A Subset-Reduced Method for FDE ARAIM of Tightly-Coupled GNSS/INS

The advanced receiver autonomous integrity monitoring (advanced RAIM, ARAIM) is the next generation of RAIM which is widely used in civil aviation. However, the current ARAIM needs to evaluate hundreds of subsets, which results in huge computational loads. In this paper, a method using the subset excluding entire constellation to evaluate the single satellite fault subsets and the simultaneous multiple satellites fault subsets is presented. The proposed ARAIM algorithm is based on the tight integration of the global navigation satellite system (GNSS) and inertial navigation system (INS). The number of subsets that the proposed GNSS/INS ARAIM needs to consider is about 2% of that of the current ARAIM, which reduces the computational load dramatically. The detailed fault detection (FD) process and fault exclusion (FE) process of the proposed GNSS/INS ARAIM are provided. Meanwhile, the method to obtain the FD-only integrity bound and the after-exclusion integrity bound is also presented in this paper. The simulation results show that the proposed GNSS/INS ARAIM is able to find the failing satellite accurately and its integrity performance is able to meet the integrity requirements of CAT-I precision approach.


Introduction
With the development of civil aviation, the number of aircraft in the same airspace increases greatly. Therefore, there is an increasing demand to improve flight efficiency. The global navigation satellite system (GNSS) is very important for flight efficiency improvement. However, the application of GNSS must be able to meet the stringent navigation performance requirements of civil aviation. The International Civil Aviation Organization (ICAO) specifies the navigation performance in terms of integrity, accuracy, continuity, and availability [1]. Integrity reflects correctness of a position solution and it is the ability of a navigation system to alert the users timely when the position errors exceeding specified requirements [2]. Integrity monitoring is very important to safeguard the safety of the crew and passengers [3]. Continuity is the ability of a navigation system to maintain the required performance. Both integrity and continuity are important for civil aviation to safeguard safety-of-life (SOL). The navigation performance requirements are determined by the flight phase, which contains en route, terminal, and approach. The Category-I (CAT-I) is a precision approach which needs reliable lateral and vertical guidance.
With the evolution of GNSS, there will be more navigation satellites broadcasting signals in two or more sub-bands in the aeronautical radio navigation satellite service (ARNSS) band. Using dual-frequency GNSS measurements, it is able to eliminate the ionospheric delay, which will greatly enhance the integrity and positioning accuracy and make it possible to achieve the precision approach relying on GNSS.

Number of Subsets of the Current ARAIM
The number of the subsets is determined by the prior probabilities of satellite fault and constellation fault which are provided in the integrity support message (ISM) [10]. Further, the ARAIM proposed a probability threshold, p thre , to bound the integrity risk (IR) coming from the unmonitored satellite fault subsets and unmonitored constellation fault subsets, and it is also presented in the ISM [8]. According to the number of failing satellites the subset contained, the fault subsets can be divided into multiple fault groups [28]. The zeroth-order fault group doesn't have the failing satellite and it is a fault free subset. Further, the first-order fault mode group contains single satellite fault subsets and single constellation fault subsets. In addition, the second-order fault group contains the simultaneous two satellites fault subsets, and one-satellite and one-constellation fault subsets. The probability of the group is the sum of the probabilities of all fault subsets in this group. Furthermore, if the sum of the probabilities of the group (e.g., first-order group) and its higher-order groups (e.g., second-order group, third-order group, and so on) is smaller than the p thre , all the fault subsets in this group and its higher-order group need no monitoring. Otherwise, all the fault subsets in this group need to be monitored.
We will denote the prior probability of satellite i fault and the prior probability of constellation i fault as p sat,i and p const,i , respectively. The prior probability of fault free subset (zeroth-order group) is given by [29]: where N sat is the number of available satellites, N const represents the number of available constellations. The sum of the probabilities of the first-order group and its higher-order fault mode groups is given by [29]: p rm,1 = 1 − p rm,0 Similar to the above formula, the sum of the probabilities of the second-order group and its higher-order groups is given by [29]: The total probability of the third-order group and its higher-order groups is given by [29]: To reduce the computational burden, the method to obtain the upper bound of the probability of the group is provided. The probability upper bound of the r th − order group and its higher-order groups is given by [29]: If p rm,r ≥ p thre and p rm,r+1 < p thre , the ARAIM only monitors the subsets in the r th − order group and its lower order groups.
In general, we only need to monitor fault free mode, first-order fault modes, and second-order fault modes. Suppose there are N const constellations, then there are (N const − 1)N sat one-satellite and one-constellation out fault subsets, N sat single satellite faults, and N sat (N sat − 1)/2 simultaneous two satellites fault subsets. Then the total number of subsets is given by: The total number of first-order and second-order subsets is presented in Table 1. The number is obtained based on the Global Positioning System (GPS) and the BeiDou Navigation Satellite System (BDS) two constellations. Table 1 shows that there are hundreds of subsets the current ARAIM needs to evaluate. Meanwhile, the computational load of each subset is almost the same as that of one complete positioning process. Therefore, the computational load of the current ARAIM is so high that it is unpractical for the current ARAIM to applicate in the airborne receiver [30].

