The Stanford – ESA Integrity Diagram: Focusing on SBAS Integrity

Article Details
Category	File:Icon.gif
Title	The Stanford – ESA Integrity Diagram: Focusing on SBAS Integrity
Author(s)	M. Tossaint, J. Samson, F. Toran and J. Ventura-Traveset, European Space Agency, ESA; J. Sanz, M. Hernandez-Pajares and J.M. Juan, UPC, Barcelona, Spain; A. Tadjine and I. Delgado, GMV, Spain;
Year of Publication	2006

Abstract

In this article, a new concept for SBAS integrity validation is presented. The proposed concept is a modification of the well known Stanford diagram [2], where a 2D histogram shows the relationship of position errors against protection levels for a set of measurements using an all in view satellite selection. The new method consists on two diagrams: the Worst-Safety Index diagram and the “All-Geometries” diagram, known here as the Stanford-ESA and the All-Stanford-ESA, respectively. The first consist on taking, at each sample time and given location, the worst possible satellite geometrical combination (out of all possible combinations) from a SBAS integrity margin viewpoint. In the second, all possible geometries are displayed and, in case of MIs, the geometries associated to each epoch are leveled with different symbols and colors. It allows, to easily identify the different clusters and to assess the time correlation of the events. Real measurement results are presented here showing that the EGNOS integrity margins remain safe under this very exigent criterion, a certainly very positive result. It is suggested here the use the Stanford-ESA Integrity concept, for routine performance monitoring and to support and complement the safety case of the EGNOS systems with real experimental data.

Introduction

ESA detailed studies on the transfer of integrity between pseudo-range and position domains [1], have led to the introduction of a specific kind of representation technique able to provide a strong evidence of the robustness of an SBAS (Satellite Based Augmentation System) system with respect to integrity bound provision, and for all possible satellite geometrical conditions. This new representation is then exclusively focussed on Integrity (versus the Integrity, Availability, and Accuracy information of the bi-dimensional nominal Stanford Diagram). During the SBAS Interoperability Working Group meeting celebrated in Madrid (Spain) in March 2005, it was suggested to call this new Integrity representation as the “Stanford-ESA Integrity Diagram”. The Stanford-ESA modified Integrity Diagram concept is described in this Document, and a quick and simple algorithm to compute this diagram is provided in the appendix, together with a source code example of its implementation in C and in FORTRAN77. Results with real data sets from several sites in Europe are also shown here.

The Stanford-ESA Modified Integrity Diagram

The Stanford-ESA Integrity Diagram, as the name itself indicates, is a modification of the well known Integrity-Availability-Accuracy 2D histogram proposed by the WAAS laboratory of the Stanford University, commonly known as “Stanford Diagram”. The Stanford diagram has become a reference representation technique in the SBAS domain, especially to have a quick and clear view of system performances, highlighting its capability to clearly show the integrity margins offered by the SBAS system. For further details on the Stanford Diagrams, the reading of [2] is highly recommended. The Stanford-ESA Integrity Diagram concept proposes exactly the same representation technique, but introducing a modification in the data to be used as input source to build the graph, which focuses exclusively on integrity. Note that the standard Stanford Diagram uses an all-in-view approach (i.e. all GPS satellites in view) for computing the error/protection level pair to plot for each time sample. When focusing on integrity, though, the classical Stanford Diagram is not always conservative. Indeed, using all in view satellites to measure integrity over-bounding capability may lead, for instance, to a situation in which a specific integrity loss in one or more satellite or IGP may be mitigated by other “well-bounded” line of sight, so that the net effect at position domain will not be appreciated. Furthermore, there is no obligation for the users to use always all available satellites, since for instance in some cases, some satellites in view may have been discarded because of a wrong tracking. Those users may have big discrepancies in performances with respect to others. When focusing on the ability of SBAS to always maintain integrity, and to overcome the above limitations, the Stanford-ESA Integrity Diagram converts the typical Stanford Diagram into the most possible conservative analysis tool at the user domain. Two possible displays are being considered for the Stanford-ESA Integrity Diagram, booth involving the same computational load:

a) The Worst-Safety-Index diagram and

b) The All-Geometries diagram.

The Worst Safety Index Diagram

Instead of representing each (XPE, XPL) pair for an all-in-view situation, it does that, at every second, for the sub-ensemble of satellites leading to the minimum Safety Index (XPL/XPE). The algorithm shown in Figure 1, as follows:

Figure 1: Stanford-ESA Modified Integrity Diagram Algorithm

Specifically, at each time sample, all the combinations of satellites from 4 to all-in-view are analysed. The combination of satellites leading to the minimum Safety Index (i.e. leading to the less possible comfortable Integrity margin) is selected. The Stanford-ESA Integrity diagram is then updated with the (XPE,XPL) pair corresponding to that minimum SI case. The process is repeated for every time sample. Obviously, with the Stanford-ESA Integrity diagram the obtained results for accuracy and availability do not have any meaning and the analysis of results shall only focus on Integrity. Indeed, showing that in this user domain worst-ever possible case there is no situation in which the error overcomes the protection level, is the best experimental guarantee that at user domain for a specific location and epoch over-bounding is assured.

