An Efficient Fault Detection and Exclusion Method for Ephemeris Monitoring

Abstract

The ephemeris fault needs to be detected and mitigated in the ground-based augmentation system to provide precision approach for the aircraft. In the current fault detection and exclusion (FDE) method, the double-differenced carrier phase (DDCP) observation is used as a test statistic to detect a faulty satellite caused by an ephemeris fault, taking advantage of the residual spatial gradient. However, the current FDE method cannot distinguish whether the fault comes from a reference satellite (RS) or a non-reference satellite (NRS) in DDCP. One way to address this issue is to pre-validate the RS before it can be used to form a DDCP test statistic for detecting ephemeris fault on the NRS. The RS is pre-validated using the previous ephemeris for any newly acquired and re-acquired satellite. This method is developed in detail to present the shortcomings. A more efficient FDE method using multiple hypothesis testing to detect ephemeris fault on both the RS and NRS simultaneously in real time is proposed. Moreover, to facilitate the application in integrity monitoring, the test risks and minimum detectable error are analyzed. The numerical results of the proposed FDE method show an improved performance in detecting ephemeris fault on the RS and a comparable performance on the NRS compared with the current FDE method.

1. Introduction

The global navigation satellite systems (GNSSs) have been widely applied into various fields and play an important role in civil navigation utility. The ground-based augmentation system (GBAS) is installed in the vicinity of an airport as a local-area differential GNSS system for precision approaches [1,2]. The GBAS uses differential techniques to improve the positioning accuracy as well as provides integrity information to the aircraft during precision approaches. The system failures and anomalies, such as ephemeris fault and ionospheric anomalies, need to be reliably detected [3,4]. Ephemeris faults pose a threat to the aircraft if undetected since the incorrect satellite orbit may be used to compute the aircraft position and result in a large position error. Therefore, it is vital to monitor the ephemeris fault in the GBAS, and the goal of ephemeris monitor is to detect and exclude a faulty satellite before it is used for broadcasting differential corrections to an aircraft.

Satellite ephemeris faults can be categorized into two types, namely, type A with planned satellite maneuvers, and type B without planned satellite maneuvers. The major difference between type A and type B faults is that type B fault can be detected at onset by comparing the ephemeris with an earlier correct ephemeris [5,6]. For GBAS users within the satellite-based augmentation system (SBAS) coverage area, the ephemeris error can be mitigated by the use of SBAS ephemeris correction. However, it is not practical for GBAS users outside the SBAS service area. Therefore, the ephemeris fault mitigation should rely on GBAS capability alone. For CAT I precision approaches, the yesterday-minus-today ephemeris (YE-TE) test has been used in GBAS to monitor the type B ephemeris threat, where newly received ephemeris data are compared with a previously validated ephemeris or a projection of that ephemeris to the current time [5,7,8]. However, such a monitoring method is unable to protect users against type A ephemeris threat as prior ephemeris data are not used after satellite maneuvers [9,10,11,12,13,14,15,16]. A mitigation method with single range rate monitor is proposed to detect the type A ephemeris threat for CAT I operation [17,18]. For more demanding CAT II/III approaches, the high-precision double-differenced carrier phase (DDCP) observation has been used to monitor ephemeris faults of both type A and type B [9,10,19]. The test statistic using DDCP observation between the reference satellite (RS) and the non-reference satellite (NRS) of two ground receivers is sensitive to the ephemeris fault. The current fault detection and exclusion (FDE) method raises alarm if the test statistic exceeds the threshold. However, the ephemeris fault, if detected, cannot be distinguished whether it occurs on the RS or the NRS.

Although the single fault assumption, that is, only a single satellite fault may exist in the system at any time and the probability of simultaneous ephemeris fault on multiple satellites is negligible, is valid since the ephemeris message are created independently for each satellite and based on the GNSS performance [2,17], it is necessary to distinguish a faulty satellite between the reference satellite (RS) and the non-reference satellite (NRS). To address this issue and to meet the CAT II/III requirement, the RS can be pre-validated beforehand with the previously mentioned YE-TE method or range rate monitor, and the pre-validated RS can then be used to form the test statistic for monitoring the NRS. The pre-validation can be arranged in the time period before the data processing filter reaches the steady state. However, with two fault detection and exclusion (FDE) tests for RS and NRS separately, the computation of probability of false alarm (PFA), probability of misdetection (PMD), and probability of incorrect exclusion (PIE) are shown to be complex to compute. For instance, there is a risk that a faulty reference satellite has not been detected in the pre-validation test and propagates to the second test. Therefore, a new FDE method is proposed to test both RS and NRS in real time, saving the effort of pre-validating the RS beforehand. Compared with the current FDE method, which applies the single hypothesis testing, the proposed FDE method utilizes the multiple hypothesis testing. The single hypothesis testing considers only one test statistic and deals with all test statistics one by one, while the multiple hypothesis testing considers all test statistics at the same time [20]. With combined information from all test statistics, the proposed FDE method can detect the ephemeris fault on both the RS and the NRS simultaneously. To facilitate using the method for integrity monitoring applications, the test risks and the minimum detectable error (MDE) are analyzed.

The rest of this paper is organized as follows: First, the current ephemeris monitor is introduced including both the test statistics and corresponding ambiguity resolution methods. Second, the FDE method with the pre-validation procedure is described in detail with identified issues. Then, a new FDE method is proposed with the outcome test risks, including the PFA, PMD, and the MDE analyzed. Finally, the numerical results regarding the new FDE method are presented.