Number of Subsets of the Proposed ARAIM
As the computational load is linear to the number of subsets, reducing the number of subsets is essential for reducing computational load. However, reducing subset always degrades the integrity performance [28]. On account of the integrity requirements of CAT-I being tight for the GNSS alone ARAIM, the integrity performance of the subset-reduced GNSS alone ARAIM is not always able to meet CAT-I requirements. Meanwhile, almost all aircraft have high-performance INS on board. Therefore, a subset-reduced GNSS/INS ARAIM is proposed to reduce the number of subsets while ensuring that the ARAIM is able to meet the requirements of CAT-I. The proposed algorithm is suitable for two-constellation scenarios, three-constellation scenarios, and four-constellation scenarios. For clarity and without loss of generality, the proposed method is presented in two-constellation scenarios involving GPS and BDS. It can be easily extended to other scenarios. For two-constellations scenarios, ARAIM needs to monitor the zeroth-order fault free group, first-order fault mode group, and second-order fault mode group. As the probability of INS fault is far smaller than the probability of satellite faults, the INS fault is neglected.
We denote the state estimate obtained by INS and all-in-view GPS/BDS satellites asx k,0 . WE name the state estimate obtained by the INS and all-in-view GPS asx k,1 , which is also named BDS-out fault subset. The state estimate by the INS and all-in-view BDS satellites is namedx k,2 , which is also named GPS-out fault subset. We denote the a priori position estimate asx k,3 which is also named the GPS-and-BDS-out fault subset. Furthermore, the prior probability of fault free subset is given by: where the p const,GPS and p const,BDS is the prior probability of GPS constellation fault and BDS constellation fault, respectively. The probability of the BDS-out fault subset is given by: where N BDS represents the number of available BDS satellites. In addition, the prior probability of the GPS-out fault subset is given by: where N GPS represents the number of available GPS satellites. Furthermore, the prior probability of the GPS-and-BDS-out fault is given by: The BDS-out fault subset can evaluate the single BDS out fault modes, simultaneous two individual BDS satellites out fault modes, and BDS constellation out fault mode. The GPS-out fault subset can monitor the single GPS out fault modes, simultaneous two individual GPS satellites out fault modes, and GPS constellation out fault mode. The GPS-and-BDS-out fault subset can evaluate the single BDS satellite and single GPS satellite out fault modes, single BDS out and GPS constellation out fault modes, single GPS satellite out and BDS constellation out fault modes. That means the new four fault subsets are able to monitor the zeroth -order, first-order and second-order subsets of the current ARAIM. Table 2 presents the comparison of the number of subsets of the current ARAIM and the subset-reduced ARAIM. It is easy to find that the number of subsets of the subset-reduced ARAIM is about 2% of that of the current ARAIM, which reduces the computational burden dramatically. The proposed subset-reduced GNSS/INS ARAIM consists of two-part, fault detection and fault exclusion. The overview flow diagram of the ARAIM is presented in Figure 1. The protection level (PL) and alert limit (AL) in this figure represent the protection level and alert limit, respectively. Furthermore, the detailed FD and FE process of the proposed subset reduced ARAIM is presented in the following Sections 4 and 5, respectively.

