Impact Analysis of Satellite Geometry Variation on ARAIM Integrity Risk over Exposure Interval

Abstract

Accurate integrity risk evaluation is of significance in ensuring that aviation navigation applications satisfy the predefined integrity requirement. The integrity risk evaluation method over a specified exposure interval has been proposed in previous works for the development of advanced receiver autonomous integrity monitoring (ARAIM) (ARAIM technical subgroup reference airborne algorithm description document v4.1, 2022). However, this method typically relies on an underlying optimistic assumption that the satellite geometry remains constant throughout the exposure interval. The variation in satellite geometry due to potential satellite outages undermines the widely-used geometry constant assumption. Thus, we investigate the influence of satellite geometry variations throughout the exposure interval on the integrity performance by introducing a geometry-sensitive risk-evaluation model. The findings demonstrate that, under the nominal situation, the region where the ARAIM fails to meet predefined integrity requirement could expand by a maximum of 2.93% when accounting for satellite geometry variations. Furthermore, in the situation of a single satellite outage, this hazardous region has significantly expanded from 13.12% of the global coverage to 66.82%. Based on these findings, we recommend that the ARAIM should consider satellite outages as a critical factor in real-time integrity risk evaluation.

1. Introduction

The global navigation satellite system (GNSS)-based positioning service is susceptible to rare faults, such as satellite and constellation faults, which can threaten the integrity of aircraft navigation [1,2]. Receiver autonomous integrity monitoring (RAIM) and Advanced RAIM (ARAIM) have been developed to support the integrity of positioning. The classic RAIM algorithm is designed to satisfy the required navigation performance (RNP) of en-route and non-precision approach phases as defined by the international civil aviation organization [3]. With the full deployment of the Galileo and Beidou navigation satellite system (BDS), an increased number of redundant observations are available [4,5,6]. There has been a renewed interest in expanding the RAIM to satisfy more demanding RNP, such as with the localizer precision vertical 200 (LPV-200) [7].

With this goal, the Global Positioning System (GPS) Evolutionary Architecture Study (GEAS) introduced a new concept of dual-frequency multi-constellation ARAIM and a corresponding user algorithm [8]. One of the primary tasks in ARAIM is to evaluate the integrity risk, or alternatively, a protection level, which is an upper bound on the positioning error with a specified integrity requirement. According to the definition of the international civil aviation organization (ICAO), integrity risk refers to the probability of a positioning error exceeding the specified alarm limit throughout the exposure interval, while the system fails to provide a timely warning to the user [9,10]. The exposure interval corresponds to the period of navigation service. For instance, the exposure interval for the LPV-200 is set at 150 s. Integrity risk evaluation is needed when designing a navigation system to meet a predefined integrity requirement P_HMI,REQ, and it is needed operationally to inform the user whether to abort or to pursue a mission [11]. In most of the literature [11,12,13], the integrity risk is evaluated at a single epoch without considering detection across multiple epochs, even though their corresponding requirements are specified over the exposure interval [14]. The literature assumes that when the correlation times of detection statistics and positioning error are significantly greater than the exposure interval, the integrity risk would be nearly constant as if one independent test was executed over the interval [14]. However, there has been some relevant earlier work on ARAIM suggesting that the assumption is not true, and that the actual integrity risk can be much higher [14,15]. To resolve these issues, Milner et al. [15] and Blanch et al. [16] proposed an integrity risk evaluation method that accurately accounts for the time-correlation effect of detection statistics and positioning error by utilizing the number of effective samples (NES). The NES represents the ratio of the integrity risk for a single epoch to the integrity risk over an exposure interval, and it can be computed using a first-order Gauss Markov model. When determining the NES, the upper limit of integrity risk over a given exposure interval can be evaluated based on the integrity risk observed at a single epoch within that interval [17]. At present, this algorithm has been adopted in the ARAIM technical subgroup reference airborne algorithm-description document [1]. However, to simplify the complexity of integrity risk evaluation, this method typically assumes a constant satellite geometry throughout the exposure interval. Unfortunately, the variation in satellite geometry is frequent and presents practical challenges for accurate integrity risk evaluation. This traditional assumption can introduce errors in integrity risk evaluation, particularly as the exposure interval increases. Therefore, we focus on the integrity risk evaluation of ARAIM in the presence of satellite geometry variation in this contribution.

Currently, the integrity risk evaluation based on the NES generally assumes a constant satellite geometry throughout the exposure interval. This assumption is regarded as reasonable only under the following conditions: First, the duration of the given exposure interval should be short. For instance, this assumption can be applicable to an LPV-200 approach with an exposure interval of 150 s. Secondly, there should be no satellite outages throughout the exposure interval. Unfortunately, achieving both of these conditions simultaneously is often challenging in real-time aviation navigation applications. There are several factors that can cause satellite outages within the exposure interval, e.g., aircraft banking and ionospheric scintillation. The aircraft attitude affects the reception of the signal because the antenna pattern is such that signals coming from underneath the plane of the aircraft suffer a significant loss of power [18]. Outages can also occur due to ionospheric scintillation, particularly in low latitude regions, which are affected by the equatorial anomaly. The addition or removal of a satellite in the view, especially for weak geometries, can cause significant changes in the satellite geometry. This variation in satellite geometry undermines the widely-used assumption of constant geometry and can result in errors in integrity risk evaluation. Although the ARAIM algorithm incorporates multiple conservative assumptions to constrain the actual integrity risk, to our knowledge, there is a lack of prior studies investigating the influence of satellite geometry variations within the exposure interval on the performance of the NES-based ARAIM. Nikiforov [19] has conducted a simulation analysis in previous research to quantify satellite geometry variations within the exposure interval. However, these quantitative results were primarily focused on a shorter exposure interval, and the impact of satellite geometry variations on integrity risk was not further explored. For this purpose, we investigate the actual integrity performance of the ARAIM under different situations of satellite geometry variation. If the observed performance significantly exceeds the predefined integrity risk requirement, it can provide a foundation for developing a more efficient integrity risk evaluation method to achieve better real-time performance.

