Kalman Filter-Based RAIM for Reliable Aircraft Positioning with GPS and NavIC Constellations

Abstract

This paper presents a novel Kalman filter (KF)-based receiver autonomous integrity monitoring (RAIM) algorithm for reliable aircraft positioning with global navigation satellite systems (GNSS). The presented method overcomes major limitations of the authors’ previous work, and uses two GNSS, namely, Navigation with Indian Constellation (NavIC) of India and the Global Positioning System (GPS). The algorithm is developed in the range domain and compared with two existing approaches—one each for the weighted least squares navigation filter and KF. Extensive simulations were carried out for an unmanned aircraft flight path over the Indian sub-continent for validation of the new approach. Although both existing methods outperform the new one, the work is significant for the following reasons. KF is an integral part of advanced navigation systems that can address frequent loss of GNSS signals (e.g., vector tracking and multi-sensor integration). Developing KF RAIM algorithms is essential to ensuring their reliability. KF solution separation (or position domain) RAIM offers good performance at the cost of high computational load. Presented range domain KF RAIM, on the other hand, offers satisfactory performance to a certain extent, eliminating a major issue of growing position error bounds over time. It requires moderate computational resources, and hence, shows promise for real-time implementations in avionics. Simulation results also indicate that addition of NavIC alongside GPS can substantially improve RAIM performance, particularly in poor geometries.

1. Introduction

In recent years, global navigation satellite systems (GNSS) have evolved into important infrastructure of modern society, with day-to-day activities increasingly relying on their positioning, navigation and timing services [1,2]. GNSS is now so deeply entrenched in everyday life that disruption or malfunction of its operations can lead to undesirable consequences. Among many other diverse applications, aircraft navigation in particular has immensely benefited from GNSS during different flight phases (e.g., cruising, terminal, and approach to landing) [3,4,5,6]. GNSS is also identified as a key sensor on-board unmanned aerial vehicles (UAV) [7,8,9]. In spite of ever expanding use, major concerns in aviation applications remain to be reliability and continuity of GNSS services. The reason is that a system anomaly/loss of signal in aviation can jeopardize safety, or cause legal or economic liabilities.

In order to guarantee reliability, a GNSS signal integrity monitor is integrated with avionics. Integrity is considered an essential performance metric in aviation. It is a measure of trustworthiness of a system [10]. An integrity monitor is designed to issue alarms to pilots within a prescribed time, when reliable GNSS performance cannot be ensured. To this end, it carries out continuous fault detection tests and raises an alarm in case a fault is detected. If no fault is identified, the monitor outputs a bound on position error named protection level (PL). The PL protects error in estimated position with a large probability. As an example, Figure 1 illustrates PLs for an approach to landing application.

Figure 1. Illustration of PLs. To ensure reliability, magnitude of error in the estimated position (both horizontal and vertical) must be within the corresponding PL with a certain probability. Calculated PLs must be below the alert limits when integrity monitoring is available.

Design of integrity monitors (or monitoring algorithms) relies on what navigation filter is used for GNSS signal processing. Two standard candidates are weighted least squares (WLS) and Kalman filter (KF) (or in particular, extended KF (EKF)). WLS is easy to implement, but not ideal for advanced navigation systems [11]. On the other hand, EKF can be used in traditional as well as advanced methods. It is an important part of advanced systems (e.g., vector tracking [12] and multi-sensor integration [13]). These systems are more accurate and robust. They can address the vulnerability of weak GNSS signals, which are prone to loss of lock in the presence of moderate to high dynamics [14,15,16,17]. Thus, advanced navigation systems can help improve continuity of GNSS services.

While integrity monitoring with WLS is extensively studied and well-developed [18,19,20,21,22,23,24,25], relatively few studies are available on its KF counterpart [26,27,28,29,30,31,32,33,34,35,36,37,38]. To this end, a novel KF-based integrity algorithm is designed in this paper for reliable absolute positioning with GNSS pseudorange (carrier smoothed) and pseudorange rate measurements. The presented method, being computationally efficient, shows promise for real-time implementations in avionics. It also has potential for extensions to advanced methods (e.g., vector tracking [30]), thereby contributing to enhancing both reliability and continuity of GNSS operations. The algorithm’s performance is compared with two existing approaches—one each for WLS and KF—for a UAV navigation scenario.

Over the last two decades, extensive research has been carried out on integrity monitoring with the Global Positioning System (GPS) in civil aviation [21,25]. In order to meet stringent requirements, dual frequency multi-constellation GNSS signals were deemed necessary [23]. Consequently, there are studies on combined integrity performance of GPS and Galileo/Beidou in the context of aviation [24,39]. However, to the best of the authors’ knowledge, no such research is available in the open literature in relation to the Indian GNSS, Navigation with Indian Constellation (NavIC). This navigation satellite constellation provides coverage to the Indian sub-continent and areas extending about 1500 km around it [40,41]. NavIC is intended to support aviation users among others over its coverage area. With regard to this, the current work aims to analyse KF integrity performance with GPS and NavIC. Design of the algorithm is also discussed with a focus on the dual constellations. However, the methodology can apply to other GNSS systems with appropriate changes.

The organization of the remaining paper is as follows: First, prior work on integrity algorithms is discussed. Contributions of the current work are also noted in this context. Following this, a brief overview of existing KF-based integrity algorithms is provided. Next, the integrity monitoring algorithm proposed in this paper is described. Subsequently, the performance of the KF integrity algorithm is compared with two other approaches using simulated GPS and NavIC measurements for a UAV trajectory. Finally, the paper ends with conclusions and future extensions of the current work.

2. Prior Work and Contributions

Aircraft-based augmentation system (ABAS) is one of the different methods implemented for GNSS integrity monitoring for aviation users. It has a built-in integrity monitor in avionics. An integral part of ABAS is a GNSS receiver-based algorithm called receiver autonomous integrity monitoring or RAIM [3]. A detailed literature survey of RAIM algorithms for civil aviation is presented in [10]. As mentioned before, RAIM depends on what navigation filter (WLS or KF) is used in the GNSS signal processing of the receiver. An extensive body of knowledge is available in the literature on WLS RAIM [20,21]. Position domain implementation of WLS RAIM is called solution separation method. Advanced RAIM (ARAIM) extends this method by including dual frequency, multi-constellation GNSS signals, an extensive threat model and an integrity support message [42]. ARAIM is envisioned to support horizontal and vertical guidance of aircraft. On the other hand, range domain implementation of RAIM is called range-based RAIM in this paper. Its formulation for WLS dates back to the late 1980s and early 1990s [18,19]. This method has been extended to handle multiple faults in [20]. RAIM for a batch least squares algorithm is developed in [22].

Solution separation RAIM for KF was first presented in [26] for aviation applications. It performs integrity monitoring in the position domain by eliminating a visible satellite from one of multiple KFs running in parallel. References [27,28] extend ARAIM to KF for high accuracy and precision applications, and propose methods to reduce the computational load for running parallel filters. In [29], a range-based KF RAIM algorithm is described. It develops a recursive fault detection test with KF residuals, and calculates the worst-case fault vector using a batch least squares approach. Range-based KF RAIM has an advantage over position domain method in that it does not need parallel filters. It has less architectural complexity, but it needs to take into account contributions from past epoch measurements to the current PL. This should be done in a computationally efficient way without increasing the PL as time progresses [31]. Reference [32], on the other hand, proposes an isotropy-based RAIM algorithm with KF.

Integrity monitoring for integrated GNSS-inertial navigation system (INS) was recently studied in [34,35,36,37,38] in both range and position domains for KF. In [34] an integrity monitor is presented in the range domain to deal with spoofing attacks during an aircraft approach to a runway. The work is later extended with a computationally efficient calculation of the worst-case fault vector [35]. In a subsequent reference [36], solution separation approach is preferred over the proposed range-based monitor in case of good satellite visibility for an autonomous land vehicle application. Solution separation RAIM for tightly coupled GNSS-INS is described in [37] for precise point positioning. A fault detection and exclusion scheme for tightly coupled GNSS-INS system is designed in [38]; it can detect multiple GNSS, and simultaneous GNSS and INS faults.

Restricting the increase of PLs over time in range-based KF RAIM is still a major challenge, with little work done in this regard. In [33], an implementation of range domain KF RAIM is provided for GNSS receivers. Its PL does not grow with time due to contributions from previous measurements to the present epoch. However, it assumes a single satellite failure, and does not model time correlated errors of measurements. A range-based KF RAIM algorithm is detailed in this paper, building upon [33]. It models time correlated errors, and handles multi-satellite failures. The algorithm also retains computational efficiency. A different implementation of KF called Schmidt KF (SKF) [43] is required for design. It is essential to the formation of fault detection tests. More precisely, it helps in overcoming the issue of growing PLs by enabling more than one test in the presence of time correlated errors. Each test considers measurement innovations of a finite number of epochs, as before, but requires a completely different formulation. Hence, the PL computation is also significantly modified. It should be noted that constellation-wide faults due to a common cause are not considered in the current work. Measurements of a given epoch are also assumed to be uncorrelated with each other.

Extensive simulations over the primary coverage area of NavIC on the Indian sub-continent were performed for a 20-min UAV trajectory. With GPS and NavIC measurements, it is shown that the existing methods used as reference outperform the new one. However, the work is significant for the following reasons. KF is an integral part of advanced navigation systems, as noted earlier. Therefore, developing KF RAIM algorithms is essential to ensuring their reliability. The improvement of KF solution separation RAIM is obtained at the expense of high computational load. The presented range-based KF RAIM, on the other hand, offers satisfactory performance to a certain extent with moderate computational resources. It has potential for extensions to advanced methods such as vector receivers, where running parallel vector tracking loops for solution separation RAIM would be too complex and prohibitively expensive. Further, simulation results indicate that the addition of NavIC alongside GPS can substantially improve performance, particularly in poor geometries.

3. Overview of Existing KF RAIM Algorithms

The developed KF RAIM is compared with two existing integrity algorithms. The first one is range-based RAIM with WLS [20]. Although snapshot in nature, it is chosen for performance comparison because it works in the range domain, like the presented method. The second one, KF RAIM in the position domain, implements the solution separation approach with the EKF. Since the WLS RAIM algorithm is described in detail in [20], it is not repeated here. First, a brief overview of existing solution separation KF RAIM is provided. Following this, background of the existing range-based KF RAIM, which is extended further later in this paper, is presented for ease of understanding.

3.1. Solution Separation KF RAIM

First, error models and key integrity parameters are described. Although these are discussed in the context of solution separation method, these are used by all RAIM algorithms of this paper. The following error models are considered. Ionospheric error is assumed to be removed using dual frequency measurements. Broadcast satellite clock and ephemeris error, residual tropospheric delay (i.e., remaining error after removing the modeled component), noise and multipath in pseudorange measurements are modeled as a first order Gauss Markov (GM) process with 100 s time constant. Their standard deviations are taken from [44,45] for carrier smoothed code pseudorange measurements of GPS in L${}_1$ and L${}_5$ bands for airborne users. More realistic error models with different time constants for individual components will be considered in future work. Due to lack of availability of similar error models for NavIC, the same equations as those for GPS are assumed with frequency bands appropriately changed. Only white noise is modeled in the pseudorange rate measurements. Noise standard deviation corresponds to a C/N${}_0$ of 45 dB-Hz.

The prior probability of narrow fault $P_F$ for both GPS and NavIC constellations is assumed to be ${10}^{-4}$/satellite/h. Over the years, $P_F$ is found to be less than this value for GPS [42]. For NavIC being a new constellation, many years of data are yet to be analyzed before arriving at a suitable probability. Constellation-wide faults are not considered in this work. The allocated probability of hazardously misleading information (HMI) (i.e., the probability that position error exceeds the PL but no alert is issued), $P_{HMI}^{alloc}$, is considered ${10}^{-7}$/h [46]. $P_{HMI}^{alloc}$ for the vertical component, $P_{HMI,V}^{alloc}$ is $9\times {10}^{-8}$/h (i.e., 90% of $P_{HMI}^{alloc}$). $P_{HMI}^{alloc}$ for the horizontal component, $P_{HMI,H}^{alloc}$ is $1\times {10}^{-8}$/h. For the assumed $P_{HMI}^{alloc}$ (or allocated integrity budget) and $P_F$, monitoring up to two simultaneous independent satellite failures is sufficient, as discussed in [24]. This is because three or more simultaneous failures will have a probability less than the total integrity budget. The probability of three or more unmonitored faults $P_{um}$ is therefore subtracted from the integrity budget. The continuity budget allocated to disruptions due to false alert $P_{FA}$ is $3.33\times {10}^{-7}$/sample [47]. $P_{FA}$ and $P_{HMI}^{alloc}$ values chosen correspond to the en route phase of civil aviation.

Let $P_{HMI,h}^{nf}$ be the probability of HMI for no-fault (NF) condition, where h = 1, 2, 3 for north, east and down components of position, respectively. $P_{HMI,h}^{sf}$ is the probability for single-fault (SF) modes. $P_{HMI,h}^{df}$ is the probability for dual-fault (DF) modes. For each horizontal component of position, their allocated values are

$$\begin{array}{cc}\hfill P_{HMI,h}^{alloc,nf}& =1.8\times {10}^{-11}/\mathrm{h},P_{HMI,h}^{alloc,sf}=1.8\times {10}^{-11}/\mathrm{h},\hfill \\ \hfill P_{HMI,h}^{alloc,df}& =4.849\times {10}^{-9}/\mathrm{h}\hfill \end{array}$$

(1)

where h = 1 and 2 denote north and east components, respectively. NavIC constellation currently has seven operational satellites in orbit. Assuming a maximum of twelve GPS satellites, the sum of the preceding probabilities is slightly less than half of $(P_{HMI,H}^{alloc}-0.1P_{um})$.