Fault Detection of Subset-Reduced GNSS/INS ARAIM
As shown in Section 3, the subset-reduced ARAIM is also based on MHSS, then the fault detection statistics are the difference between the , and the , ( = 1,2,3). There a detection test using the pseudorange residuals of the GNSS measurements is added to improve the accuracy of detecting failing satellites. As the continuity risk is mainly from the false alarm [18], the thresholds of the fault detection test are determined by the continuity requirements. As there are two fault detection tests and each of them can cause a false alarm, it is assumed that the continuity risk coming from the two-fault detection test is equal. The continuity risk requirement of CAT-I is 8 × 10 /15s. To be conservative, the continuity risk allocation to the false alarm is set to 4 × 10 /15 [8]. Then half of the false alarm probability, i.e. 2 × 10 /15 is allocated to the MHSS fault detection and the other half is allocated to the pseudorange residual fault detection.

MHSS Fault Detection Test
As the state estimate of last epoch is the same for all the subsets, the MHSS fault detection statistic of the subset ( = 1,2,3) is given by: where , is Kalman gain of the subset at epoch , and it is given by [31]: where | , is the error covariance matrix of a priori state estimate. Further, it is given by [31,32]: where ∅ is the state transition matrix which translates the last epoch state estimate to the current epoch a priori state estimate.
, is the error covariance matrix of the state estimate of last epoch. In addition, is the covariance matrix of the process noise. , is the geometry matrix which translates the state error to the pseudorange error and pseudorange rate error.
, is the geometry matrix of the subset , and it is obtained by:

Fault Detection of Subset-Reduced GNSS/INS ARAIM
As shown in Section 3, the subset-reduced ARAIM is also based on MHSS, then the fault detection statistics are the difference between thex k,0 and thex k,i (i = 1, 2, 3). There a detection test using the pseudorange residuals of the GNSS measurements is added to improve the accuracy of detecting failing satellites. As the continuity risk is mainly from the false alarm [18], the thresholds of the fault detection test are determined by the continuity requirements. As there are two fault detection tests and each of them can cause a false alarm, it is assumed that the continuity risk coming from the two-fault detection test is equal. The continuity risk requirement of CAT-I is 8 × 10 −6 /15s. To be conservative, the continuity risk allocation to the false alarm is set to 4 × 10 −6 /15s [8]. Then half of the false alarm probability, i.e., 2 × 10 −6 /15s is allocated to the MHSS fault detection and the other half is allocated to the pseudorange residual fault detection.

MHSS Fault Detection Test
As the state estimate of last epoch is the same for all the subsets, the MHSS fault detection statistic of the subset i (i = 1, 2, 3) is given by: where K k,i is Kalman gain of the subset i at epoch k, and it is given by [31]: whereP k|k−1,0 is the error covariance matrix of a priori state estimate. Further, it is given by [31,32]: where ∅ k−1 is the state transition matrix which translates the last epoch state estimate to the current epoch a priori state estimate.P k−1,0 is the error covariance matrix of the state estimate of last epoch. In addition, Q k is the covariance matrix of the process noise. H k,0 is the geometry matrix which translates the state error to the pseudorange error and pseudorange rate error. H k,i is the geometry matrix of the subset i, and it is obtained by: where E i is an identity matrix except that the diagonal elements corresponding to the satellites on the hypothetical fault list of subset i are replaced by zero. R k,i is the covariance matrix of the GNSS measurement errors of subset i. It is obtained by: It is easy to obtain the covariance matrix of the fault detection statistics, which is given by: The fault detection of ARAIM is focused on the position domain [33]. Then a matrix is constructed to extract the position part from the state estimate. The position domain MHSS fault detection statistics and their corresponding covariance matrix are rewritten as: where matrix A is used to extract the needed position part from the state estimate, and it is defined by: In addition, the MHSS fault detection threshold of subset i in the q direction is given by: where q = 1, 2, and 3, denote the east, north, and vertical components of the threshold, respectively.
The Ω MS,FD,k,i,q is the q th diagonal element of Ω MS,FD,k,i . Furthermore, the factor κ MS,q is defined by: where Q is the complement of the zero-mean cumulative standard normal distribution function, and it is defined by: where Q −1 is the inverse function of the above formula. The p FA_HOR_MS and p FA_VERT_MS are the false alarm probability allocations to the MHSS fault detection test in the horizontal and vertical direction, respectively.