2. Overview of Ephemeris Monitor

The DDCP is adopted as test statistics, where the common errors between two satellites and two reference receivers are canceled. With the precisely surveyed coordinates of the ground receivers, the “observed-minus-computed” L1 DDCP ${\mathrm{\varnothing }}_{ab,1}^{ij}$ with ambiguity resolved is adopted as the test statistic for testing satellite j,

$$t_j={\mathrm{\varnothing }}_{ab,1}^{ij}-{\lambda }_1{N}_{ab,1}^{ij}=I_{ab,1}^{ij}+T_{ab}^{ij}+E_{ab}^{ij}+{\epsilon }_{d{d}_{p1}}$$

(1)

where the satellite with the highest elevation angle is denoted as an RS i, and the other satellite is denoted as an NRS j; subscripts a and b indicate two ground reference stations; ${\lambda }_1$ is the L1 wavelength; $N_{ab,1}^{ij}$ is the double-differenced ambiguity; the residual atmospheric errors include ionospheric error $I_{ab,1}^{ij}$ and tropospheric error $T_{ab}^{ij}$ after double differencing; $E_{ab}^{ij}$ is the residual ephemeris error; and ${\epsilon }_{d{d}_{p1}}$ is the residual double-differenced phase error due to multipath and noise.

Under the fault-free hypothesis, ${\epsilon }_{d{d}_{p1}}$ dominates the residual errors and the test statistics can be assumed to follow a normal distribution with a zero mean. Under the faulty hypothesis, a spatial gradient is generated by an ephemeris fault, which is illustrated in Figure 1 and defined in (2),

$${E_{ab}^{ij}=∆\mathit{e}}_{\mathit{j}}^{\mathit{T}}{\mathit{x}}_{\mathit{a}\mathit{b}}=\frac{∆{\mathit{s}}_{\mathit{j}}^{\mathit{T}}\left(\mathit{I}-{{\mathit{e}}_{\mathit{j}}\mathit{e}}_{\mathit{j}}^{\mathit{T}}\right)x_{ab}}{r_j}$$

(2)

where ${\mathit{e}}_{\mathit{j}}$ is the broadcast line-of-sight (LOS) unit vector from a ground station to a satellite j; ${∆\mathit{e}}_{\mathit{j}}^{\mathit{T}}$ is a difference between the broadcast signal and true LOS unit vector; ${\mathit{x}}_{\mathit{a}\mathit{b}}$ is the baseline vector between two reference receivers; $∆{\mathit{s}}_{\mathit{j}}^{\mathit{T}}$ is the position error vector of a satellite j; $\mathit{I}$ is the identity matrix; and $r_j$ is the geometric range from ground receiver a to satellite j. According to (2), only the satellite position error orthogonal to the LOS (i.e., $∆{\mathit{s}}_{\mathit{j}}^{\mathit{T}}\left(\mathit{I}-{{\mathit{e}}_{\mathit{j}}\mathit{e}}_{\mathit{j}}^{\mathit{T}}\right)$) contributes to the range error, also the impact of ephemeris faults on the test statistics is proportional to the length of a ground baseline $x_{ab}$.

$t_j$ can be used to monitor ephemeris fault only when the unknown ambiguity $N_{ab,1}^{ij}$ is correctly resolved. To isolate the fault with the ambiguity, the statistics for ambiguity resolution need to be geometry-free. The optimal method of resolving $N_{ab,1}^{ij}$ is determined considering the PMD performance and the required number of averaging epochs for newly acquired and re-acquired satellites [11]. First, the wide-lane (WL) ambiguity is estimated by the Melbourne–Wübbena (MW) combination,

$$\frac{{\mathrm{\varnothing }}_{ab,w}^{ij}-R_{ab,n}^{ij}}{{\lambda }_w}=N_{ab,w}^{ij}+\frac{{\epsilon }_{w_p}}{{\lambda }_w}-\frac{{\epsilon }_{n_c}}{{\lambda }_w}$$

(3)

where ${\lambda }_w=\frac{c}{f_1-f_5}$ is the WL wavelength at the speed of light $c$; $f$ is the frequency and subscripts “1” and “5” are used to indicate frequencies L1 and L5, respectively; $N_{ab,w}^{ij}=N_{ab,1}^{ij}-N_{ab,5}^{ij}$ is the WL ambiguity; and ${\epsilon }_{w_p}$ is the residual error in ${\mathrm{\varnothing }}_{ab,w}^{ij}$; ${\mathrm{\varnothing }}_{ab,w}^{ij}$ is the WL combination of phase observations,

$${\mathrm{\varnothing }}_{ab,w}^{ij}=\frac{f_1{\varnothing }_{ab,1}^{ij}-f_5{\varnothing }_{ab,5}^{ij}}{f_1-f_5}$$

(4)

where $R_{ab,n}^{ij}$ is the narrow-lane (NL) code combination,

$$R_{ab,n}^{ij}=\frac{f_1{R}_{ab,1}^{ij}+f_5{R}_{ab,5}^{ij}}{f_1+f_5}$$

(5)

where $R$ is the double-differenced code observation; and ${\epsilon }_{n_c}$ is the residual error in $R_{ab,n}^{ij}$.

