EUROPEAN ORGANISATION FOR THE SAFETY OF AIR NAVIGATION EUROCONTROL EUROCONTROL EXPERIMENTAL CENTRE SAPPHIRE - FIRST RESULTS - EEC Report No.

Transcription

1 EUROPEAN ORGANISATION FOR THE SAFETY OF AIR NAVIGATION EXPERIMENTAL CENTRE SAPPHIRE - FIRST RESULTS - EEC Report No. 330 EEC Task C04 EATCHIP Task NAV-4-E1 Issued: June 1998 The information contained in this document is the property of the Agency and no part should be reproduced in any form without the Agency s permission. The views expressed herein do not necessarily reflect the official views or policy of the Agency.

2

3 REPORT DOCUMENTATION PAGE Reference: EEC Report No. 330 Originator: EEC - SNA (Satellite Navigation Applications) Sponsor: EATCHIP Development Directorate Security Classification: Unclassified Originator (Corporate Author) Name/Location: Experimental Centre BP Brétigny-sur-Orge CEDEX FRANCE Telephone : +33 (0) Sponsor (Contract Authority) Name/Location: Agency Rue de la Fusée, 96 B BRUXELLES Telephone : +32-(0) TITLE: SAPPHIRE - FIRST RESULTS - Authors N. Bondarenco A. Lipp B. Tiemeyer A. Watt Date 06/98 Pages x + 28 Figures 11 Tables 8 Appendix - References 15 EATCHIP Task Specification NAV-4-E1 EEC Task No. C04 Task No. Sponsor Period 01/96-04/98 Distribution Statement: (a) Controlled by: Head of SNA (b) Special Limitations: None (c) Copy to NTIS: YES Descriptors (keywords): SAPPHIRE, DUAU, Database Update & Access Unit, Satellite Navigation, GPS, EGNOS, Data Recording, Commercial Airliner, RAIM, AAIM, Certification, Safety Regulation Abstract: This report presents first results on the availability of Receiver Autonomous Integrity Monitoring (RAIM) onboard of commercial aircraft derived from the Flight Trial Programme SAPPHIRE (Satellite & Aircraft Database Programme for System Integrity Research). The objective of this programme is to develop a statistically representative database of regular GNSS and other navigation sensor measurements to investigate system integrity, availability and continuity of service aspects in order to contribute to the GNSS certification process. The data evaluation process is explained together with the set of navigation performance requirements which will be initially used before first results are presented and discussed.

4 This document has been collated by mechanical means. Should there be missing pages, please report to: Experimental Centre Publications Office B.P BRETIGNY-SUR-ORGE CEDEX France

5 FOREWORD This report presents the first results produced by s SAPPHIRE Programme (Satellite & Aircraft Database Programme for System Integrity Research). The objective of this programme is to provide statistical evidence about the performance of satellite navigation systems in the airborne environment so that they may be certificated for operational use. The initiation of this programme started 1994 when decided to commence evaluation of Satellite Navigation performance onboard of commercial airliners to support related safety regulation activities. During that year an experimental flight trial was conducted to investigate the reception conditions of geostationary satellites in high latitudes. Concerns of States in that region were addressed and the results supported the decision to continue with the development of the EGNOS (European Geostationary Navigation Overlay Service) Programme to provide a civil augmentation service for the currently existing satellite navigation systems, GPS and GLONASS. After establishing a User Requirements Document in close co-operation with national administrations the development of the SAPPHIRE DUAU (Database Update & Access Unit) was launched in The DUAU achieved pre-operational status during the second half of 1997 and achieved operational status during March 1998 when system acceptance test activities were successfully completed. The implementation of a life-cycle approach, proposed by the Software Engineering Unit at the Experimental Centre, and the development of advanced prototypes for early validation helped to achieve a high level of confidence in the system. This was also supported by the approach to run the system in a pre-operational status before starting full operation. On behalf of we would like to thank all parties who have been involved in SAPPHIRE up to now for their support, effort and contributions. This document is the first in a series of regular publications reporting on the status and results derived within the SAPPHIRE Programme. Bernd Tiemeyer Andrew Watt Experimental Centre Satellite Navigation Applications CoE v

6 INTENTIONALLY LEFT BLANK vi

7 TABLE OF CONTENTS SUMMARY...IX 1. INTRODUCTION General Policy Overview OBJECTIVES Data Recording DUAU Phase I DUAU Phase II DUAU Phase III Glossary ORGANISATIONAL STRUCTURE AIRCRAFT INSTALLATION AND DATA RECORDING DATABASE UPDATE & ACCESS UNIT Background Data Evaluation Phase I Visibility Scenarios Accuracy RAIM Detection Availability RAIM Detection and Identification Input Parameters SOFTWARE DEVELOPMENT FIRST RESULTS ON AVAILABILITY OF RAIM DETECTION Description of Database Contents Flights included in the Database Phases of Flight Scenarios Remark on Results Availability of Accuracy Analyses of RAIM Detection Availability Availability of RAIM Detection Analyses of Outages Saturation of Statistical Results STATUS PERSPECTIVE PRELIMINARY CONCLUSIONS REFERENCES TRADUCTION EN FRANÇAIS DE L AVANT-PROPOS, DU RESUME, DE L INTRODUCTION, DES OBJECTIFS ET DES CONCLUSIONS PRELIMINAIRES vii