For the vertical component of position, the allocated probabilities are

$$\begin{array}{cc}\hfill P_{HMI,3}^{alloc,nf}& =3.6\times {10}^{-10}/\mathrm{h},P_{HMI,3}^{alloc,sf}=3.6\times {10}^{-10}/\mathrm{h},\hfill \\ \hfill P_{HMI,3}^{alloc,df}& =8.825\times {10}^{-8}/\mathrm{h}\hfill \end{array}$$

(2)

The sum of the above three probabilities is a little less than $(P_{HMI,V}^{alloc}-0.9P_{um})$. The probabilities are not optimally chosen to minimize PLs due to higher computational load involved in optimization. As an alternative, a larger value (about 99% of the total probability) is allocated to dual-satellite fault mode instead of assigning one third of the sum to each of NF, SF and DF. This is to reduce PLs as the DF mode is found to result in higher PLs.

Position domain KF RAIM implemented in this paper adapts solution separation approach to EKF. It runs parallel EKFs—one for each fault mode plus an all-in-view filter for NF condition. Each EKF estimates errors in three coordinates of aircraft position and velocity in the Earth centered Earth Fixed (ECEF) frame, and receiver clock biases and drifts for GPS and NavIC from their respective a priori values. In addition, each of them has additional states (one for each pseudorange measurement) to model time correlated errors as first order GM processes. Key equations of KF solution separation RAIM are provided in Appendix A. Satellite position, velocity and modeled tropospheric delays are calculated only in the all-in-view filter and shared among all subset filters—one for each fault mode—to reduce the computational load. State error covariances are updated using a numerically stable forward recursive modified rank-one update algorithm [43]. Next, an overview of existing range-based KF RAIM is provided to lay foundation for the modified algorithm described later in this paper.

3.2. Existing Range-Based KF RAIM

In the fault detection method of existing range-based RAIM, three test statistics are formed, each with KF measurement innovations of a number of epochs [33]. The reason for three tests is described in detail in the reference. The first statistic, ${\alpha }_1$, is calculated with measurement innovations of M epochs including the current epoch $t_k$. The second statistic, ${\alpha }_2$, has $(N-M)$ epochs from $k-N+1$ to $k-M$. The third test statistic, ${\alpha }_3$, is formed with innovations of all epochs before N epochs, whose contributions are included in ${\alpha }_3$ before these terms are discarded (or removed from memory). At a time, only N epoch terms are retained in memory, but test statistics are formulated with innovations of all epochs. N and M are adaptively determined. Mathematically, the test statistics at $t_k$, (${\alpha }_{j,k}$; j = 1, …, 3), are given by

$$\begin{array}{cc}\hfill {\alpha }_{j,k}^2& =\sum _{\ell =p_j}^{m_j}\left(\Delta {\underline{\mathbf{\rho }}}_{\ell }^T{\mathbf{W}}_{\ell }^{-1}(\mathbf{I}-{\mathbf{G}}_{\ell })\Delta {\underline{\mathbf{\rho }}}_{\ell }+\Delta {\underline{\dot{\mathbf{\rho }}}}_{\ell }^T{{\mathbf{W}}_{rr,\ell }}^{-1}(\mathbf{I}-{\mathbf{G}}_{\ell }^{rr})\Delta {\underline{\dot{\mathbf{\rho }}}}_{\ell }\right)\hfill \end{array}$$

(3)

where $\Delta {\underline{\mathbf{\rho }}}_{\ell }$ and $\Delta {\underline{\dot{\mathbf{\rho }}}}_{\ell }$ denote EKF pseudorange and pseudorange rate innovation vectors, respectively, at epoch ℓ. $m_j$ and $p_j$ hold different values for different j, as mentioned before. $\mathbf{I}$ is the identity matrix of size $n\times n$; and n is the number of visible satellites at an epoch. n can change with time. ${\mathbf{G}}_{\ell }$ and ${\mathbf{G}}_{\ell }^{rr}$ are computed by WLS estimation. They are

$$\begin{array}{cc}\hfill {\mathbf{G}}_{\ell }& ={\mathbf{H}}_{\ell }{({\mathbf{H}}_{\ell }^T{\mathbf{W}}_{\ell }^{-1}{\mathbf{H}}_{\ell })}^{-1}{\mathbf{H}}_{\ell }^T{\mathbf{W}}_{\ell }^{-1}\hfill \end{array}$$

(4)

$$\begin{array}{cc}\hfill {\mathbf{G}}_{\ell }^{rr}& ={\mathbf{H}}_{\ell }{({\mathbf{H}}_{\ell }^T{{\mathbf{W}}_{rr,\ell }}^{-1}{\mathbf{H}}_{\ell })}^{-1}{\mathbf{H}}_{\ell }^T{{\mathbf{W}}_{rr,\ell }}^{-1}\hfill \end{array}$$

(5)

where ${\mathbf{W}}_{\ell }$ is the pseudorange measurement error covariance matrix at $t_{\ell }$th epoch. ${\mathbf{H}}_{\ell }$ is linearized pseudorange (or pseudorange rate) measurement model matrix. ${\mathbf{W}}_{rr}$ is the pseudorange rate error covariance matrix. The error model accounts for unmodeled propagation delays by inflating noise covariance, and neglects error in broadcast satellite clock terms and ephemeris, and multipath. Measurement error between time epochs is thus assumed uncorrelated. Fault detection method considers WLS estimation whereas PL calculation is based on EKF position error.

A WLS estimation-based fault detection test with EKF innovations allows simplified calculations of mean position error bounds, as discussed in the reference. With WLS estimation-based fault detection, each term of the test statistic under summation in Equation (3) and in the denominator of failure mode slope (FMS) would contribute fault of only the corresponding epoch, not any other epochs. This simplifies FMS calculation, and allows the formation of a separate FMS for mean position error bound pertaining to a test statistic. As a result, more than one test can be formulated. The noise statistics of $\alpha$s can also be easily computed. It was proved in [31] that each term in Equation (3) generated with KF innovations has the same noise distribution as that of the WLS navigation filter. The threshold $T_{th,j}$ for an ${\alpha }_j$ is therefore computed from the Chi square distribution with probability $P_{\mathrm{FA}}/3$ and appropriate degrees of freedom (DOF). A fault is declared if at least one of the test statistics crosses its threshold.

The bounds on horizontal and vertical mean position error under a fault, HPE${}_i^U$ and VPE${}_i^U$, respectively, for a satellite i are derived as

$$\begin{array}{cc}\hfill {\mathrm{HPE}}_i^U& =\sum _{j=1}^3{\mathrm{HPE}}_{i,j}^U+\sqrt{{\left({\underline{\mathbf{\mu }}}_n^{\mathrm{error},U}(1)\right)}^2+{\left({\underline{\mathbf{\mu }}}_n^{\mathrm{error},U}(2)\right)}^2}\hfill \end{array}$$

(6)

$$\begin{array}{cc}\hfill {\mathrm{VPE}}_i^U& =\sum _{j=1}^3{\mathrm{VPE}}_{i,j}^U+{\underline{\mathbf{\mu }}}_n^{\mathrm{error},U}(3)\hfill \end{array}$$

(7)

where ${\mathrm{HPE}}_{i,j}^U$ and ${\mathrm{VPE}}_{i,j}^U$ are bounds corresponding to ${\alpha }_j$ (i.e., they consider the same epoch terms as those of ${\alpha }_j$), with j = 1, 2, 3. ${\underline{\mathbf{\mu }}}_n^{\mathrm{error},U}(1:3)$ is a three-element vector of north, east and down mean position error bounds resulting from second order terms of nonlinear GNSS measurement equations.

It is important to note that the DOF of ${\alpha }_3$, and ${\mathrm{HPE}}_{i,3}^U$ and VPE${}_{i,3}^U$ grow with time. However, as HPE${}_{i,3}^U$ and VPE${}_{i,3}^U$ have very small contributions, VPE${}_i^U$ and HPE${}_i^U$ do not have the same growing trend over time. It is justified through simulation results that with three test statistics and mean position error bounds as calculated in the preceding equations, PL does not grow over time, unlike the PL with a single test statistic. Faults are also detected in a shorter time than that with a single test formed using all innovation terms from the beginning up to the current epoch. The reason is that the growing DOF of a single test statistic increases the fault detection threshold fast, resulting in late detection of faults. PLs are computed using the above-mentioned mean position error bounds under the assumption of a single satellite fault.

As noted before, SKF is used as navigation processor for range domain KF RAIM algorithm developed in this paper. Its formulation is briefly provided next.

4. Schmidt KF

In this section, the SKF formulation of KF is briefly outlined. Interest readers can refer to [43,48] for more details. The reason for using SKF will be explained in the next section while discussing the fault detection test of range-based KF RAIM. Although sub-optimal in nature, SKF accounts for the effects of time correlated errors without estimating additional states. It also has fast execution time.

It is desired to determine aircraft absolute position and velocity, and receiver clock biases and drifts for GPS and NavIC. Their true values and a priori estimate are denoted as $\underline{\varkappa }$ and ${\tilde{\underline{\varkappa }}}^{-}$, respectively. The difference between $\underline{\varkappa }$ and ${\tilde{\underline{\varkappa }}}^{-}$, $\Delta {\underline{\varkappa }}_k$ is estimated. Thus, the SKF state vector at $t_k$ is

$$\Delta {\underline{\varkappa }}_k={[\Delta x\Delta \dot{x}\Delta y\Delta \dot{y}\Delta z\Delta \dot{z}\Delta b_{\mathrm{clk}}^{\mathrm{G}}\Delta {\dot{b}}_{\mathrm{clk}}^{\mathrm{G}}\Delta b_{\mathrm{clk}}^{\mathrm{N}}\Delta {\dot{b}}_{\mathrm{clk}}^{\mathrm{N}}]}_k^T$$

(8)

where $x,y\mathrm{and}z$ are three position components of aircraft expressed in ECEF coordinate frame. $\dot{x}$, $\dot{y}$ and $\dot{z}$ are velocity components in ECEF. $b_{\mathrm{clk}}^{\mathrm{G}}$ and $b_{\mathrm{clk}}^{\mathrm{N}}$ are the receiver clock biases for GPS and NavIC, respectively, and ${\dot{b}}_{\mathrm{clk}}^{\mathrm{G}}$ and ${\dot{b}}_{\mathrm{clk}}^{\mathrm{N}}$ are the receiver clock drifts for the two constellations.

Broadcast ephemeris and clock error, residual tropospheric delay along the line of sight, multipath and noise in carrier smoothed code pseudorange measurements of a satellite are modeled as a first order GM process with time constant 100 s. Let ${\sigma }_{\mathrm{ura}}^i$, ${\sigma }_{\mathrm{tr}}^i$, ${\sigma }_{\mathrm{mp}}^i$ and ${\sigma }_n^i$ be the standard deviations of broadcast ephemeris and clock error, residual tropospheric delay, multipath and noise, respectively, for ith satellite. Their elevation angle dependent models for airborne users are taken from [44,45] for GPS $L_1$ and $L_5$ band measurements and provided next.

$$\begin{array}{cc}\hfill {\sigma }_{\mathrm{tr}}^i& =1.001/\sqrt{0.002001+{(sin({\theta }_i))}^2}\times 0.12\hfill \end{array}$$

(9)

$$\begin{array}{cc}\hfill {\sigma }_{\mathrm{mp}}^i& =(0.13+0.53{exp}^{-({\theta }_i\times 180/\pi /10)})\sqrt{{\displaystyle \frac{({1.57542}^4+{1.17645}^4)}{{({1.57542}^2-{1.17645}^2)}^2}}}\hfill \end{array}$$

(10)

$$\begin{array}{cc}\hfill {\sigma }_n^i& =(0.15+0.43{exp}^{-({\theta }_i\times 180/\pi /6.9)})\sqrt{{\displaystyle \frac{({1.57542}^4+{1.17645}^4)}{{({1.57542}^2-{1.17645}^2)}^2}}}\hfill \end{array}$$

(11)

where ${\theta }_i$ is the elevation angle of ith GPS satellite in radians. ${\sigma }_{\mathrm{ura}}$ is assumed to be 0.75. Thus, the resultant error is a GM process with 100 s time constant, and has a standard deviation of $\sqrt{{({\sigma }_{\mathrm{ura}}^i)}^2+{({\sigma }_{\mathrm{tr}}^i)}^2+{({\sigma }_{\mathrm{mp}}^i)}^2+{({\sigma }_n^i)}^2}$ for ith GPS satellite. The same error models are used for NavIC, but the frequencies are changed to $L_5$ and S bands.