With only multipath and noise residual errors in MW combination, ${\widehat{N}}_{ab,w}^{ij}$ can be obtained by averaging over a sufficient number of epochs. Then, the L1 DDCP ambiguity is estimated by [11],

$$\frac{{\mathrm{\varnothing }}_{ab,1}^{ij}-{\mathrm{\varnothing }}_{ab,5}^{ij}-{\lambda }_5{\widehat{N}}_{ab,w}^{ij}}{{\lambda }_1-{\lambda }_5}=N_{ab,1}^{ij}+\frac{I_{ab,1}^{ij}-I_{ab,5}^{ij}}{{\lambda }_1-{\lambda }_5}+\frac{{\epsilon }_{d{d}_{p1}}}{{\lambda }_1-{\lambda }_5}-\frac{{\epsilon }_{d{d}_{p5}}}{{\lambda }_1-{\lambda }_5}$$

(6)

where the residual ionosphere error is assumed to be under nominal state with the assumption of single satellite fault and that two faults cannot exist on a single satellite [2]. The residual multipath and noise become the dominating errors which can also be reduced by averaging among multiple epochs.

With the ambiguity resolved, the tests statistic $t_j$ is highly sensitive to the ephemeris fault as $E_{ab}^{ij}$ exceeds the threshold when the fault occurs. Since $t_j$ is formed by two satellites of the RS and the NRS, it requires one of them to be healthy or fault-free. In the current FDE method, the RS with the highest elevation angle is assumed to be fault-free. This assumption may neglect the risk due to the misdetection of the fault on the RS and incorrect exclusion of the NRS. Therefore, two methods are proposed in the next two sections to address this issue.

3. FDE Method with Pre-Validation

The first method is to ensure the RS is fault-free before it can be used in the monitoring of ephemeris fault in the NRS, the pre-validation procedure can be used to detect the ephemeris fault in the RS beforehand. In the pre-validation procedure, the current broadcast ephemeris data in RS are validated by the most recent validated ephemeris data regarding the satellite position or ephemeris parameters [5]. Two test statistics are used, namely $s_i$ for testing the RS i as a difference between two sets of ephemeris data and $t_j$ for testing the NRS. A cascaded test procedure is adopted, where the pre-validation test for an RS is followed by the detection of a spatial gradient for an NRS.

To demonstrate the combined test risks, three cases are considered assuming a single satellite fault. The first case assumes that the RS i is fault-free as well as NRSs with the corresponding results shown in Figure 2. T_s and T_j denote the thresholds for test statistics $s_i$ and $t_j$, respectively. In the pre-validation period, if the RS is detected as faulty with $\left|s_i\right|>T_s$, another satellite is selected as the RS to repeat the previous process. The pre-validation is completed when a healthy RS is selected without any alarm generated. It is assumed that at least one healthy satellite can pass the pre-validation process. After the pre-validation process, the maximum $\left|t_j\right|$ among all NRSs is compared with the threshold using the healthy RS. The P_FA,j is the outcome PFA to alert an NRS j.

The second case is comprised of a fault-free RS i and a faulty NRS k with the test procedure shown in Figure 3, where P_MD,k is the PMD of the faulty NRS k. The third case assumes that an RS i out of the pre-validation test is faulty and all NRSs are fault-free, where P_MD,i is the PMD of the faulty RS i as shown in Figure 4. In this case, a faulty RS which passes through the pre-validation test is used for monitoring the NRS. There is a large probability that the faulty RS will cause the test statistic to exceed the threshold and then the NRS is excluded. In this case, the fault-free NRS is incorrectly excluded. However, it is also likely that the test statistic is below the threshold and no alarm is raised. In this case, the RS is misdetected.

As shown from Figure 2, Figure 3 and Figure 4, the test risks including PMD, PFA, and PIE are related with not only the NRS test but also the pre-validation test, making the computation and bounding of test risks complex. Therefore, a more efficient FDE method is proposed in the next section.

4. DD-FDE Method

With the single fault assumption, a new FDE method is proposed to test NRS and RS in a single test, which is referred to as the DD-FDE method. Instead of using the single hypothesis testing in the current FDE method, the DD-FDE method utilizes the multiple hypothesis testing. The pre-validation process is saved and the waiting time for a validated RS is not needed anymore with this method.

4.1. Statistical Decisions

To illustrate the DD-FDE method, an example of three visible satellites, including an RS i and NRSs j and k, is used. Two test statistics are generated, $t_j$ and $t_k$, for testing two NRSs separately. The test conditions and relevant test risks are illustrated in

Table 1. The DD-FDE method with an example of three visible satellites.

	Test Result	${\mathit{H}}_0$	${\mathit{H}}_{\mathit{i}}$	${\mathit{H}}_{\mathit{j}}$	${\mathit{H}}_{\mathit{k}}$
Real Case		$$\begin{gathered} \left|{\mathit{t}}_{\mathit{j}}\right|\le \mathit{T}\& \\ \left|{\mathit{t}}_{\mathit{k}}\right|\le \mathit{T} \end{gathered}$$	$$\begin{gathered} \left|{\mathit{t}}_{\mathit{j}}\right|>\mathit{T}\& \\ \left|{\mathit{t}}_{\mathit{k}}\right|>\mathit{T} \end{gathered}$$	$$\begin{gathered} \left|{\mathit{t}}_{\mathit{j}}\right|>\mathit{T}\& \\ \left|{\mathit{t}}_{\mathit{k}}\right|\le \mathit{T} \end{gathered}$$	$$\begin{gathered} \left|{\mathit{t}}_{\mathit{j}}\right|\le \mathit{T}\& \\ \left|{\mathit{t}}_{\mathit{k}}\right|>\mathit{T} \end{gathered}$$
		A + F	C + D	B	E
$H_0$		Correct decision	PFA ${\alpha }_{0i}$	PFA ${\alpha }_{0j}$	PFA ${\alpha }_{0k}$
$H_i$		PMD ${\beta }_{i0}$	Correct decision	PIE ${\gamma }_{ij}$	PIE ${\gamma }_{ik}$
$H_j$		PMD ${\beta }_{j0}$	PIE ${\gamma }_{ji}$	Correct decision	PIE ${\gamma }_{jk}$
$H_k$		PMD ${\beta }_{k0}$	PIE ${\gamma }_{ki}$	PIE ${\gamma }_{kj}$	Correct decision

. When all test statistics are smaller than the threshold, the fault-free hypothesis is accepted, and when all test statistics exceed the threshold, the faulty RS hypothesis is accepted. A faulty NRS hypothesis is accepted when the following three conditions are satisfied: (1) the corresponding test statistic is maximum among all test statistics; (2) the corresponding test statistic exceeds the threshold; (3) and not all test statistics exceed the threshold.