8 LIST OF FIGURES Figure 1-1: SAPPHIRE Programme... 3 Figure 4-1: Aircraft Installation (A340/321)... 5 Figure 5-1: Database Update & Access Unit... 6 Figure 5-2: Accuracy Evaluation... 7 Figure 5-3: RAIM Availability... 8 Figure 5-4: RAIM Detection and Identification... 9 Figure 6-1: Software Lifecycle Figure 7-1: Trajectories of Flights in SAPPHIRE Database Figure 7-2: Combined Aircraft and Antenna Reception Diagram for the LH A Figure 7-3: Accumulated Statistics for Sturza/Brown RAIM Detection Availability (Measured Visibility Scenario; En Route)...19 Figure 7-4: Accumulated Statistics for Sturza/Brown RAIM Detection Availability (Measured Visibility Scenario; Departure, Terminal, Initial & Final App.) LIST OF TABLES Table 5-1: Required Accuracy Performance (Navigation System Error) Table 5-2: Required RAIM Performance Table 7-1: Itineraries of Flights in SAPPHIRE Database Table 7-2: Definition of Phases of Flight Table 7-3: Availability of Accuracy (Percentage of Time)...15 Table 7-4: Availability of RAIM Detection (Percentage of Time) Table 7-5: Outages in RAIM Detection Availability Table 7-6: Total Outage Time in RAIM Detection Availability (in secs.) viii

9 SUMMARY This report presents first results on the availability of Receiver Autonomous Integrity Monitoring (RAIM) for satellite navigation receivers installed onboard of commercial aircraft, which have been derived from the flight trial programme SAPPHIRE (Satellite & Aircraft Database Programme for System Integrity Research). The objective of this programme is to develop a statistically representative database of regular Global Navigation Satellite System (GNSS) and other navigation sensor measurements to investigate system integrity, availability and continuity of service aspects in order to contribute to the safety regulation of GNSS. The required regular data recording started mid-1997 onboard a LUFTHANSA Airbus A and will soon be extended to an LH A321 and a BRITISH AIRWAYS Boeing B For subsequent data evaluation the SAPPHIRE Database Update & Access Unit (DUAU) is now operational in its Phase I to evaluate the satellite navigation performance onboard of commercial airliners in the operational environment. The system extension into Phase II, mainly concentrating on Failure Detection & Identification by RAIM & AAIM algorithms is currently under development. In its Phase III the DUAU is planned to provide the core for s EGNOS Operational Test & Validation Programme. Within this report important aspects of the data evaluation process are outlined, in order to explain how the presented results have been derived and which assumptions and navigation performance requirements have been applied. The database contents which provide the basis for this report are described before first results concerning the availability of accuracy and of RAIM Detection are presented. The identified outages in availability are analysed in detail to identify why the navigation service was not available at all times onboard the aircraft. However, the initial results clearly demonstrate the high level of GPS RAIM availability, although they are not yet representative in a statistical sense for all phases of flight as outlined in the preliminary conclusions (chapter 10). ix

10 INTENTIONALLY LEFT BLANK x

11 1. INTRODUCTION 1.1 GENERAL This report presents first results on the availability of Receiver Autonomous Integrity Monitoring (RAIM) for satellite navigation receivers installed onboard of commercial aircraft. These are the first results which have been derived from the flight trial programme SAPPHIRE (Satellite & Aircraft Database Programme for System Integrity Research). The objective of this programme is to develop a statistically representative database of regular Global Navigation Satellite System (GNSS) and other navigation sensor measurements to investigate system integrity, availability and continuity of service aspects in order to contribute to the GNSS safety regulation process. The data evaluation process is explained together with the set of navigation performance requirements which will be initially used before first results are presented and discussed. 1.2 POLICY At its 175th Session, in March 1994, the Committee of Management approved the Satellite Navigation Strategy. This Strategy is based on four objectives for satellite navigation: It has to be ultimately a sole-means system; It must be global for aviation; It must be multi-modal; Early benefits must be achieved. The aim of the Strategy is to ensure that GNSS is introduced in the ECAC States in a safe and cost-beneficial manner. SAPPHIRE is s principle programme for demonstrating the safety, or otherwise, of GNSS in the operational environment. At their fourth meeting on air traffic matters, on 9-10 June 1994 in Copenhagen, the ECAC Transport Ministers instructed, the European Union, the European Space Agency and Member States to: develop and pursue jointly proposals for a European component of an initial global satellite system for navigation; and to take appropriate action to place Europe in a position to contribute to the next generation of global civil satellite navigation systems. The experience gained from SAPPHIRE will put in a strong position to contribute to the development of safety and user requirements for forthcoming GNSS implementations. 1.3 OVERVIEW The Global Positioning System (GPS), as the building block for a first-generation Global Navigation Satellite System (GNSS), is being installed on commercial transport aircraft. The position-fixing accuracy of GPS is known and will easily meet the requirements of the en-route phase of flight, including Basic and Precision area navigation (RNAV). If GPS, and a GNSS subsequently based on it, is to become a sole means system - which is an objective of the Satellite Navigation Strategy - it also has to satisfy integrity, availability and continuity of service requirements which, with accuracy, make up the Required Navigation Performance (RNP) parameters. 1