Residual-Based Fault Detection Test
To improve the accuracy of detecting fault, pseudorange residual fault detection is introduced. The pseudorange residuals are the difference between the pseudorange measurements and the predicted pseudorange based on the state estimate,x k,0 . We can extract the position part ofx k,0 , and name it aŝ x k,0,pos . Then the pseudorange residuals are given by: where G W is the weighted geometry matrix, which is able to translate the position estimate to the pseudorange. E FD,k is a N sat − dimensional vector. z k is pseudorange measurement and it can be modelled as: Substituting Equation (23) into the Equation (22), E FD,k can be rewritten as: where n k is the pseudorange noise vector, which is assumed to be a Gaussian white noise sequence. Then covariance matrix of E FD,k is obtained by: where R k,0 is the covariance matrix of noise n k .P k,0,pos is the covariance matrix of the position error vector ∆x k,0,pos . Then the residual-based fault detection statistic at epoch k is obtained by: The fault detection statistic is a chi-square distribution with a degree of freedom of N sat . The corresponding fault detection threshold is given by: where Q −1 Chi is the chi-square inverse cumulative distribution function. Further, p FA,RD is the false alarm probability allocations to the residual-based fault detection test.
To show the accuracy of the fault detection, FD results in two cases are presented. In the first case, a 20-m bias is added on the pseudorange of the first satellite of the available GPS satellites during the 150th minute to 200th minute period. In the second case, a 15-m bias is added on the third satellite and fifth satellite (randomly selected) of the available GPS satellites during the 150th minute to 200th minute. The other simulation parameters are presented in Table 3. The aviation-grade INS simulation parameters are referred to in [31,34,35]. In addition, the GNSS simulation parameters are referred to in [1,11]. In Table 3, the gyro time constant and the accelerometer bias time constant are the correlation time of the first-order Markov bias of the gyro and accelerometer, respectively. Furthermore, the approach in Table 3 is one of the flight phases, and it is always set to 150 s. The hazardous monitoring information (HMI) and Effective Monitor Threshold-I (EMT-I) are defined in Sections 4.3 and 6.1, respectively. Figures 2 and 3 present the FD test statistics and the corresponding thresholds in the first and second cases, respectively. The results show that the MHSS FD is not always able to find the pseudorange error. The reason why the MHSS FD can't detect these pseudorange errors is that this pseudorange error and the dilution of precision of this satellite is so small that they do not cause the position error exceeding the threshold at the current epoch. The results in Figures 2 and 3 also show that the pseudorange residual fault detection test is able to detect this pseudorange bias. The results show that the fault detection test of the proposed ARAIM is able to find the bias accurately.