In Table 1, H₀ denotes the fault-free hypothesis, H_i, H_j, and H_k are faulty hypotheses where indexes i, j, and k denote the faulty satellites. Comparing the real cases with the test results, different test risks can be obtained, including PFA, PMD, and PIE. To further demonstrate the probabilities of accepting each of the hypotheses, a rectangle space representing the total probability of one is shown in Figure 5. First, the probabilities of $\left|t_j\right|>T$, $\left|t_k\right|>T$, $\left|t_j\right|>\left|t_k\right|$, and $\left|t_j\right|<\left|t_k\right|$ separate the whole space into six subsections of A, B, C, D, E, and F. The areas of subsections are used to indicate the probabilities of accepting each hypothesis in Table 1. In particular, the test result of H₀ is represented by the sum of subsections A and F; the test result of H_i is represented by subsections C and D; the test results of H_j and H_k are represented by subsection B and E, respectively.

Numerically, the test risk can be computed with the assumed normal distribution. For instance, the joint distribution of $t_j$ and $t_k$ is provided by,

$$t={\left[t_j,t_k\right]}^T~N\left(\mu ,{\mathsf{\Sigma }}_t\right)$$

(7)

where N is the two-dimensional normal distribution with a non-central vector $\mathit{\mu }$ and a covariance matrix ${\mathsf{\Sigma }}_t$,

$${\mathsf{\Sigma }}_{\mathit{t}}=\left[\begin{array}{cc}{{\sigma }_t}^2& {\rho }_{jk}{{\sigma }_t}^2\\ {\rho }_{jk}{{\sigma }_t}^2& {{\sigma }_t}^2\end{array}\right]$$

(8)

where ${\sigma }_t$ is the standard deviation of the test statistic; and ${\rho }_{jk}$ is the correlation coefficient between two statistics. With multipath and other residual errors from the same RS, there is a correlation between test statistics of different NRSs. The correlation coefficient varies with satellite trajectory and elevation angles. Without loss of generality, the correlation coefficient between two test statistics can be assumed to be arbitrary with a value from a range (−1, 1).

For a general case with (m + 1) visible satellites, the test risks are provided in

Table 2. Results of the DD-FDE method with (m + 1) visible satellites.

	Test Results	${\mathit{H}}_0$	${\mathit{H}}_{\mathit{i}}$	${\mathit{H}}_1$		${\mathit{H}}_{\mathit{k}}$
Real Case		$\left|{\mathit{t}}_{\mathit{r}}\right|\le \mathit{T}$ For all $\mathit{r}=1,2,\dots \mathit{m}$, $\mathit{r}\ne \mathit{i}$	$\left|{\mathit{t}}_{\mathit{r}}\right|>\mathit{T}$ For all $\mathit{r}=1,2,\dots \mathit{m}$, $\mathit{r}\ne \mathit{i}$	$$\begin{gathered} \{\mathbf{max}\left(\left|{\mathit{t}}_{\mathit{r}}\right|\right)=\left|{\mathit{t}}_1\right|\}\& \\ \hspace{1em}\left\{\left|{\mathit{t}}_1\right|>\mathit{T}\right\}\& \\ \hspace{1em}\hspace{1em}\{\left|{\mathit{t}}_{\mathit{r}}\right|\le \mathit{T} \end{gathered}$$ For one or more $\mathit{r}=1\dots \mathit{m}$, $\mathit{r}\ne \mathit{i}\}$	$\cdots$	$$\begin{gathered} \mathbf{max}\left(\left|{\mathit{t}}_{\mathit{r}}\right|\right)=\left|{\mathit{t}}_{\mathit{k}}\right|\}\& \\ \hspace{1em}\{\left|{\mathit{t}}_{\mathit{k}}\right|>\mathit{T}\}\& \\ \hspace{1em}\hspace{1em}\{\left|{\mathit{t}}_{\mathit{r}}\right|\le \mathit{T} \end{gathered}$$ For one or more $\mathit{r}=1\dots \mathit{m}$, $\mathit{r}\ne \mathit{i}\}$
$H_0$		Correct decision	PFA ${\alpha }_{0i}$	PFA ${\alpha }_{01}$	$\cdots$	PFA ${\alpha }_{0m}$
$H_i$		PMD ${\beta }_{i0}$	Correct decision	PIE ${\gamma }_{i1}$	$\cdots$	PIE ${\gamma }_{im}$
$H_1$		PMD ${\beta }_{10}$	PIE ${\gamma }_{1i}$	Correct decision	$\cdots$	PIE ${\gamma }_{1m}$
$⋮$		$⋮$	$⋮$	$⋮$	$\ddots$	$⋮$
$H_m$		PMD ${\beta }_{m0}$	PIE ${\gamma }_{mi}$	PIE ${\gamma }_{m1}$	$\cdots$	Correct decision

. In previous research, it was observed that tropospheric anomalies can also generate a spatial gradient in the DDCP observation [12], which may trigger false alerts in the ephemeris monitor. Considering that the troposphere anomaly is a local phenomenon, dual baselines with enough separation can be used to alleviate this effect [10,11]. Only when both baselines trigger an alarm, is it regarded as an ephemeris fault. Therefore, this test is also generalized with double baseline as shown in

Table 3. Results of the DD-FDE method with double baseline.