Pseudorange rate measurement error is modeled as white Gaussian noise with standard deviation corresponding to a C/N${}_0$ of 45 dB-Hz. Thus, there are n GM processes, where n is the number of visible satellites at an epoch. In the SKF algorithm, states of GM processes are not estimated, but their effects are considered. If the vector ${\underline{\mathit{p}}}_{gm,k-1}$ has the states of n GM processes at $t_{k-1}$, then $\Delta {\underline{\varkappa }}_{k-1}$ and ${\underline{\mathit{p}}}_{gm,k-1}$ can be combined as ${\underline{\mathit{X}}}_{k-1}$ = ${[\Delta {\underline{\varkappa }}_{k-1}^T{\underline{\mathit{p}}}_{gm,k-1}^T]}^T$. The process and linearized measurement models of ${\underline{\mathit{X}}}_k$ and measurement update equations of SKF are described in Appendix B. Next, the range-based KF RAIM algorithm is presented.

5. Range-Based KF RAIM Algorithm

First, the fault detection method in the presence of time correlated errors is developed. Then, mean position error bounds and PLs are computed considering up to two simultaneous independent satellite failures.

5.1. Fault Detection Method

The test statistic described by Equation (3) earlier is modified to account for time correlated errors in pseudorange measurements, as explained next. Since no time correlated error is modeled in the pseudorange rate measurements, part of the test statistics with pseudorange rate innovations remains the same as before. It can be shown that

$$\Delta {\underline{\mathbf{\rho }}}_{\ell }^T{\mathbf{W}}_{\ell }^{-1}(\mathbf{I}-{\mathbf{G}}_{\ell })\Delta {\underline{\mathbf{\rho }}}_{\ell }={\Delta {\underline{\mathbf{\rho }}}^{*}}_{\ell }^T(\mathbf{I}-{\mathbf{G}}_{\ell }^{*}){\Delta {\underline{\mathbf{\rho }}}^{*}}_{\ell }$$

(12)

where ${\Delta {\underline{\mathbf{\rho }}}^{*}}_{\ell }^T$ = ${\mathbf{W}}_{\ell }^{-1/2}\Delta {\underline{\mathbf{\rho }}}_{\ell }^T$ and ${\mathbf{G}}_{\ell }^{*}$ = ${\mathbf{W}}_{\ell }^{-1/2}{\mathbf{H}}_{\ell }{({\mathbf{H}}_{\ell }^T{\mathbf{W}}_{\ell }^{-1}{\mathbf{H}}_{\ell })}^{-1}\times {\mathbf{H}}_{\ell }^T{\mathbf{W}}_{\ell }^{-1/2}$ where $‘\times ’$ is matrix multiplication. Using the idempotent property of $(\mathbf{I}-{\mathbf{G}}_{\ell }^{*})$ [18]

$${\Delta {\underline{\mathbf{\rho }}}^{*}}_{\ell }^T(\mathbf{I}-{\mathbf{G}}_{\ell }^{*}){\Delta {\underline{\mathbf{\rho }}}^{*}}_{\ell }={\Delta {\underline{\mathbf{\rho }}}^{*}}_{\ell }^T(\mathbf{I}-{\mathbf{G}}_{\ell }^{*})(\mathbf{I}-{\mathbf{G}}_{\ell }^{*}){\Delta {\underline{\mathbf{\rho }}}^{*}}_{\ell }$$

(13)

With singular value decomposition, $(\mathbf{I}-{\mathbf{G}}_{\ell }^{*})$ can be written as

$$(\mathbf{I}-{\mathbf{G}}_{\ell }^{*})={\mathbf{S}}_{\ell }\mathcal{L}{\mathbf{S}}_{1\ell }$$

(14)

$\mathcal{L}$ is a diagonal matrix. Its diagonal elements are ones and zeros. The number of zeros is equal to the dimension of the null space of $(\mathbf{I}-{\mathbf{G}}_{\ell }^{*})$. For a single constellation it is four whereas for dual constellations with a separate receiver clock bias state for each, it is five. Let the null space dimension be denoted as $n_{\mathrm{null}}$. It can be shown that $(\mathbf{I}-{\mathbf{G}}_{\ell }^{*})$ is also equal to

$$(\mathbf{I}-{\mathbf{G}}_{\ell }^{*})={\mathbf{S}}_{\ell }(1:n,1:n-n_{\mathrm{null}}){({\mathbf{S}}_{\ell }(1:n,1:n-n_{\mathrm{null}}))}^T$$

(15)

where $\mathbf{J}(1:n_1,1:n_2)$ represents first $n_1$ rows and $n_2$ columns of a matrix $\mathbf{J}$. Using Equations (12) and (13), and replacing each $(\mathbf{I}-{\mathbf{G}}_{\ell }^{*})$ in Equation (13) with Equation (15) and ${\mathbf{S}}_{\ell }(1:n,1:n-n_{\mathrm{null}})$ with ${\mathbf{S}}_{\ell }^{\prime }$, part of the test statistic formed with pseudorange innovations, ${\sum }_{\ell =p_j}^{m_j}\Delta {\underline{\mathbf{\rho }}}_{\ell }^T{\mathbf{W}}_{\ell }^{-1}(\mathbf{I}-{\mathbf{G}}_{\ell })\Delta {\underline{\mathbf{\rho }}}_{\ell }^T$ (denoted as ${({\alpha }_j^{\prime })}^2$ later) in Equation (3) is changed as

$$\begin{array}{c}\hfill {({\alpha }_j^{\prime })}^2={\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}}^T{\tilde{\mathbf{S}}}^{\prime }{{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }{{\tilde{\mathbf{S}}}^{\prime }}^T\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}\end{array}$$

(16)

where $\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}$ stacks all $\Delta {\underline{\mathbf{\rho }}}_{\ell }^{*}$ vectors with ℓ varying from the lower limit $p_j$ to the upper limit $m_j$ of Equation (3). ${\tilde{\mathbf{S}}}^{\prime }$ is a block matrix having non-zero sub-matrices (or blocks) along the diagonal, with the ℓth block given by ${\mathbf{S}}_{\ell }^{\prime }$. $\Theta$ is a square matrix with number of rows/columns equal to ${\sum }_{\ell =p_j}^{m_j}n$. It is introduced in the middle and defined later. When it is the identity matrix, Equation (16) reduces to Equation (3). For ease of representation, the time epoch k is dropped from the subscript. The mathematical model of $\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}$ is given by

$$\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}={\mathbf{H}}^{*}\Delta {\underline{\varkappa }}_p+{\underline{\mathbf{\eta }}}_1$$

(17)

${\mathbf{H}}^{*}$ is a block matrix with non-zero blocks along the diagonal. Its ℓth block is ${\mathbf{W}}_{\ell }^{-1/2}{\mathbf{H}}_{\ell }$. ${\mathbf{H}}_{\ell }$ is defined after Equation (5). Only difference is that ${\mathbf{H}}_{\ell }$ has an additional column for receiver clock bias corresponding to the second constellation. $\Delta {\underline{\varkappa }}_p$ stacks all ${[\Delta x\Delta y\Delta z\Delta b_{\mathrm{clk}}^G\Delta b_{\mathrm{clk}}^N]}_{\ell }^T$ vectors for all ℓ noted after Equation (16). ${\underline{\mathbf{\eta }}}_1$ is measurement error. The diagonal terms of its covariance matrix, $\Psi$, are unity. ${\tilde{\mathbf{S}}}^{\prime }{{\tilde{\mathbf{S}}}^{\prime }}^T$ present on either side of $\Theta$ in Equation (16) removes ${\mathbf{H}}^{*}\Delta {\underline{\varkappa }}_p$ from $\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}$, ensuring that the fault of only ℓth epoch is injected through $\Delta {\underline{\mathbf{\rho }}}_{\ell }^{*}$. This enables formation of more than one test statistic, each with a certain number of epochs, as before. If a term from one epoch also injects faults of other epochs, formation of separate test statistics is difficult from the point of view of the corresponding FMS computation, as discussed earlier. This would be the case if ${\tilde{\mathbf{S}}}^{\prime }{{\tilde{\mathbf{S}}}^{\prime }}^T$ were omitted from Equation (16). Grouping ${{\tilde{\mathbf{S}}}^{\prime }}^T\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}$ as $\Delta {\underline{\tilde{\mathbf{\rho }}}}^{\prime }$, Equation (16) becomes

$${({\alpha }_j^{\prime })}^2={\Delta {\underline{\tilde{\mathbf{\rho }}}}^{\prime }}^T\left({{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }\right)\Delta {\underline{\tilde{\mathbf{\rho }}}}^{\prime }$$

(18)

where ${{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }$ (or ${\Theta }_1$) has ${\sum }_{\ell =p_j}^{m_j}(n-n_{\mathrm{null}})$ rows/columns. The covariance matrix ${\Psi }_1$ of error in $\Delta {\underline{\tilde{\mathbf{\rho }}}}^{\prime }$, ${\underline{\mathbf{\eta }}}_2$ is given by

$${\Psi }_1=E\left({\underline{\mathbf{\eta }}}_2{\underline{\mathbf{\eta }}}_2^T\right)={{\tilde{\mathbf{S}}}^{\prime }}^T\Psi {\tilde{\mathbf{S}}}^{\prime }$$

(19)

where E is the expectation operator. $\Psi$ is the covariance matrix of measurement error in $\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}$, ${\underline{\mathbf{\eta }}}_1$. Measurement error comprises broadcast ephemeris and satellite clock error, unmodeled tropospheric delay, multipath and noise. It is assumed that the pseudorange measurement error of each visible satellite is a first order GM process with time constant $1/\beta$ and of zero mean under no faults.

Since time correlated errors are not estimated by the SKF, they remain unchanged in the pseudorange innovation terms. In this context, it should be noted that if time correlated errors were estimated by augmenting states in EKF, it would not be possible to formulate the RAIM algorithm described here. This is because if the augmented states for time correlated errors (one for each pseudorange innovation) were included in the WLS estimation of fault detection method, the resulting system would be under-determined. If the augmented states of EKF were not included in WLS estimation, faults of other epochs would be injected through the pseudorange innovation term of an epoch. This is because of possible wrong estimation of augmented states in EKF in the presence of a fault. This would complicate the calculation of FMS, and a separate FMS for each test statistic would not be possible. The reason for preferring a WLS-based fault detection approach was discussed in Section 3.2 and before Equation (18). Therefore, implementation of the SKF is essential to the formulation of the range-based KF RAIM algorithm presented in this paper. SKF is computationally efficient, and provides reasonably good performance as compared to that of the EKF that estimates additional states for time correlated errors [43]. Next, $\Psi$ and $\Theta$ are formulated for the first test statistic with M epochs (see paragraph before Equation (3) for the definition of M).

5.1.1. Formulation of Ψ for First Test Statistic

First, $\Psi$ is determined. Expanding ${\underline{\mathbf{\eta }}}_1$

$$\begin{array}{c}\hfill {\underline{\mathbf{\eta }}}_1={[{\underline{\mathbf{\eta }}}_1^{(1)}(1)\cdots {\underline{\mathbf{\eta }}}_1^{(1)}(n){\underline{\mathbf{\eta }}}_1^{(2)}(1)\cdots {\underline{\mathbf{\eta }}}_1^{(2)}(n)\cdots {\underline{\mathbf{\eta }}}_1^{(\ell )}(1)\cdots {\underline{\mathbf{\eta }}}_1^{(\ell )}(n)\cdots {\underline{\mathbf{\eta }}}_1^{(M)}(1)\cdots {\underline{\mathbf{\eta }}}_1^{(M)}(n)]}^T\end{array}$$

(20)

where the superscript within parentheses denotes time instants, and the argument indicates pseudorange measurement index (or satellite index) at a time instant. Total number of visible satellites, n can vary across epochs. By definition, $\Psi$ (=$E\left({\underline{\mathbf{\eta }}}_1{\underline{\mathbf{\eta }}}_1^T\right)$) is

$$\begin{array}{cc}\hfill \Psi =\left[\begin{array}{cccc}E\left({\left({\underline{\mathbf{\eta }}}_1^{(1)}(1)\right)}^2\right)& {\left[\mathbf{0}\right]}_{1\times (n-1)}& E\left({\underline{\mathbf{\eta }}}_1^{(1)}(1){\underline{\mathbf{\eta }}}_1^{(2)}(1)\right)& \cdots \\ 0& E\left({\left({\underline{\mathbf{\eta }}}_1^{(1)}(2)\right)}^2\right)& {\left[\mathbf{0}\right]}_{1\times (n-1)}& \cdots \\ {\left[\mathbf{0}\right]}_{(n-2)\times 1}& \cdots & & \\ E\left({\underline{\mathbf{\eta }}}_1^{(2)}(1){\underline{\mathbf{\eta }}}_1^{(1)}(1)\right)& \cdots & \\ & ⋮& \end{array}\right]& \hfill \end{array}$$

(21)

where $\left[\mathbf{0}\right]$ is a matrix with zero elements. Its dimension is shown in the subscript. For any satellite i, at epochs ℓ and $\ell +q$, with q > 0

$$E\left({\underline{\mathbf{\eta }}}_1^{(\ell )}(i){\underline{\mathbf{\eta }}}_1^{(\ell +q)}(i)\right)={\displaystyle \frac{E\left({\underline{\mathbf{\eta }}}^{(\ell )}(i){\underline{\mathbf{\eta }}}^{(\ell +q)}(i)\right)}{{\sigma }^{(\ell )}(i){\sigma }^{(\ell +q)}(i)}}$$

