Abstract
The baseline algorithm for horizontal advanced receiver autonomous integrity monitoring (HARAIM) provides a reference method for computing a horizontal protection level (HPL) for aircraft en-route navigation safety requirements. The baseline HPL bounds the radial positioning error in three steps by iteratively solving for an east protection level (PL), solving for a north PL, and then combining the two PLs. Each iterative process optimally allocates an integrity risk requirement across fault-free and fault hypotheses. We develop two new HPLs that require the iterative process to be performed only once. One approach is more compact, whereas the other provides a tighter bound than the baseline. Additionally, we derive a theoretical generalized chi-square horizontal reference boundary for analytical purposes. Using simplified single- and two-hypothesis examples, we assess how satellite geometry and measurement error model parameters impact the HPL bounds. Finally, we conduct a worldwide analysis comparing the proposed HPL approaches against the baseline for an example HARAIM-based aircraft navigation application.
1 INTRODUCTION
The Global Positioning System (GPS) has become the most ubiquitous navigation utility, but it alone does not provide sufficient integrity, continuity, and availability for safety-critical transportation applications. Integrity is a measure of trust in sensor information, whereas integrity risk is the probability of a system's navigation errors exceeding acceptable bounds without timely warning. This research focuses on high-integrity navigation applications for general and commercial aviation. Advanced receiver autonomous integrity monitoring (ARAIM) is a GPS augmentation that leverages dual-frequency measurements from multiple global navigation satellite system (GNSS) constellations as well as integrity support data. This information is processed at the airborne user receiver through algorithms designed to provide navigation safety guarantees.
The ARAIM baseline algorithm provides probabilistic positioning error bounds for dual-frequency multi-constellation GNSS (Working Group C, 2016). These positioning error bounds account for both measurement nominal errors and undetected faults and come in the form of a horizontal protection level (HPL) for horizontal ARAIM (HARAIM) and vertical ARAIM (VARAIM) and a vertical protection level (VPL) for VARAIM. Together, the HPL and VPL describe a cylinder centered at the true user location, containing the estimated location with a high level of confidence, such as 99.99999% (Working Group C, 2022). The baseline algorithm was developed over the last decade with an initial focus on VARAIM for aircraft approach with vertical guidance that then shifted toward HARAIM for aircraft en-route navigation (Working Group C, 2012, 2015, 2016). This paper addresses the HARAIM HPL. The current ARAIM algorithm description document is a reference algorithm for computing an HPL that meets safety requirements for aircraft en-route navigation (Working Group C, 2022). While alternative HPL equations exist (Jiang & Wang, 2016; Ober, 1997; Walter & Enge, 1995), they are not as tightly bounding nor as computationally efficient as the ARAIM baseline HPL method.
According to the satellite-based augmentation system (SBAS) minimum operational performance standards (MOPS) for GPS, the HPL is defined as the horizontal radius of a circle, centered at the true position, that is expected to contain the estimated horizontal position at a probability defined by the integrity and continuity requirements (Radio Technical Commission for Aeronautics (RTCA) Special Committee 159, 2009). We express the two-dimensional (2D) horizontal positioning error (HPE) vector as in a local east–north (E, N) coordinate frame and define the HPL as follows:
1
where the vector norm is defined as . HPL is the radius of a circle such that the probability of the radial error, , exceeding HPL is equal to the predefined integrity risk requirement allocation PAlloc. Upright bold-face characters designate vectors, whereas italicized characters denote scalars. Figure 1 shows HPE samples with a non-zero mean. In ARAIM, considering multiple fault-free and fault hypotheses and their probabilities of occurrence, this 2D error distribution can be represented by a mixture of bivariate Gaussian distributions, whose probability density function, f(ε), is represented by a shell (the fault-free hypothesis is dominant because its probability of occurrence is orders of magnitude higher than that of the fault hypotheses).
Illustration of HPE samples and probability density function in an east–north frame
While the VPL is computed from a one-dimensional (1D) Gaussian distribution, the challenge with the HPL is that it involves integrating a 2D distribution over a circular area. The SBAS MOPS defines conditions during aircraft approaches that justify deriving the HPL from a 1D normal distribution along the worst-case horizontal direction. Building upon SBAS, the baseline ARAIM algorithm efficiently evaluates two protection levels (PLs) for two 1D normal distributions aligned to the east and north directions, respectively, and then combines the two PLs to bound the HPE (Blanch et al., 2015; She et al., 2023).
In Section 2 of this paper, we derive two new HPLs: one that is more compact and one that provides a tighter bound than the baseline. In addition, for analytical purposes, we derive a generalized chi-square horizontal reference boundary (HRB); this notional bound is valid only if the HPE is actually Gaussian, which is unrealistic, but is useful when evaluating the performance of the other bounds. In Section 3, we evaluate the tightness of the baseline and new tight HPL by comparing them to the generalized chi-square HRB through simplified single- and two-hypothesis examples. Finally, in Section 4, we quantify the ARAIM availability performance of the baseline and new HPLs for Required Navigation Performance (RNP) with a horizontal alert limit (HAL) of 0.1 and 0.3 nautical miles (Federal Aviation Administration, 2017).
