is adopted in this study. Scenario 2 represents the realistic case which uses the time constants derived based on real GNSS data processing or based on the products that are estimated by the real GNSS data from reference papers [11], [24], [26]. For the multipath time constant, 5th percentile of the estimated multipath in [11] is adopted, because it is the smallest value that is specified for Boeing aircraft. In addition, scenario 3 represents the practical worst-case, using the time constants and $σ_{URA}$ for which the simulation results were the worst in the previous section. Finally, scenario 4 represents the worst-case which can only be applicable to Class 2+ receivers. In this scenario, the combined error is assumed to be temporally correlated at 100 seconds, which is the same value as the time constant used for carrier smoothing filter. This represents the worst-case limit whereby only local errors with a short temporal correlation contribute to the error
budget. This scenario is feasible under significant orbit, clock and tropospheric modelling improvements but nevertheless remains unlikely and may be considered as an alternative upper limit on the NES.

<table><caption>TABLE 8. Time constants of each error for different simulation scenarios.</caption><thead><tr><th rowspan="2"></th><th colspan="4">Time constant (second)</th></tr><tr><th>Satellite orbit and clock error</th><th>Tropospheric delay</th><th>Ionospheric delay</th><th>Noise /multipath</th></tr></thead><tbody><tr><td>Scenario 1 (Standards)</td><td>7200</td><td>1800</td><td rowspan="2">7200<br>[24]</td><td>25</td></tr><tr><td>Scenario 2 (Realistic)</td><td>7200<br>[26]</td><td>25×3600<br>[26]</td><td>7<br>[11]</td></tr><tr><td>Scenario 3 (Practical worst-case)</td><td>N/A<br>(σ<sub>URA</sub> = 0 m)</td><td>1800</td><td>3600</td><td>8</td></tr><tr><td>Scenario 4 (Worst-case)</td><td colspan="4">Only applicable to Class 2+ receiver.<br>Time constant of combined errors: 100 seconds</td></tr></tbody></table>

## B. NES RESULTS FOR ERROR MODEL SCENARIOS

TABLE 9 summarizes the PMDT, PMDT, and NES results when the fault detection is conducted every TTA seconds. For Class 1, the NES can be bounded at 77 for the SF mode, and 282 for the DF mode, respectively. For Class 2+ receivers and scenarios 1-3, the NES may be bounded by 13 and 120 for SF and DF modes, respectively. In the worst-case scenario (Scenario 4), the NES for Class 2+ receivers could reach around 155. Milner et al. [10] provides the bound of the NES of ARAIM according to exposure time ($T_E$) and TTA ($T_a$). When the current simulation condition is applied, $T_E$ = 3600s and $T_a$ = 8s, the upper bound of the NES computes to 450. It can be observed that the NES results for all scenarios in TABLE 9 are below this value.

<table><caption>TABLE 9. PMDT and NES according to scenarios ($T_{FD}$ = TTA).</caption><thead><tr><th rowspan="2">Receiver</th><th rowspan="2">σ<sub>URA</sub> (m)</th><th rowspan="2">Mode</th><th colspan="2">Scenario 1 (Standards)</th><th colspan="2">Scenario 2 (Realistic)</th><th colspan="2">Scenario 3 (Practical worst case)</th><th colspan="2">Scenario 4 (Worst-case)</th></tr><tr><th>PMDT</th><th>NES</th><th>PMDT</th><th>NES</th><th>PMDT</th><th>NES</th><th>PMDT</th><th>NES</th></tr></thead><tbody><tr><td rowspan="4">Class 1</td><td rowspan="2">5.7</td><td>SF</td><td>0.0390</td><td>39.0</td><td>0.0496</td><td>49.6</td><td>-</td><td>-</td><td>-</td><td>-</td></tr><tr><td>DF</td><td>0.2021</td><td>202</td><td>0.2142</td><td>214</td><td>-</td><td>-</td><td>-</td><td>-</td></tr><tr><td rowspan="2">2.4</td><td>SF</td><td>0.0533</td><td>53.3</td><td>0.0697</td><td>69.7</td><td>-</td><td>-</td><td>-</td><td>-</td></tr><tr><td>DF</td><td>0.2500</td><td>250</td><td>0.2658</td><td>266</td><td>-</td><td>-</td><td>-</td><td>-</td></tr><tr><td rowspan="2">0</td><td>SF</td><td>-</td><td>-</td><td>-</td><td>-</td><td>0.0766</td><td>76.6</td><td>-</td><td>-</td></tr><tr><td>DF</td><td>-</td><td>-</td><td>-</td><td>-</td><td>0.2816</td><td>282</td><td>-</td><td>-</td></tr><tr><td rowspan="4">Class 2+</td><td rowspan="2">5.7</td><td>SF</td><td>0.0074</td><td>7.4</td><td>0.0078</td><td>7.8</td><td>-</td><td>-</td><td>0.1542</td><td>154</td></tr><tr><td>DF</td><td>0.0075</td><td>7.5</td><td>0.0072</td><td>7.2</td><td>-</td><td>-</td><td>0.1530</td><td>153</td></tr><tr><td rowspan="2">2.4</td><td>SF</td><td>0.0082</td><td>8.2</td><td>0.0086</td><td>8.6</td><td>-</td><td>-</td><td>0.1546</td><td>155</td></tr><tr><td>DF</td><td>0.0111</td><td>11.1</td><td>0.0090</td><td>9.0</td><td>-</td><td>-</td><td>0.1529</td><td>153</td></tr><tr><td rowspan="2">0</td><td>SF</td><td>-</td><td>-</td><td>-</td><td>-</td><td>0.0127</td><td>12.7</td><td>0.1544</td><td>155</td></tr><tr><td>DF</td><td>-</td><td>-</td><td>-</td><td>-</td><td>0.1192</td><td>120</td><td>0.1539</td><td>154</td></tr></tbody></table>