12 Signals from GPS are continuously transmitted from a constellation of satellites orbiting at 20,000 kilometres above the Earth. Since aircraft are also moving this means that the navigation solution is calculated exclusively from moving vehicles whose relative geometry changes extremely rapidly. This is a radical change from traditional navigation techniques using fixed ground transmitters. If aircraft bank, for example, they may lose lock on one or more satellites. Furthermore, satellites are continuously rising and setting at different positions relative to the aircraft. Investigations based on simulations and data collections at static ground positions can reveal considerable information about the performance of GPS but they do not include effects introduced by the dynamic airborne environment which remain unknown. To have a complete picture of the performance an airborne data recording campaign - satisfying statistical requirements - was vital. Airlines can be expected to seek benefits from their investments in GPS and GNSS technology. Due to technical and institutional limitations, operational approval for the use of GPS in the ECAC States is heavily restricted, thereby limiting the amount of benefit that the airlines can gain. A number of short airborne campaigns to evaluate GPS performance have been carried out by some States but these would appear to have concentrated on particular aspects of GPS performance, such as during approach and landing, rather than a more general assessment. Indeed, European certification material is largely based on that provided by the United States Federal Aviation Administration. The ECAC States have not been in a position to carry out a full, independent assessment of what will be a major component of their navigation infrastructure early in the 21st Century. This would further handicap the airlines use of satellite navigation technology. It is understandable therefore that with the increasing number of GPS-equipped aircraft the aviation community has been anxious to see that GPS and, subsequently, GNSS be certificated for civil aviation applications as quickly as possible. The most demanding question to be answered for certification would clearly be: Can Satellite Navigation meet the Required Navigation Performance parameters of Accuracy, Integrity, Availability and Continuity of Service for it to be approved and certificated as safe for sole means operational use in civil aviation? Although the accuracy of satellite navigation has already been demonstrated experimentally in the airborne environment for all phases of flight, there has been no definitive demonstration, either theoretically or in flight trials, that it can meet the four RNP parameters simultaneously. To remedy this situation, it was therefore vital to obtain a comprehensive database of measurement samples recorded in an operational airborne environment from various receiver types and covering short-, medium- and long haul operations. Subsequent statistical analysis would establish whether all four RNP parameters could be met simultaneously and for what length of time. Such information would be vital for the validation of ICAO Standards And Recommended Practices (SARPs) covering GNSS and would be sought by the national certification authorities for their safety regulatory procedures. Consequently, the Member States and the Agency have been working, through the EATCHIP Satellite Navigation Applications Group, to initiate a programme addressing the above question and have co-operated in establishing the programme which has become known as SAPPHIRE (Satellite & Aircraft Database Programme for System Integrity Research). 2

13 2. OBJECTIVES The general objectives of the SAPPHIRE Programme are to: SAPPHIRE PART I - Commercial Airliner Data Recording support the States and the Joint Aviation Authorities (JAA) in their campaign to carry out the safety regulation of GNSS; harmonise national projects for the recording and analysis of GNSS data; provide a central facility to process onboard GNSS data recordings; support the work programme of the Satellite Navigation Applications (SNA) Group within EATCHIP; support the input of ECAC States to the ICAO GNSS Panel via the SNA Group; contribute to two of s commitments within the European Tripartite Group, namely EGNOS operational test and validation, and GNSS safety regulation support. LUFTHANSA A LUFTHANSA A321 BRITISH AIRWAYS B DGPS Reference Stations (Local Area & Racal SkyFix) PART II - Database Update & Access Unit PHASE I Evaluation of Satellite Navigation Performance in the Operational Environment PHASE II Failure Detection & Identification by RAIM & AAIM Algorithms PHASE III Core for EGNOS Test & Validation Programme Figure 1-1: SAPPHIRE Programme SAPPHIRE will contribute to the certification of GNSS by providing statistical evidence about the performance of satellite navigation systems in the airborne environment [1]. The Programme is divided into two major parts as shown in Figure 1-1: (i) the data recording onboard commercial airliners and (ii) the development and operation of the analysis tool - the Database Update & Access Unit (DUAU) - whose development is carried out in three Phases. 2.1 DATA RECORDING To serve the purposes of the data evaluation activities foreseen within SAPPHIRE, data recordings had to be set up onboard of commercial airliners. A mix of different aircraft types had been anticipated to satisfy requirements of different operational scenarios and different onboard equipment. To introduce a common SAPPHIRE data recording format an interface control document [3] was established. It describes in detail the raw measurements and computed data which are needed to be recorded from the satellite navigation sensors and the inertial sensors. Additional data from various other sensors such as the air data computer, Instrument Landing System (ILS) and Distance Measurement Equipment (DME) are included to provide a comprehensive description of the aircraft status vector. It was decided, in view of s future EGNOS activities, to include readings from available satellite communication (SatCom) equipment which will deliver indications about the reception conditions of geostationary satellites onboard these aircraft. 2.2 DUAU PHASE I In its first phase the data evaluation is focused on investigating the capability of satellite navigation to provide the required accuracy and to be able to perform integrity monitoring (RAIM Availability) in the operational environment. The statistical analyses are carried out as a function of theoretical and measured satellite visibility, taking into account the geometry of the local constellation. 3