According to the above analysis, the rigorous integrity risk-evaluation model is primarily constrained by the accurate description of satellite geometry variation within the exposure interval. Monte Carlo (MC) simulation is a straightforward, brute-force method employed to solve a complex model [20]. However, this approach is impractical for our performance verification due to its time-consuming nature, especially when considering worldwide integrity performance. An analytical integrity risk evaluation is more suitable for conducting worldwide performance verification. To the best of our knowledge, a rigorous integrity risk-evaluation model that considers satellite geometry variation within the exposure interval is still absent. In this contribution, we develop a general integrity risk-evaluation model to quantify the impact of satellite geometry variation on integrity performance. The principle of inclusion and exclusion (PIE) is introduced to rigorously characterize the influence of the satellite geometry variation within the exposure interval. It should be noted that our proposed method is designed for application in the offline integrity performance analysis of ARAIM. Through a rigorous assessment of ARAIM’s integrity performance, it is poised to furnish a dependable foundation for performance verification, as well as the subsequent update and adjustment of the ARAIM algorithm.

The next section introduces the concept of overall integrity risk to clarify the integrity requirements for ARAIM operations. In the following sections, we review the least-squares estimation of states of interest and the current ARAIM fault-detection algorithm to define the hazardously misleading information (HMI). The HMI definition will serve as a foundation for integrity risk evaluation. Next, we provide a detailed overview of the methodology we applied to evaluate the integrity risk of ARAIM. Following the detailed description of the method, we proceed to analyze the bounding tightness of the proposed method to the integrity risk reference, ensuring the effectiveness of the subsequent performance verification. Finally, we present the resulting integrity risk performance of the ARAIM under various simulation conditions, discuss the influence of satellite geometry variation on integrity performance, and concludes with remark on the future work.

2. Problem Definition

Since the integrity risk requirement is defined as the probability over the specific exposure interval, the integrity risk is required to evaluate over multiple detection epochs. Without losing generality, the integrity risk over the exposure interval can be expressed as [21],

$$P_{\mathrm{HMI},\mathrm{actual}}^{}={\displaystyle \sum _{k=0}^{N}P\left\{{\displaystyle \underset{j=1}{\overset{n_{\mathrm{s}}-n_{\mathrm{sa}}}{\cup }}{\displaystyle \underset{i=j}{\overset{j+n_{\mathrm{sa}}}{\cap }}\left({\mathrm{HMI}}_i,{\mathrm{H}}_{k,i}\right)}}\right\}}+P_{\mathrm{NM}}\left(t_{\exp }\right)$$

(1)

where HMI represents the hazardous misleading information, which is the situation when an undetected positioning error exceeds a predefined alert limit (AL). There are three different time metrics for integrity risk evaluation, i.e., the exposure interval time (t_exp), the time-to-alert (t_TTA) defined by required navigation performance, and the single detection time (t_s). Based on these time metrics, two parameters required for integrity risk evaluation, i.e., n_s and n_sa, can be determined. The n_s is the number of epochs in the t_exp, i.e., t_exp/t_s. The n_sa is the number of epochs in the t_TTA, i.e., t_TTA/t_s. As seen from Figure 1, we usually have t_exp > t_TTA > t_s. Furthermore, H_k in (1) represents the fault mode hypotheses for k = 0…N, which account for all fault satellite combinations including H₀, single satellite fault, multi-satellite faults, and constellation fault [22,23,24,25]. N is the number of fault modes to be monitored. P_NM(t_exp) is the probability of the fault modes that need not be monitored in the exposure interval. The calculation method of P_NM(t_exp) and the fault modes number N can be found in [16]. i and j represent the epoch time within the exposure interval. It should be noted that we will denote the event of continuous HMI occurrence within t_TTA under fault mode k, i.e., ${\displaystyle {\cap }_{i=j}^{j+n_{\mathrm{sa}}}\left({\mathrm{HMI}}_i,{\mathrm{H}}_{k,i}\right)}$, as ${\mathrm{HMI}}_{\mathrm{TTA},j}^k$ in the following to simplify the notation.