Fig. 12 shows the PMDT according to satellite geometry. As in Fig. 3, the satellite geometry is selected to provide an HPL ranging from 0.1 NM to 4 NM. Solid and dashed lines indicate the SF and DF modes, respectively. We can also observe that the PMDT is relatively independent of satellite geometry for those geometries yielding an HPL larger than

<figure><img src="image_14.png" /><figcaption>FIGURE 12. PMDT according to HPL for (a) Class 1, and (b) Class 2+ receivers ($σ_{URA}$ = 5.7m for scenario 1, 2 and 4).</figcaption></figure>

<figure><img src="image_15.png" /><figcaption>FIGURE 13. Comparisons of Class 1 SF HPLs computed with using NES=1 (current RAIM, blue) and using the derived NES (red) for scenario 1-3 (a-c).</figcaption></figure>

<figure><img src="image_16.png" /><figcaption>FIGURE 14. Comparisons of Class 2+ SF HPLs computed with using NES=1 (current RAIM, blue) and using the derived NES (red) for scenarios 1-4 (a-d).</figcaption></figure>

approximately 1 NM. Based on this observation, the simulation design in this study could provide solid results which will not change much even if additional satellite geometries are considered.

Fig. 13 and Fig. 14 show the impact of the NES on the SF HPL of Class 1 and Class 2+ receivers for various scenarios.
The blue line indicates the HPL computed using NES=1 which is the assumption of the current RAIM. The red line denotes the HPL computed using the NES values shown in TABLE 9. The results show that the NES larger than 1 lead to an increase in the HPL, while also helping to avoid possible underestimation of the integrity risk. Similar results can be observed for DF HPL which are omitted in this paper.

## VII. CONCLUSION

As a prior step to develop a test procedure for ARAIM, the existing test procedure for RAIM has been revisited and several advancements are proposed to account for the worst-case fault bias and the period of the exposure time. Additionally, this study analyzes the impact of error correlation and computes the NES for RAIM. Overall results indicate that the NES from the proposed representative method is greater than the values from the current method, suggesting a potential underestimation of the integrity risk by the current test procedure. This discrepancy may arise because the representative test procedure uses the worst-case fault bias to simulate the faulty GPS satellite, allowing it to account for the worst PMD throughout the test period, unlike the current test procedure, which employs a ramp error. In addition, error model scenarios are established to represent different assumptions regarding the temporal correlation of each error source. The results from all scenarios illustrate the ranges of achievable NES of RAIM under various error modeling conditions. The results from scenario 1 and 2, which comply with the time constants from standards and real data processing, yield similar NES values. Scenario 3, representing a practical worst-case, shows NES values that are approximately 1.1 and 13 times larger than those of scenario 1 and 2 for Class 1 and Class 2+ receivers, respectively. Results from the worst-case scenario indicate that the NES can reach up to 155 for Class 2+ receiver, although such an extreme case is unlikely to occur. Overall, the results of all scenarios are bounded by 450, which is the theoretical NES upper bound for ARAIM when considering 1 hour of exposure time and 8 seconds of TTA. The derived scenario-specific NES may be used to compute the protection level as described in [10].