The All Stanford ESA Diagram

In this case, instead of representing each (XPE, XPL) pair for an all-in-view situation, it does that, at every second, all the combinations of satellites from 4 to all-in-view are displayed. Moreover, the right of diagonal is modified as follows:

• If a MI happens, all the geometries on the right of diagonal are plot with the same colour, and with a common symbol (square, star, triangle,…). And the colour indicates the epoch relative to the time interval recorded in the file, in the colour bar of the plot.
• The previous rule applies only to the last 10 epochs with MIs. All the other epochs with MIs (if it happens) will be display as in the left side. Nevertheless, this situation should be extremely rare and will indicate an important anomaly from the receiver or system.

The aim of previous rules is to identify the sets of geometries associated to the same MI and, especially, to provide some information about the time correlation of such MIs. In this way, the all-geometries diagram provides a quick and clear view of the system performance for the all possible geometries (not only for all-in-view or the worst safety index). And, at the same time, the display is enhanced with time information for the unsafe geometries (i.e., with MIs), which are clustered by epochs using different symbols.

The number of geometries with MIs or with HMIs is also written in the plot, together with the number of epochs involved (notice that a given epoch can involve geometries with MIs and HMIs). Finally, at the bottom it is written the “number of epochs with XPE>XPL”, which summarizes the simple pass/fail criterion: no points on the right of diagonal (for any geometry at any epoch).

Four examples of All-Geometry diagrams are given in Figure 2. The first row shows two examples of diagram without MIs. The diagrams of second do not fulfil the integrity criteria, having geometries with MIs. In the left side diagram only two epochs are involved, labelled by yellow-squares and blue-stars. Such epochs are far in time. The first epoch (dark blue-stars) corresponds to the beginning of the file. The second one (yellow-squares) happened at the middle of data collecting period. Thence, such MIs are independent in time. The figure at bottom left shows a diagram with several geometries having MIs which involve five epochs. The MIs happen basically in three different periods of times: At the beginning of the file (dark blue-crosses), after the first quarter (light blue squares and circles) and before the third quarter of file (brown squares and triangles). HMIs happened only in two independent epochs, one of them involves only one geometry, which is in the left border of the region.

Note: The underbounding situations indicated in this article are included here for the sake of illustrating the principle of the Stanford-ESA concepts proposed and do not correspond to EGNOS system real performances.

Figure 2: Four artificially generated examples of All-Stanford-ESA Integrity Diagram. The number of epochs (N) in the measurement file, the number of epochs with valid navigation solution (NV) and the number of computed geometries (NG) are shown at the top of each diagram.

The ICAO SARPS [3] requires that when performing all in view user positioning it is always verified that the protection level bounds the navigation system error all the time (i.e. points are always at the left of the diagonal of the nominal Stanford diagram). This is required, irrespectively of the alert limit, for which, instead the integrity risk is referred. Through discussions with standardisation experts the authors were informed that the main reason for such a conservative condition is to take a margin to cover the possible case that not all in view satellites are used in the position domain. When the “All Geometries Stanford–ESA Integrity diagram is considered, it could then be argued that this very conservative condition is not any more necessary, and that just showing the error does not go beyond the Alert limit without being warned by an over-bounding protection level could be sufficient. Yet, as we will show later (Section 3), EGNOS is required to meet the “out of tolerance” conservative criteria also in the case of the Stanford-ESA modified Integrity diagrams. This is consistent with EGNOS bounding design concept, in which EGNOS is required to bound always the residual error at the level of each individual PRN satellites orbit/clock and line of sight ionosphere pseudo-ranges.

Figure 3: Standard Stanford plot (left), Worst-Safety Index (middle) and All-Combinations (right) Stanford-ESA Integrity Diagram for a receiver in Canarias Islands (Spain) on 2nd February 2006 (PRN 120 ESTB). No MIs appear in the standard Stanford Plot, while 10 Epochs with MIs and HMIs are detected by the Stanford-ESA plots.