Integrity Monitoring without Fault Being Detected
If all the fault detection statistics are lower than the corresponding fault detection thresholds, the integrity monitoring is started. The protection level (PL) is the integrity bound at position domain and it is always used to evaluate the integrity performance of the navigation system. The hazardous monitoring information (HMI) probability refers to the probability that position error caused by the undetected fault exceeds the specified alert limit (AL) of CAT-I. Similar to the integrity risk bound computing process of the current ARAIM [8], the bound of the actual integrity risk (IR) in the direction at epoch ,

Integrity Monitoring without Fault Being Detected
If all the fault detection statistics are lower than the corresponding fault detection thresholds, the integrity monitoring is started. The protection level (PL) is the integrity bound at position domain and it is always used to evaluate the integrity performance of the navigation system. The hazardous monitoring information (HMI) probability refers to the probability that position error caused by the undetected fault exceeds the specified alert limit (AL) of CAT-I. Similar to the integrity risk bound computing process of the current ARAIM [8], the bound of the actual integrity risk (IR) in the direction at epoch ,

Integrity Monitoring without Fault Being Detected
If all the fault detection statistics are lower than the corresponding fault detection thresholds, the integrity monitoring is started. The protection level (PL) is the integrity bound at position domain and it is always used to evaluate the integrity performance of the navigation system. The hazardous monitoring information (HMI) probability refers to the probability that position error caused by the undetected fault exceeds the specified alert limit (AL) of CAT-I. Similar to the integrity risk bound computing process of the current ARAIM [8], the bound of the actual integrity risk (IR) in the q direction at epoch k, p FD,HMI,k,q , is obtained by: where PL FD,k,q is the protection level in the q direction at epoch k. The p k,i is the prior probability and it is given by Equation (7) through to (10). Further, q = 1, 2, and 3 denotes the east, north, and up components of PL, respectively. In addition, σ k,i,q is the q direction component of the σ k,i , i.e., q th diagonal factor of the σ k,i . σ k,i is the position part ofP k,i , the covariance matrix ofx k,i . It can be obtained by [8]:P where K k,i , H k,i , andP k|k−1,0 can be obtained by Equations (12)- (14), respectively. b nom,k,i,q is the impact of the nominal bias on the position solution of the subset i. It is obtained by: where K k,i,q is the q th row of the K k,i which is defined by Equation (12). b nominal,k is the nominal bias which is defined in [10]. PL FD,k,q can be obtained by making the integrity risk bound expressed by Equation (28) where the right part of the Equation (31) is the integrity risk threshold allocation to q direction. p HMI represents the total HMI probability requirement. And p HMI,q means the HMI probability allocation to the q direction. p not monitored is the HMI probability coming from the subsets that do not need to be monitored [29]. Furthermore, the PL FD,k,q solution of Equation (31) is the FD only (without fault detected) protection level in the q direction.
If the FD only integrity bound, PL FD,k,q , is not able to meet the PL requirement of CAT-I, the receiver alerts the user to abort the approach. If any subset fails the FD test, the fault exclusion process is started.

Fault Exclusion of Subset-Reduced ARAIM
The goal of the fault exclusion test is to identify the failing satellite accurately and to continue providing positioning services after exclusion. Fault exclusion algorithm contains two parts: the fault exclusion test and the integrity performance evaluation after exclusion.