2 BASELINE, NEW, AND GENERALIZED CHI-SQUARE BOUNDS
2.1 Baseline Three-Step HPL and New Single-Step HPL Equations
The baseline ARAIM algorithm computes an HPL by considering a set of mutually exclusive, exhaustive hypotheses for faulty and fault-free measurements. The set includes monitored hypotheses H(i) for i = 0,…, h, where h is the number of monitored hypotheses, and the non-monitored hypotheses are treated as described by Working Group C (2016). Baseline HPL computation is achieved in three steps by first determining two separate PLs along the east and north directions and then combining them to bound the radial positioning error distribution. Each PL computation is an iterative process equivalent to optimally allocating some integrity requirement across all h hypotheses. The algorithm has been fully described by Working Group C (2022). The baseline ARAIM PL equations can be expressed as follows:
2
3
4
where:
- PAlloc
- is the predefined risk requirement allocation, as described, for example, by Working Group C (2022),
- is the tail probability of a standard (zero-mean, unit-variance) normal distribution,
- is the modified Q function, where for u > 0 and for u ≤ 0,
- q
- is a position coordinate index: q is E for east or N for north,
- h
- is the number of monitored fault hypotheses,
- PLq
- is the protection level in the q direction,
- is a bound on the worst-case impact of the nominal bias in the q direction for subset solution i,
- is the solution separation detection threshold in the q direction for subset solution i,
- is the positioning error standard deviation in the q direction for subset solution i, and
- is the prior probability of hypothesis H(i) .
Equations (2) and (3) capture the facts that the prior probability for the fault-free hypothesis, , is bounded by 1 and that the summation only accounts for the right-tail risk contributions of faulted hypotheses (Blanch et al., 2015).
In this paper, we develop two new approaches to derive the HPL directly from the HPE. Another way to express this idea is that the optimal integrity risk allocation across hypotheses is directly performed for the HPE instead of for two separate horizontal directions. In each of the two new approaches, we iteratively solve a single HPL equation instead of two. The first single-step HPL equation derived in Section 2.2.1 is a compact formulation, which can be expressed as follows:
5
The terms and are derived from , and for , which are the same parameters as those used to derive . For and . The terms and are defined for as follows:
6
For cases in which HPE bound tightness is prioritized over compactness, a second, tighter bound is derived in Section 2.2.2, which is given by the following:
7
where:
8
Computing HPLCP or HPLTT requires only a few minor changes to the last step of the baseline algorithm, but provides a radial error bound that is either simpler or tighter. These compact and tight HPL equations build upon our earlier analysis (Racelis & Joerger, 2022) and on another HPL approach (Blanch & Walter, 2023). The alternative HPL formulation by Blanch and Walter (2023) provides a tighter bound than Equation (7) and has a structure similar to that of Equation (7), albeit slightly more complex.
The ARAIM algorithm includes additional terms to account for fault exclusion through multipliers and for repeated exposures through a number of effective samples (Working Group C, 2022), which are not directly significant to this derivation and can be easily incorporated into Equations (2), (3), (5), and (7). These refinements are not included in Section 2 or 3 to avoid obscuring the derivation, but are accounted for in the HPL performance evaluation in Section 4.2.
2.2 Derivation of the New Single-Step HPLs
In ARAIM, under a fault hypothesis H(i), the 2D HPE vector for the full-set solution (superscript (0)) and for subset solutions i (superscript (i) ) are respectively defined as follows:
9
10
The 2×1 full-set HPE vector ε(0) is broken up into a random component (caused by satellite orbit and clock ephemeris errors, residual tropospheric and ionospheric delays, and multipath and receiver noise), a nominal bias component (primarily due to code-phase signal deformation), and the full-set position-domain impact of an undetected fault under and are the 2×1 HPE vectors of the subset solutions due to nominal measurement random errors and biases, respectively. ε(i) is fault-free under H(i) (i.e., under ). The notation in Equation (10) is also valid for i = 0, as under H(0). Subscript r distinguishes random HPE components and with over-bounded error distributions (Blanch et al., 2018; DeCleene, 2000; Rife et al., 2006), from unknown but element-wise interval-bounded error vectors , and .
Given a fault hypothesis H(i), the probability of hazardously misleading information (HMI) is the probability that the HPE exceeds the alert limit l and there is no detection . This conditional integrity risk is defined as follows:
11
Starting from Equation (11), we derive single-step compact-form and tight HPL equations in Sections 2.2.1 and 2.2.2, respectively.
2.2.1 Compact Single-Step HPL
Equation (11) is bounded by the following inequality:
12
Using the triangle inequality, the bound in Equation (12) can be expressed in conditional form as follows:
13
where we used the fact that . We distinguish the estimation error component , whose zero-mean distribution can be modeled, from the remaining components which are unknown but can be bounded. Assuming a solution separation detector, the conditional event is expressed as . Therefore, the second norm in Equation (13) can be bounded by the following inequalities:
14
where , and and are bounds on the impacts of the nominal bias in the east and north directions, respectively. Equation (14) uses the same , and terms as the baseline method equations (Equations (2)–(4)).
By substituting Equation (14) into Equation (13) and using the condition of Equation (13), , we obtain the following bound:
15
Up to this point, we have been following the risk bounding steps used in solution separation (see, e.g., the work by Joerger et al. (2014)), but applied to the norm of a 2D vector.