The integrity risk over the exposure interval can be accurately evaluated based on (1) [13]. However, the evaluation of integrity risk based on (1) is computationally challenged by the presence of time-correlation among multiple epochs [8]. A conservative but computationally efficient risk-evaluation model is usually used to calculate the integrity risk, instead of (1) [23],

$$\begin{array}{ll}{\overline{P}}_{\mathrm{HMI},\mathrm{actual}}^{}& ={\displaystyle \sum _{k=0}^N{\displaystyle \sum _{j=1}^{n_{\mathrm{s}}-n_{\mathrm{sa}}}P\left\{{\mathrm{HMI}}_{\mathrm{TTA},j}^k\right\}}}+P_{\mathrm{NM}}\left(t_{\exp }\right)\\ & ={\displaystyle \sum _{k=0}^N{\displaystyle \sum _{j=1}^{n_{\mathrm{s}}-n_{\mathrm{sa}}}P\left\{{\mathrm{HMI}}_{\mathrm{TTA},j}^{}\left|{\mathrm{H}}_k\right.\right\}P\left({\mathrm{H}}_k\right)}}+P_{\mathrm{NM}}\left(t_{\exp }\right)\end{array}$$

(2)

where $P\left({\mathrm{H}}_k\right)$ is the prior probability of the fault mode H_k. It should be noted that the subscript i of H_k,i is eliminated in (2) because we assume that the fault mode occurring at the first epoch in the exposure interval will always persist in this interval. This assumption is reasonable, because according to analysis in [1], the mean fault duration of GPS and Galileo is 1 h, which is usually much longer than the exposure interval. Equation (2) strictly considers all epochs’ geometry in the exposure interval and is referred to as the geometry-sensitive risk-evaluation model.

Provided the statistical distribution of HMI and the satellite geometry from all epochs across the exposure interval, the integrity risk can be obtained based on the geometry-sensitive risk-evaluation model. Nonetheless, it is usually difficult to forecast the satellite geometry variation in the exposure interval for real-time aviation navigation applications. Therefore, the geometry constant assumption within the exposure interval is adopted to simplify the complexity of integrity risk evaluation. However, the satellite geometry variation due to the rising and falling of satellites undermines the widely-used geometry constant assumption. This assumption may lead to an integrity risk-evaluation error. Next, we will introduce a general integrity risk-evaluation method to investigate the influence of satellite geometry variations throughout the exposure interval on the integrity performance of the NES-based ARAIM.

3. Integrity Risk Evaluation over the Exposure Interval

This section describes a general methodology for evaluating the integrity risk within the exposure interval. It begins by reviewing the definition of HMI events in the baseline ARAIM algorithm. Subsequently, the rigorous P_HMI evaluation approach based on the geometry-sensitive model (2) is introduced.

3.1. Hazardous Misleading Information

This section provides a description of the HMI definition for various satellite geometry. According to (2), the integrity risk of navigation application is determined by the temporal characteristics of the HMI events. In the baseline ARAIM algorithm, the HMI event under fault mode hypotheses k is described as [17]

$$\left({\mathrm{HMI}}_i|{\mathrm{H}}_k\right)=\left(\left|x_{0,q}^{(i)}\right|>\mathrm{AL}\cap {\displaystyle \underset{d=1}{\overset{N}{\cap }}\left|x_{d,q}^{(i)}-x_{0,q}^{(i)}\right|\le T_{d.q}^{(i)}}|{\mathrm{H}}_k\right)$$

(3)

$$\subset \left(\left|x_{k,q}^{(i)}\right|>\frac{\mathrm{AL}-T_{k,q}^{(i)}-{\left|s_{k,q}^{(i)}\right|}^T{b}_{\mathrm{nom}}}{{\sigma }_{k,q}^{(i)}}|{\mathrm{H}}_k\right)=\left(\left|x_{k,q}^{(i)}\right|>F_{k,q}^{(i)}|{\mathrm{H}}_k\right)$$

(4)

where $x_{0,q}^{(i)}$ is a position estimate error using all satellites in view at epoch i. The subscript q = 1, 2, and 3 denote the east, north, and up components, respectively. $x_{d,q}^{(i)}$ is a position estimate error using all satellites except the one(s) included in fault mode d. The distribution of $x_{d,q}^{(i)}$ in (3) and (4) can be written in detail as

$$x_{d,q}^{(i)}\sim N\left(s_{d,q}^{(i)}{b}_{\mathrm{nom}},{\left({\sigma }_{d,q}^{(i)}\right)}^2=e_q^{\mathrm{T}}{\left(H_i^{\mathit{T}}{R}_c^{}{H}_i\right)}^{-1}{e}_q^{}\right)$$

(5)

where $s_{d,q}^{(i)}$ is a 1 × n project vector to exclude the fault satellite, i.e., $s_{d,q}^{(i)}=e_q^{\mathrm{T}}{\left(H_i^{\mathrm{T}}{R}_c^{}{H}_i\right)}^{-1}{H}_i^{\mathrm{T}}{R}_c^{}$, R_c is the identity matrix with the c-th diagonal element equal to 0 when the c-th satellite is included in fault mode hypothesis d, and e_q is the m × 1 vector used to extract the q-th state out of the full state vector. For example, use of $e_q={[0 0 1 {\mathbf{0}}_{\left(m-3\right)\times 1}^{\mathrm{T}}]}^{\mathrm{T}}$ to extract the vertical position error. b_nom is the n × 1 nominal bias vector.  ${\sigma }_{d,q}^{(i)}$ is the standard deviation of the estimated error for the q-th state. H_i is the n × m normalized geometry matrix in epoch i and the normalization procedure is described in [24], n is the number of all-in-view satellites, and m is the number of estimated states. In addition, the detection threshold $T_{d,q}^{(i)}$ in (3) and (4) is set based on an allocated continuity requirement P_FA,q,REQ and NES_cont for continuity risk evaluation [16],

$$T_{q,d}^{(i)}=Q^{-1}\left(\frac{P_{FA,q,REQ}}{2P_{{\mathrm{H}}_0}\cdot N\cdot {\mathrm{NES}}_{cont}}\right){\sigma }_{{\Delta }_{d,q}}^{(i)}$$