Future work needs to consider the impact of exclusion and include the determination of appropriate assumptions regarding the temporal correlation constants of errors for operation. The result of this work could contribute to the definition of test procedures for ARAIM. In this regard, the representative test procedure shall also be extended to account for multiple hypotheses, including multiple simultaneous failures and constellation faults. Additionally, since ARAIM takes into account nominal biases in the pseudorange residual error, this error term should be considered in the future work.

## ACKNOWLEDGMENT

The authors would like to thank Matteo Sgammini from the JRC, European Commission, for providing them Total Electron Content (TEC) estimates.

## REFERENCES

[1] International Civil Aviation Organization (ICAO) Aeronautical Telecommunications, Volume 1, (Radio Navigation Aids), Annex 10, Montreal, QC, Canada, 2018.

[2] C. Lee, "Analysis of range and position comparison methods as a means to provide GPS integrity in the user receiver," in Proc. 42nd Annu. Meeting Inst. Navig., Seattle, WA, USA, 1986, pp. 1-4.

[3] M. A. Sturza, "Navigation system integrity monitoring using redundant measurements," Navigation, vol. 35, no. 4, pp. 483-501, Dec. 1988.

[4] M. Brenner, "Integrated GPS/inertial fault detection availability," Navigation, vol. 43, no. 2, pp. 111-130, Jun. 1996.

[5] B. W. Parkinson and P. Axelrad, "Autonomous GPS integrity monitoring using the pseudorange residual," Navigation, vol. 35, no. 2, pp. 255-274, Jun. 1988.

[6] WG-C ARAIM TSG Reference Airborne Algorithm Description Document (ADD), document WG-C ARAIM TSG, Version 3.1, 2019.

[7] Minimum Operational Performance Standards for Global Positioning System/Aircraft Based Augmentation System Airborne Equipment, document RTCA DO-316, 2009.

[8] Y. Lee, K. Van Dyke, B. Decleene, J. Studenny, and M. Beckmann, "Summary of RTCA SC-159 GPS integrity working group activities," Navigation, vol. 43, no. 3, pp. 307-338, Sep. 1996.

[9] J. Blanch, T. Walker, P. Enge, Y. Lee, B. Pervan, M. Rippl, A. Spletter, and V. Kropp, "Baseline advanced RAIM user algorithm and possible improvements," IEEE Trans. Aerosp. Electron. Syst., vol. 51, no. 1, pp. 713-732, Jan. 2015.

[10] C. Milner, B. Pervan, J. Blanch, and M. Joerger, "Evaluating integrity and continuity over time in advanced RAIM," in Proc. IEEE/ION Position, Location Navigat. Symp. (PLANS), Portland, WA, USA, Apr. 2020, pp. 502-514.

[11] B. Pervan, S. Khanafseh, and J. Patel, "Test statistic auto- and cross-correlation effects on monitor false alert and missed detection probabilities," in Proc. ION-ITM, Monterey, CA, USA, 2017, pp. 562-590.

[12] E. Bang, C. Milner, C. Macabiau, and P. Estival, "ARAIM temporal correlation effect on PHMI," in Proc. Int. Tech. Meeting Satell. Division Inst. Navigat., Miami, FL, USA, Oct. 2018, pp. 2682-2694.

[13] Minimum Operational Performance Standards for Global Positioning System/Satellite-Based Augmentation System Airborne Equipment, document RTCA DO-229, Revision E, 2016.

[14] Minimum Operational Performance Standards for GNSS Aided Inertial Systems, document RTCA DO-384, 2020.

[15] J. Blanch and T. Walter, "Stress testing advanced RAIM airborne algorithms," in Proc. Int. Tech. Meeting The Inst. Navigat., San Diego, CA, USA, Feb. 2020, pp. 421-439.

[16] M. Joerger, F.-C. Chan, and B. Pervan, "Solution separation versus residual-based RAIM," Navigation, vol. 61, no. 4, pp. 273-291, Dec. 2014, doi: 10.1002/navi.71.