	${\mathit{H}}_0$	${\mathit{H}}_{\mathit{i}}$	${\mathit{H}}_1$		${\mathit{H}}_{\mathit{k}}$
$H_0$	Correct decision	PFA ${\alpha }_{0i}^1\cap {\alpha }_{0i}^2$	PFA ${\alpha }_{01}^1\cap {\alpha }_{01}^2$	$\cdots$	PFA ${\alpha }_{0m}^1\cap {\alpha }_{0m}^2$
$H_i$	PMD ${\beta }_{i0}^1\cup {\beta }_{i0}^2$	Correct decision	PIE ${\gamma }_{i1}^1\cap {\gamma }_{i1}^2$	$\cdots$	PIE ${\gamma }_{im}^1\cap {\gamma }_{im}^2$
$H_1$	PMD ${\beta }_{10}^1\cup {\beta }_{10}^2$	PIE ${\gamma }_{1i}^1\cap {\gamma }_{1i}^2$	Correct decision	$\cdots$	PIE ${\gamma }_{1m}^1\cap {\gamma }_{1m}^2$
$⋮$	$⋮$	$⋮$	$⋮$	$\ddots$	$⋮$
$H_m$	PMD ${\beta }_{n0}^1\cup {\beta }_{n0}^2$	PIE ${\gamma }_{ni}^1\cap {\gamma }_{ni}^2$	PIE ${\gamma }_{m1}^1\cap {\gamma }_{m1}^2$	$\cdots$	Correct decision

, where superscripts “1” and “2” denote the two baselines. Two baselines are tested separately, and an alert is generated only when test statistics of both baselines meet the criteria in Table 1.

4.2. Test Risks and MDE Derivation

As shown in the last section, the multi-variant normal distribution with a varying correlation coefficient significantly increases the complexity for calculation of test risks. The following demonstrates that pre-defined values can bound the test risks with a single-variant normal distribution for any correlation coefficient. An example of a single baseline with three visible satellites is illustrated below. First, ${\alpha }_0$ and ${\beta }_0$ are defined by the single-variant normal distribution,

$${\alpha }_0=P\left(\left|t_j\right|>T|H_0\right)$$

(9)

$${\beta }_0=P\left(\left|t_j\right|\le T|H_j\right)$$

(10)

where T is the threshold that is used in the following risk definitions. The test risks in Table 1 can be bounded by ${\alpha }_0$ and ${\beta }_0$ as follows,

$${\alpha }_{0i}=P(\left|t_j\right|>T\cap \left|t_k\right|>T|H_0)\le {\alpha }_0$$

(11)

$${\alpha }_{0j}=P\left(\left|t_j\right|>T\cap \left|t_k\right|\le T|H_0\right)\le {\alpha }_0$$

(12)

$${\beta }_{i0}=P\left(\left|t_j\right|\le T\cap \left|t_k\right|\le T|H_i\right)\le {\beta }_0$$

(13)

$${\beta }_{j0}=P(\left|t_j\right|\le T\cap \left|t_k\right|\le T|H_j)\le {\beta }_0$$

(14)

$${\gamma }_{ji}=P\left(\left|t_j\right|>T\cap \left|t_k\right|>T|H_j\right)\le {\alpha }_0$$

(15)

$${\gamma }_{kj}=P(\left|t_j\right|>T\cap \left|t_k\right|\le T|H_k)\le {\alpha }_0$$

(16)

where an arbitrary correlation coefficient between $t_j$ and $t_k$ is adopted. Similar conclusions can be derived for more visible satellites. For the case of double baseline, it holds that,

$$\left({\alpha }_{0i}^1\cap {\alpha }_{0i}^2\right)<{\alpha }_0$$

(17)

$$\left({\beta }_{i0}^1\cup {\beta }_{i0}^2\right)<1-{(1-{\beta }_0)}^2$$

(18)

$$\left({\gamma }_{ih}^1\cap {\gamma }_{ih}^2\right)<{\alpha }_0$$

(19)

where an arbitrary correlation coefficient between two baselines is adopted. It is concluded that the PFA and PIE with double baseline can be bounded by ${\alpha }_0$, and PMD with double baseline is bounded by $1-{(1-{\beta }_0)}^2$. Therefore, incorporating a second baseline to protect users against false alarms results in an increase in PMD with ($1-{(1-{\beta }_0)}^2)\ge {\beta }_0$.

The purpose of bounding test risks with ${\alpha }_0$ and ${\beta }_0$ is to simplify the proceeding calculations of thresholds and protection levels. Particularly, with ${\alpha }_0$ as the required PFA value, T can be derived directly from (9) to avoid the complexity of the multi-variate distribution and the varying correlation coefficient. In this way, the resulted PFAs with the DD-FDE method can be guaranteed to be lower than the required value with (17). The significance of bounding PMD is demonstrated in the next section for calculating the protection level.