Figure 2 shows example covariance ellipses scaled by a factor k(i). The ellipses are curves of constant joint probability density for the zero-mean bivariate normally distributed random vector in Equation (15). The standard deviations of the east and north components of are and , respectively. In this derivation, consistent with the baseline algorithm, we do not assume to know the correlation between and . Thus, any ellipse inscribed in the rectangle (dashed red line) of half-side lengths and , i.e., of half-diagonal length , will be accounted for in the bounding process. This circumscribing rectangle is key to bounding the bivariate distribution using two univariates, i.e., considering the probabilities of the east and north positioning errors being in two half-plane pairs (gray-shaded).
Examples of -covariance ellipses scaled by a factor k(i) for given values of and
The scaled ellipses and their circumscribing rectangle of diagonal half-length change with k(i), whereas the circle is of fixed radius . When , the risk of exceeding the dashed red rectangle provides an upper bound for that of exceeding the black circle.
The scaling factor k(i) for the ellipse and its circumscribing rectangle is a probability multiplier corresponding to an undetermined risk allocation under H(i): k(i) is useful for describing the bounding process, but will be eliminated in the next steps of the derivation. A larger value of k(i) corresponds to a smaller risk of exceeding the rectangle. Here, we want k(i) to be as large as possible.
The last element needed to represent Equation (15) is the circle of radius . The risk that the 2×1 vector exceeds this circle is upper-bounded by the risk that exceeds the dashed rectangle if the rectangle stays inside the circle. Therefore, the largest allowable value of k(i) is the one for which the rectangle is inscribed in the circle. In this case, the rectangle's half diagonal equals the radius of the circle, which is expressed as follows:
16
Substituting Equation (16) into Equation (15) and bounding the risk of exceeding the circle with the probability of being in the two gray-shaded pairs of half-planes, we find the following inequalities:
17
18
Furthermore, we use the symmetry of the zero-mean normal distribution of and to deal with the absolute values, and we divide each variable by its standard deviation to obtain the following inequalities:
19
20
where εSN follows a standard normal distribution. We use the notation . By substituting Equation (16) into Equation (20) and rearranging, we obtain the following bound:
21
Considering all fault-free and fault hypotheses, the integrity risk bound is as follows:
22
where PNM is a bound on the risk contribution from not-monitored hypotheses. The equivalent single-step compact HPL or HPLCP equation can be expressed as follows:
5
where the risk requirement allocation PAlloc accounts for PNM, as described, for example, by Working Group C (2022).
2.2.2 Tight Single-Step HPL
In this section, we derive a tighter HPL than in Equation (5) by accounting for the fact that, under H(i), a fault can only shift the error distribution in one horizontal direction, and one direction only. Therefore, in contrast with Equation (15), where was subtracted from the alert limit, this section starts from Equation (11) and takes additional steps to tighten the systematic positioning error bound.
Figure 3 differs from Figure 2 in that the dashed red rectangle circumscribing the example k(i)-scaled ellipses is centered at ( ). In addition, Figure 3 depicts the alert limit as a black circle of radius l. Similar to Equation (16), we can determine the largest acceptable value of k(i) such that . Defining is a simplification assuming that the worst-case HPE bias bound, i.e., the diagonal of the black dotted rectangle in Figure 3, is aligned with the diagonal of the red dashed rectangle.
Examples of -covariance ellipses scaled by a factor k(i) for given values of and , with their circumscribing rectangle of diagonal half-length shown in dashed red lines
The black circle is of radius . When and , the risk of ε(0) exceeding l under an undetected fault H(i) is bounded by the risk of being in any one of the four gray-shaded half-planes.
The subsequent derivation is a conservative bound because it evaluates the risk of the full-set positioning error ε(0) exceeding the gray circle, which bounds that of ε(0) exceeding the black circle as defined in Equation (11). This step is well worth the mathematical simplification because, for realistic cases such as those analyzed in Section 4, the gray circle in Figure 3 is only slightly smaller than the black one.
In Figure 3, the corner of the red dashed rectangle closest to the gray circle defines two half-planes at distances and from the origin in the east and north directions, respectively. Two additional half-planes in the west and south directions are added to form a rectangle inscribed in the gray circle. With k(i) defined by the diagonal of the red dashed rectangle as in Equation (16), the half-planes are defined by the distances to the origin:
23
Thus, the risk of ε(0) exceeding the gray circle is bounded by the probability of ε(0) being in any one of the four gray-shaded half-planes. This probability is itself bounded by the sum of the risks of ε(0) being in each individual half-plane, which is given by the following:
24
for the east, north, west, and south gray-shaded half-planes, respectively.
Under fault hypotheses H(i), for , the core of the distribution is shifted by the presence of a fault. Let us assume that a fault causes . The bounding process can be similarly derived for a fault lying on any of the other three quadrants. The right-tail probabilities, i.e., the first and second terms of Equation (24) (east and north half-planes in Figure 3), are treated differently from the left-tail probabilities, i.e., the third and fourth terms of Equation (24) (west and south half-planes in Figure 3). This approach is similar to that of the single-tail derivation presented by Blanch et al. (2015), but is applied here to a 2D HPE vector.