Figure 3 illustrates the interest of using the Stanford-ESA diagrams as part of the daily SBAS performance monitoring. The performance of the standard Stanford plot is compared with the Worst-Safety-Index and the All-Combinations Stanford-ESA diagrams in Figure 3. This corresponds to a specific critical day of the ESTB. The ESTB is a very basic prototype of a SBAS system, which have not been designed to maintain integrity, and therefore, this extreme situations, although rare may occur with it. This case is selected to illustrate that while no MIs are found in the standard Stanford plot (no alarm had been raised based on that diagram by the operators), up to 10 epochs with geometries having MIs are detected when using the Stanford-ESA diagrams. The All-Combinations Stanford-ESA diagram shows that during these 10 epochs, a total of 26 possible geometries where not properly bound by the VPLs, and from those two geometries led to true HMIS cases. We see also in this particular example that all of such epochs (except one) happened at the beginning of the data collecting period (blue colour) and one somehow at half of the observed period (yellow color), affecting a single geometry case.

Figure 4 provides another example about the limitations of the classical Stanford plot, again using the non-safety of life ESTB system. The figures at the left show the classical Stanford plots. The figures at the right show the associated All-Combinations Diagrams. While the Stanford plot at the top looks like the best performance with availability of 99.93% (and 100% of samples within the normal operation region), is the All-Geometries Diagram at the bottom who has the best performance.

Figure 5 shows an example of how optimistic can the Classical Stanford plot be. The figure at the left show the classical Stanford plot without having MIs. The figure al the right shows a very unsafe situation with a huge number of geometries having MIs.

These examples clearly illustrate author’s conviction on the importance of complementing daily user/pseudorange bounding routine performance tests with Stanford-ESA tests around Europe sites, so that all geometries are systematically assessed, confirming hopefully system margins are sound in all circumstances. This maybe of particular interest upon major identified GPS or ionospheric threat events, to confirm user domain margins remain constant upon a system maintenance correction, etc.

Figure 4: Two examples comparing the performance of the Stanford plot and the All-Geometries Diagram. Each row shows the Stanford Plot and its associated All-Geometries Stanford-ESA Diagram.

File:Conservative Classical Stanford Plot.jpg

Figure 5: Example of how conservative the Classical Stanford plot can be. No MIs appear in the Stanford Plot, while a very unsafe performance is displayed in the Stanford-ESA All-Geometries Diagram.

Computation Algorithm

A simple sequential/recursive algorithm to compute the XPE and XPL for all possible geometries of satellites in view with very low storage and CPU requirements is provided in the appendix. An example of its implementation in C and FORTRAN77 software is also provided in this appendix.

The algorithm starts up from the normalized geometry matrix and measurement vector for all satellites in view with valid differential corrections available. It excludes one satellite and computes the XPE and XPL; then iterates recursively from previous matrix and vector up to when only 4 satellites remain (i.e., recursively going over one branch in the “combinations tree”). Next, it comes back to the starting matrix, excludes another satellite and recursively iterates again. This scheme is sequentially applied over all the possible branches, covering all combinations of satellites.

The strategy has low storage requirements. Only a single geometry matrix G and measurement vector y have to be stored (at most) at the same time (see note 3 in appendix 1). No combination is computed twice.

The previous algorithm has been implemented in BRUS [4], the software developed by the UPC Univeresity in Barcelona, Spain, to process and analyze the SBAS data. It has also been incorporated in a testing version of the Global Monitoring System (GMS) [5] that is computing daily the EGNOS performance for GEOs PRN 124 and PRN 126 and the ESTB performance for GEO PRN120.

The standard Stanford plot together with the Stanford-ESA diagrams Worst-Safety-Index and All-Combinations are shown in figure 6, for a 24h data set collected in Toulouse at May 2nd 2006 (GEO PRN126).

The generation of the Stanford-ESA diagram for this 24h data set at 1Hz involved the computation of the navigation solution for 17.419.635geometries. The computation of the “all geometries” required only 1 min. and 5 sec. of CPU additional to the computation of “one single” geometry for each epoch (see Table 1).

Figure 6: Stanford plot (left), Worst-Safety Index (middle) and All-Combinations (right) for the horizontal component. The measurements were collected from a receiver in Toulouse at May 2nd 2006 (PRN 126). The numbers of valid epochs (with differential corrections available) were 85.053 from 86.400 (24h) available in the RINEX file. The Stanford-ESA diagram involved the computation of the navigation solution for 17.419.635 geometries. No MIs appears for any geometry at any time.

Notice that the both, the Worst-Safety-Index and the All-Geometries diagrams require the computation of the navigation solution for all possible geometries. And booth diagrams can be generated at the same time.

Table 1: Computation time over a standard PC with LINUX (Pentium 4, CPU 3.0 GHz).

Computation	Time
One geometry for each epoch (to make the standard Stanford plot)	1 min 48 sec (85.053 geometries)
1 min 48 sec (85.053 geometries)	2 min 53 sec (17.419.635 geometries)
Total additional time	1 min 05 sec

EGNOS Measurement Results

Stanford-ESA performance results with real EGNOS signal in space were computed for a set of stations covering a wide range of locations in Europe. These results, provided here for illustration, were obtained on March 12th 2006 with PRN 126 EGNOS transmission.