(6)

where Q⁻¹ is the inverse tail probability function of a zero-mean unit-variance Gaussian distribution. ${\sigma }_{{\Delta }_{d,q}}^{(i)}$ is the standard deviation of the detection statistic for the q-th state. A detail calculation of above parameters can be found in [23], and the superscript q is eliminated in the following to simplify notations.

It should be noted that this section introduces two distinct definitions of HMI characterization, denoted as (3) and (4). Compared to (4), Equation (3) describes a more precise HMI event and is often utilized to precisely analyze the values of certain parameters associated with the ARAIM [21]. However, conducting an integrity risk evaluation based on this definition involves a complex challenge of determining the worst-case fault. Currently, there is a lack of appropriate strategies to determine the worst-case fault considering the variation in satellite geometry. From a navigation safety standpoint, the HMI definition based on (4) is more conservative than that based on (3). This conservative definition is commonly employed to rigorously analyze the integrity performance of ARAIM [20]. Compared to (3), the conservative definition mainly has the following advantages: Firstly, this definition is currently used by the NES-based ARAIM to evaluate integrity risk, and its conservative nature ensure the reliability of the analysis results. Secondly, when evaluating integrity risk based on this definition, all positioning errors under different fault mode hypotheses are considered fault-free, thus eliminating the need to search for the worst-case fault. Therefore, we will adopt the conservative definition to conduct integrity risk evaluation in this paper.

3.2. Evaluation of P_HMI

With the definition of HMI, this section applies it to evaluate the integrity risk over the exposure interval. Figure 2 illustrates the epochs that are essential to consider for the integrity risk evaluation under a specific fault mode. Figure 2 indicates that an HMI event will have an impact on navigation safety only when its duration exceeds the time length of t_TTA. Additionally, HMI events can potentially occur at any point within the exposure interval. Therefore, a rigorous integrity risk evaluation requires the incorporation of geometry information from all epochs across the exposure interval.

The integrity risk within the exposure interval can be derived from (2) by summing up the probabilities of ${\mathrm{HMI}}_{\mathrm{TTA},j}^{}$ across all fault modes and epochs. For clarity, we will only present the expression for the integrity risk in a single t_TTA under a specific fault event k,

$$P\left\{{\mathrm{HMI}}_{\mathrm{TTA},j}^{}\left|{\mathrm{H}}_k\right.\right\}=P\left\{\left.\left({\displaystyle \underset{i=j}{\overset{j+n_{sa}}{\cap }}{\mathrm{HMI}}_i}\right)\right|{\mathrm{H}}_k\right\}=1-P\left\{\left.\left({\displaystyle \underset{i=j}{\overset{j+n_{sa}}{\cup }}\overline{{\mathrm{HMI}}_i}}\right)\right|{\mathrm{H}}_k\right\}$$

(7)

where $\overline{{\mathrm{HMI}}_i}=\left\{\left|x_k^{(i)}\right|\le F_k^{(i)}\right\}$. Due to the positioning error $x_k^{(i)}$ being highly time-correlated within the allowable time-to-alert, we introduce the PIE to accurately deal with the impact of time-correlation and satellite geometry variation on the integrity risk evaluation simultaneously. The probabilistic PIE is a method used to calculate the probability of unions of events [12]. Based on the PIE, the probability of the $\overline{{\mathrm{HMI}}_i}$ occurring under fault mode hypothesis H_k can be described as follows:

$$\begin{array}{ll}P\left\{\left.\left({\displaystyle \underset{i=j}{\overset{j+n_{sa}}{\cup }}\overline{{\mathrm{HMI}}_i}}\right)\right|{\mathrm{H}}_k\right\}& ={\displaystyle \sum _{a=j}^{j+n_{sa}}P\left(C_a\left|{\mathrm{H}}_k\right.\right)-{\displaystyle \sum _{j\le a<b\le j+n_{sa}}P\left(C_{a,b}\left|{\mathrm{H}}_k\right.\right)}}+{\displaystyle \sum _{j\le a<b<c\le j+n_{sa}}P\left(C_{a,b,c}\left|{\mathrm{H}}_k\right.\right)}\\ & +\cdots +{\left(-1\right)}^{n_{sa}-1}{\displaystyle \sum _{j\le l_1<l_2\cdots <l_{n_{sa}}\le j+n_{sa}}P\left(C_{l_1,l_2\cdots l_{n_{sa}}}\left|{\mathrm{H}}_k\right.\right)}+{\left(-1\right)}^{n_{sa}}P\left(C_{j,\left(j+1\right)\cdots \left(j+n_{sa}\right)}\left|{\mathrm{H}}_k\right.\right)\end{array}$$