14 2.3 DUAU PHASE II The development of the DUAU in its second phase will focus on the analysis of the performance of different Receiver Autonomous (RAIM) and Aircraft Autonomous Integrity Monitoring (AAIM) algorithms for system failure detection & identification. The database will be extended to handle data from additional aircraft and to interface with GLONASS and EGNOS receivers once these are available. A module will be included which can simulate realistic GNSS and INS error scenarios for performance test purposes. Finally, the hardware platform will be upgraded and provisions for a distributed database system will be implemented to allow the combination of results which may be generated by independent DUAUs. 2.4 DUAU PHASE III In its third development phase the SAPPHIRE DUAU shall provide the core module for s task within the European Tripartite Group to test and validate the European Geostationary Navigation Overlay Service (EGNOS) [2]. Recently, discussions have explored extending the scope of the SAPPHIRE programme at the request of national air traffic service providers and civil aviation authorities to enable more comprehensive investigations into the precision approach phase of flight. This would be a major step in the fulfilment of the Gate-to-Gate strategy for as agreed at the fifth meeting of ECAC Transport Ministers on the Air Traffic System in Europe, Copenhagen, 14 February The following sections concentrate on the data evaluation within SAPPHIRE Phase I. 2.5 GLOSSARY AAIM ACMS ADR CAA DGPS DMC DME DMU DUAU EATCHIP ECAC EGNOS ESA GEO GLONASS GNSS GPS GPSSU ICAO ILS IRS JAA RAIM RNP SARPs SDP SEU SNA SV URP Aircraft Autonomous Integrity Monitoring Aircraft Condition Monitoring System Air Data Reference Civil Aviation Authority Differential GPS Data Monitoring Computer Distance Measurement Equipment Data Management Unit Database Update & Access Unit European Air Traffic Control Harmonisation and Integration Programme European Civil Aviation Conference European Geostationary Navigation Overlay Service European Space Agency GEOstationary Satellite Global Orbiting Navigation Satellite System Global Navigation Satellite System(s) Global Positioning System GPS Sensor Unit International Civil Aviation Organisation Instrument Landing System Inertial Reference System Joint Aviation Authorities Receiver Autonomous Integrity Monitoring Required Navigation Performance Standards and Recommended Practices Software Development Phase Software Engineering Unit Satellite Navigation Applications Space Vehicle User Requirements Phase 4

15 3. ORGANISATIONAL STRUCTURE LUFTHANSA was identified as the initial partner to record data for SAPPHIRE, because the German airline was taking delivery of some of the first commercial aircraft - Airbus A340 s and A321 s - to have GPS receivers already included in their standard avionics fit. The regular data recording onboard the LH A commenced in April In addition BRITISH AIRWAYS have subsequently equipped one of their Boeing B for SAPPHIRE data recording. Dornier Satellite Systems GmbH (DSS) was awarded the contract to design and develop the data evaluation software - known as the Database Update & Access Unit (DUAU) - with scientific support from the Institute of Flight Guidance at the Technical University of Braunschweig. In addition, a number of companies have made significant contributions of equipment and engineering advice. The responsibilities of each organisation are as follows: (Project lead / data evaluation / co-operation with civil aviation authorities), LUFTHANSA (A /A321 installation/operation), LITTON Aero Products (inertial system/gps), AlliedSignal/Dassault (in-flight recording system), DORNIER (Database Update and Access Unit: user requirements & software development), Technical University of Braunschweig (scientific support) RACAL Survey (DGPS ground reference station network), Deutsche Flugsicherung GmbH (DGPS station at Frankfurt/Main airport), BRITISH AIRWAYS (Boeing B installation/operation). 4. AIRCRAFT INSTALLATION AND DATA RECORDING Figure 4-1 presents the hardware setup onboard the A340 and A321. All systems providing the required sensor data are connected to a dedicated Data Management Unit (DMU) via ARINC 429 data busses; the DMU then forwards the data to an Optical Quick Access Recorder (OQAR) via an ARINC 573 data bus. The GPS Sensor Unit (GPSSU) and Satellite SatCom information are of initial interest for the system integrity, availability and continuity of service investigations during the first phase of DUAU operation. These recordings are complemented by readings from IRS and diverse sensors to provide all required information needed during the second phase of DUAU operation. Figure 4-1: Aircraft Installation (A340/321) The recordings onboard the aircraft will be accompanied by GPS ground reference station recordings obtained on an occasional basis from the RACAL SkyFix world-wide monitor station network and on a regular basis from a local monitor at Frankfurt/Main airport. By post-processing the airborne GPS data with the differential corrections, experience will be gained for the future real-time application of this technique to improve accuracy and integrity of the position calculation onboard the airliners. 5

16 5. DATABASE UPDATE & ACCESS UNIT 5.1 BACKGROUND The data evaluation objectives and the major software design criteria and constraints were developed as a result of discussions with European civil aviation authorities about their requirements for a future GNSS safety regulation process. As a result, data processing during the first phase of DUAU operation concentrates on determining the satellite navigation system performance with respect to the following qualifiers : Accuracy, Integrity, Availability and Continuity of Service. Related qualifiers will be tested against minimum requirements according to the phase of flight. The onboard and ground recordings also provide the additional parameters needed during the second DUAU phase to investigate the system performance with respect to failure detection and identification by Receiver and Aircraft Autonomous Integrity Monitoring (RAIM/AAIM) algorithms. Furthermore, the software which is used to access the database is of a modular design to allow for additional integrity monitoring algorithms be tested on request. The processing core for this programme is the Database Update & Access Unit (DUAU). The DUAU has been developed around an ORACLE database system and was delivered to s specifications as a turnkey system comprising all required soft- and hardware. Its functions and operations are explained in more detail in Figure 5-1. The data recorded onto the optical discs onboard the aircraft and - on an occasional basis - in the ground reference stations will be read into the Database Update & Access Unit (DUAU) for conversion into engineering units, formatting and quality control. Subsequently the data are loaded into the relevant tables of the database system and the operator can start the data evaluation process. Usually a standard set of evaluations is carried out to provide the operator with basic results before he can access the database for individual investigations. The following sections introduce the strategy which has been developed to evaluate the system performance for three different satellite visibility scenarios. It is explained in detail how Accuracy and Integrity Qualifiers have been defined, how they finally have been realised by algorithms and how the results will be presented. The chapter closes with tables presenting the Required Navigation Performance Parameters which will be initially used within SAPPHIRE. 5.2 DATA EVALUATION PHASE I Visibility Scenarios The Accuracy, Integrity and Availability Qualifiers describing the performance of the satellite navigation system are dependent on the relative geometry Figure 5-1: Database Update & Access Unit 6