The undetected ephemeris error needs to be bounded by VPL in the vertical position domain [13]. An ephemeris p value is broadcast to users for calculation of VPL [1,14],

$$P_j=\frac{MDE}{x_{ab}}=\frac{u_j}{x_{ab}}$$

(20)

where MDE denotes the MDE in the differential range domain with given PMD; MDE is equal to the non-centrality bias in the test statistic, which is denoted as $u_j$ under hypothesis $H_j$; and $x_{ab}$ is the baseline length of the ground receivers. The ephemeris vertical protection level ${VPL}_e^j$ under hypothesis $H_j$ is [5,14],

$${VPL}_e^j=\left|S_{3,j}\right|P_{j}b+K_{md}\sqrt{\sum _{k=1}^N{S}_{vert,k}^2{\sigma }_k^2}$$

(21)

where $S$ is the projection matrix from the least-squares estimation; $b$ is the distance between an aircraft and ground stations; $N$ is the total number of visible satellites; ${\sigma }_k$ is the standard deviation of the differential range error for a satellite k; and $K_{md}$ is the broadcast K-value. The maximum VPL among all hypotheses is the final VPL. With the previous FDE method, the VPL under a hypothesis of a faulty RS is not derived. With the proposed DD-FDE method, VPL can be obtained for all satellites.

Since VPL value is a function of $P_j$, which is determined by MDE, it is necessary to analyze MDE for the proposed FDE method and compare it with MDE of the previous FDE method. The current FDE method uses single hypothesis testing, and $P_{md}$ is defined as the probability that $t_j$ is inside the threshold region under $H_j$, which has a Gaussian distribution with mean of $u$ and standard deviation of ${\sigma }_t$, i.e., $P_{md}$=$P\left(\left|t_j\right|\le T|H_j\right)$. With ${\beta }_0$ allocated to $P_{md}$ as indicated by (10), the non-centrality bias is obtained by,

$$u=T+Q^{-1}\left(1-{\beta }_0\right){\sigma }_t$$

(22)

where $Q^{-1}$ as the inverse of the standard normal inverse cumulative distribution function. $T$ is computed by $Q^{-1}\left({1-P}_{fa}\right){\sigma }_t$ from (9).

On the other hand, the proposed FDE method uses multiple hypothesis testing, and the expression of $P_{md}$ is indicated by the sum of ${\beta }_{i0}$ and ${\beta }_{r0}(r=1,\cdots ,m-1)$ considering m satellites. Assuming ${\beta }_0$ is equally allocated to all satellites, $P_{md}$ for the RS and NRS are ${\beta }_{i0}={\beta }_{r0}=\frac{{\beta }_0}{m}(r=1,\dots ,m-1)$. With m satellites in view, $P_{md}$ for the NRS j is defined as the probability that all the test statistics are inside the threshold region under $H_j$. In this case, $t_j$ follows a Gaussian distribution with a mean of $u_j$ and standard deviation of ${\sigma }_t$, while $t_i$ and $t_r(r=1,\dots ,m-1,\mathrm{a}\mathrm{n}\mathrm{d}r\ne j)$ follow a Gaussian distribution with a mean of zero. Then, $P_{md}$ for the NRS j can be written as,

$$P\left(\left|t_j\right|\le T\cap \left|t_i\right|\le T\cap \left|t_r\right|\le T|H_j\right)={\beta }_{j0}=\frac{{\beta }_0}{m},(r=1,\dots ,m-1,\mathrm{a}\mathrm{n}\mathrm{d}r\ne j)$$

(23)

where the probabilities of $\left|t_i\right|\le T$ and $\left|t_r\right|\le T$ are approximately to 1. Therefore, (23) can be approximated as,

$$P\left(\left|t_j\right|\le T|H_j\right)\approx \frac{{\beta }_0}{m}$$

(24)

and $u_j$ can be obtained by,

$$u_j\approx T+Q^{-1}\left(1-\frac{{\beta }_0}{m}\right){\sigma }_t$$

(25)

which is larger than $u$ compared with (22). In other words, the non-centrality bias for the NRS in the new FDE method is larger than that in the current FDE method.

For the RS i in the new FDE method, $P_{md}$ is defined as the probability that all the test statistics are inside the threshold region under $H_i$. In this case, all test statistics follow a Gaussian distribution with mean of $u_i$ and standard deviation of ${\sigma }_t$ since the bias $u_i$ in the RS is propagated to other NRS. Then, $P_{md}$ for the RS i can be written as,

$$P\left(\left|t_i\right|\le T\cap \left|t_r\right|\le T|H_i\right)={\beta }_{i0}=\frac{{\beta }_0}{m},(r=1,\dots ,m-1)$$

(26)

where the probabilities of $\left|t_i\right|\le T$ and $\left|t_r\right|\le T$ are equal. Considering the independence between all test statistics, (26) can be rewritten as,

$$P\left(\left|t_i\right|\le T|H_i\right)={\left(\frac{{\beta }_0}{m}\right)}^{\frac{1}{m}},(r=1,\dots ,m-1)$$

(27)

and $u_i$ can be obtained by,

$$u_i=T+Q^{-1}\left(1-{\left(\frac{{\beta }_0}{m}\right)}^{\frac{1}{m}}\right){\sigma }_t$$

(28)

which is smaller than $u$ compared with (22) since ${\left(\frac{{\beta }_0}{m}\right)}^{\frac{1}{m}}$ is larger than ${\beta }_0$. In other words, the non-centrality bias for the NRS in the new FDE method is larger than that in the current FDE method.