(8)

where the intersection of $\overline{{\mathrm{HMI}}_i}$ is descried as $C_{l_1,l_2\cdots l_{n_{sa}}}=\left\{\overline{{\mathrm{HMI}}_{{}_{l_1}}}\cap \overline{{\mathrm{HMI}}_{{}_{l_2}}}\cap \cdots \cap \overline{{\mathrm{HMI}}_{{}_{l_{n_{sa}}}}}\right\}$ to simplify notations. Given the threshold $F_k^{(i)}$, the probability of the $C_{l_1,l_2\cdots l_{n_{sa}}}$ can be expressed as follows,

$$\begin{array}{ll}P\left(C_{l_1,l_2\cdots l_{n_{sa}}}\left|{\mathrm{H}}_k\right.\right)=& P\left[{\displaystyle \underset{i=l_1}{\overset{l_{n_{sa}}}{\cap }}\left(-F_k^{(i)}<x_k^{(i)}<F_k^{(i)}\right)}|{\mathrm{H}}_k\right]\\ & =\frac{{(2\pi )}^{-\left(n_{sa}\right)/2}}{\sqrt{\left|\mathsf{\Sigma }\right|}}{\displaystyle {\int }_{-F_k^{(l_1)}}^{F_k^{(l_1)}}\cdots }{\displaystyle {\int }_{-F_k^{(l_{n_{sa}})}}^{F_k^{(l_{n_{sa}})}}\exp }\left[-\frac{1}{2}\left(X_k^{}{}^T{\mathsf{\Sigma }}^{-1}{X}_k^{}\right)\right]\mathrm{d}{x}_k^{(l_{n_{sa}})}\cdots \mathrm{d}{x}_k^{(l_1)}\end{array}$$

(9)

where the sequence of random vectors $X_k^{}$ composed of the positioning errors, i.e., $X_k^{}={\left(x_k^{(l_1)},\dots ,x_k^{(l_{n_{sa}})}\right)}^{\mathrm{T}}$. Equation (9) involves a multidimensional-integration calculation. In this paper, the MATLAB function mvncdf was used to implement the integral calculation. Moreover, the normalized positioning errors covariance matrix of adjacent epochs can be expressed as

$$\mathsf{\Sigma }=\left[\begin{array}{llll}1& e^{-\beta \Delta t}& \cdots & e^{-\left(n_{sa}-1\right)\beta \Delta t}\\ e^{-\beta \Delta t}& 1& \cdots & e^{-\left(n_{sa}-2\right)\beta \Delta t}\\ ⋮& ⋮& \ddots & ⋮\\ e^{-\left(n_{sa}-1\right)\beta \Delta t}& e^{-\left(n_{sa}-2\right)\beta \Delta t}& \cdots & 1\end{array}\right]$$

(10)

where β is the reciprocal time constant of the first-order Gaussian Markov process. Δt is a time interval between adjacent two x’s. The sample rate of the receiver t_s is typically 0.2–0.5 s based on 2–5 Hz sampling frequencies. For the purposes of this article, a lower sampling interval of 2 s is employed to ease computation times for the MC simulation described below. This is a conservative parameter setting from the perspective of integrity risk evaluation, which was proved by [21]. Furthermore, the numerical examples in Section 4 are calculated for several values of the reciprocal time constant β, ranging from 10 to 1000, to represent different levels of correlation strength.

Here, the integrity risk over the exposure interval can be determined by substituting (7) into (2). In the current ARAIM algorithm, the evaluation of integrity risk often disregards the influence of allowable t_TTA, which results in a conservative evaluation result. In contrast, we chose to accurately calculate the integrity risk within the allowable t_TTA. The impact of geometry variation on the ARAIM’s integrity performance can be evaluated.

The integrity risk evaluation method has been described in the above related sections, and the detailed integrity risk evaluation process can be described below:

Step 1. Run geometry simulation to obtain the satellite geometry information within the exposure interval in specified time.

Step 2. Collect all the geometry matrix H_i in the exposure interval and calculate $F_k^{(i)}$ based on (4). The $F_k^{(i)}$ will be employed later to reflect satellite geometry variation.

Step 3. Describe the time-correlation effect of the HMI events in the allowable t_TTA and determine the normalized positioning errors covariance matrix $\mathsf{\Sigma }$ of adjacent epochs based on (10).

Step 4. Given the $F_k^{(i)}$ and $\mathsf{\Sigma }$ determined by step 2 and step 3, calculate the integrity risk $P\left\{{\mathrm{HMI}}_{\mathrm{TTA},i}^k\right\}$ based on (7) and (8) across all fault modes and epochs.

Step 5. Substitute (7) on (2), and calculate the actual integrity risk ${\overline{P}}_{\mathrm{HMI},\mathrm{actual}}^{}$ in the entire exposure interval.

In order to rigorously examine the integrity performance of the ARAIM, an integrity risk evaluation method is proposed to account for the satellite geometry variation in the exposure interval. The integrity performance of the ARAIM under different exposure interval times will be tested later.