Thus, the risk contributions from the east and north half-planes are bounded using the same steps as in Section 2.2.1. With and , Equation (24) is now as follows:
25
By using Equation (9) to identify the fault components in and , applying the assumption that and , and introducing the subscript q = E for east and q = N for north, we can bound the west and south half-planes (second and third terms of Equation (25)) as follows:
26
27
28
The inequality in Equation (28) uses the facts that and that the overbounding function on is symmetric. All variables in Equation (28) are defined, and the condition H(0) can be dropped.
In addition, we must express Equation (25) in terms of the alert limit l to later find an HPL equation. By substituting the expression of k(i) from Equation (16) into Equation (23) and substituting the resulting expression of into Equation (28), we obtain the following bound q = E and q = N:
29
30
31
where:
32
We substitute Equation (31) for q = E and q = N into Equation (25), considering all monitored hypotheses H(i), for , and all non-monitored hypotheses that have a risk of occurrence lower than PNM. Then, based on the facts that and , the integrity risk bound can be expressed as follows:
33
The equivalent tight single-step HPL equation or HPLTT equation is expressed as follows:
7It is worth noting that for the simulation parameters used in Section 4, the last two terms in Equation (7) are negligibly small (of course, we still evaluate these terms to ensure integrity).
A bound that is both compact and tight is derived in Appendix A. This bound is not included in the remainder of this paper's analysis because it is less compact that HPLCP and looser than HPLTT; however, it can be an adequate solution in some implementations.
2.3 Derivation of Generalized Chi-Square HRB
In this section, we derive an HRB for analytical purposes. The HRB is a notional bound whose tightness arises from direct numerical integration of the bivariate Gaussian distribution of the HPE model. Similar to the other HPL bounds in this paper, the HRB uses solution separation detectors and requires only minor changes to the last step of the HPE bounding process. The HRB is valid only if the measurement error distributions exactly match their overbounding Gaussian models, which is unrealistic. Therefore, the HRB is not meant for ARAIM implementation and would not be practical because bivariate cumulative distribution function (CDF) computation is expensive.
We start with the definition of risk under H(i) in Equation (12):
12
34
with:
where is zero-mean, normally distributed with a 2×2 covariance matrix P in the (E, N) frame and . The joint no-detection event ensures that the magnitude of the solution separation (SS) vector is smaller than , where . However, the direction of is unknown and is impacted by the fault vector. To lighten the notation, the superscript (i) is not included in the remainder of this section.
We conjecture that the worst-case εSS direction, which maximizes P(HMI |H(i)), is aligned with the major axis of the covariance ellipse of P Let u1 be the unit eigenvector corresponding to the largest eigenvalue of P.
Figure 4 shows the εSS-magnitude bound as a dashed circle and its worst-case direction u1 as a dashed line. The zero-mean random vector εr can be added as in Equation (34) and is represented by a black HPE ellipse centered at that worst-case εSS vector. The conjecture can then be described as follows: the ellipse's area outside the circle of radius lb is greatest when . The corresponding gray-shaded area is larger than the red area for any other example εSS vector. The areas in Figure 4 are only conceptual representations; actual probability computation involves integrating a bivariate Gaussian outside the circle of radius lb.
First steps in the generalized chi-square HRB derivation
Thus, using this conjecture and Equation (34), we obtain the following bound:
35
where:
36
The remainder of this section shows that in Equations (35) and (36) follows a generalized chi-square distribution with known parameters. The eigen-decomposition of P can be expressed as follows:
37
where U is an orthonormal matrix composed of the eigenvectors u1 and u2 of the symmetric positive definite matrix P (i.e., ) and Λ is a diagonal matrix whose diagonal elements are the eigenvalues , and of matrix P, with . We define vector x as follows:
38
Here, is the inverse of the principal square root of the covariance matrix P, and we applied the fact that . The mean of x can also be expressed as . We obtain the following expression:
39
where we leveraged the fact that and . Equation (39) is a weighted sum of squares of independent, non-zero-mean, squared Gaussian variables. Therefore, this term is a generalized chi-square distributed random variable. The HRB equation is then as follows:
40
This probability can be evaluated using numerical methods (Davies, 1980; Langel, 2021). Once again, HRB is intended for analytical purposes only. It is not strictly an HPL, but it is a useful point of reference for the analysis and evaluations presented in Sections 3–4.
3 EVALUATING THE TIGHTNESS OF THE BASELINE AND NEW TIGHT HPL
The compact HPL bound in Section 2 can be looser or tighter than HPLBL. On the one hand, HPLCP is efficient because it directly bounds the radial HPE instead of using PLE and PLN. On the other hand, HPLCP does not leverage the fact that a fault-induced shift of the HPE distribution occurs in one direction, and one direction only. HPLTT is always lower than HPLCP because it addresses this second point.
In this section, we analyze the tightness of HPLBL, HPLTT and HRB through simplified single-hypothesis and two-hypothesis examples. Performance evaluations for realistic satellite geometries are carried out in Section 4. This section focuses on the subtle impacts of (a) the relative values of σE and σN for a single hypothesis and (b) the relative values of for , for . Section 3.1 analyzes (a) by varying the shape of HPE covariance ellipses, whereas Section 3.2 tackles (b) by varying the relative ellipse orientations and ellipse center locations across hypotheses. These simplified analyses help explain changes in the relative tightness of HPLTT and HPLBL as a function of satellite geometry in Section 4.