17 between the aircraft antenna and the satellite constellation as described by (i) the aircraft position and attitude and (ii) the satellite elevations and azimuths. In this context it is understood that Availability is given if, and only if, the Accuracy and Integrity Qualifiers both meet their relevant requirements. The Qualifiers are determined for three visibility scenarios: Theoretical visibility: All user-selected GPS and geostationary Inmarsat (GEO) satellites are taken into consideration, in order to establish whether or not they would be theoretically visible from the aircraft s position (which is considered to be a point in space). Theoretical dynamic visibility: The same information as above is generated, but an aircraft antenna model and the measured aircraft attitude are taken into consideration to determine theoretical signal reception. Measured visibility: Satellites are only considered visible when related status bits and/or available GPS and GEO measurements indicate the successful signal reception in the real environment. The satellite navigation system performance within these three visibility scenarios is investigated in order to obtain information about the combined influence of aircraft dynamics and the real operational environment on the quality of reception of satellite navigation signals. The database is used to assess whether these qualifiers meet the required navigation performance for Accuracy, Integrity and Availability as defined by the operator for different phases of flight. Availability performance along continuous flight tracks will be checked to establish whether this Qualifier meets its requirements during a time defined as the minimum Time of Continuity. The following sections provide details of the data evaluation with respect to Accuracy, RAIM Availability and RAIM Detection & Identification which will be carried out during the operation of Phases I and II of the DUAU Accuracy To define the Accuracy Qualifier a concept has been adopted which has been proposed in [4]. The maximum horizontal and vertical position errors are estimated from the expected measurement noise and the geometry of the current satellite constellation. Therefore, these calculations are solely dependent on the combined influence of the geometry of the local constellation and the range error and can be derived either from an empirical model or using actual measurement data. RNP for ACC Ground Departure Enroute Terminal Initial App. NPA CAT I hor/vert CAT III hor/vert range error hor. accuracy limit vert. accuracy limit ACC RESULT 0: not computed (<4 SV) 1: exceeds limit (=4 SV) 2: within limit (=4 SV) 3: exceeds limit for full constellation 4: within limit for full constellation exceeds limit for subset constellation 5: within limit Figure 5-2: Accuracy Evaluation 7

18 On the left hand-side of Figure 5-2 the input parameters are displayed which describe the Required Navigation Performance for the different phases of flight related to accuracy. The results of the evaluation are classified into six different result classes as given in Figure 5-2. The accuracy requirements are considered as being fulfilled without redundancy if the result is within classes 2, 4 or 5. If, in the case of a detected faulty satellite, the requirements have still to be fulfilled by a remaining sub-set of satellites, only a result in class 5 fulfils the requirements RAIM Detection Availability The initial step to evaluate the performance of the RAIM algorithms is to decide whether RAIM Failure Detection can be carried out depending on the geometric constellation of the visible satellites. The RAIM Detection procedure requires, therefore, sufficiently performant sub-sets of satellites, the sub-sets being generated by successively excluding individual satellites from the set of visible satellites. The performance of the resulting sub-sets is described by the decrease in quality of the satellite constellations Horizontal and Vertical Dilutions of Precision (HDOP and VDOP), as one satellite at a time is sequentially excluded from the set of visible satellites. The maximum allowable limit of this geometric deterioration - that is, when the worst case satellite is excluded - is calculated from the following parameters: the probability of false alarm, the probability of missed detection, the protection limit for the position error, the range residual error and the total number of visible satellites. Three result classes have been defined (Figure 5-3) for the RAIM Availability Qualifier, class (2) representing the case where the current geometry of the satellite constellation is sufficient to start a reliable RAIM Detection procedure. In other words, all necessary pre-conditions have been met for the RAIM algorithm to detect that a single satellite has failed. In using models for the range error and the range residual error, the calculation of the Accuracy and RAIM Availability Qualifiers can be carried out based on the relative constellation of visible satellites with respect to the aircraft. This process is comparable to a pre-flight prediction of the system performance. By using pseudo-range measurements the real errors can be calculated and, thereafter, used as input to the Accuracy and RAIM Availability Qualifier evaluations. These two calculations - one based on error models the other based on real measurement data - RNP for RAIM AVA Ground Departure Enroute Terminal Initial App. NPA CAT I hor/vert CAT III hor/vert No of satellites RAIM AVA RESULT 0: not enough satellites (<5 SV) 1: geometry not sufficient 2: geometry sufficient limit for geometric deterioration Figure 5-3: RAIM Availability 8