4. Experiment and Analysis

In order to examine the integrity performance of the ARAIM, we conducted P_HMI simulations based on the proposed method. First, we analyzed the bounding tightness of the evaluated P_HMI,actual to the reference P_HMI,ref. Second, a worldwide ARAIM integrity performance analysis based on a combination of GPS and Galileo constellation was carried out using the proposed method. The baseline simulation conditions, which are specified in some earlier works [13,26,27,28], were applied to the analysis, and those conditions are also shown in

Table 1. Simulation parameters setting [1].

Parameters	Value
Satellite clock and orbits correction error σURA (integrity)	V-ARAIM: 1.5 [m] H-ARAIM: 2.4 [m]
Satellite clock and orbits correction error σURE (accuracy and continuity)	(2/3) σURA [m]
PHMI,REQ	V-ARAIM: 9.8 × 10−8/150 s H-ARAIM: 1.0 × 10−7/h
PFA,REQ	V-ARAIM: 3.9 × 10−6/150 sH-ARAIM: 5.0 × 10−7/h
Rsat	10−5/h for both GPS and Galileo
Rconst	10−8/h (GPS); 1 × 10−4/h (Galileo)
MFD (mean fault duration)	1 h for both GPS and Galileo
NES	texp/ts for both integrity and continuity
texp	150 [s] (LPV-200); 3600 [s] (RNP 0.1)
ta	6 [s] (LPV-200); 10 [s] (RNP 0.1)
ts	2 [s]
PNM	6 × 10−8
Alarm limit	VAL: 35 [m]; HAL: 185 [m]

. Based on the open-source software MAAST for ARAIM Version 0.4 of Stanford University (https://gps.stanford.edu/resources/software-tools/maast, accessed on 4 June 2023), the GPS and Galileo dual constellations were used for the global simulation experiment. The GPS and Galileo almanac files contained in MAAST were used. The global simulation parameters came from ARAIM Technical Subgroup [1] and are listed in Table 1.

4.1. Tightness Analysis of Integrity Risk Evaluate Results

In this section, we will analyze the bounding tightness of the proposed method for the reference. Bounding tightness is a critical characteristic for assessing the performance of an integrity risk-evaluation method. Firstly, it necessitates that the evaluation results are more conservative than the reference results. Secondly, the closer the evaluation results are to the reference, the better the bounding tightness. The purpose of this analysis is to prove the proposed method’s effectiveness in verifying the performance of ARAIM. If the evaluation results of the proposed method are consistently lower than the reference, the subsequent performance verification will be too optimistic. Conversely, if they are significantly higher than the reference, it would lead to an excessively conservative performance verification. We chose the MAAST for ARAIM Version 0.4 software (from Stanford University in Stanford, CA, USA) as the simulation platform, and took the Beijing site as an example to show the relationship between the evaluated results obtained from the proposed method and the reference. It should be noted that the reference was obtained by MC simulation based on (1). Satellite observation error in MC simulation follows the first-order Gaussian Markov model, and the specific model setting can be referred to in [15]. Unfortunately, a full numerical evaluation based on MC simulation would be too computationally taxing for an P_HMI,REQ of 10⁻⁷ over exposure interval. For instance, considering the RNP 0.1 phase, this would require the simulation of a Gaussian Markov process for at least 10⁷ h, which is more than a thousand years. This limitation is the reason that MC simulation is not directly employed to analyze the performance of the ARAIM. In the tightness analysis simulations, we implemented two settings to mitigate the time-consuming simulations: Firstly, we only tested the Galileo constellation fault situation, as it is the most crucial fault mode impacting the integrity performance of the ARAIM. Secondly, we artificially set VAL to 15 m and HAL to 20 m. This was performed to avoid a considerable number of invalid MC simulations caused by extremely low integrity risk. Our tests mainly include two situations: LPV-200 for V-ARAIM and RNP 0.1 flight phase for H-ARAIM. The total simulation duration for both situations was 10 days, including the LPV-200 approach for 5760 times and the RNP 0.1 phase simulation for 960 times. It should be noted that in the RNP 0.1 phase simulation, a sliding window of 3600 s with the step of 4 s was utilized to increase the test samples. The number of MC simulations was 10⁵, which is significantly higher than the required number of MC simulations converted from P_HMI,REQ/10⁻⁴. It should be noted that 10⁻⁴ represents the prior probability of the Galileo constellation fault, and the calculation is based on the R_const and MFD. We have collected four types of integrity risk results: the integrity risk reference derived from MC simulation, the minimum and maximum integrity risks within the exposure interval obtained from NES-based ARAIM, and the actual integrity risk obtained from the proposed method.

