The Joint Precision Approach and Landing System (JPALS) is being developed as the next-generation navigation tool that will enable precision approach and landing of U.S. military aircraft using the Global Positioning System (GPS). Variants of JPALS have been studied for use both at terrestrial airfields (Land-Based JPALS) and aboard aircraft carriers at sea (Sea-Based JPALS). In both cases JPALS fulfills three important functions. First, the system communicates final approach segment data that define the reference trajectory for incoming aircraft. Second, the system broadcasts differential GPS corrections that improve navigation accuracy by removing systematic errors from the GPS signal. Third, the system provides warnings of navigation quality degradation for cases of poor GPS satellite geometry, internal system faults, or hazardous external jamming. Given sufficient reliability, these functions will permit automated carrier landings of unmanned aircraft (Fig. 1) and of manned aircraft in foul-weather conditions.

This paper presents the results of a multi-year, multi-institution collaboration to design navigation algorithms for the Sea-Based JPALS mission. A sea-based system introduces numerous challenges not present in a land-based system. Examples of thorny Sea-Based JPALS implementation issues include definition of aircraft approach trajectories for a pitching and rolling landing strip, placement of reference antennas in locations that do not interfere with shipboard operations but that still provide a clear sky view, and compensation for ship flexure in mapping reference antenna locations to the touchdown point [1]. Another especially challenging problem is developing a navigation algorithm that achieves the aggressive safety standards required for precision shipboard landing. Validating reliability and performance (also called guidance-quality) standards is the focus of this paper. To meet this challenge, we propose a set of complementary navigation algorithms, interference suppression techniques, and integrity monitors that together ensure performance sufficient to meet the extreme guidance-quality demands of Sea-Based JPALS. These demands are quantified in terms of six major guidance-quality parameters: accuracy, alert limit, integrity, continuity, availability, and Radio Frequency Interference (RFI) vulnerability.

*Accuracy* is the scatter of nominal navigation errors, as described by their standard deviation (sigma).

*Alert Limit* is the largest undetected navigation error which does not pose an operational safety hazard.

*Integrity Risk* is the probability of a hazardously large, undetected navigation error, one which is larger in magnitude than the alert limit. The integrity risk probability covers both nominal and faulted conditions (including satellite, receiver, or signal-in-space anomalies). In effect, the integrity requirement limits the far tails of the navigation error distribution. Consequently, integrity usually dominates accuracy as the limiting factor in the design of GPS navigation systems.

*Continuity Risk* is the likelihood of an interruption of JPALS service occurring during the final phase of landing. A continuity break occurs when JPALS detects and excludes a real or perceived anomaly and the remaining valid measurements no longer support safe landing. The proximity of aircraft and ship during the final phase of flight makes aborted landings risky. Consequently, continuity risk is required to be a very small probability in order to minimize the frequency of aborted landings caused by false alarms. Alarms that occur before the final phase of landing pose a lesser risk and are counted only against system availability (and not continuity).

*Availability* is the fraction of time that the system is usable and meets its accuracy, integrity, and continuity requirements. As GPS satellites move in orbit above the Earth, navigation accuracy and integrity risk vary continually. Thus instantaneous availability depends both on time and on the JPALS user's latitude and longitude.

*Vulnerability to RFI* is the risk of a system outage occurring during intentional or unintentional jamming. JPALS must deploy RFI mitigation measures to maintain availability during jamming events.

Because of severe constraints on runway length and the significant consequences of failed landings at sea, guidance quality requirements are significantly stricter for sea-based operations than for terrestrial operations. In the case of a fully automated aircraft-carrier landing, for instance, undetected navigation errors may not exceed an alert limit of approximately 1 m. The Sea-Based JPALS alert limit is an order of magnitude tighter than the proposed 10 m limit for Land-Based JPALS and for civilian terrestrial GPS landing systems, such as the Federal Aviation Administration's Local Area Augmentation System (LAAS). JPALS specifications for the 2007 program year are listed in Table 1. The JPALS Systems Requirements Document (SRD) lists two sets of specifications: for a 61 m decision height, in the first increment of the program, and for fully automated landing (autoland), in future increments [2]. The guidance quality specifications for Sea-Based JPALS continue to evolve. To be conservative, the research presented in this paper uses an older but slightly stricter set of guidance-quality parameters (also given in Table 1) for analysis of autoland operations.