19 allow for a comparison of the predicted and the achieved Accuracy and RAIM Availability performance RAIM Detection and Identification After RAIM Availability has been declared valid using the measured data, the performance of the following RAIM algorithms can be investigated: 1. M. Sturza / A. Brown [4] Constant False Alarm Rate (CFAR) Constant Probability of Missed Detection (CPOD) 2. MOPS Baseline Algorithm [5] Based on M. Sturza / A. Brown CFAR 3. M. Brenner [6] CFAR (CPOD possible) 4. R.G. Brown [7] Fault Detection & Identification (FDI) Fault Detection & Exclusion (FDE) Partial Identification The Required Navigation Performance with respect to RAIM FDI is described by those input parameters given in Figure 5-4, and which were previously discussed in section Results for RAIM FDI have been classified in accordance with the scheme in Figure 5-4. The three main result classes are: detection of a faulty satellite not reliable (0), detection reliable (1) and detection impossible (2). Class (1) is split into: detection occurred (3) and everything within specification (4). If detection occurred in the case of class (3) the evaluation continues with the identification process, which tries to identify which satellite is faulty. There are three possible results: RNP for RAIM FDI Ground Departure Enroute Terminal Initial App. NPA CAT I hor/vert CAT III hor/vert Probability of false alarm Probability of missed detection Position acc to be garanteed σ of pseudorange residual noise detection not reliable identification occurred RAIM FDI RESULT detection + + reliable detection occurred identification not occurred detection impossible within specification identification impossible Figure 5-4: RAIM Detection and Identification 9

20 identification of the faulty satellite occurred (5), identification not occurred (6) and identification impossible (7). The navigation performance requirements for RAIM Detection are fulfilled in the case of class (1) - detection reliable. Requirements are met for RAIM Detection and Identification for the combination of class (1) and class (5) - identification of the faulty satellite successfully occurred Input Parameters Table 5-1 and Table 5-2 summarise the required navigation performance parameters which have been chosen for the data evaluation explained in sections 5.2.2, and Horizontal Accuracy Limit [m] Vertical Accuracy Limit [m] Ground Departure Enroute Terminal Initial Approach NPA CAT I CAT III 815 [8] 7150 [8] 815 [8] 350 [8] 230 [10] 18 [8] 5 [8] 5 [8] 1 [8] Table 5-1: Required Accuracy Performance (Navigation System Error) Probability of False Alarm Probability of Missed Detection Horizontal Protection Limit [m] Vertical Protection Limit [m] σ of Pseudorange Noise [m] Ground Departure Enroute 5.6*10-7 [9] 5.6*10-7 [9] 1*10-3 [9] 1* [8,10] [9] Terminal 5.6*10-7 [9] 7408 [8] 1852 [8,10] Initial Approach 5.6*10-7 [9] NPA CAT I CAT III 5.6*10-7 [9] 1*10-3 [9] 1*10-3 [9] 1*10-3 [9] 926 [8,10] 556 [8,10] 5.6*10-7 [9] 9*10-8 [11] 5.6*10-7 [9] 1*10-9 [12] 111 [8] 17 [8] 32 [8] 5 [8] 33.3 [10] 33.3 [10] Table 5-2: Required RAIM Performance 33.3 [10] 33.3 [10] 33.3 [10] 1.77 [11] 1.77 [11] 10

21 6. SOFTWARE DEVELOPMENT A professional software lifecycle was adopted for the SAPPHIRE DUAU software development as proposed by the Software Engineering Unit (SEU) at the Experimental Centre. During software development this approach contributed to satisfying important quality factors such as: i. correctness, ii. expandability, iii. maintainability, iv. reliability and v. verifiability. Figure 6-1: Software Lifecycle This approach had been adopted with the views of European civil aviation authorities in mind, who are keen to make use of the data and the evaluation unit in their campaign to approve satellite navigation for operational use. The software must, therefore, meet certain standards which the adoption of the SEU s software lifecycle methodology would help to satisfy. The phases in the software lifecycle are graphically summarised in Figure 6-1. The main deliverables of the User Requirements Phase were the User Requirements Document (URD), the Software Acceptance Test Plan (SATP) and the Software Quality Assurance Plan (SQAP). They were the input to the Software Development Phase which started with the implementation of software specifications and finished with the Integration Testing. The final step before the Database Update & Access Unit became operational was the Provisional Acceptance Testing in which installed software and hardware were evaluated according to the Software Acceptance Test Plan. During all phases of the DUAU development the fact that the system has also been developed for applied research purposes was taken into account. As a result a modular system has been designed to allow frequent updates and modification driven by experiences gained during the operational phase. During the software development, major emphasis was put on the development of advanced system prototypes for validating and verifying the DUAU user requirements at an early stage on the one hand, and the onboard recording process on the other. Therefore, soon after the availability of the first onboard recordings, plausibility check prototypes were applied to the data. They helped to identify errors in the data recordings from onboard the LUFTHANSA A340. Subsequently, LUFTHANSA and AlliedSignal could efficiently correct and adjust the recording process until the prototype functionalities fully satisfied the user requirements. A second prototype was developed comprising functions to determine satellite visibility and dilution of precision for the three scenarios explained in section It also included a select and merge program to combine different data sets, and a graphic tool to display results. By using these prototypes was in the position to determine if the user requirements were correctly defined and, subsequently, correctly implemented by the software developers. In the subsequent development step the prototypes enabled the future users to carry out first investigations into the applicability of RAIM based on the constellation of visible satellites. 11

22 7. FIRST RESULTS ON AVAILABILITY OF RAIM DETECTION This chapter presents the first results obtained from the operational SAPPHIRE Database Update & Access Unit concerning the availability of RAIM Detection during the flights initially contained in the database. The size of the database is described and all parameters which are required to interpret the results are introduced and explained. After presentation of first statistics on the availability of RAIM Detection, outages in the availability are analysed and their reasons are explained. 7.1 DESCRIPTION OF DATABASE CONTENTS Flights included in the Database Latitude [degrees] Longitude [degrees] Figure 7-1: Trajectories of Flights in SAPPHIRE Database The database used for the presented results comprises 55 intercontinental flights of a LUFTHANSA Airbus A representing a total of 473 flight hours collected from 14/04/1997 to 24/05/1997. These represents the data collected during the first six weeks of operational data recording onboard the A340. Figure 7-1 displays the trajectories of these flights and Table 7-1 summarises their itineraries. 12