[17] E. Bang and C. Milner, "Integrity risk under temporal correlation for horizontal ARAIM," IEEE Trans. Aerosp. Electron. Syst., vol. 57, no. 6, pp. 3974-3987, Dec. 2021.

[18] GPS Standard Positioning Service Performance Standard, 5th ed., Department of Defense, Washington, DC, USA, Apr. 2020.

[19] C. D. Milner and W. Y. Ochieng, "A fast and efficient integrity computation for non-precision approach performance assessment," GPS Solutions, vol. 14, no. 2, pp. 193-205, Mar. 2010.

[20] R. G. Brown, "A baseline GPS RAIM scheme and a note on the equivalence of three RAIM methods," Navigation, vol. 39, no. 3, pp. 301-316, Sep. 1992.

[21] G. Y. Chin, J. H. Kraemer, and R. G. Brown, "GPS RAIM: Screening out bad geometries under worst-case bias conditions," in Proc. ION, Dayton, OH, USA, 1992, pp. 63-72.

[22] C. Milner, "Determination of the effects of GPS failures on aviation applications," Ph.D. thesis, Imperial College London, London, U.K., 2009.

[23] Minimum Operational Performance Standards for Airborne Supplemental Navigation Equipment Using Global Positioning System (GPS), document RTCA DO-208, 1993.

[24] C. Shi, S. Gu, Y. Lou, and M. Ge, "An improved approach to model ionospheric delays for single-frequency precise point positioning," Adv. Space Res., vol. 49, no. 12, pp. 1698-1708, Jun. 2012.

[25] Minimum Aviation System Performance Standards: Required Navigation Performance for Area Navigation, document RTCA DO-236B, 2003.

[26] E. Gallon, M. Joerger, and B. Pervan, "Bounding temporal dynamics of DFMC GNSS ranging errors," Presented at the ARAIM Task Force Meeting, May 2021.
[27] J. Klobuchar, “Ionospheric time-delay algorithm for single-frequency GPS users,” *IEEE Trans. Aerosp. Electron. Syst.*, vol. AES-23, no. 3, pp. 325–331, May 1987.

[28] M. S. Circiu, S. Caizzone, C. Enneking, F. Fohlmeister, M. Rippl, M. Meurer, M. Felux, I. Gulie, D. Rüegg, J. Griggs, R. Lazzerini, F. Hagemann, F. Tranchet, P. Bouniol, and M. Sgammini, “Final results on airborne multipath models for dualconstellation dual-frequency aviation applications,” in *Proc. ION-ITM*, 2021, pp. 714–727.

[29] J. Blanch, T. Walter, C. Milner, M. Joerger, B. Pervan, and D. Bouvet, “Baseline advanced RAIM user algorithm: Proposed updates,” in *Proc. Int. Tech. Meeting Inst. Navigat.*, Long Beach, CA, USA, Feb. 2022, pp. 229–251.

<figure><img src="image_17.png" /></figure>

**JUNESOL SONG** received the B.S. and Ph.D. degrees in aerospace engineering from Seoul National University, South Korea. She was a Postdoctoral Fellow with the Telecom Laboratory, Ecole Nationale de l'Aviation Civile (ENAC), Toulouse, France. She is currently an Assistant Professor with the Department of Mechanical Engineering, The University of Suwon. Her research interests include multi-GNSS network RTK, compact RTK, DFMC GBAS fault monitoring, and integrity monitoring.

<figure><img src="image_18.png" /></figure>

**CARL MILNER** received the master's degree in mathematics from the University of Warwick, in 2004, and the Ph.D. degree from the Centre for Transport Studies, Imperial College London, in 2009. He is currently an Associate Professor with Ecole Nationale de l'Aviation Civile (ENAC), Toulouse, France. He lectures on navigation science and technology, including radio navigation aids, signal processing, positioning algorithms, and GNSS for aviation. His research interests include the design of positioning and integrity monitoring algorithms for civil aviation and urban applications.

<figure><img src="image_19.png" /></figure>

**CHRISTOPHE MACABIAU** received the degree in electronics engineering from the Ecole Nationale de l'Aviation Civile (ENAC), Toulouse, France, in 1992, and the Ph.D. degree, in 1997. From 2000 to 2012, he was In Charge with the Signal Processing Laboratory, ENAC. Since 1994, he has been working on the application of satellite navigation techniques to civil aviation. He is currently the Head of the TELECOM Team of ENAC.

...