Equations (2), (3), and (7) are solved iteratively to find PLq for q = E, N and HPLTT. An alternative, equivalent approach allocates the in Equations (2) and (3) across all hypotheses by defining such that and then optimizes that integrity risk requirement allocation (Blanch et al., 2007). This alternative approach simplifies the analysis in this section. In this case, the baseline PLs can be expressed as follows:
41
For the sake of this simplified analysis, we neglect the second and third terms in Equation (7) and denote this approximation by HPLTT* as follows:
42
For the parameter values used in Section 4, we verified that the HPLs based on Equations (7) and (42) match – Equation (42) is not to be used in practice, but is sufficient for this analysis. Similar to Equation (41), for an allocation , our approximation, HPLTT*, can be expressed as follows:
43
3.1 Single-Hypothesis Analysis
For a single hypothesis, we drop the superscript (i) and use Equations (41), (4), and (43) to obtain the following HPLs:
44
45
where . Figure 5 shows an example HPE covariance ellipse in the positive (E, N) quadrant. The center of the HPE ellipse can lie anywhere within a rectangle of dimensions 2dE and 2dN to account for nominal measurement biases and undetected faults. The radius of the red circle is HPLBL, and that of the blue circle is HPLTT*. The two HPLs are computed using Equations (44) and (45), and their construction in Figure 5 highlights the fact that for a single hypothesis. The tightness of HPLTT* lies in the risk allocation across hypotheses, as detailed in Sections 3.2–4.
Single-hypothesis illustration of HPLBL and HPLTT*
For the case in which , which we identify by adding a subscript r (for random HPE component), we define . We analyze the tightness of HPLBL and HPLTT* relative to HRB, which serves as a reference bound, considering the ratio . This larger-than-one ratio approaches one when HPLr is a tight HPE bound.
To analyze all cases of random HPE components, we parametrize the HPE covariance ellipse by considering the semimajor axis λ1 (assuming, without a loss of generality, that ), the eccentricity , and the orientation θ (the angle between the ellipse semimajor axis and the east axis). In prior work (Racelis & Joerger, 2022), we demonstrated that the tightness of HPLr is independent of θ for this single-hypothesis case. We can rewrite the HPE covariance matrix P in Equation (37) by using the following:
46
Figure 6 shows the HPL ratio versus risk allocation PAlloc for color-coded values of eccentricity, ranging from black for e = 0 (indicating a circular HPE covariance ellipse) to light gray for e approaching one. HPLr is loose when e is zero and becomes tighter when the HPE covariance ellipse flattens (e →1). As PAlloc increases, HPLr for e approaching one becomes looser while HPLr for e = 0 becomes tighter. At the 10–7 risk requirement, HPLr values are approximately 10% looser than for e = 0.9 and over 35% looser for e = 0. The analytical derivation in Appendix A of Racelis and Joerger (2022) consolidates these results by showing that the HPL ratio approaches when e = 0 and 1 when e approaches unity.
Tightness of HPLr (bound on random HPE component for a single hypothesis) with respect to integrity risk allocation for different HPE covariance ellipse eccentricities
3.2 Two-Hypothesis Analysis
In the previous section, we established that for a single hypothesis, , and when . In this section, we extend the analysis to two hypotheses to explore the difference in risk optimization between the three-step HPLBL and the single-step HPLTT*. We show that if HPE distributions differ across hypotheses, i.e., for different subset solutions, then HPLBL can become looser than HPLTT*.
We evaluate the two sets of scenarios listed in Table 1, assuming two hypotheses H(1) and H(2) with equal prior probabilities and for an example risk requirement allocation . Scenarios 1–3 investigate the impact of differences in HPE ellipse orientations between H(1) and H(2), while . Scenarios 4–6 explore the effect of variations in directions between H(1) and H(2), while maintaining the HPE ellipse eccentricities and orientations constant across hypotheses. We use Equations (2)–(4), (42), and (40) to compute HPLBL, HPLTT*, and HPR, respectively.
3.2.1 Two-Hypothesis Analysis: Zero-Mean HPE
In Figure 7, black horizontal and dashed gray vertical ellipses represent the subset solution HPE distributions under H(1) and H(2), respectively. To facilitate visualization, the ellipses in Figure 7, which are lines of constant probability density labeled for H(1) and for H(2), are shown with an inflation factor c.
Two-hypothesis examples for subset solution HPE ellipses, for different ellipse orientations under Scenarios 1–3 of Table 1
In Scenario 1, HPLBL, which is computed as the root-sum-square of PLE and PLN, is conservative because the two PLs are separately optimized across H(1) and H(2). PLE for Scenario 1 can be written as follows (a similar expression can be written for PLN):
47
Because under H(1) and under H(2), after optimal allocation, the following approximations are satisfied:
48
which is why the dashed vertical red PLE line in Figure 7 is tangent to the ellipse and the dashed horizontal red PLN line is tangent to the ellipse. In contrast, , and HPLTT* is much tighter than HPLBL. As shown in Figure 7, from left to right, HPLBL tightens as θ(2) approaches θ(1), while HPLTT* remains constant.
Figure 8 displays the ratio of to for and for ranges of θ(2) and eccentricity values: HPLBL becomes looser than HPLTT* when the difference θ(2) – θ(1) increases and when both ellipses elongate (e →1).