(22)

where $\underline{\mathbf{\eta }}$ is measurement error in $\Delta \underline{\tilde{\mathbf{\rho }}}$ (which stacks relevant $\Delta \underline{{\mathbf{\rho }}_{\ell }}$ terms), and $\sigma$ denotes standard deviation of its individual element. Using GM model, one can write

$$\begin{array}{cc}\hfill {\underline{\mathbf{\eta }}}^{(\ell +1)}(i)& ={exp}^{(-\beta \Delta t)}{\underline{\mathbf{\eta }}}^{(\ell )}(i)+{\zeta }_i^{(\ell )}\hfill \end{array}$$

(23)

$$\begin{array}{cc}\hfill E\left({\underline{\mathbf{\eta }}}_1^{(\ell )}(i){\underline{\mathbf{\eta }}}_1^{(\ell +q)}(i)\right)=& {\left({exp}^{(-\beta \Delta t)}\right)}^q{\displaystyle \frac{E\left({\left({\underline{\mathbf{\eta }}}^{(\ell )}(i)\right)}^2\right)}{{\sigma }^{(\ell )}(i){\sigma }^{(\ell +q)}(i)}}\hfill \end{array}$$

(24)

where $\Delta t$ = measurement update interval = 1 s. ${\zeta }_i^{(\ell )}$ is white noise sample for satellite i and uncorrelated with ${\underline{\mathbf{\eta }}}^{(\ell )}(i)$. Simplifying,

$$E\left({\underline{\mathbf{\eta }}}_1^{(\ell )}(i){\underline{\mathbf{\eta }}}_1^{(\ell +q)}(i)\right)={({exp}^{(-\beta \Delta t)})}^q{\displaystyle \frac{{\sigma }^{(\ell )}(i)}{{\sigma }^{(\ell +q)}(i)}}$$

(25)

Substituting this into Equation (21)

$$\begin{array}{c}\Psi =\left[\begin{array}{cccccc}1& {\left[\mathbf{0}\right]}_{1\times (n-1)}& {exp}^{(-\beta \Delta t)}{\displaystyle \frac{{\sigma }^{(1)}(1)}{{\sigma }^{(2)}(1)}}& {\left[\mathbf{0}\right]}_{1\times (n-1)}& \cdots & 0\\ & & ⋮& & & ⋮\\ & & \cdots & & & {exp}^{(-\beta \Delta t)}{\displaystyle \frac{{\sigma }^{(M-1)}(n)}{{\sigma }^{(M)}(n)}}\\ & & ⋮& & & {\left[\mathbf{0}\right]}_{(n-1)\times 1}\\ 0& \cdots & & {exp}^{(-\beta \Delta t)}{\displaystyle \frac{{\sigma }^{(M-1)}(n)}{{\sigma }^{(M)}(n)}}& {\left[\mathbf{0}\right]}_{1\times (n-1)}& 1\end{array}\right]\end{array}$$

(26)

The term ${\displaystyle \frac{{\sigma }^{(\ell )}(i)}{{\sigma }^{(\ell +q)}(i)}}$ can be written as

$${\displaystyle \frac{{\sigma }^{(\ell )}(i)}{{\sigma }^{(\ell +q)}(i)}}={\displaystyle \frac{{\sigma }^{(\ell )}(i)}{{\sigma }^{(\ell +1)}(i)}}{\displaystyle \frac{{\sigma }^{(\ell +1)}(i)}{{\sigma }^{(\ell +2)}(i)}}{\displaystyle \frac{{\sigma }^{(\ell +2)}(i)\cdots }{{\sigma }^{(\ell +3)}(i)\cdots }}{\displaystyle \frac{{\sigma }^{(\ell +q-1)}(i)}{{\sigma }^{(\ell +q)}(i)}}$$

(27)

It is a product of q ratios. Each ratio will have an accompanying ${exp}^{(-\beta \Delta t)}$ when ${\left({exp}^{(-\beta \Delta t)}\right)}^q$ is multiplied with the product. Using Equations (9)–(11), Figure 2 shows how the upper and lower bounds of ${exp}^{(-\beta \Delta t)}\times {\displaystyle \frac{{\sigma }^{(\ell )}(i)}{{\sigma }^{(\ell +1)}(i)}}$ (=$a_{\ell 1}$) vary for GPS satellites with elevation angles ${\theta }^{(\ell )}$ at epoch ℓ. It is evident from the equations that maximum change in elevation angle between two successive epochs would maximize $a_{\ell 1}$, which is also higher when ${\theta }^{(\ell +1)}$ > ${\theta }^{(\ell )}$. The maximum change in elevation angle between two epochs of 1 s interval is calculated in radians as follows.

$${\theta }^{(\ell +1)}-{\theta }^{(\ell )}={\displaystyle \frac{v_{\max }^s+v_{\max }^u}{r_{\min }^{su}}}$$

(28)

where $v_{\max }^s$ is the maximum satellite speed, $v_{\max }^u$ is the maximum user speed (assumed Mach 1) and $r_{\min }^{su}$ is the minimum range between a satellite and user at an elevation angle. The maximum altitude of the user is 15 km. When ${\theta }^{(\ell +1)}$ < ${\theta }^{(\ell )}$, following the same procedure, lower bounds of $a_{\ell 1}$ are obtained. The term $a_{\ell 1}$ calculated for GPS is found to be greater and less than that of NavIC with respect to upper and lower bounds, respectively. This is because NavIC satellites are located in geosynchronous orbits. As shown in the figure, the largest value of $a_{\ell 1}$, $a_{\max }$ is 0.9911 at 5${}^{\circ }$ mask angle. The lowest value of $a_{\ell 1}$, $a_{\min }$ is 0.9890. A matrix ${\Psi }_{\max }$ is modeled as

$$\begin{array}{cc}\hfill {\Psi }_{\max }=& \left[\begin{array}{cccccc}1& {\left[\mathbf{0}\right]}_{1\times (n-1)}& a_{\max }& {\left[\mathbf{0}\right]}_{1\times (n-1)}& \cdots & 0\\ 0& 1& {\left[\mathbf{0}\right]}_{1\times (n-1)}& a_{\max }& & \cdots \\ {\mathbf{0}]}_{(n-2)\times 1}& & & & & \\ a_{\max }& & \cdots & & & \\ {\mathbf{0}]}_{(n-1)\times 1}& & & & & ⋮\\ & & ⋮& & & \\ & & \cdots & & & a_{\max }\\ & & ⋮& & & {\left[\mathbf{0}\right]}_{(n-1)\times 1}\\ 0& \cdots & & a_{\max }& {\left[\mathbf{0}\right]}_{1\times (n-1)}& 1\end{array}\right]\hfill \end{array}$$

(29)

Figure 2. Variation of upper and lower bounds of ${exp}^{(-\beta \Delta t)}\times {\displaystyle \frac{{\sigma }^{(\ell )}(i)}{{\sigma }^{(\ell +1)}(i)}}$ for GPS satellites for different elevation angles at epoch ℓ, and $\Delta t$ = 1 s.

The determinant of ${\Psi }_{\max }$ can be easily calculated by the product of the determinants of all sub-matrices—each formed by grouping together the non-zero elements for a particular satellite. This is because measurements are assumed uncorrelated across satellites. Thus, with some rearrangements of rows and columns, it can be shown that ${\Psi }_{\max }$ is a block diagonal matrix formed by these sub-matrices. Each sub-matrix is of the form ${\Psi }_{\mathrm{sub},}^i\max$ = $\left[\begin{array}{ccccc}1& a_{\max }& a_{\max }^2& a_{\max }^3& \cdots \\ a_{\max }& 1& a_{\max }& a_{\max }^2& \cdots \\ a_{\max }^2& a_{\max }& 1& a_{\max }& \cdots \\ & & ⋮& \end{array}\right]$, where i is satellite index. Its dimension is determined by the number of time instants when the satellite is visible within M epochs. If it is visible throughout, then the determinant of the sub-matrix is ${(1-a_{\max }^2)}^{(M-1)}$. It is greater than zero, and approaches zero as M increases, but theoretically is not equal to zero for a finite M. All leading principal minors are also positive. Thus, each sub-matrix is positive definite, and has all positive eigenvalues. Combining all sub-matrices, one can say that ${\Psi }_{\max }$ is positive definite.

In case of $\Psi$, following Equations (26) and (27), the sub-matrix is of the form ${\Psi }_{\mathrm{sub}}^i$ = $\left[\begin{array}{ccccc}1& a_{11}& a_{11}{a}_{21}& a_{11}{a}_{21}{a}_{31}& \cdots \\ a_{11}& 1& a_{21}& a_{21}{a}_{31}& \cdots \\ a_{11}{a}_{21}& a_{21}& 1& a_{31}& \cdots \\ & & ⋮& \end{array}\right]$, where $a_{11}$, $a_{21}$, and $a_{31}$ are values of $a_{\ell 1}$ at epochs $t_{\ell }$ = $t_1$, $t_2$ and $t_3$, respectively. Its determinant is ${\prod }_{\ell =1}^{(M-1)}(1-a_{\ell 1}^2)$. Using the same argument as earlier, $\Psi$ is positive definite. Since ${\tilde{\mathbf{S}}}^{\prime }$ has full column rank, ${\Psi }_1$ (=${{\tilde{\mathbf{S}}}^{\prime }}^T\Psi {\tilde{\mathbf{S}}}^{\prime }$) is also positive definite. This implies that there exists a matrix ${\Psi }_2$ such that ${\Psi }_1$ = ${\Psi }_2{{\Psi }_2}^T$.

For $a_{\ell 1}$ between $[a_{min},a_{max}]$, it is evident from the mathematical expressions that the determinant of ${\Psi }_{\mathrm{sub},\max }^i$, $|{\Psi }_{\mathrm{sub},\max }^i|$ ≤ $|{\Psi }_{\mathrm{sub}}^i|$. ${\Psi }_{\mathrm{sub},\max }^i$ can also be written as ${\Psi }_{\mathrm{sub},\max }^i$ = ${\Psi }_{\mathrm{sub}}^i$ + $\Delta {\Psi }_{\mathrm{sub}}^i$, where all diagonal terms of $\Delta {\Psi }_{\mathrm{sub}}^i$ are zero, and off-diagonal terms are positive ∀$a_{\ell 1}$ ≠ $a_{max}$. This is equivalent to perturbing ${\Psi }_{\mathrm{sub}}^i$ so as to make it move closer to singularity. Hence, the condition number of ${\Psi }_{\mathrm{sub},\max }^i$ (ratio of maximum to minimum eigenvalue for a symmetric matrix) would be greater. Figure 3 justifies this for different M by generating ${\Psi }_{\mathrm{sub}}^i$${10}^4$ times for each M with uniformly random $a_{\ell 1}$ between $[a_{min},a_{max}]$, and comparing its eigenvalues with those of ${\Psi }_{\mathrm{sub},\max }^i$. From the figure, it can be concluded that the minimum (or maximum) eigenvalue of ${\Psi }_{\mathrm{sub},\max }^i$ is less (or greater) than the respective eigenvalue of ${\Psi }_{\mathrm{sub}}^i$, when $a_{\ell 1}$s are not equal to $a_{max}$. Thus, the maximum and minimum eigenvalues of $\Psi$ can be related to those of ${\Psi }_{\max }$ as

$${\lambda }_{\Psi }^{\max }\le {\lambda }_{\Psi ,max}^{\max },{\lambda }_{\Psi }^{\min }\ge {\lambda }_{\Psi ,max}^{\min }$$

(30)

where ${\lambda }_{\mathbf{J}}$ represents an eigenvalue of a matrix $\mathbf{J}$ and its superscript shows if it is maximum or minimum. Equation (30) will be useful while discussing the second test statistic.

Figure 3. Comparison of maximum and minimum eigenvalues of ${\Psi }_{\mathrm{sub}}^i$ and ${\Psi }_{\mathrm{sub},\max }^i$ for different M. There are ${10}^4$ values for each M. Upper and lower limits are shown, ∀$a_{\ell 1}$ = $a_{min}$ and $a_{\ell 1}$ = $a_{max}$. This figure can be regenerated with the Matlab program, matlab_prog_figures_3_A1.m provided in the Supplementary Materials.