For the case of double baselines, $P_{md}$ for the NRS is defined as the probability that either of the double baseline misdetect the ephemeris fault. Based on the $P_{md}$ analysis for the NRS of the single baseline, $P_{md}$ for the NRS under double baselines is,

$$P\left(\left|t_j^1\right|\le T|H_j\right)\cup P\left(\left|t_j^2\right|\le T|H_j\right)\approx \frac{{\beta }_0}{m}$$

(29)

with the risk overbounding result derived in (18), the non-centrality of the NRS for the double baselines can be obtained by,

$$u_j^{\prime }\approx T+Q^{-1}\left(\sqrt{1-\frac{{\beta }_0}{m}}\right){\sigma }_t$$

(30)

Similarly, the non-centrality of the RS for the double baselines can be obtained by substituting $\sqrt{1-\frac{{\beta }_0}{m}}$ into (28),

$$u_i^{\prime }=T+Q^{-1}\left({\left(1-\frac{{\beta }_0}{m}\right)}^{\frac{1}{2m}}\right){\sigma }_t$$

(31)

where the additional $P_{md}$ is introduced by the second baseline, and $u_i^{\prime }$ as well as $u_j^{\prime }$ are larger than $u_i$ and $u_j$, respectively.

5. Numerical Results of DD-FDE Method

With $\sigma$ bounded as 0.6 cm [9], the numerical results of PFA under the fault-free case with $\mu ={\left[0,0\right]}^T$ are obtained in

Table 4. Test risk results for the fault-free case with three visible satellites.

${\mathit{\rho }}_{\mathit{j}\mathit{k}}$	${\mathit{\alpha }}_{0\mathit{i}}$	${\mathit{\alpha }}_{0\mathit{j}}$	${\mathit{\alpha }}_{0\mathit{k}}$
0.9	1.8 × 10−9	8.2 × 10−9	8.2 × 10−9
0.6	3.3 × 10−11	1.0 × 10−8	1.0 × 10−8
0.3	1.7 × 10−13	1.0 × 10−8	1.0 × 10−8
0	7.5 × 10−17	1.0 × 10−8	1.0 × 10−8

as a function of ${\rho }_{jk}$. It can be observed that ${\rho }_{jk}$ has a slight influence on ${\alpha }_{0j}$ and ${\alpha }_{0k}$, while ${\alpha }_{0i}$ increases obviously with the increase in ${\rho }_{jk}$. In other words, PFA of an alerted RS is easier to be triggered when test statistics are more correlated, while the PFA of an alerted NRS is not obviously influenced by the correlation among test statistics.

For the faulty RS case, an example with $\mu ={\left[0.065,0.065\right]}^T$ is used to calculate the risk values. As shown in

Table 5. Test risk results for the faulty RS case with three visible satellites.

${\mathit{\rho }}_{\mathit{j}\mathit{k}}$	${\mathit{\beta }}_{\mathit{i}0}$	${\mathit{\gamma }}_{\mathit{i}\mathit{j}}$	${\mathit{\gamma }}_{\mathit{i}\mathit{k}}$
0.9	3.7 × 10−8	1.3 × 10−7	1.3 × 10−7
0.6	1.4 × 10−9	1.7 × 10−7	1.7 × 10−7
0.3	1.9 × 10−11	1.7 × 10−7	1.7 × 10−7
0	2.8 × 10−14	1.7 × 10−7	1.7 × 10−7

, ${\beta }_{i0}$ increases obviously when ${\rho }_{jk}$ increases, while other probabilities remain relatively stable. In other words, the PMD of a faulty RS is easier with more correlated test statistics, while the PIE of a fault-free NRS is not obviously affected by the correlation level among test statistics.

For the faulty NRS case, an example with $\mu ={\left[0.065,0\right]}^T$ is used to calculate the risk values. As shown in

Table 6. Test risk results for the faulty NRS case with three visible satellites.

${\mathit{\rho }}_{\mathit{j}\mathit{k}}$	${\mathit{\beta }}_{\mathit{j}0}$	${\mathit{\gamma }}_{\mathit{j}\mathit{i}}$	${\mathit{\gamma }}_{\mathit{j}\mathit{k}}$
0.9	1.6 × 10−7	6.7 × 10−9	3.3 × 10−9
0.6	1.7 × 10−7	1.0 × 10−8	1.3 × 10−10
0.3	1.7 × 10−7	1.0 × 10−8	1.2 × 10−12
0	1.7 × 10−7	1.0 × 10−8	1.7 × 10−15

, ${\gamma }_{ji}$ and ${\beta }_{j0}$ are relatively stable when ${\rho }_{jk}$ varies, while ${\gamma }_{jk}$ increases obviously with the increase in ${\rho }_{jk}$. In other words, a higher correlation between test statistics makes it harder to distinguish the fault among different NRSs.

The numerical results for the fault-free case with eight visible satellites are shown in

Table 7. Test risk results for the fault-free case with eight visible satellites.

${\mathit{\rho }}_{\mathit{j}\mathit{k}}$	${\mathit{\alpha }}_{0\mathit{i}}$	${\mathit{\alpha }}_{01}$	$\cdots$	${\mathit{\alpha }}_{07}$
0.9	1.6 × 10−7	6.7 × 10−9	$\cdots$	3.1 × 10−14
0.6	1.7 × 10−7	1.0 × 10−8	$\cdots$	2.4 × 10−9
0.3	1.7 × 10−7	1.0 × 10−8	$\cdots$	8.6 × 10−9
0	1.7 × 10−7	1.0 × 10−8	$\cdots$	1.0 × 10−8

, where $\mu ={\left[\mathrm{0,0},\mathrm{0,0},\mathrm{0,0},0\right]}^T$, and ${\rho }_{jk}$ between any two test statistics is assumed to be the same. Compared with the results in Table 2, the PFA results in Table 7 decrease with the increase in the number of visible satellites. For the double baseline, numerical results are shown in

Table 8. Test risk results for the fault-free case with eight visible satellites and a double baseline.