Tightness of at different ellipse eccentricities with respect to θ(2)
3.2.2 Two-Hypothesis Analysis: Non-Zero-Mean HPE
In this subsection, we vary the mean HPE bounds and for and hold all other parameters constant. In Figure 9, HPE covariance ellipses for the fault-free subset solutions under H(1) and H(2) are represented by solid black and dashed gray lines, respectively, and with an inflation factor c. In Scenario 4, the black ellipse is centered at (4, 0) whereas the dashed gray ellipse is centered at (0, 4). Similar to the findings in Section 3.2.1, HPLBL is looser than HPLTT* because the PLs are separately optimized in the east and north directions. This effect is attenuated in Scenarios 5 and 6, where the difference between the centers of the ellipses is reduced to the point where they coincide in Scenario 6, which matches the single-hypothesis case illustrated in Figure 5.
Two-hypothesis examples for subset solution HPE ellipses for different HPE mean bounds under Scenarios 4–6 of Table 1
In practice, some combination of diversity in orientation and mean will affect each subset solution HPE covariance ellipse. This "diversity" in hypotheses will cause HPLTT* to sometimes be tighter and sometimes be looser than HPLBL*.
4 HARAIM HPL PERFORMANCE EVALUATION
4.1 HARAIM Fault Detection Only
In this section, we evaluate the HPL performance using fault detection only (no exclusion) for HPLBL, HPLCP, HPLTT, and HRB. In addition, we evaluate the HPL for the approach in the fifth equation of Blanch and Walter (2023), which we denote as HPLJB:
49
where: and
We simulate a nominal joint constellation of 24 GPS satellites and 24 Galileo satellites. The HPL analysis is performed every minute over 24 h for HARAIM parameters that can be found in the latest ARAIM algorithm description document (Working Group C, 2022). Measurement error models follow ED259a (The European Organisation for Civil Aviation Equipment (EUROCAE), 2021). Example requirements include RNP 0.3, corresponding to a HAL of nautical miles and to integrity and continuity risk requirements detailed by Working Group C (2022).
We first select an example location at latitude 40°N, longitude 50°W, which achieves one of the lowest baseline availability values for RNP 0.3. Figure 10 compares all HPLs over 24 h. The figure shows that HPLBL, HPLCP, HPLTT, and HPLJB are mostly looser than HRB. Compared with HPLBL, HPLTT provides tighter bounds in 98% of cases, with approximately equal bounds in the remaining instances.
Time history of , and HRB sampled every minute over 24 h at an example location (40°N, 50°W)
Figure 11 focuses on two satellite geometries at times 3.18 h and 18.62 h to explain why HPLCP and HPLTT are often tighter than the baseline and why sometimes they are not. These two time stamps are indicated by vertical dashed lines in Figure 10. Figure 11 depicts the HPE covariance ellipses for the monitored hypotheses at these two times. For visualization purposes, each HPE covariance ellipse is inflated by a hypothesis-specific inflation factor c(i). The left plot shows a case in which , whereas in the right plot, . These two plots show that, consistent with the analysis in Section 3.2, a "diversity" in positioning error distributions across hypotheses can cause a loosening of the baseline HPL, which is mitigated by the new single-step HPL approaches.
Examples of HPE covariance ellipses for each monitored hypothesis at 3.18 h and 18.62 h of Figure 10
We used MATLAB's built-in code Profiler to evaluate the computation time of our ARAIM availability simulation tool (validated by She et al. (2023)) for the four 24-h HPL curves in Figure 10, excluding HRB. Depending on the computer's other tasks, the measured time of MATLAB's Profiler can vary from one run to another by a few seconds. To help reduce the effect of this variability, we timed a single run (24 simulated hours sampled every minute at an example location [40°N, 50°W]) and computed , and HPLJB at each sample. Then, we tabulated the percentage of this run time spent in each iterative PLq or HPL equation. This approach is sensible because Equations (2), (3), (5), (7), and (49) all use the same input parameters.
Table 2 presents a comparison of HPL computation times among the four HPL schemes. These computations were conducted using MATLAB R2019a running on an Intel(R) Xeon(R) W-2125 CPU @ 4.00 GHz with 32.0 GB installed RAM, operating on a 64-bit system, with an x64-based processor.
The PL/HPL computation times presented in Table 2 – obtained using Virginia Tech's Assured Vehicle Autonomy Lab's Tool for Availability Analysis (ATAA) – may differ from those generated using other software tools, such as Stanford's MATLAB Algorithm Availability Simulation Tool (MAAST), MITRE's GNSS Performance Analysis Tool (GPAT), EUROCONTROL's PEGASUS, GMV's Service Volume Simulator (SVS), or the European Commission Joint Research Centre's ARTEX (She et al., 2023).
The entire simulation takes approximately 86 s to generate the HPL time histories in Figure 10 (excluding HRB). Of this total time, approximately 43 s are dedicated to computing , and . The third column in Table 2 presents the percentage of those 43 s spent on the last step of the HPL computation. The number of calls to each PL/HPL method is listed in the second column of Table 2, whereas the corresponding percentage of computation time (of 43 s) is provided in the third column. These percentages are directly tied to the number of calls to the Gaussian CDF, i.e., to the functions that appear three times in Equation (49) for HPLJB and in Equation (7) for HPLTT, but only once each in Equations (2), (3), and (5) for PLE, PLN and HPLCP, respectively. The fourth column in Table 2 shows the number of iterations required for each PL/HPL method, highlighting that the combined number of iterations for PLE and PLN is approximately twice that of the single-step HPL methods.