Fault Exclusion Test
The difference between the pseudorange measurements and the pseudorange prediction based on the a priori position estimatex k,3 is used as the fault exclusion statistics. The pseudorange residual of satellite j is given by: where G w is defined in (22).x k,3,pos is the position part ofx k, 3 . In addition, Γ j is used to extract the j th element of the pseudorange residual vector. Γ j is a vector whose elements are all zeros except that the j th element equals one. It is defined by: Furthermore, the pseudorange z k contains the true distance between the true position and the satellites as well as the pseudorange noise. Given this, it can be modelled as: z k = G w x k,pos + n k = G wxk,3,pos + G w x k,pos −x k,3,pos + n k = G w ∆x k,3,pos + G wxk,3,pos + n k (34) where x k,pos is the true position. Substituting (34) into (32), the fault exclusion statistic of the satellite j is obtained by: where Ω FE,k,j is the standard deviation of Ps FE,k,j . Substituting Equation (34) into Equation (32), then Ω FE,k,j is obtained by: whereP k|k−1,3,pos is the position part of the covariance matrix of the a priori state estimate of the subset three. It is easy to get that E FE,k, j is normal Gaussian white noise. Then the threshold of the fault exclusion statistic of the satellite j is obtained by: where Q is defined in Equation (21) and p FE is the probability of wrong exclusion. If the subset exceeding the FD threshold contains the satellite failing to pass the FE test, the receiver will continue providing the navigation services after excluding the identified satellite. Otherwise, the receiver alerts the user to abort the approach.  Figure 4a-d present the FE test results of all available satellites within the 160th minute through to the 190th minute in the first case. From the results, it is easy to find that the statistics exceeding the threshold are always coming from the first GPS satellite which the bias is added on. Figure 5a-d present the FE test results in the first case over all time. From these results, it is easy to find that the FE test is able to find the failing satellite exactly. Figure 6a-d present the FE test results in the second case over all time. All the failing-satellite FE statistics exceed the corresponding threshold, which means the FE test is able to find the failing satellites exactly in the second case. That means the FE test is always able to find the failing satellite accurately. the 190th minute in the first case. From the results, it is easy to find that the statistics exceeding the threshold are always coming from the first GPS satellite which the bias is added on. Figure 5a-d present the FE test results in the first case over all time. From these results, it is easy to find that the FE test is able to find the failing satellite exactly. Figure 6a-d present the FE test results in the second case over all time. All the failing-satellite FE statistics exceed the corresponding threshold, which means the FE test is able to find the failing satellites exactly in the second case. That means the FE test is always able to find the failing satellite accurately.

Protection Level Computing after Fault Exclusion
If the excluded satellites are just supposed as not in view and use (28) to obtain the IR upper bound of the rest satellites without the excluded satellite, the actual IR may be beyond the IR estimate [18,36]. Although the probability of excluding normal satellite is very low, it does exist. If the normal satellite is excluded and we use (28) to evaluate IR, the probability of the rest satellite faults will be underestimated [36]. In order to ensure that the IR estimate is able to bound the actual IR, the wrong exclusion must be considered. We denote the right exclusion probability as and the wrong exclusion probability as . The wrong exclusion probability is set to 0.001 in [37]. In order to be conservative, the wrong exclusion probability is set to = 0.01 here. Furthermore, when the wrong exclusion occurs, the probability of the rest satellite faults is set to 100%. In this way, the IR estimate is able to bound the actual IR after exclusion and then the PL is able to bound the position error. For the right exclusion, the prior probability of the fault subset is given by: where , is defined by Equations (7)-(10) without the identified failing satellite. Further, for the wrong exclusion group, the prior probability of the fault subset is set to: , , , = 1 The actual IR after exclusion comes from both the wrong exclusion group and the right exclusion group, and it can be expressed as: , , , = , , , + , , , where , , , and , , , are the integrity risk from the right exclusion and wrong exclusion, respectively. For the right exclusion, the failing satellite is considered as an outage. As stated above, the IR after right exclusion is the probability that after the failing satellite is identified and excluded and the rest subsets pass the FD test, but the position errors still exceed the PL. Similar to the IR bound in the current ARAIM [29], the IR in the direction at epoch can be bounded by:

Protection Level Computing after Fault Exclusion
If the excluded satellites are just supposed as not in view and use (28) to obtain the IR upper bound of the rest satellites without the excluded satellite, the actual IR may be beyond the IR estimate [18,36]. Although the probability of excluding normal satellite is very low, it does exist. If the normal satellite is excluded and we use (28) to evaluate IR, the probability of the rest satellite faults will be underestimated [36]. In order to ensure that the IR estimate is able to bound the actual IR, the wrong exclusion must be considered. We denote the right exclusion probability as p rex and the wrong exclusion probability as p wex . The wrong exclusion probability is set to 0.001 in [37]. In order to be conservative, the wrong exclusion probability is set to p wex = 0.01 here. Furthermore, when the wrong exclusion occurs, the probability of the rest satellite faults is set to 100%. In this way, the IR estimate is able to bound the actual IR after exclusion and then the PL is able to bound the position error.
For the right exclusion, the prior probability of the fault subset i is given by: where p k,i is defined by Equations (7)-(10) without the identified failing satellite. Further, for the wrong exclusion group, the prior probability of the fault subset i is set to: The actual IR after exclusion comes from both the wrong exclusion group and the right exclusion group, and it can be expressed as: p HMI,k,a f ,q = p rex p HMI,k,re,q + p wex p HMI,k,we,q where p HMI,k,re,q and p HMI,k,we,q are the integrity risk from the right exclusion and wrong exclusion, respectively. For the right exclusion, the failing satellite is considered as an outage. As stated above, the IR after right exclusion is the probability that after the failing satellite is identified and excluded and the rest subsets pass the FD test, but the position errors still exceed the PL. Similar to the IR bound in the current ARAIM [29], the IR in the q direction at epoch k can be bounded by: i=0 p a f ,k,re,i P x k,q −x a f ,k,0,pos,q > PL a f ,k,q , x a f ,k,i,pos,q −x a f ,k,0,pos,q < T a f ,MS,FD,k,i,q subset i ≤ 2Q PL a f ,k,q −b nom,k,0,q σ a f ,k,0,q where x k,q is the true position in the q direction at epoch k. PL a f ,k,q is the protection level in the q direction after exclusion.x a f ,k,i,pos,q is the q th component of the position estimate of subset i (i = 0, 1, 2, 3) at epoch k after exclusion. T a f ,MS,FD,k,i,q is the MHSS detection threshold of subset i in the q direction after exclusion and it can be obtained by Equation (19) without the identified failing satellites. σ a f ,k,i,q is the standard deviation ofx a f ,k,i,pos,q and it can be obtained by Equation (29) without the identified failing satellite. b a f ,nom,k,i,q is the impact of the nominal bias on position solution of the subset i after exclusion. It can be obtained by Equation (30) without the identified failing satellites. For the wrong exclusion, the probability of the rest subsets is set to 100%. Similar to the HMI bound of the current ARAIM [29], the HMI probability from the wrong exclusion group can be bounded by: As expressed by the Equation (40), the actual IR in q direction at epoch k comes from the right exclusion and wrong exclusion. Substituting Equations (41) and (42) into Equation (40), and the after-exclusion integrity risk bound, pb HMI,k,a f ,q , can be obtained by: p HMI,k,a f ,q ≤ pb HMI,k,a f ,q = 2Q PL a f ,k,q −b nom,k,0,q σ k,0,q Similar to the current ARAIM, the PL can be obtained by making the integrity risk bound equal to the CAT-I integrity risk probability allocation to the q direction. Then we have the following: pb HMI,k,a f ,q = 2Q PL a f ,k,q −b nom,k,0,q σ k,0,q The PL in the q direction after exclusion is the PL a f ,k,q solution of the Equation (44). If all of the PL a f ,k,q (q = 1, 2, 3) are smaller than the corresponding requirements of CAT-I, the ARAIM claims the position estimatex a f ,k,0,pos available, otherwise, the ARAIM warns the user to abort the approach.

Performance Estimation
The CAT-I is a precision approach with decision height (DH) not lower than 60 m (200 feet) and runway visual range (RVR) not less than 550m [1]. The purpose of the proposed ARAIM is to achieve the CAT-I precision approach. Navigation performance requirements of CAT-I are presented as follows [1,38]: 1.
The vertical protection level (VPL) and horizontal protection level (HPL) must be less than 3.
The 95% vertical accuracy and horizontal accuracy should be lower than 4 − 6 m and 16 m, respectively; 5.
The availability requirement is 0.99-0.99999.