23 Number of Flights between 2 Frankfurt / FRA - Atlanta / ATL 4 Frankfurt / FRA - Bangkok / BKK 5 Frankfurt / FRA - Boston / BOS 6 Frankfurt / FRA - Dallas/Ft. Worth / DFW 3 Frankfurt / FRA - Madras / MAA 14 Frankfurt / FRA - New York / JFK 6 Frankfurt / FRA - Osaka / KIX 2 Frankfurt / FRA - Rio de Janeiro / GIG 1 Frankfurt / FRA - Sao Paolo / CGH 4 Frankfurt / FRA - Sao Paolo / GRU 2 Dallas/Ft. Worth / DFW - Houston / IAH 2 Dallas/Ft. Worth / DFW - New Orleans / MSY 4 Düsseldorf / DUS - New York / JFK Table 7-1: Itineraries of Flights in SAPPHIRE Database Phases of Flight All flights - when loaded into the database - were automatically split into phases of flight applying the rules summarised in Table 7-2. The right-hand column of this table indicates how many samples with a sampling rate of 1 Hz are currently included in the database (representing a total of 473 flight hours). A total of 294 samples have been excluded from the data evaluation due to recording problems identified by the quality control procedures carried out before loading the data into the database. These procedures apply plausibility checks to the raw data concerning their physically possible range and change versus time, their resolution and the consistency between measurements of different sensors. Those data samples which have been identified by the quality control procedures as being erroneous are manually checked by the system operator and have subsequently been marked in the database. The data remain in the database for traceability but they are not included in the statistical evaluation. This manual part of the procedure ensures that data are only excluded for known reasons, which are related to the recording equipment and not related to failures of the measurement equipment. Phase of Flight Rule Number of Samples Ground Groundspeed < 100 Kn. not investigated Departure Groundspeed > 100 Kn Altitude < 8000 ft En Route Altitude > 8000 ft Terminal Altitude < 8000 ft Distance to Airport > m Initial Approach Distance to Airport < m > 8500 m Final Approach (NPA) Distance to Airport Groundspeed < 8500 m > 100 Kn Table 7-2: Definition of Phases of Flight Scenarios The results presented in this report have been generated for the following three visibility scenarios: 13

24 15 10 Elevation Mask Angle [deg.] Azimuth [deg.] 0 at nose Figure 7-2: Combined Aircraft and Antenna Reception Diagram for the LH A Theoretical visibility: All satellites are taken into account which are visible at the aircraft s position considering a minimum elevation angle of 0 above the Earth s horizontal plane. Theoretical dynamic visibility: the same information as above is generated, but an aircraft model, an aircraft antenna model and the aircraft attitude are taken into consideration to determine satellite visibility. The combined aircraft and antenna reception diagram is displayed in Figure 7-2. Measured visibility: Satellites are only considered when successful signal reception has been confirmed. The LITTON LTN-2001 receiver installed onboard the LH A is limited to a maximum of 8 satellites. Rising satellites are considered from a minimum elevation angle of 2 onwards. Setting satellites are tracked even for small negative elevation angles as long as the Signal-To-Noise Ratio is above a certain threshold. For data evaluation, satellites are considered with a minimum elevation angle of 0 above the Earth s horizontal plane. 7.2 REMARK ON RESULTS All results presented in the following sections are still subject to validation since the Software Acceptance Test activities for the SAPPHIRE DUAU have not yet been finally completed; these include software validation and verification by. In particular the results for Initial and Final Approach are not yet representative: (i) they are only based on four accumulated flight hours during these phase of flight and (ii) its most stringent requirements cause differences between the measurements and the aircraft reception model to have impact on the results. This requires a detailed validation of the aircraft reception model - an activity already foreseen for SAPPHIRE Phase II. 7.3 AVAILABILITY OF ACCURACY Table 7-3 presents the availability of the accuracy for the three visibility scenarios and the different phases of flight based on the accuracy qualifier definition presented in section

25 Accuracy Measured Departure En Route Terminal Initial App. Final App. (NPA) Number of Samples (in sec) Available Available with redundancy Not computed (<4SV) Exceeds limits (=4SV) Within limits (=4SV) Exceeds limits (full const.) Within limit (full const.) & Exceeds limits (subset) Accuracy Theoretical Dynamic Departure En Route Terminal Initial App. Final App. (NPA) Number of Samples (in sec) Available Available with redundancy Not computed (<4SV) Exceeds limits (=4SV) Within limits (=4SV) Exceeds limits (full const.) Within limit (full const.) & Exceeds limits (subset) Accuracy Theoretical Departure En Route Terminal Initial App. Final App. (NPA) Number of Samples (in sec) Available Available with redundancy Not computed (<4SV) Exceeds limits (=4SV) Within limits (=4SV) Exceeds limits (full const.) Within limit (full const.) & Exceeds limits (subset) Table 7-3: Availability of Accuracy (Percentage of Time) For all visibility scenarios and during all phases of flight down to Non-Precision Approach the required accuracy (Table 5-1) is available. When requiring redundancy, meaning that accuracy shall be still available even when the worst-case satellite - whose exclusion would have the worst impact on the results - is excluded from the constellation, a slight drop in performance occurs for the measured visibility due to manoeuvring of the aircraft coupled with the limitation of the onboard receiver to 8 reception channels. These occurrences are subject to further investigations in section In that section, outages with respect to the availability of RAIM Detection are analysed and it can be assumed that availability outages of accuracy and RAIM Detection outages are caused by similar effects. The presentation of 8 significant decimals in Table 7-3 and Table 7-4 for the percentage-values may not be meaningful yet due to the limited amount of processed data, but this presentation will be required with the growing set of data comprised in the statistics and, in particular, with integrity requirements and Target Levels of Safety expressed to an order of magnitude of ANALYSES OF RAIM DETECTION AVAILABILITY Availability of RAIM Detection Table 7-4 presents the first results on the availability of RAIM Detection during the 473 flight hours loaded into the database. The main observations are: 15