5.1.2. Formulation of Θ for First Test Statistic

Next, $\Theta$ is determined so that the fault detection threshold of ${\alpha }_j^{\prime }$ can be obtained. For ease of understanding, ${({\alpha }_j^{\prime })}^2$ and the mathematical model of $\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}$ are repeated here.

$$\begin{array}{cc}\hfill {({\alpha }_j^{\prime })}^2& ={\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}}^T{\tilde{\mathbf{S}}}^{\prime }{{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }{{\tilde{\mathbf{S}}}^{\prime }}^T\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}={\Delta {\underline{\tilde{\mathbf{\rho }}}}^{\prime }}^T\left({{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }\right)\Delta {\underline{\tilde{\mathbf{\rho }}}}^{\prime }\hfill \end{array}$$

(31)

$$\begin{array}{cc}\hfill \Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}& ={\mathbf{H}}^{*}\Delta {\underline{\varkappa }}_p+{\underline{\mathbf{\eta }}}_1\hfill \end{array}$$

(32)

Since ${\tilde{\mathbf{S}}}^{\prime }{{\tilde{\mathbf{S}}}^{\prime }}^T$ removes ${\mathbf{H}}^{*}\Delta {\underline{\varkappa }}_p$ from $\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}$, the distribution of ${({\alpha }_j^{\prime })}^2$ is determined by the measurement error ${\underline{\mathbf{\eta }}}_1$. Hence, only ${\underline{\mathbf{\eta }}}_1$ of $\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}$ will be considered in subsequent derivations. Using measurement error, Equation (31) results in

$${{\underline{\mathbf{\eta }}}_2}^T\left({{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }\right){\underline{\mathbf{\eta }}}_2$$

(33)

Replacing ${\underline{\mathbf{\eta }}}_2$ with ${\Psi }_2{\underline{\mathbf{\eta }}}_3$, where ${\underline{\mathbf{\eta }}}_3$ has unit-variance independent elements (since $E({\underline{\mathbf{\eta }}}_2{\underline{\mathbf{\eta }}}_2^T)={\Psi }_1$ = ${\Psi }_2{\Psi }_2^T$)

$${{\underline{\mathbf{\eta }}}_3}^T{{\Psi }_2}^T\left({{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }\right){\Psi }_2{\underline{\mathbf{\eta }}}_3$$

(34)

Putting ${\Theta }_2$ in place of ${{\Psi }_2}^T\left({{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }\right){\Psi }_2$

$${{\underline{\mathbf{\eta }}}_3}^T{\Theta }_2{\underline{\mathbf{\eta }}}_3$$

(35)

Reference [49] proves that the fault detection threshold of the preceding term can be obtained from the Chi square distribution if the maximum eigenvalue of ${\Theta }_2$ is less than or equal to one. $\Theta$ is determined next to satisfy this. If ${\lambda }_{\Theta ,2}$ is an eigenvalue of ${\Theta }_2={{\Psi }_2}^T\left({{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }\right){\Psi }_2$, and $\underline{\mathbf{v}}$ is the corresponding eigenvector, then

$${{\Psi }_2}^T\left({{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }\right){\Psi }_2\underline{\mathbf{v}}={\lambda }_{\Theta ,2}\underline{\mathbf{v}}$$

(36)

Multiplying ${\Psi }_2$ on either side and denoting ${\Psi }_2\underline{\mathbf{v}}$ as ${\underline{\mathbf{v}}}_1$

$${\Psi }_2{{\Psi }_2}^T\left({{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }\right){\underline{\mathbf{v}}}_1={\lambda }_{\Theta ,2}{\underline{\mathbf{v}}}_1$$

Replacing ${\Psi }_2{{\Psi }_2}^T$ with ${\Psi }_1$ and $\left({{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }\right)$ with ${\Theta }_1$, it is clear that the eigenvalues of ${\Psi }_1{\Theta }_1$ (denoted by $\Omega$ later) are identical with those of ${\Theta }_2$. Therefore, in subsequent derivations, the eigenvalues of $\Omega$ will be considered.

The following form of $\Theta$ is proposed.

$$\Theta ={(c\mathbf{I}+\Psi )}^{-1}$$

(37)

where c is a positive scale factor, which is determined such that the maximum eigenvalue of $\Omega$ is less than or equal to unity. From the preceding equation it is evident that for a positive value of c, $\Theta$ is a positive definite matrix. Since both ${\tilde{\mathbf{S}}}^{\prime }$ and ${\Psi }_2$ have full column rank, ${{\Psi }_2}^T\left({{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }\right){\Psi }_2$ or $\Omega$ (=${\Psi }_1{\Theta }_1$) have all positive eigenvalues. Next, it will be proved that there is a value of c, for which the maximum eigenvalue of $\Omega$, ${\lambda }_{\Omega }^{\max }$ is less than unity. If ${\left|\right|.\left|\right|}_2$ is the 2-norm of a matrix

$${\lambda }_{\Omega }^{\max }<\left|\right|{\Psi }_1{\Theta }_1{\left|\right|}_2\le \left|\right|{\Psi }_1{\left|\right|}_2\left|\right|{\Theta }_1{\left|\right|}_2\le {\left|\right|\Psi \left|\right|}_2{\left|\right|\Theta \left|\right|}_2$$

(38)

It should be noted that $\left|\right|{\tilde{\mathbf{S}}}^{\prime }{\left|\right|}_2$ is unity. Since both $\Psi$ and $\Theta$ are symmetric, their maximum eigenvalues are equal to respective 2-norms. Hence, ${\lambda }_{\Psi }^{\max }$ = ${\left|\right|\Psi \left|\right|}_2$ and ${\lambda }_{\Theta }^{\max }$ = ${\left|\right|\Theta \left|\right|}_2$. An expression of ${\lambda }_{\Theta }^{\max }$ is derived next. If ${\lambda }_{\mathbf{J}}$ represents an eigenvalue of a matrix $\mathbf{J}$, then it can be easily shown that

$${\lambda }_{(c\mathbf{I}+\Psi )}=c+{\lambda }_{\Psi }$$

(39)

For matrix $\Theta ={(c\mathbf{I}+\Psi )}^{-1}$, ${\lambda }_{\Theta }$ = $1/(c+{\lambda }_{\Psi })$. Thus, the maximum eigenvalue of $\Theta$, ${\lambda }_{\Theta }^{\max }$ = $1/(c+{\lambda }_{\Psi }^{\min })$, where ${\lambda }_{\Psi }^{\min }$ is the minimum eigenvalue of $\Psi$. Therefore,

$${\left|\right|\Psi \left|\right|}_2{\left|\right|\Theta \left|\right|}_2={\displaystyle \frac{{\lambda }_{\Psi }^{\max }}{(c+{\lambda }_{\Psi }^{\min })}}$$

(40)

If c is chosen equal to $({\lambda }_{\Psi }^{\max }-{\lambda }_{\Psi }^{\min })$, ${\lambda }_{\Omega }^{\max }$ is less than unity.

However, the above c results in a large FMS corresponding to the first test statistic. Since the FMS of the first test statistic significantly contributes to determining the PL, it should be reduced by selecting a small c. A computationally efficient algorithm to adaptively find $\Theta$ for ${\alpha }_1^{\prime }$ at every epoch is provided in Appendix C. $\Psi$ is recursively computed at every $t_k$ with ${\Psi }_{\mathrm{sub}}^i$ for all satellites. It should be noted that even after a satellite sets, its measurement innovations are used to form test statistics as long as they are within N epochs from the current epoch.

5.1.3. Formulation of Θ for Second Test Statistic

$\Psi$ and ${\Psi }_{\max }$ for the second test statistic, ${\alpha }_2$ can be formulated the same way as before, but for $(N-M)$ epochs. As the FMS corresponding to ${\alpha }_2$ is generally small, $\Theta$ for it is calculated as

$${(c\mathbf{I}+{\Psi }_{\max })}^{-1}$$

(41)

where c is provided after Equation (40), but calculated with the minimum and maximum eigenvalues of ${\Psi }_{\max }$. In this case,

$${\lambda }_{\Omega }^{\max }{<\left|\right|\Psi \left|\right|}_2{\left|\right|\Theta \left|\right|}_2={\displaystyle \frac{{\lambda }_{\Psi }^{\max }}{(c+{\lambda }_{\Psi ,\max }^{\min })}}$$

(42)

Substituting for c and using Equation (30), it is evident that ${\lambda }_{\Omega }^{\max }$< 1. $\Theta$ can be pre-determined for various $(N-M)$. Since ${\Psi }_{\max }$ can be put in the form of a block diagonal matrix, it is sufficient to pre-calculate the inverse of $(c\mathbf{I}+{\Psi }_{\mathrm{sub},\max }^i)$ for various $(N-M)$. ${\Psi }_{\mathrm{sub},\max }^i$ and its pre-calculated inverse are loaded into the program. With this, $\Theta$ is appropriately formed at every $t_k$ for all visible satellites over epochs $t_{k-N+1}$ to $t_{k-M}$. If a satellite q is visible for a shorter time during this interval, then part of $\Theta$ corresponding to ${\Psi }_{\mathrm{sub},\max }^q$ is recursively calculated starting from ${(c\mathbf{I}+{\Psi }_{\mathrm{sub},\max }^i)}^{-1}$, following [50]. Satellite i is assumed to be visible for the longest duration over $(N-M)$ epochs. Hence, ${\lambda }_{\Psi ,\max }^{\min (\mathrm{or}\max )}$ = minimum (or maximum) eigenvalue of ${\Psi }_{\mathrm{sub},\max }^i$. Next, the final form of test statistics and their thresholds are discussed.

5.1.4. Test Statistics and Thresholds

In this work, the third test formulated with all discarded terms of epochs before $t_{k-N+1}$ is not performed. The following subsection computes a bound on the contributions of the discarded terms to mean position error without requiring an FMS (or a corresponding test). Thus, Equation (3) is modified as

$$\begin{array}{cc}\hfill {\alpha }_j^2& ={\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}}^T{\tilde{\mathbf{S}}}^{\prime }{{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }{{\tilde{\mathbf{S}}}^{\prime }}^T\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}+\sum _{\ell =p_j}^{m_j}\left(\Delta {\underline{\dot{\mathbf{\rho }}}}_{\ell }^T{{\mathbf{W}}_{rr,\ell }}^{-1}(\mathbf{I}-{\mathbf{G}}_{\ell }^{rr})\Delta {\underline{\dot{\mathbf{\rho }}}}_{\ell }\right)\hfill \end{array}$$

(43)

where j = 1, 2. Since ${\tilde{\mathbf{S}}}^{\prime }{{\tilde{\mathbf{S}}}^{\prime }}^T$ is a block diagonal matrix with each block from an epoch, elements of the vector ${\tilde{\mathbf{S}}}^{\prime }{{\tilde{\mathbf{S}}}^{\prime }}^T\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}$ corresponding to an epoch are calculated at that epoch and then stacked along with those of other epochs. This eliminates unnecessarily large matrix multiplications.

With the designed $\Psi$ and $\Theta$, fault detection thresholds, $T_{th,1}^2$ for ${\alpha }_1^2$ and $T_{th,2}^2$ for ${\alpha }_2^2$, can be determined from the Chi square distribution with probability $P_{FA}/2$ and DOF = ${\sum }_{\ell =p_j}^{m_j}2(n-n_{\mathrm{null}})$, where $n_{\mathrm{null}}$ is the dimension of the null space of $(\mathbf{I}-{\mathbf{G}}_{\ell }^{*})$. The number two is multiplied for the second term of Equation (43). If either ${\alpha }_1$ exceeds $T_{th,1}$ or ${\alpha }_2$ exceeds $T_{th,2}$ or both happen, a fault is declared. Calculation of the mean position error bounds is detailed next.

5.2. Mean Position Error Bounds under Faults

Changes to mean position error bound computation mentioned in Section 3.2 are explained in this subsection. Since the contribution of nonlinear measurement model (see Equations (6) and (7) and discussion after them) was found to be very small, it is not considered in this paper. Next, the three terms under the summation of Equation (7) are discussed for the vertical position error (VPE). Terms for horizontal position error (HPE) are changed accordingly. The mean position error, ${\underline{\mu }}_k^{\prime }$ at time $t_k$ in the north-east-down (NED) frame is

$$\begin{array}{cc}\hfill {\underline{\mu }}_k^{\prime }& =-\underset{\mathrm{discarded}\mathrm{terms}}{\underbrace{\sum _{j=N-1}^{k-(m+1)}{\mathbf{B}}_{k-j}^{\prime }{\underline{\mathit{f}}}_{k-m-j}}}-\underset{N\mathrm{terms}\mathrm{corresponding}\mathrm{to}{\alpha }_1\&{\alpha }_2}{\underbrace{\left(\sum _{j=0}^{N-2}{\mathbf{B}}_{k-j}^{\prime }{\underline{\mathit{f}}}_{k-m-j}+{\mathbf{K}}_{s,k}^{\prime }{\underline{\mathit{f}}}_{k-m+1}\right)}}\hfill \end{array}$$

(44)

where ${\underline{\mu }}_k^{\prime }$ = ${\mathbf{C}}_e^n{\underline{\mu }}_k(1:2:5)$, ${\underline{\mu }}_k$ is the mean error of all estimated states and $(1:2:5)$ represents elements for the position states, ${\mathbf{B}}_{k-j}^{\prime }$ = ${\mathbf{C}}_e^n{\mathbf{B}}_{k-j}(1:2:5,:)$, ${\mathbf{B}}_{k-j}$ = $\left[{\prod }_{\ell =k}^{k-j}{\mathbf{A}}_{\ell }\right]{\mathbf{K}}_{s,k-j-1}$, ${\mathbf{A}}_{\ell }=(\mathbf{I}-{\mathbf{K}}_{s,\ell }{\mathbf{C}}_{s,\ell }){\mathbf{F}}_{s,\ell -1}$. ${\mathbf{K}}_s$, ${\mathbf{F}}_s$ and ${\mathbf{C}}_s$ are Kalman gain, state transition and measurement model matrices of estimated SKF states, respectively. They are defined in Appendix B. ${\mathbf{K}}_{s,k}^{\prime }$ = ${\mathbf{C}}_e^n{\mathbf{K}}_{s,k}(1:2:5,:)$, where $\mathbf{J}(1:2:5,:)$ has rows one, three and five of matrix $\mathbf{J}$. ${\mathbf{C}}_e^n$ is the ECEF to NED frame coordinate transformation matrix. N terms corresponding to two test statistics and discarded terms are separately grouped with under braces. Fault is assumed to have started at an epoch m and denoted by vector ${\underline{\mathit{f}}}_{k-m+1}$ at $t_k$. Up to two independent satellite faults are considered. As noted earlier, three or more faults are not monitored. Thus, for any two satellites $s_1$ and $s_2$, ${\underline{\mathit{f}}}_{k-m+1}(s_1)=b_{1,k-m+1}$, ${\underline{\mathit{f}}}_{k-m+1}(s_1+n)={\dot{b}}_{1,k-m+1}$, ${\underline{\mathit{f}}}_{k-m+1}(s_2)=b_{2,k-m+1}$, ${\underline{\mathit{f}}}_{k-m+1}(s_2+n)={\dot{b}}_{2,k-m+1}$ and all other elements of ${\underline{\mathit{f}}}_{k-m+1}$ are zero. For SF cases, only $s_{1}th$ satellite is assumed faulty. The vertical component of mean position error bound for ${\alpha }_1$ under fault mode i, $VP{E}_{1,i}^U$ is calculated as follows.