Figure 3 and Figure 4 illustrate the evaluation tightness of the proposed method. β = 10 and β = 1000 were utilized to represent the cases with weak and strong time correlations of positioning errors, respectively. In cases of the low error correlation, as indicated in Figure 3, the empirical cumulative distribution functions (ECDFs) based on the actual integrity risk and reference were very close. This means that the proposed method effectively reflects the integrity risk reference. However, in cases of strong error correlation, the difference between the actual integrity risk results and reference increased. This is attributed to our assumption that ${\mathrm{HMI}}_{\mathrm{TTA},j}^k$ is independent of time during the integrity risk evaluation, which leads to conservative evaluation results as the positioning error correlation increases. The more conservative the actual integrity risk, the higher the likelihood of a false decision occurring in the subsequent performance analysis is. The false decision implies that the integrity risk reference is below P_HMI,REQ, but according to the proposed method, we conclude that ARAIM is not available. In order to analyze whether the evaluation results are too conservative, we further analyzed the bounding tightness of the actual integrity risk to the reference. We chose the ratio between the actual integrity risk and the reference as the tightness index. It should be noted that we only considered the reference results below 10⁻⁷/approach for analysis, as results greater than this threshold would not lead to a false decision. As shown in Figure 4, the tightness index of the proposed method is mostly less than 2. This implies that a false decision occurs only when the reference integrity risk is extremely close to the predefined P_HMI,REQ, for instance, falling within the range of 5 × 10⁻⁸/approach to 1 × 10⁻⁷/approach. Furthermore, according to the analysis by [20], due to the high sensitivity of integrity risk to geometry variation, it usually either falls significantly below the P_HMI,REQ or notably exceeds the requirement, and rarely falls near the P_HMI,REQ. The bounding tightness analysis implies that the proposed method has the ability to verify the ARAIM integrity performance in an LPV-200 approach.

Figure 5 and Figure 6 illustrate the integrity evaluation results under the RNP 0.1 flight phase. Compared with LPV-200, the tightness index of the proposed method is noticeably increased under RNP 0.1, especially when β = 1000. In this scenario, the bounding tightness of the proposed method significantly deteriorates, and the maximum tightness index reaches nearly 10. This indicates that the evaluation error of the proposed method increases with the lengthening of the exposure interval. Fortunately, the AL during the RNP 0.1 phase is relatively loose, implying that the integrity risk is significantly lower than the P_HMI,REQ. The high tightness index of the proposed method will not cause many false decisions. This conclusion will be further proved in the subsequent global simulation analysis. Moreover, a notable observation in Figure 5 is that the maximum and minimum evaluation results obtained from the NES-based integrity risk evaluation method vary significantly within the exposure interval, and the ECDF generated by the minimum evaluation results does not effectively bound the reference. This occurs primarily due to the longer duration of the exposure interval in RNP 0.1, leading to more obvious satellite geometry variation during this interval. By comparison, the proposed method can achieve a rigorous bounding for the reference risk value. This is because our method rigorously considers all epoch information when evaluating the integrity risk. Overly optimistic evaluation results pose a significant threat to the integrity of navigation services. This underscores the notable advantages of the proposed method over traditional approaches in ensuring the reliability of navigation services. In Figure 7, an illustrative example of an exposure interval at the Beijing station is selected, demonstrating fluctuations in the number of satellites. The straight line depicted in Figure 7 represents the evaluated risk value by considering geometry variation over the whole exposure interval, so it does not change with time. Since the NES-based ARAIM evaluation result only relies on the single-epoch information throughout the exposure interval, most of the integrity risk evaluation results in Figure 7 are obviously underestimated. On the contrary, the proposed method can effectively bind the reference. Based on the above analysis, we can conclude that the traditional integrity risk evaluation method may be overly optimistic during the RNP 0.1 phase. Therefore, it is necessary to quantify the impact of satellite geometry variation on the ARAIM performance. Subsequently, we utilized the proposed method to validate the worldwide integrity performance of the ARAIM.

4.2. Evaluation of PHMI for Solution Separation ARAIM

To analyze the impact of satellite geometry variations on the integrity performance of the ARAIM, three simulations were conducted under different situations of satellite geometry variation: the first simulation situation is the LPV-200 in a nominal situation, with an exposure interval time of 150 s. The second is the LPV-200 under a one-satellite outage situation. The third situation is RNP 0.1 phase, with an exposure interval time of 3600 s. For the one-satellite outage situation, a satellite was randomly selected as an outage within the exposure interval, and this outage lasted for 30 s. These settings are commonly employed to simulate ionospheric scintillation conditions [18]. The underlying vital assumptions and parameters specified in [13] are used to perform the simulations. The dual-frequency 24 GPS/Galileo nominal constellation with formal parameters was used, and the results were assessed for V-ARAIM (LPV-200) and H-ARAIM (RNP 0.1) operation, respectively. The global simulation was based on a 10° × 10° user grid, for 24 h with a sampling interval of 10 min, which generated 144 samples per user grid. The cut-off elevation angle was set as 5° to balance the observation accuracy and visible satellite. The availability of a grid point can be determined by calculating the ratio of epochs where the evaluated integrity risk is less than the required P_HMI,REQ to the total number of epochs during the simulation duration. The global availability coverage was used as the metric to reflect the global integrity performance, which was calculated as the ratio between the number of user grids with the integrity risk smaller than the required P_HMI,REQ and the total number of grids. In addition, we chose the minimum value to represent the integrity risk throughout the exposure interval evaluated by the NES-based ARAIM.

Figure 8 shows the global availability of V-ARAIM in the nominal LPV-200 situation with β = 100. According to Figure 8, the availability of the ARAIM under the traditional method is very close to the actual availability. This indicates that the impact of satellite geometry variation on the integrity performance of the ARAIM is extremely low at a short exposure interval. Furthermore, we summarize the global availability results of the ARAIM under different time correlation strengths of positioning error in

Table 2. Average availability results and coverage (95%) of the ARAIM.