26 RAIM Detection Measured Departure En Route Terminal Initial App. Final App. (NPA) Number of Samples (in sec) Sturza-Brown Available Not possible (<5SV) Not possible (geometry) Brenner Available Not possible (<5SV) Not possible (geometry) RAIM Detection Theoretical Dynamic Departure En Route Terminal Initial App. Final App. (NPA) Number of Samples (in sec) Sturza-Brown Available Not possible (<5SV) Not possible (geometry) Brenner Available Not possible (<5SV) Not possible (geometry) RAIM Detection Theoretical Departure En Route Terminal Initial App. Final App. (NPA) Number of Samples (in sec) Sturza-Brown Available Not possible (<5SV) Not possible (geometry) Brenner Available Not possible (<5SV) Not possible (geometry) Table 7-4: Availability of RAIM Detection (Percentage of Time) RAIM Detection is available during all phases of flight in the theoretical visibility scenario. As already stated in section 7.2, the results for Non-Precision Approach are currently not yet representative. No situation occurred where RAIM Detection was not available due to the fact that less than five satellites were visible. During 29 seconds (out of a total of 1,704,516 seconds) the receiver tracked 5 satellites only with RAIM Detection being available. Outages in RAIM Detection availability occur for the scenarios of measured and theoretical dynamic visibility. These outages are further analysed in section The availability of the RAIM Detection capability does not differ for algorithms according to M. Sturza / A. Brown [4] and to M. Brenner [6] except for 2 seconds during the Terminal phase of flight under theoretical dynamic visibility Analyses of Outages Outages Caused by Onboard Effects The detailed analyses of those occurrences where RAIM Detection capabilities were unavailable revealed that they can currently be classified into four different categories: A. RAIM Detection unavailable due to the receiver being limited to 8 reception-channels: In this category RAIM Detection has been identified as being unavailable due to the fact that the LH A onboard receiver hardware is limited to 8 reception channels. The receiverdependent choice of 8 satellites out of potentially more than 8 visible satellites is not optimal for RAIM Detection purposes as the receiver was designed for supplemental means only according to TSO C-129 C3. Furthermore, a satellite may become unusable due to shadowing, which limits the receiver - at least for several tens seconds - to 7 or less satellites, 16

27 Flightkey Scenario Length (in secs) Phase of Flight Outage Group Comment 5 Measured 29 En route D 5 Measured 14 Terminal A 5 Measured 22 Initial Approach A 5 Measured 2 Initial Approach A 13 Measured 85 Final Approach C 15 Theoretical Dynamic 1 Terminal B Brenner only 15 Theoretical Dynamic 1 Terminal B Brenner only 15 Theoretical Dynamic 3 Terminal B 28 Measured 3 Departure A 31 Measured 7 En route A 33 Measured 2 Final Approach B 33 Measured 8 Final Approach C 35 Measured 23 Departure A 35 Theoretical Dynamic 2 Departure B 42 Measured 1 Final Approach C 42 Measured 1 Final Approach C 42 Measured 1 Final Approach C 51 Measured 22 Final Approach D 54 Measured 2 Final Approach A Table 7-5: Outages in RAIM Detection Availability Visibility Scenario Total Number of Phase of Flight Measured Theoretical Dynamic Theoretical Recorded Samples Departure En route Terminal 14 3 (Sturza/Brown) (Brenner) Initial App Final App. (NPA) Table 7-6: Total Outage Time in RAIM Detection Availability (in secs.) although there may still be satellites visible which the receiver is not able to track. The effects of this category on RAIM Detection unavailability are therefore rather a design issue of onboard receivers than GPS limitations. This problem will be addressed when data from the B aircraft, which carries 16 channel receivers, are loaded into the database. B. RAIM Detection unavailable due to insufficient geometry of the satellite constellation: The receiver uses all available satellites but requirements during the final approach phase of flight cannot be met by the geometry of the satellite constellation. RAIM Detection availability cannot, therefore, be maintained. C. RAIM Detection unavailable due to channel limitations coupled with marginal geometry and tight requirements: This category contains those outages which are caused by a combination of the limitations mentioned under A and B. Satellites are not tracked at low elevation angles (< 5 degrees), the geometry is marginal and the requirements are tight because the aircraft is in the final approach phase of flight. D. Other Cases: These cases need further investigation and are listed here for completeness: En route: During one occurrence the receiver lost track of one satellite with 36 elevation and 359 azimuth (bodyfixed). The number of satellites expected by the receiver to be visible drops at the same time. Tracking of the satellite is re-acquired after 30 seconds. Final Approach: Loss of a satellite with 25 elevation and 165 azimuth. The number of satellites expected by the receiver to be visible does not change. The satellite is reacquired after 26 seconds. The same happens on another occurrence to a satellite with 34 elevation and 280 azimuth; re-acquisition occurs after more than 40 seconds. 17