5.2.1. $VP{E}_{1,i}^U$

For a fault mode i (=$1,\dots ,N_{fault}$), square of the maximum FMS [20] corresponding to the first test statistic ${\alpha }_1$ with terms of M time epochs from k to $k-M+1$ is given by

$$(\mathrm{maximum}{\mathrm{FMS})}_{\alpha 1,i}^2=\underset{{\underline{\mathit{f}}}_w^T\Lambda {\underline{\mathit{f}}}_w=\Gamma }{max}{\displaystyle \frac{{\underline{\mathit{f}}}_w^T\mathbf{L}{\underline{\mathit{f}}}_w}{{\underline{\mathit{f}}}_w^T\Lambda {\underline{\mathit{f}}}_w}}$$

(45)

where ${\underline{\mathit{f}}}_w$, the worst-case fault vector, maximizes the FMS. A pictorial depiction of FMS is provided in Figure 4.

Figure 4. Illustration of FMS for a hypothetical two dimensional fault vector. The maximum FMS (FMS${}_{max}$) for each ellipse is the same. The mean position error bound is the product of maximum FMS and $\sqrt{\Gamma }$.

For a DF mode in satellites $s_1$ and $s_2$, $\mathbf{L}$ is

$$\begin{array}{c}\hfill \mathbf{L}=[{\mathbf{B}}_{k-(M-2)}^{\prime }(3,s_1){\mathbf{B}}_{k-(M-2)}^{\prime }(3,s_1+n){\mathbf{B}}_{k-(M-2)}^{\prime }(3,s_2)\\ \hfill {\mathbf{B}}_{k-(M-2)}^{\prime }(3,s_2+n)\dots {\mathbf{B}}_k^{\prime }(3,s_1){\mathbf{B}}_k^{\prime }(3,s_1+n)\\ \hfill {\mathbf{B}}_k^{\prime }(3,s_2){\mathbf{B}}_k^{\prime }(3,s_2+n){\mathbf{K}}_{s,k}^{\prime }(3,s_1){\mathbf{K}}_{s,k}^{\prime }(3,s_1+n)\\ \hfill {\mathbf{K}}_{s,k}^{\prime }(3,s_2){\mathbf{K}}_{s,k}^{\prime }(3,s_2+n){]}^T\\ \hfill \times [{\mathbf{B}}_{k-(M-2)}^{\prime }(3,s_1){\mathbf{B}}_{k-(M-2)}^{\prime }(3,s_1+n){\mathbf{B}}_{k-(M-2)}^{\prime }(3,s_2)\\ \hfill {\mathbf{B}}_{k-(M-2)}^{\prime }(3,s_2+n)\dots {\mathbf{B}}_k^{\prime }(3,s_1){\mathbf{B}}_k^{\prime }(3,s_1+n)\\ \hfill {\mathbf{B}}_k^{\prime }(3,s_2){\mathbf{B}}_k^{\prime }(3,s_2+n){\mathbf{K}}_{s,k}^{\prime }(3,s_1){\mathbf{K}}_{s,k}^{\prime }(3,s_1+n)\\ \hfill {\mathbf{K}}_{s,k}^{\prime }(3,s_2){\mathbf{K}}_{s,k}^{\prime }(3,s_2+n)]& \hfill \end{array}$$

(46)

where ‘×’ represents matrix multiplication operation. Although it is not evident, the number of visible satellites, n can vary across epochs. ${\underline{\mathit{f}}}_w$ has the corresponding $b_1$, ${\dot{b}}_1$, $b_2$ and ${\dot{b}}_2$ terms from Equation (44). For a SF mode, elements for only satellite $s_1$ are considered.

It should be noted that for the HPE, first and second rows of ${\mathbf{B}}^{\prime }$ and ${\mathbf{K}}_s^{\prime }$ are used to form $\mathbf{L}$. ${\underline{\mathit{f}}}_w$ is composed of the corresponding $b_1$, ${\dot{b}}_1$, $b_2$ and ${\dot{b}}_2$ terms. $\Lambda$ of Equation (45) is given as

$$\begin{array}{cc}\hfill \Lambda =& \left[\begin{array}{cc}{\Theta }_3& \left[\mathbf{0}\right]\\ \left[\mathbf{0}\right]& {\Theta }_4\end{array}\right]\hfill \end{array}$$

(47)

where ${\Theta }_3$ is formed with terms of ${\tilde{\mathbf{W}}}^{-1/2}{\tilde{\mathbf{S}}}^{\prime }{{\tilde{\mathbf{S}}}^{\prime }}^T\Theta {\tilde{\mathbf{S}}}^{\prime }{{\tilde{\mathbf{S}}}^{\prime }}^T{\tilde{\mathbf{W}}}^{-1/2}$ of Equation (43) corresponding to faulty satellites of a fault mode. $\tilde{\mathbf{W}}$ is a block diagonal matrix whose ℓth block is ${\mathbf{W}}_{\ell }$, and $\Delta {\underline{\tilde{\mathbf{\rho }}}}^{*}$ = ${\tilde{\mathbf{W}}}^{-1/2}\Delta \underline{\tilde{\mathbf{\rho }}}$. ${\Theta }_4$ is a diagonal matrix with diagonal entries constituted from relevant terms of ${{\mathbf{W}}_{rr,\ell }}^{-1}(\mathbf{I}-{\mathbf{G}}_{\ell }^{rr})$, ℓ = k (=$p_1$), $k-1$, …, $k-M+1$ (=$m_1$), of Equation (43). $(\mathrm{maximum}{\mathrm{FMS})}_{\alpha 1,i}$ is given by the square root of the maximum eigenvalue of $\mathbf{L}{\Lambda }^{-1}$, ${\lambda }_{\mathbf{L}{\Lambda }^{-1}}^{\max }$. Since ${\Theta }_4$ is a diagonal matrix, ${\Lambda }^{-1}$ requires the inverse of an $M\times M$ matrix for SF cases and $2M\times 2M$ matrix for DF cases. Thus, the upper bound of mean VPE corresponding to ${\alpha }_1$ for fault mode i is

$${\mathrm{VPE}}_{i,1}^U=\sqrt{{\lambda }_{\mathbf{L}{\Lambda }^{-1}}^{\max }\Gamma }$$

(48)

where $\Gamma$ = ${\underline{\mathit{f}}}_w^T\Lambda {\underline{\mathit{f}}}_w$. It is determined next corresponding to the allocated probability of missed detection for fault mode i, $P_{MD,i}^{alloc}$. $P_{MD,i}^{alloc}$ for SF and DF modes is

$$\begin{array}{cc}\hfill P_{MD,i}^{alloc}& =P_{HMI,3}^{alloc,sf}/(n^{max}{P}_F)(\mathrm{for}\mathrm{SF}\mathrm{modes})\hfill \\ \hfill P_{MD,i}^{alloc}& =P_{HMI,3}^{alloc,df}/(0.5n^{max}(n^{max}-1)P_F^2)(\mathrm{for}\mathrm{DF}\mathrm{modes})\hfill \end{array}$$

(49)

where $n^{max}$ is the maximum number of visible satellites.

Using Equation (35), and putting pseudorange rate measurement error, ${\underline{\mathbf{\eta }}}_4$ in place of pseudorange rate innovations, $\Delta {\underline{\dot{\mathbf{\rho }}}}_{\ell }$ for the same reason as that discussed before Equation (33), Equation (43) for ${\alpha }_1$ is written as

$$\begin{array}{cc}\hfill {\alpha }_1^2& ={{\underline{\mathbf{\eta }}}_3}^T{\Theta }_2{\underline{\mathbf{\eta }}}_3+\sum _{\ell =p_1}^{m_1}\left({\underline{\mathbf{\eta }}}_{4,\ell }^T{{\mathbf{W}}_{rr,\ell }}^{-1}(\mathbf{I}-{\mathbf{G}}^{rr,\ell }){\underline{\mathbf{\eta }}}_{4,\ell }\right)\hfill \end{array}$$

(50)

Replacing ${\mathbf{W}}_{rr,\ell }^{-1/2}{\underline{\mathbf{\eta }}}_{4,\ell }$ with ${\underline{\mathbf{\eta }}}_{5,\ell }$, and ${\mathbf{W}}_{\mathbf{rr},\ell }^{-1/2}{\mathbf{H}}_{\ell }{({\mathbf{H}}_{\ell }^T{\mathbf{W}}_{\mathbf{rr},\ell }^{-1}{\mathbf{H}}_{\ell })}^{-1}{\mathbf{H}}_{\ell }^T{\mathbf{W}}_{\mathbf{rr},\ell }^{-1/2}$ with ${\mathbf{G}}_{\ell }^{rr,*}$

$$\begin{array}{cc}\hfill {\alpha }_1^2& ={{\underline{\mathbf{\eta }}}_3}^T{\Theta }_2{\underline{\mathbf{\eta }}}_3+\sum _{\ell =p_1}^{m_1}\left({\underline{\mathbf{\eta }}}_{5,\ell }^T(\mathbf{I}-{\mathbf{G}}_{\ell }^{rr,*}){\underline{\mathbf{\eta }}}_{5,\ell }\right)\hfill \end{array}$$

(51)

Similar to Equation (15)

$$(\mathbf{I}-{\mathbf{G}}_{\ell }^{rr,*})={\mathbf{S}}_{\ell }^{rr}(1:n,1:n-n_{\mathrm{null}}){({\mathbf{S}}_{\ell }^{rr}(1:n,1:n-n_{\mathrm{null}}))}^T$$

(52)

Replacing ${\mathbf{S}}_{\ell }^{rr}(1:n,1:n-n_{\mathrm{null}})$ with ${{\mathbf{S}}_{\ell }^{rr,}}^{\prime }$, and substituting Equation (52) into Equation (51)

$${\alpha }_1^2={{\underline{\mathbf{\eta }}}_3}^T{\Theta }_2{\underline{\mathbf{\eta }}}_3+\sum _{\ell =p_1}^{m_1}\left({\underline{\mathbf{\eta }}}_{5,\ell }^T{{\mathbf{S}}_{\ell }^{rr,}}^{\prime }{({{\mathbf{S}}_{\ell }^{rr,}}^{\prime })}^T{\underline{\mathbf{\eta }}}_{5,\ell }\right)$$

(53)

Putting ${\left({\Theta }_2\right)}^{1/2}{\underline{\mathbf{\eta }}}_3$ as ${\underline{\mathbf{\eta }}}_6$(${\left({\Theta }_2\right)}^{1/2}$ is the matrix square root of ${\Theta }_2$), and stacking ${({{\mathbf{S}}_{\ell }^{rr,}}^{\prime })}^T{\underline{\mathbf{\eta }}}_{5,\ell }$ for all relevant values of ℓ in ${\underline{\mathbf{\eta }}}_7$

$${\alpha }_1^2={{\underline{\mathbf{\eta }}}_6}^T{\underline{\mathbf{\eta }}}_6+{{\underline{\mathbf{\eta }}}_7}^T{\underline{\mathbf{\eta }}}_7$$

(54)

With known error covariance of pseudorange rate measurements, ${\underline{\mathbf{\eta }}}_7$ has unit-variance independent elements. Hence, its covariance is identity matrix. Since ${\underline{\mathbf{\eta }}}_3$ also consists of unit-variance independent elements (see before Equation (34)), the covariance of ${\underline{\mathbf{\eta }}}_6$ is ${\Theta }_2$. It was shown in the previous subsection that the eigenvalues of ${\Theta }_2$ lie between zero and one. The error covariance of ${\left[{{\underline{\mathbf{\eta }}}_6}^T{\underline{\mathbf{\eta }}}_7^T\right]}^T$ (=$\underline{\tilde{\mathbf{\eta }}}$) denoted as $\tilde{\Theta }$ is a block diagonal matrix. The first block is ${\Theta }_2$, and the second block is identity matrix. Thus, the maximum eigenvalue of $\tilde{\Theta }$, ${\lambda }_{\tilde{\Theta }}^{\max }$ is unity. The minimum eigenvalue ${\lambda }_{\tilde{\Theta }}^{\min }$ is greater than zero and equal to the minimum eigenvalue of ${\Theta }_2$. Although not considered in this paper, unknown error covariance of pseudorange rate measurements can be accommodated following [49]. If the mean of $\underline{\tilde{\mathbf{\eta }}}$ due to faults is represented as $\underline{\tilde{\mathit{f}}}$, then the probability of missed detection $P_{MD}$ is given by

$$P_{MD}={\int }_{{\underline{\tilde{\mathbf{\eta }}}}^T\underline{\tilde{\mathbf{\eta }}}⩽T_{th,1}^2}\mathcal{N}(\underline{\tilde{\mathbf{\eta }}},\tilde{\Theta },\underline{\tilde{\mathit{f}}})dV$$