Figure 7 and 8, show the All-Stanford-ESA diagrams in the Horizontal and Vertical domains, respectively, for 6 fixed sites which coordinates are given in Table 2. All data sets were collected at 1Hz.

Table 2: Site coordinates.

Station	Location	Longitude	Latitude
bud2	Budapest (Hungary)	47.48	19.06
fuc2	Fuciono (Italy)	41.98	13.60
mala	Malaga (Spain)	36.68	-4.49

Figures 9 and 10 are similar to 7 and 8, but showing the Worst-Safety-Index Stanford-ESA diagrams.

The data sets were processed assuming MOPS APV Approach and using the MOPS defined 100sec user receiver smoothing, excluding the satellites during the convergence of the smoother. The Appendix J of DO229C MOPS [6] was assumed for the receiver contributions for the computation of protection levels. Results clearly reveal excellent EGNOS integrity margins for all geometries. The integrity margins remain large, and for all samples it is confirmed that the computed protection levels do always bound the user position error. A regular daily monitoring of the Stanford-ESA diagrams at several European sites could be a very good complement to daily accuracy, availability and continuity performance measurements and could help to understand better the actual EGNOS safety margins, allowing confirming through real data the designed safety margins.

Conclusions

In this article, a new concept for SBAS integrity performance validation is presented. The proposed concept, known as the Stanford-ESA modified integrity, is a modification of the well known and extensively used Stanford diagram. When focusing on SBAS integrity exclusively, it is clearly apparent that the classical Stanford Diagram is not always conservative. With the Stanford-ESA concept, instead, it may easily be concluded that, for a specific user location and period interval, every computed all possible combinations of satellites seen by the user from 4 to all in view are checked for that user at that location. Thus, if no integrity risk violation is observed with the Stanford-ESA Integrity diagram computation at a given location and for a given period of time, we may certainly conclude that for all possible GPS satellite geometries and SBAS information that could potentially be used in that location and for that period, the system was safe. Real measurement results have been presented here showing that the EGNOS integrity margins remain safe when the Stanford-ESA integrity diagram is computed. The Stanford-ESA Integrity diagram is considered by the authors a powerful tool for safety analysis, since it may easily be applied to real data, and without significant CPU or storage requirements. Actually, with the mathematical approach proposed by the authors in the Appendix, the Stanford-ESA diagrams may be computed in real time at any given location. It could then be suggested as a complementary real time monitoring for the SBAS operators, allowing the identification in time of possible problems at user level. It could be suggested, for instance, that involved European civil aviation and related certification authorities, do perform, during EGNOS initial operations, daily collection campaigns at well selected European sites, computing, among other parameters, the Stanford-ESA Integrity diagrams proposed here, and reporting on the actually obtained margins. This could be done, for instance, in complement to daily pseudorange bounding analysis. The authors believe this data could certainly be of some support to the EGNOS Safety case and could help to understand better the actual EGNOS safety margins, hopefully, confirming the integrity designed margins. Situations of specific interest (such as specific GPS anomaly cases of severe iono storms) could also be assessed in terms of margin reduction at user level. Finally, we believe these concepts may also have an interest in the area of Ground Based Augmentation Systems (GBAS).

Acknowledgement

We would like to thank the European Space Agency, Eurocontrol, The Institut Cartografic de Catalunya (ICC) and the IGS community for providing the ground receiver data. The contributions from gAGE/UPC to this work are done in the frame of EGNOS SIS validation activities carried out as a sub-contract to Pildo Labs, under contract to Eurocontrol.

References

</references>

[1] A. Tadjine. “WP 103.2: Integrity at User Level (Part II)”. Issue 1, Rev. B. Ref. GMV-EGNOSAE-TN-007/04. Dated 17/01/2005.

[2] WADGPS Laboratory (Stanford University). "WAAS Precision Approach Metrics. Accuracy, Integrity, Continuity and Availability," http://waas.stanford.edu/metrics.htm. October 1997

[3] SARPS Amendment 77, Annex 10 to the Convention on International Civil Aviation, Aeronautical Telecommunications: International Standards and Recommended Practices, Volume 1, Radio Navigation Aids, November 2002.

[4] Basic Research Utilities for SBAS. M. Hernández-Pajares, J. M Juan and J. Sanz. gAGE/UPC 2003. http://gage9.upc.es.

[5] GMS Architectural Design and Detailed Design Document, M. Hernández-Pajares, J. M. Juan and Jaume Sanz. gAGE/EEC, 2004. EUROCONTROL.

[6] Minimum Operational Performance Standards for GPS/WAAS Airborne Equipment, RTCA, Do 229C, November, 2001.