To illustrate the sensitivity of the computation time to implementation, we also evaluated a version of Stanford's MAAST in which we included the different HPL schemes. It is worth noting that if a bisection method is used for the iterative HPL determination process, then the starting interval is sensitive to the computation time. Using MAAST, the computation times for , and represent roughly the same percentage of the last step of the HPL computation, whereas takes less than half this amount.
4.2 HARAIM Fault Detection and Exclusion
In this section, we evaluate worldwide ARAIM availability performance using fault detection and exclusion. Figure 12 presents availability maps for all four HPL approaches and the HRB, for a worldwide grid of locations at 10° × 10° latitude–longitude spacing. Availability is the percentage of time over 24 h when the computed HPL or HRB meets the HAL (in this example, the HAL is l = 556 m for RNP 0.3). The color bar indicates a range of availability values from 96% in red to 100% in blue.
Availability maps of , and (left) and of HRB (right) for a HAL of 556 m
These availability maps were generated without the use of a risk-optimized estimator.
The overall performance metric is the “coverage of 100% availability,” which is the fraction of locations that achieve 100% availability weighted by the cosine of the location's latitude. In this example, coverage is 94.75% for , and versus 94.91% for HRB. Coverage values of 99%, 99.5%, and 100% availability for HAL values of 185 m and 556 m are given in Table 3. The results consistently show equal performance for , and and only small differences as compared with HRB. Thus, Table 3 suggests that the computationally efficient baseline and new HPLs provides tight bounds, achieving coverage of RNP performance approaching that of direct integration of a bivariate distribution. The column of coverage values for HRB is shown in gray to denote that it is not strictly an HPL and is included for analytical purposes only.
Coverage of 100% availability for HPLCP is slightly lower for a HAL of 185 m than for HPLBL, HPLTT, and HPLJB, but the compact HPL coverage is the same as for the other HPLs for the other five cases (coverage of 99.5% and 99% availability for both HALs and coverage of 100% availability for a HAL of 556 m). Therefore, for a HAL of 556 m, HPLCP is the most efficient among the HPL methods without sacrificing performance.
Figure 13 provides a refinement over the coverage results by presenting a histogram of HPL ratios between the baseline and new HPL approaches. The histogram shows that most geometries exhibit a 10%–20% reduction in HPLTT as compared with HPLBL, but this reduction is negligible for geometries that are unavailable under the requirements of interest. Thus, HPLTT provides a tighter bound than HPLBL and has a simpler expression.
Histogram of HPL ratios for 196,992 satellite geometries (simulated every 5 min over 24 h, for a 10° × 10° latitude–longitude grid of locations)
5 CONCLUSIONS
In this paper, we first derived two new HPL equations that require solving a single iterative HPL equation as opposed to two for the baseline HPL. The new HPLs are either more computationally efficient or can provide a tighter bound. Second, we derived a generalized chi-square HRB by direct integration of a bivariate distribution serving as a theoretical reference bound on the HPE. Third, we analyzed the tightness of the baseline and new tight HPLs as compared with the generalized chi-squared HRB: the new approach provides tighter HPL bounds when HPE covariance ellipses or mean HPE bound vectors vary across fault hypotheses. We analyzed worldwide availability performance using the new HPLs and HRB for realistic aircraft en-route navigation requirements; the analysis shows that the new bounds can match the performance of the baseline ARAIM algorithm at a lower computational cost.
HOW TO CITE THIS ARTICLE:
How to cite this article: Racelis, D., & Joerger, M. (2026). Modified Horizontal Protection Levels for ARAIM. NAVIGATION, 73. https://doi.org/10.33012/navi.760
ACKNOWLEDGMENTS
The authors would like to thank the Federal Aviation Administration for their support of this research. We express our sincere gratitude to Dr. Juan Blanch at Stanford University for his invaluable feedback on early versions of this paper and to Dr. Shizhuang Wang at Virginia Tech for his thoughtful contributions during the revision process. The opinions expressed in this paper are our own and do not necessarily represent those of any other person or organization.
Appendix
A | COMPACT AND TIGHT SINGLE-STEP HPL
In this appendix, we derive a third HPL expression: the HPL is most often tighter than HPLBL and HPLCP and is more compact than HPLTT. The derivation starts with Equation (31), where bounds on the left-tail terms along the east and north directions are given. The probabilities of the HPE being in the west and south half-planes are summed in Equation (25). To evaluate this sum in a compact manner, we apply the same method as in Section 2.2.1 and Figure 2 for a rectangle with half-side lengths for q = E and q = N. The multiplier is set such that the rectangle's half-diagonal length is equal to the radius of the circumscribing circle. Thus, we define the following variables:
50
Following the same steps as in Equations (16)–(21) for the south and west half-planes, Equation (31) is then as follows, for q = E and q = N:
51
where . By substituting Equation (51) into Equation (25) for q = E and q = N, considering all monitored hypotheses H(i) for and all non-monitored hypotheses (with probability of occurrence lower than PNM), and applying the facts that and , the integrity risk bound can be expressed as follows:
52
The equivalent compact and tight (CT) single-step HPL equation is expressed as follows:
53
This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.