(55)

where $\mathcal{N}$ stands for multi-variate Gaussian distribution, and V is the variable of integration. The square of magnitude of $\underline{\tilde{\mathit{f}}}$, ${\underline{\tilde{\mathit{f}}}}^T\underline{\tilde{\mathit{f}}}$, is $\Gamma$, which is the same as ${\underline{\mathit{f}}}_w^T\Lambda {\underline{\mathit{f}}}_w$ under fault mode i (see after Equation (48)). Let the non-central Chi square distribution $P_{ncx}({(T_{th,1}^{*})}^2,\mathrm{DOF},{\Gamma }^{*})$ with non-centrality parameter ${\Gamma }^{*}$ and for some threshold ${(T_{th,1}^{*})}^2$ have a probability $P_1$, then $P_{MD}$ ⩽ $P_1$ if [49]

$$\begin{array}{cc}\hfill {(T_{th,1}^{*})}^2& ={\displaystyle \frac{1}{{({\lambda }_{\tilde{\Theta }}^{\min })}^2}}{T}_{th,1}^2\hfill \\ \hfill \sqrt{{\Gamma }^{*}}& =(\sqrt{\Gamma }-T_{th,1})+T_{th,1}^{*}\hfill \end{array}$$

(56)

If ${\Gamma }^{*}$ is obtained such that $P_{ncx}({(T_{th,1}^{*})}^2,\mathrm{DOF},{\Gamma }^{*})$ = $P_{MD,i}^{alloc}$, DOF = number of rows/columns of $\tilde{\Theta }$, and $\Gamma$ is calculated from Equation (56), then $P_{MD}$ ⩽ $P_{MD,i}^{alloc}$. This value of $\Gamma$ is used in Equation (48). A look up table of $\Gamma$ is prepared for different values of $1/{({\lambda }_{\tilde{\Theta }}^{\min })}^2$ and DOF using $P_{MD,i}^{alloc}$. It is justified in the beginning of Appendix D that $\Gamma$ increases with $1/{({\lambda }_{\tilde{\Theta }}^{\min })}^2$. Hence, $\Gamma$ pertaining to the entry in the look up table next higher than the calculated $1/{({\lambda }_{\tilde{\Theta }}^{\min })}^2$ is considered. The bound on mean VPE for ${\alpha }_2$ under fault mode i, $VP{E}_{2,i}^U$ is discussed next.

5.2.2. $VP{E}_{2,i}^U$

$VP{E}_{2,i}^U$ is calculated in a similar way to that of $VP{E}_{1,i}^U$. The major differences are as follows. First, it involves terms of $(N-M)$ epochs from $t_{k-M}$ to $t_{k-N+1}$. $(N-M)$ is generally found to be higher than M. Therefore, for the calculation of ${\Theta }_3$ of Equation (47), relevant rows of ${\tilde{\mathbf{W}}}^{-1/2}{\tilde{\mathbf{S}}}_k^{\prime }{\tilde{\mathbf{S}}}_k^{\prime T}$ are identified corresponding to the fault mode and then multiplied with $\Theta$. This way, large matrix multiplications, which take longer time, are avoided. ${\Lambda }^{-1}$ requires inverting an $(N-M)\times (N-M)$ matrix for an SF mode and a $2(N-M)\times 2(N-M)$ matrix for a DF mode. In simulation studies with realistic error models for airborne users, this is not found to be a time intensive operation. This will be evident later with algorithm execution times.

Second, $\Theta$ is pre-calculated using ${\Psi }_{\max }$ instead of the actual $\Psi$ to avoid forming a large $\Psi$ over $N-M$ epochs. ${\lambda }_{\tilde{\Theta }}^{\min }$ of Equation (56) is also calculated with ${\Psi }_{\max }$ in the place of $\Psi$. In order to ensure that the corresponding $\Gamma$ is overbounded, the following is justified in Appendix D. For a given probability $P_1$, $\Gamma$ increases with decreasing ${\lambda }_{\tilde{\Theta }}^{\min }$, and the calculated ${\lambda }_{\tilde{\Theta }}^{\min }$ is lower than the actual value obtained with $\Psi$.

The third bound $VP{E}_3^U$ accounts for the contributions of all discarded terms before epoch $t_{k-N+1}$ to the mean position error. Since it remains the same for all fault modes, the fault mode index i is dropped from its subscript. It is presented next.

5.2.3. $VP{E}_3^U$

As noted earlier, the third test with discarded terms has been eliminated in the current work. However, discarded terms may have an effect on current mean position error at $t_k$, which should be bounded by $VP{E}_3^U$. In this context, a pertinent question arises as to which faults should be considered for the bound. Suppose at a time epoch $t_{\ell }$, ${\underline{\mathit{f}}}_w^T\Lambda {\underline{\mathit{f}}}_w$ corresponding to a fault detection test is equal to $\Gamma$, which is determined from $P_{MD,i}^{alloc}$ under fault mode i. Hence, for any fault $\underline{\mathit{f}}$ under the same fault mode such that ${\underline{\mathit{f}}}^T\Lambda \underline{\mathit{f}}>\Gamma$, the probability of missed detection is less than $P_{MD,i}^{alloc}$ at $t_{\ell }$. Positinon error due to this fault is not bounded at $t_{\ell }$. It also need not be bounded at subsequent epochs. This is because if HMI occurs at $t_{\ell }$ due to this fault with missed detection probability less than $P_{MD,i}^{alloc}$, then bounding its contribution to position error at subsequent epochs holds little meaning. It can be explained with the help of the relative frequency approach of the probability theory. Thus, $VP{E}_3^U$ at $t_k$ bounds the contributions of faults with probability of missed detection more than the allocated probability corresponding to both ${\alpha }_1$ and ${\alpha }_2$ and all fault modes over all epochs from $t_1$ up to $t_{k-N}$. It should be noted that $VP{E}_{2,i}^U$, if obtained in a way similar to that of $VP{E}_3^U$, would be too large and inflate the PL to a great extent. Therefore, $VP{E}_{2,i}^U$ is not determined this way. ${\mathrm{VPE}}_3^U$ is [33]

$${\mathrm{VPE}}_3^U=U_{\max }{N}_{\max }\times {\displaystyle \frac{1\times {10}^{-6}}{1-0.1}}({\widehat{b}}_{\max }+{\dot{\widehat{b}}}_{\max })$$

(57)

For the HPE, the factor $1\times {10}^{-6}$ is modified to $\sqrt{2}\times {10}^{-6}$ to include north and east components. $N_{\max }$ is the maximum of all values of N up to $t_k$. N at an epoch is determined in the following way for an asymptotically stable filter. At an epoch $t_k$, the last $\mathbf{B}$ matrix (see after Equation (44) for definition) with 2-norm larger than or equal to $1\times {10}^{-6}$ is identified. If the magnitude of N at $t_{k-1}$ is more than the index of that $\mathbf{B}$ matrix, N is set to that index plus one. One is added to account for the new term at $t_k$. All $\mathbf{B}$ matrices with indices higher than updated $(N-1)$ are not considered anymore. On the other hand, if the index is the same as N at $t_{k-1}$, N is only increased by one to include the new term at $t_k$. All terms including $\mathbf{B}$ matrices from epochs before $t_{k-N+1}$ are discarded or deleted from memory. Note that a small threshold $1\times {10}^{-6}$ is chosen to calculate N. A smaller value can also be chosen, but that will increase N. $U_{\max }$ is an upper bound such that a discarded $\mathbf{B}$ matrix cannot have a 2-norm outside the range of $U_{\max }\times {10}^{-6}$ and zero after it is discarded. A computationally efficient algorithm to find $U_{\max }$ at each epoch is provided in [33]. The denominator of Equation (57) results from an infinite geometric series with common ratio $0.1$. Next, the maximum values of bias and bias rate, ${\widehat{b}}_{\max }$ and ${\dot{\widehat{b}}}_{\max }$, respectively from faults mentioned before Equation (57) are calculated differently in this paper as follows.

$$\begin{array}{cc}\hfill {\widehat{b}}_{\max }& =\sqrt{{\Gamma }_{\max }/s_{\min }},{\dot{\widehat{b}}}_{\max }=2\sqrt{{\Gamma }_{\max }/s_{\min }^{\prime }}\hfill \end{array}$$

(58)

Each term of the preceding equation is obtained next. ${\Gamma }_{\max }$ is the maximum of all $\Gamma$s calculated for SF and DF modes corresponding to ${\alpha }_1$ and ${\alpha }_2$ over all epochs up to $t_k$. Using ${\underline{\mathit{f}}}_w^T\Lambda {\underline{\mathit{f}}}_w$ = $\Gamma$, and the fact that ${\Theta }_4$ of $\Lambda$ in Equation (47) is a diagonal matrix, $s_{\min }^{\prime }$ is

$$s_{\min }^{\prime }=\underset{\forall \ell =1,\cdots ,k}{min}\underset{{\alpha }_1,{\alpha }_2}{min}\underset{i\in \mathrm{fault}\mathrm{modes}}{min}(min(\mathrm{diag}({\Theta }_4))$$

(59)

where the operator “min” denotes minimum over all terms provided below it or within parentheses next to it, and $\mathrm{diag}(.)$ has all diagonal elements of a square matrix. It should be noted that the multiplication of two in ${\dot{\widehat{b}}}_{\max }$ of Equation (58) accounts for DF modes (i.e., faults in any two pseudorange rate measurements).

In order to determine ${\widehat{b}}_{\max }$, ${\Theta }_3$ of $\Lambda$ in Equation (47) is used. If ${\underline{\mathit{f}}}_{\mathbf{\rho }}$ represents faults in only pseudorange measurements for a fault mode, then one can write

$$\begin{array}{cc}\hfill {\underline{\mathit{f}}}_{\mathbf{\rho }}^T{\Theta }_3{\underline{\mathit{f}}}_{\mathbf{\rho }}⩽& {\Gamma }_{\max }\hfill \end{array}$$

(60)

Multiplying and dividing ${\underline{\mathit{f}}}_{\mathbf{\rho }}^T{\underline{\mathit{f}}}_{\mathbf{\rho }}$ on the left-hand side

$$\begin{array}{cc}\hfill {\displaystyle \frac{{\underline{\mathit{f}}}_{\mathbf{\rho }}^T{\Theta }_3{\underline{\mathit{f}}}_{\mathbf{\rho }}}{{\underline{\mathit{f}}}_{\mathbf{\rho }}^T{\underline{\mathit{f}}}_{\mathbf{\rho }}}}({\underline{\mathit{f}}}_{\mathbf{\rho }}^T{\underline{\mathit{f}}}_{\mathbf{\rho }})⩽& {\Gamma }_{\max }\hfill \end{array}$$

(61)

Noting that the minimum value of ${\displaystyle \frac{{\underline{\mathit{f}}}_{\mathbf{\rho }}^T{\Theta }_3{\underline{\mathit{f}}}_{\mathbf{\rho }}}{{\underline{\mathit{f}}}_{\mathbf{\rho }}^T{\underline{\mathit{f}}}_{\mathbf{\rho }}}}$ is the minimum eigenvalue of ${\Theta }_3$, ${\lambda }_{\Theta ,\mathbf{3}}^{\min }$, ${\widehat{b}}_{\max }^2$(or $max\left({\underline{\mathit{f}}}_{\mathbf{\rho }}^T{\underline{\mathit{f}}}_{\mathbf{\rho }}\right)$) is given by

$$\begin{array}{cc}\hfill \left(\underset{\forall \ell =1,\cdots ,k}{min}\underset{{\alpha }_1,{\alpha }_2}{min}\underset{i\in \mathrm{fault}\mathrm{modes}}{min}{\lambda }_{\Theta ,3}^{\min }\right){\widehat{b}}_{\max }^2& ={\Gamma }_{\max }\hfill \end{array}$$

(62)

It is apparent that for ${\widehat{b}}_{\max }$, the two need not be multiplied as $\left({\underline{\mathit{f}}}_{\mathbf{\rho }}^T{\underline{\mathit{f}}}_{\mathbf{\rho }}\right)$ includes DF. Next, the PLs are determined.

5.3. Protection Levels (PLs)

The VPL is determined in this subsection without assuming statistical independence between test statistics and position error. The HPL can also be calculated the same way. The probabilities of HMI for the vertical position under NF, SF and DF are $P_{HMI,3}^{nf}$, $P_{HMI,3}^{sf}$ and $P_{HMI,3}^{df}$, respectively. Their allocated values are provided in Section 3. If ${ϵ}_v$ represents the absolute VPE, and ${\mathrm{VPL}}_{NF}$ is the VPL under NF, then by definition, $P_{HMI,3}^{nf}$ is

$$\begin{array}{cc}\hfill P_{HMI,3}^{nf}& =P(({ϵ}_v>{\mathrm{VPL}}_{NF})\cap (({\alpha }_1⩽T_{th,1})\cap ({\alpha }_2⩽T_{th,2}))|NF)\hfill \\ \hfill & =P(({ϵ}_v>{\mathrm{VPL}}_{NF})|NF)P((({\alpha }_1⩽T_{th,1})\cap \hfill \\ & ({\alpha }_2⩽T_{th,2}))|(ϵ>{\mathrm{VPL}}_{NF})|NF)\hfill \\ & ⩽P(({ϵ}_v>{\mathrm{VPL}}_{NF})|NF)\hfill \end{array}$$

(63)

Thus, ${\mathrm{VPL}}_{NF}$ is obtained by setting $P(({ϵ}_v>{\mathrm{VPL}}_{NF})|NF)$ equal to $P_{HMI,3}^{alloc,nf}$.