EMT-I Computing
A lot of operational trials have shown that the vertical position error larger than 15 m significantly increases the workload of the flight crew and reduces the safety margin greatly [1]. Furthermore, the Federal Aviation Administration (FAA) introduces a concept, i.e., the effective monitor threshold (EMT), in the requirements of LPV-200 to bound the probability of vertical position error larger than 15 m [11]. The ICAO also stipulates that the probability of a position error exceeding 15 m should be lower than 10 −5 /approach.
To bound the probability of the vertical error exceeding 15 m, we denote the vertical integrity performance of the subsets with prior probability larger than 10 −5 /approach as EMT-I and its threshold is set to 15 m.
The EMT-I only monitors the subsets with prior probability greater than p EMT−I , i.e., the 10 −5 /approach. Then if there is no fault detected, the EMT-I is the integrity performance of the subsets with the prior probability exceeding P EMT−I . It can be obtained by: where T MS,FD,k,i,3 and σ k,i,3 are defined in Equations (19) and (29), respectively. In addition, for the scenario after fault exclusion, the EMT-I should monitor the fault modes with p rex p a f ,k,re,i or p wex p a f ,k,we,i greater than the P EMT−I . Further, the EMT-I in the q direction after exclusion can be obtained by: If the EMTi FD,k or the EMTi a f ,k are smaller than the threshold, (15 m), the ARAIM passes the EMT-I test. Otherwise, the ARAIM warns the user to abort the approach.

Integrity Performance
In terms of GNSS navigation, the vertical integrity requirements of CAT-I are more stringent than the horizontal integrity requirements, therefore, we only show the integrity monitoring results in the vertical direction.
The aviation-grade INS simulation conditions and GNSS simulation parameters are presented in Table 3 in Section 4.2. The standard deviation model used here is defined in [8]. In addition, the user range accuracy (URA) [39,40] for integrity is the same as that in the broadcast ephemeris of GPS, 2.4 m.        Figure 9 presents the VPL of the subset-reduced GNSS/INS ARAIM after exclusion. The results show that the fault exclusion leads to deterioration of PL performance about one meter. The results also show that although the VPL after exclusion is a little worse than the VPL without fault exclusion, it is still far lower than the PL requirement of the CAT-I. The VPL after exclusion being able to meet the CAT-I integrity requirements means that the fault exclusion for the subset-reduced GNSS/INS ARAIM is able to improve the continuity and availability performance of the navigation system.

Conclusions
In this paper, the subset reduced GNSS/INS ARAIM was proposed to reduce the computational load of the current ARAIM. The fault detection test and fault exclusion test of the proposed ARAIM were provided. Moreover, the method to obtain the FD only integrity bound, and after-exclusion integrity bound was presented.
The computational load of the proposed ARAIM was about 2% of that of the current ARAIM, which make it easy for an ARAIM application in the airborne navigation system. Meanwhile, simulation results showed that both the FD only integrity performance and integrity performance after exclusion were able to meet the integrity requirements of CAT-I.
Future research will be focused on further reducing the computational complexity of ARAIM.

Conclusions
In this paper, the subset reduced GNSS/INS ARAIM was proposed to reduce the computational load of the current ARAIM. The fault detection test and fault exclusion test of the proposed ARAIM were provided. Moreover, the method to obtain the FD only integrity bound, and after-exclusion integrity bound was presented.
The computational load of the proposed ARAIM was about 2% of that of the current ARAIM, which make it easy for an ARAIM application in the airborne navigation system. Meanwhile, simulation results showed that both the FD only integrity performance and integrity performance after exclusion were able to meet the integrity requirements of CAT-I. The results in Figures 7-11 show that the subset-reduced ARAIM is still able to meet the requirements of CAT-I with global coverage. This means the proposed method is able to reduce computational load greatly while being able to provide performance meeting CAT-I requirements.

Conclusions
In this paper, the subset reduced GNSS/INS ARAIM was proposed to reduce the computational load of the current ARAIM. The fault detection test and fault exclusion test of the proposed ARAIM were provided. Moreover, the method to obtain the FD only integrity bound, and after-exclusion integrity bound was presented.
The computational load of the proposed ARAIM was about 2% of that of the current ARAIM, which make it easy for an ARAIM application in the airborne navigation system. Meanwhile, simulation results showed that both the FD only integrity performance and integrity performance after exclusion were able to meet the integrity requirements of CAT-I.