${\mathit{\rho }}_{\mathit{j}\mathit{k}}$	${\mathit{\alpha }}_{0\mathit{i}}^1\cap {\mathit{\alpha }}_{0\mathit{i}}^2$	${\mathit{\alpha }}_{01}^1\cap {\mathit{\alpha }}_{01}^2$	$\cdots$	${\mathit{\alpha }}_{07}^1\cap {\mathit{\alpha }}_{07}^2$
0.9	1.4 × 10−16	9.6 × 10−28	$\cdots$	9.6 × 10−28
0.6	3.0 × 10−25	5.8 × 10−18	$\cdots$	5.8 × 10−18
0.3	1.7 × 10−42	7.4 × 10−17	$\cdots$	7.4 × 10−17
0	1.4 × 10−112	1.0 × 10−16	$\cdots$	1.0 × 10−16

, where PFA decreases with the increases in the number of baselines.

Similar results can be obtained for PMD and PIE, where both PMD and PIE decrease with the number of visible satellites increases, while PMD increases and PIE decreases with the number of baselines increases.

The numerical results of the non-centralities are illustrated, further considering the correlation between the test statistics. Assuming that the allocated $P_{md}$ for ephemeris monitor is 5 × 10⁻⁷ with three satellites, 1.67 × 10⁻⁷ is allocated for each hypothesis. The PFA allocated to the ephemeris monitor is 10⁻⁸ for GBAS CAT II/III approaches [15]. With ${\sigma }_t$ = 0.6 cm, T is obtained as 3.5 cm. $u_i$ and $u_j$ are derived using the MATLAB function “fsolve”. Figure 6 shows the $u_i$ and $u_j$ results as a function of correlation coefficient $\rho$ with three visible satellites under single baseline configuration.

As shown in Figure 6, $u_i$ is smaller than $u$ while $u_j$ is larger than $u$, which is consistent with the above analysis. In addition, with the increase in $\rho$, $u_i$ increases sharply while $u_j$ is relatively stable. That is, the MDE of the RS can be affected by the correlation between the test statistics since the fault in the RS will be propagated into other satellites when forming the test statistics. In contrast, the MDE of the NRS is not affected by the correlation between the test statistics because the fault in the NRS only remains within itself. Figure 7 shows the $u_i$ and $u_j$ results as a function the number of visible satellites under the single baseline configuration.

The results in Figure 7 are obtained assuming that the test statistics are independent of each other, i.e., $\rho =0$. With the number of satellite increases, $u_i$ decreases sharply while $u_j$ has a slight increase. This can also be interpreted by (25) and (28) that a larger number of satellite m will result in a smaller $u_i$ and a larger $u_j$. In addition, the $u_i$ and $u_j$ results for a different number of visible satellites under the double baselines configuration are shown and compared with the single baseline configuration in Figure 8.

The results in Figure 8 are obtained assuming that the test statistics are independent of each other, i.e., $\rho =0$. As shown in Figure 8, due to the additional misdetection risk induced by the second baseline, both $u_i$ and $u_j$ in the double baseline case are slightly larger than that in the single baseline case.

In summary, the numerical results of non-centrality of the new FDE method are consistent with the analysis with the derived equations of (25), (28), (30), and (31). Compared with the current FDE method, the non-centrality or MDE for the new FDE method varies with the RS, the NRS, the different correlation coefficient, and the number of visible satellites. In particular, the MDE for the RS is smaller in the new FDE method and decreases with a smaller correlation coefficient and a larger number of satellites, thereby resulting in a smaller VPL. As for the NRS, the MDE is larger in the new FDE method and increases with the number of satellites, thereby resulting in a larger VPL. Furthermore, introducing a double baseline can reduce false alarms induced by the tropospheric turbulence, while the integrity risk is sacrificed with enlarged MDE.

6. Discussion and Conclusions

The current FDE method uses DDCP as test statistics but it cannot distinguish whether the fault comes from the RS or the NRS. Although adding pre-validation for the RS can address this issue, the resultant test risks are difficult to be accounted for. Therefore, the DD-FDE method for ephemeris monitor is proposed in this paper, where faulty RS and NRS can be simultaneously detected by using a multiple alternative hypothesis testing technique. The outcome test risks of PFA, PMD, and PIE are derived and these risks can be bounded by pre-defined values with the single-variant normal distribution. Based on the test risk analysis, the non-centrality or MDE of the DD-FDE method is analyzed. The numerical test results are consistent with the test risk and MDE analysis. In addition, compared with the current FDE method, the MDE for the RS is smaller and decreases sharply with the correlation coefficient between test statistics decreases and the number of visible satellites increases. On the contrary, the MDE for the NRS of the DD-FDE method is slightly larger than that of the current FDE method, and it increases slightly with the number of visible satellite increases. This indicates that the DD-FDE method has an improved ability of detecting ephemeris fault on the RS and a comparable ability on the NRS compared with the current FDE method. Considering the advantages of detecting the ephemeris fault at the RS and NRS simultaneously and the comparable detecting capability, the DD-FDE method shows promising benefits in GBAS application. However, this method needs additional analysis and testing to prove its efficacy. In addition, this method is based on the single-fault assumption, future work will consider ephemeris fault induced by noise in a communication channel and a condition where multiple ephemeris faults occur at the same time.