	Method	β = 10		β = 100		β = 1000
		Average	Coverage	Average	Coverage	Average	Coverage
LPV-200 nominal	Traditional	98.41%	93.67%	98.41%	93.67%	98.41%	93.67%
	Actual	98.17%	92.44%	97.59%	91.05%	97.71%	90.74%
	Loss	0.24%	1.23%	0.82%	2.62%	0.70%	2.93%
LPV-200 one-satellite outage	Traditional	97.91%	86.88%	97.91%	86.88%	97.91%	86.88%
	Actual	94.51%	58.02%	91.69%	33.18%	90.97%	26.39%
	Loss	3.40%	28.86%	6.22%	53.70%	6.94%	60.49%
RNP 0.1	Traditional	100.00%	100.00%	100.00%	100.00%	100.00%	100.00%
	Actual	99.86%	100.00%	99.86%	100.00%	99.83%	100.00%
	Loss	0.14%	0.00%	0.14%	0.00%	0.17%	0.00%

. It can be seen that under weak correlation (β = 10), the ARAIM’s average availability loss is the lowest. When β increases to 100, the average availability loss increases from 0.24% to 0.82%. This is because the weak geometry could continue to affect multiple epochs as the correlation strength of positioning error increases. However, this does not imply that the average availability of the ARAIM will consistently decrease with the increase in β. When β is equal to 1000, the average availability increases by 0.12% compared to β = 100. This is because when the correlation is strong, the integrity performance of the ARAIM mainly depends on the first epoch in the exposure interval, and there may be only one opportunity for an HMI event to occur in this interval. According to the above analysis, under a short exposure interval, the loss in availability caused by the geometry constant assumption is low and does not change significantly with the β value. As a result, traditional methods do not result in overly optimistic integrity risk evaluation results under a short exposure interval.

Figure 9 shows the global availability of V-ARAIM in the LPV-200 under a one-satellite outage situation. It can be seen that the absence of one satellite during the interval significantly impacts the integrity performance of navigation applications. Compared to situation 1, the region where the actual ARAIM achieves a 95% availability is reduced by 57.87%. In contrast, the ARAIM determined by the traditional method is only reduced by 6.79%. This indicates that the traditional method is overly optimistic in evaluating the integrity risk based only on the current epoch. In particular, when β equals 100, the ARAIM’s availability decreases more obviously. According to the global simulation results, the average availability loss significantly increased to 6.94%, and the coverage meeting 95% availability was reduced by 53.70%. As far as we know, ARAIM currently utilizes carrier smoothing code (CSC) to mitigate high-frequency code noise, and the time constant of the CSC is also set at 100. Therefore, satellite geometry variations must be taken into account for integrity risk evaluation, particularly in situations involving aircraft banking and ionospheric scintillation. One potential approach to rigorously evaluate the integrity risk is to utilize multiple-epoch information through batch processing or filtering methods [18]. This will be discussed further in our future work. Finally, we analyzed the availability of H-ARAIM in the RNP 0.1 phase. According to Figure 10, it can be seen that the availability loss of traditional ARAIM during this phase is small. This is because the HAL during the RNP 0.1 phase is very loose, resulting in significantly lower integrity risks than the P_HMI,REQ. According to Table 2, the maximum loss of average availability based on NES-based ARAIM evaluation is only 0.17%.

Based on the above analysis, this study demonstrates the impact of satellite geometry variation on the integrity performance of NES-based ARAIM. Firstly, the previously geometry constant assumption for the ARAIM integrity risk evaluation does not appear to be overly optimistic under nominal conditions for LPV-200 and RNP 0.1 phases. However, when the navigation applications encounter situations involving aircraft banking and ionospheric scintillation, the traditional method of integrity risk evaluation could become overly optimistic.

5. Conclusions

We conducted a preliminary assessment of NES-based ARAIM integrity performance by presenting a methodology to calculate the actual integrity risk based on a geometry-sensitive risk-evaluation model. According to the simulation analysis, compared with the reference risk value, the results evaluated by traditional NES-based ARAIM methods are usually proved to be optimistic. In contrast, the proposed method can realize rigorous bounding for the reference risk value by considering all epoch information within the exposure interval during the evaluation of integrity risk. Using the proposed method and baseline conditions, we rigorously analyzed the impact of satellite geometry variation on the ARAIM integrity performance over the exposure interval. Several key conclusions are summarized as follows.

First, in the nominal LPV-200 with 150 s exposure interval time and the nominal RNP 0.1 with 3600 s, the traditional NES-based ARAIM does not produce overly optimistic integrity risk-evaluation results. According to the global simulation results, the maximum average availability loss of traditional method is only 0.82% after considering the impact of satellite geometry variation.

Second, in the situation of a single-satellite outage during LPV-200 approach, the traditional method is overly optimistic in evaluating the integrity risk based on the geometry constant assumption. According to the global simulation results, the average availability loss has significantly increased to 6.94%, and the coverage meeting 95% availability has reduced by 53.70%. This implies that ensuring the rigor of integrity risk evaluation in the case of aircraft banking and ionospheric scintillation is challenging for the NES-based method.

Finally, a potential real-time integrity risk evaluation approach is briefly introduced, which involves utilizing multiple-epoch information through batch processing or filtering methods. In future research, we will focus on applying these methods to enhance the current ARAIM algorithm.