REFERENCES
- ↵Blanch, J., Ene, A., Walter, T., & Enge, P. (2007, September). An optimized multiple hypothesis RAIM algorithm for vertical guidance. In Proceedings of the 20th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS 2007), 2924–2933. https://www.ion.org/publications/abstract.cfm?articleID=7644
- ↵Blanch, J., & Walter, T. (2023, September). Approaches to improve advanced RAIM protection levels. In Proceedings of the 36th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2023), 1765–1773. https://doi.org/10.33012/2023.19279
- ↵Blanch, J., Walter, T., & Enge, P. (2018). Gaussian bounds of sample distributions for integrity analysis. IEEE Transactions on Aerospace and Electronic Systems, 55(4), 1806–1815. https://doi.org/10.1109/TAES.2018.2876583
- ↵Blanch, J., Walter, T., Enge, P., Lee, Y., Pervan, B., Rippl, M., Spletter, A., & Kropp, V. (2015). Baseline advanced RAIM user algorithm and possible improvements. IEEE Transactions on Aerospace and Electronic Systems, 51(1), 713–732. https://doi.org/10.1109/TAES.2014.130739
- ↵Davies, R. B. (1980). The distribution of a linear combination of chi-square random variables. Journal of the Royal Statistical Society. Series C, 29(3), 323–333. https://doi.org/10.2307/2346911
- ↵DeCleene, B. (2000, September). Defining pseudorange integrity - overbounding. In Proceedings of the 13th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GPS 2000), 1916–1924. https://www.ion.org/publications/abstract.cfm?articleID=1603
- ↵Federal Aviation Administration. (2017). Instrument procedures handbook FAA-H-8083-16B (tech. rep.). U.S. Department of Transportation, Federal Aviation Administration.
- ↵Jiang, Y., & Wang, J. (2016). A new approach to calculate the horizontal protection level. The Journal of Navigation, 69(1), 57–74. https://doi.org/10.1017/S0373463315000545
- ↵Joerger, M., Chan, F. C., & Pervan, B. (2014). Solution separation versus residual-based RAIM. NAVIGATION, 61(4), 273–291. https://doi.org/10.1002/navi.71
- ↵Langel, S. (2021, September). New bounds on the horizontal protection level for the non-zero mean case. In Proceedings of the 34th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2021), 1565–1576. https://doi.org/10.33012/2021.17888
- ↵Ober, P. B. (1997, January). Ways to improve RAIM/AAIM availability using position domain performance computations. In Proceedings of the National Technical Meeting of the Institute of Navigation, 485–497. https://www.ion.org/publications/abstract.cfm?articleID=508
- ↵Racelis, D., & Joerger, M. (2022, September). Evaluating new and current horizontal protection levels in the baseline ARAIM algorithm. In Proceedings of the 35th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2022), 238–246. https://doi.org/10.33012/2022.18360
- ↵Radio Technical Commission for Aeronautics Special Committee 159. (2009). Minimum operational performance standards for Global Positioning System/wide area augmentation system airborne equipment (RTCA DO-229) (tech. rep.). RTCA.
- ↵Rife, J., Pullen, S., Enge, P., & Pervan, B. (2006). Paired overbounding for nonideal LAAS and WAAS. IEEE Transactions on Aerospace and Electronic Systems, 42(4), 1386–1395. https://doi.org/10.1109/TAES.2006.314579
- ↵She, J., Misovec, K., Blanch, J., Caccioppoli, N., Duchet, D., Tijero, E. D., Liu, F., Racelis, D., Joerger, M., & Sgammini, M. (2023, September). Implementation of the reference advanced RAIM user algorithm. In Proceedings of the 36th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2023), 1099–1127. https://doi.org/10.33012/2023.19476
- ↵The European Organisation for Civil Aviation Equipment. (2021). Minimum operational performance standards for dual frequency Galileo/Global Positioning System/satellite-based augmentation system airborne equipment, ED259a (tech. rep.). The European Organisation for Civil Aviation Equipment.
- ↵Walter, T., & Enge, P. (1995, September). Weighted RAIM for precision approach. In Proceedings of the 8th International Technical Meeting of the Satellite Division of the Institute of Navigation, (ION GPS 1995), 1995–2004. https://www.ion.org/publications/abstract.cfm?articleID=2524
- ↵Working Group C. (2012). EU-U.S. cooperation on satellite navigation, working group c, ARAIM technical subgroup, interim report (tech. rep.). GPS-Galileo Working Group C ARAIM Technical Subgroup.
- ↵Working Group C. (2015). EU-U.S. cooperation on satellite navigation working group c, ARAIM technical subgroup, milestone 2 report (tech. rep.). GPS-Galileo Working Group C ARAIM Technical Subgroup.
- ↵Working Group C. (2016, February). EU-U.S. cooperation on satellite navigation working group c, ARAIM technical subgroup, milestone 3 report (tech. rep.). GPS-Galileo Working Group C ARAIM Technical Subgroup.
- ↵Working Group C. (2022, February). Advanced RAIM reference airborne algorithm description document v4.2 (tech. rep.). GPS-Galileo Working Group C ARAIM Technical Subgroup.


