For an SF mode, $P_{HMI,3}^{sf}$ is given by

$$\begin{array}{cc}\hfill P_{HMI,3}^{sf}& =P(({ϵ}_v>{\mathrm{VPL}}_{SF})\cap (({\alpha }_1⩽T_{th,1})\cap ({\alpha }_2⩽T_{th,2}))|SF)n_f^s{P}_F\hfill \end{array}$$

(64)

where $n_f^s$ is the number of SF modes, VPL${}_{SF}$ is the VPL under SF, and $P_F$ is the prior probability of a satellite fault defined in Section 3. Representing the probability of missed detection for all SF modes as $P_{MD,sf}$ and following the same approach as before

$$\begin{array}{cc}\hfill P_{MD,sf}& ={\displaystyle \frac{P_{HMI,3}^{sf}}{n_f^s{P}_F}}=P(({ϵ}_v>{\mathrm{VPL}}_{SF})\cap (({\alpha }_1⩽T_{th,1})\cap ({\alpha }_2⩽T_{th,2}))|SF)\hfill \\ \hfill \mathrm{or},& P_{MD,sf}⩽P({\alpha }_1⩽T_{th,1}|SF)\hfill \\ \hfill \mathrm{or},& P_{MD,sf}⩽P({\alpha }_2⩽T_{th,2}|SF)\hfill \end{array}$$

(65)

$\Gamma$s for ${\alpha }_1$ and ${\alpha }_2$ are determined such that $P({\alpha }_1⩽T_{th,1}|SF)$≤$P_{MD,sf}^{alloc}$, and $P({\alpha }_2⩽T_{th,2}|SF)$≤$P_{MD,sf}^{alloc}$, respectively (see after Equation (56)). $P_{MD,sf}^{alloc}$ is equal to ${\displaystyle \frac{P_{HMI,3}^{alloc,sf}}{n_f^{s,max}{P}_F}}$. $n_f^{s,max}$ is the maximum value of $n_f^s$. VPL${}_{SF}$ is

$${\mathrm{VPL}}_{SF}=\sum _{j=1}^2\left(\underset{i\in \mathrm{SF}\mathrm{modes}}{max}VP{E}_{j,i}^U\right)+VP{E}_3^U+{\gamma }_s{\sigma }_v$$

(66)

where the operator “max” denotes maximum over all terms provided below it or within parentheses next to it. $P({ϵ}_v>{\gamma }_s{\sigma }_v)$ = $P_{MD,sf}^{alloc}$. ${\sigma }_v$ is the error standard deviation of the estimated vertical position.

Similarly for DF modes, the probability of missed detection, $P_{MD,df}$ is

$$\begin{array}{cc}\hfill P_{MD,df}& ⩽P({\alpha }_1⩽T_{th,1}|DF)\hfill \\ \hfill \mathrm{or},P_{MD,df}& ⩽P({\alpha }_2⩽T_{th,2}|DF)\hfill \end{array}$$

(67)

The corresponding $\Gamma$s are also calculated for DF modes. The VPL for DF modes, VPL${}_{DF}$ is

$${\mathrm{VPL}}_{DF}=\sum _{j=1}^2\left(\underset{i\in \mathrm{DF}\mathrm{modes}}{max}VP{E}_{j,i}^U\right)+VP{E}_3^U+{\gamma }_d{\sigma }_v$$

(68)

where $P({ϵ}_v>{\gamma }_d{\sigma }_v)$ = $P_{MD,df}^{alloc}$. $P_{MD,df}^{alloc}$ = ${\displaystyle \frac{P_{HMI,3}^{alloc,df}}{n_f^{d,max}{P}_F}}$, where $n_f^d$ is the number of DF modes, and $n_f^{d,max}$ is its maximum value.

The final VPL is

$$\mathrm{VPL}=max({\mathrm{VPL}}_{NF},{\mathrm{VPL}}_{SF},{\mathrm{VPL}}_{DF})$$

(69)

6. Simulation Studies

Primary coverage area of NavIC over the Indian sub-continent is chosen for simulation studies in this paper. A UAV is assumed to fly at an altitude of 184 m above the WGS84 reference ellipsoid at speed 10 m/s with a constant heading of $-45$${}^{\circ }$ for 20 min. UAV speed, altitude and flying time chosen are commensurate with those of small unmanned aircraft [51]. The starting point of the flight path is varied from 0${}^{\circ }$ to 40${}^{\circ }$ N latitudes and 60${}^{\circ }$ E to 105${}^{\circ }$ E longitudes in steps of 1${}^{\circ }$. There are a total of 1886 simulations, each of duration 20 min. Every 50 simulations, the start time is increased by 7.5 h. At a time, maximum twelve GPS satellites are simulated due to channel constraints of the simulation platform. Dual frequency GPS (L${}_1$ and L${}_5$) and NavIC (L${}_5$ and S) measurements are generated for the UAV flight path. Error models of carrier smoothed pseudorange measurements are discussed in Section 4 while describing SKF. White noise covariance of pseudorange rate measurements is obtained from the tracking error of a second order frequency locked loop (FLL) for 45 dB-Hz C/N${}_0$. The FLL is assumed to have a cross product discriminator, a coherent integration time of 10 ms and two-sided noise equivalent bandwidth of 4 Hz. Power spectral density of a temperature controlled crystal oscillator is considered for simulation of receiver clock error. Measurement update interval of both WLS and KF is one second.

VPLs and HPLs of the developed range-based KF RAIM algorithm are illustrated in Figure 5. Both GPS and NavIC constellations are considered. The geometric dilution of precision (GDOP) varies between 0.5 and 3.5. It is within $2.5$ for $97.6\%$ of the time as against 73.3% with GPS alone. For illustration purposes, PLs calculated every second are grouped into five bins, whose center points are indicated along the x-axis. Percentage of time along the y-axis is calculated as the ratio of the number of time instants at which the PL falls within a given range to the total number of time instants over all 1886 simulations times one hundred. KF VPL and HPL are within 40 m $97.16\%$ and $99.35\%$ of the time, respectively.

Figure 5. Histogram plots of PLs of KF range-based RAIM, and time evolution of KF PLs for highest and lowest GDOP scenarios. “Lowest DOP with GPS” indicates GPS-only scenario.

Evolution of PLs with time are also plotted in Figure 5 for specific GPS plus NavIC and GPS-only cases. For clarity, only two scenarios are selected. They have highest and lowest GDOPs corresponding to dual constellations. With the lowest GDOP, PLs are reduced by about 5 m to 15 m when both constellations are used as compared to PLs for GPS alone. For the highest GDOP, PLs are hundreds of thousands of meters with standalone GPS (having five-six visible satellites). This is shown separately in Figure 6 along with PLs of KF solution separation RAIM, with the assumption of a single satellite fault. Although not shown, a few other high GDOP cases are studied and found to have similar performance with GPS. Thus, it can be concluded that improvements obtained by using NavIC alongside GPS are more significant in poor geometries. M and N terms of KF range-based RAIM for a simulation are illustrated in Figure 7. They are of the same order in all simulations.

Figure 6. KF PLs with standalone GPS for scenario having the highest GDOP with dual constellations, assuming only single satellite fault.

Figure 7. Numbers of M and N terms of range-based KF RAIM for a simulation.

Having shown the PLs of range-based KF RAIM, its performance is compared against WLS range-based RAIM and KF solution separation RAIM using both constellations. Figure 8 depicts comparison results. Range-based KF RAIM has VPL within 3 to 11 m of that of range-based WLS RAIM $90.4\%$ of the time and HPL within −1 to 11 m $98.82\%$ of the time. Its VPL, on the other hand, is within −3 to 11 m of that of its solution separation counterpart $95.49\%$ of the time, and HPL is within −3 to 11 m $97.28\%$ of the time. Using a vertical alert limit of 50 m and horizontal alert limit of 40 m, availability of the three algorithms is shown in Table 1. Availability is calculated as the percentage of simulations, in which the PL is below the corresponding alert limit for the whole duration of 20 min. PL depends on both $P_{FA}$ and $P_{HMI}$, for which no proper values have yet been fixed for UAV applications. Thus, availability can only be treated as another way of comparing algorithm performances.

Figure 8. Performance comparison of all integrity algorithms over all simulations with GPS and NavIC. SS stands for solution separation. Along the x-axis, the difference between the center points of any two adjacent bins is 2 m.

Table 1. RAIM availability in percentage with GPS and NavIC.

Position	WLS Range-	KF Range-	KF Solution
	Based RAIM	Based RAIM	Separation
			RAIM
Vertical	99.63	97.4	99.68
Horizontal	99.63	97.4	99.63

It is apparent from the table that the two existing algorithms offer higher availability than range-based KF RAIM. It is observed that its PL sometimes exhibits an instantaneous change when a satellite sets or rises. If such a change can be smoothed out by some method, its availability would increase to 98.46% in the vertical direction and 98.89% in the horizontal direction. This will be carried out in future work.

All 1886 simulations were run in MATLAB on a DELL core i7-8700 (CPU @ 3.2 GHz) computer with a Linux operating system, and with 16 GB RAM and 20 GB swap memory. WLS range-based RAIM took 11 h to complete all simulations. Range-based KF RAIM algorithm needed 3 days and 16 h whereas KF solution separation RAIM required 9 days. In order to see execution times of the algorithms on a low end computer, time needed by them for a simulation on an IBM Thinkpad laptop is also noted. The laptop has Linux operating system, core 2 duo processor (CPU @ 2 GHz), 1 GB RAM and 2 GB swap memory. The three algorithms needed 20 s, 600 s and 1521 s, respectively, for a 20-min (1200 s) run. Time includes that needed for running the navigation filter as well. A few other simulations also took similar times. MATLAB tic and toc functions are used to record execution times.

Based on the above performance analyses, it can be concluded that WLS has the lowest execution time. However, since WLS is not preferred in advanced navigation methods, as noted earlier, KF-based RAIM algorithms are essential to ensuring reliability of such systems. Of the two KF algorithms, solution separation RAIM provides lower PLs, but has a much higher computational load. The computational burden can be reduced by fault grouping at the expense of inflated PLs [28].

Range-based KF RAIM, on the other hand, offers satisfactory performance to a certain extent with moderate computational resources, thereby having potential for real-time implementations. Its comparatively large PL is partially attributed to the fact that SKF is sub-optimal in nature for not estimating the GM states. SKF formulation is necessary for reasons discussed earlier. It allows the formation of more than one test statistic using innovation terms of a finite number of epochs and a separate FMS for each statistic. This prevents the PL from growing with time, which is considered a major challenge with KF RAIM in the range domain. There may be some scope of fine tuning the algorithm further for lower PLs, which will be attempted in the future.

7. Conclusions

A novel range domain KF RAIM algorithm is presented in this paper, building upon previous work of the authors. Major changes in the current algorithm include modeling time correlated errors of the pseudorange measurements and accounting for multi-satellite failures. The integrity monitoring performance of the developed algorithm is studied for a UAV trajectory with GPS and NavIC over the primary coverage area of the latter. It is shown that both WLS range-based and KF solution separation RAIM algorithms outperform the new method. However, WLS RAIM has limitations in that it is not ideal for advanced navigation systems. KF solution separation RAIM, on the other hand, offers lower PLs than the range-based KF algorithm, but with a much higher computational load. PLs of range-based KF RAIM are within 10 m of those of KF solution separation RAIM at least 95% of the time. Due to its low execution times, range-based KF RAIM shows promise for real-time implementations in avionics. It also has potential for extensions to advanced methods such as vector receivers, where running parallel vector loop filters for solution separation RAIM would be prohibitively expensive. Further, simulation results indicate that addition of NavIC alongside GPS can substantially improve RAIM performance, particularly in poor geometries.

Future extensions of the current work include extensive testing of RAIM for various geometries with GPS and NavIC over the latter’s primary and secondary coverage areas for different dynamic scenarios. A suitable error model also needs to be developed for NavIC and validated with real satellite data. The error model will be used for experimental validation of the RAIM algorithms. In addition, it is important to take into account constellation-wide faults for integrity monitoring with multiple constellations. While this has been addressed in the literature for solution separation or ARAIM, a suitable methodology has to be devised for range-based RAIM. It is noted that the developed KF RAIM algorithm at times exhibits an instantaneous change in PL when satellite visibility changes. This should be smoothed out with appropriate modifications. Fine tuning of the algorithm will also be attempted to reduce PLs. Effects of different $P_{FA}$ and $P_{HMI}$ on the proposed method will be investigated. Moreover, the algorithm should be able to deal with unknown error covariances. Its performance in poor signal environments also warrants further studies. Extending the developed KF RAIM to sensor integration and vector tracking is another important area that needs to be explored in depth.