To enable autoland (and meet either the 2007 SRD criteria or the stricter criteria), Sea-Based JPALS will need to rely on carrier-phase ranging measurements. Carrier-phase tracking measures the accumulated Doppler on either or both of the GPS carrier frequencies, called L1 and L2. Because signal wavelengths are extremely short (19 cm for L1 and 24 cm for L2), carrier-phase measurements deliver approximately centimeter-level precision. By comparison, standard GPS code measurements, which rely on correlating a digital bit sequence mixed with the GPS carrier wave, deliver poorer precision by more than an order of magnitude. Fig. 2 graphically contrasts the carrier-phase and code ranging signals for the L1 frequency.

The disadvantage of carrier-phase navigation is the ambiguity associated with resolving the integer number of wavelengths along the signal path between the user and the GPS satellite. To resolve these integers, it is useful to leverage code measurements. Uncertainty in the code measurements, however, introduces some risk of incorrectly fixing integer ambiguities. To limit integrity risk associated with incorrectly resolved integers, we propose a particular navigation algorithm for Sea-Based JPALS that fixes integers only after verification using redundant measurements.

Our carrier-phase navigation algorithm is designed to provide high accuracy (through integer resolution) and high integrity (through integer verification) under both nominal and off-nominal conditions. Assuring guidance quality under degraded conditions, such as a jamming or a hardware fault scenario, poses a particular challenge. JPALS will employ specialized components to mitigate off-nominal conditions. Examples of these components include inertial fusion and array antennas (for anti-jam) and integrity monitors (for detection and exclusion of faulty measurements). These components significantly impact guidance quality and must therefore be incorporated in system-level guidance-quality analysis. Anti-jam technologies, for example, reduce RFI vulnerability but may introduce measurement biases, which impact integrity. Fault monitoring algorithms ensure integrity but may introduce false alarms, which impact system continuity.

To address these issues, this paper is divided into three principal sections. The first section describes our proposed navigation algorithm and its nominal guidance-quality performance. The second section discusses radio-frequency interference, interference suppression methods, and a modified navigation algorithm that maintains integrity despite measurement biases introduced by anti-jam antenna arrays. The final section characterizes JPALS and GPS fault modes, identifies a set of integrity monitors that detect these faults, and discusses their overall impact on guidance quality.

SECTION II

## FAULT-FREE INTEGRITY DESIGN

This section proposes a two-stage navigation solution that meets JPALS guidance quality requirements under nominal (fault-free) conditions. Guidance quality is assessed by evaluating availability in the absence of specialized anti-jam hardware (which will be discussed in detail in subsequent sections).

### A. JPALS Observables and Operation Profile

In JPALS operations, both the ship and the landing aircraft receive navigation signals from GPS satellites in orbit above the Earth (Fig. 3). Current generation military GPS receivers have access to four distinct range measurements. These measurements are the code and carrier-phase pseudoranges on each of two frequencies (L1 at 1575.42 MHz and L2 at 1227.6 MHz). Although general-purpose navigation is possible using any one of these four types of ranging measurement, JPALS combines all four measurement types together to achieve its aggressive goals for guidance quality. The use of multiple measurement types both aids in resolving carrier-phase integers and in removing systematic clock biases, ionosphere delays and troposphere delays, all of which introduce significant error in general-purpose GPS navigation.

To best exploit the diversity of measurements available to JPALS users, our team has developed a two-stage navigation algorithm [4], [5]. The first stage calculates and filters geometry-free observables to estimate the integer ambiguities associated with the L1/L2 widelane beat frequency (wavelength 86 cm). The second stage exploits the geometry-free observable to resolve the distinct integer ambiguities for the L1 and L2 carrier frequencies. In integer fixing and in subsequent navigation, (through touchdown), the second-stage algorithm removes systematic biases by double-differencing measurements between the ship and aircraft for pairs of visible satellites. This second-stage algorithm relies on communications between the ship and aircraft via a one or two-way datalink (heavy gray arrow in Fig. 3).

The two-stage navigation algorithm is designed to support a datalink service volume of arbitrary size. Although the second-stage algorithm relies on communication with the ship, this algorithm becomes active only in the final minutes of landing when the aircraft is very near the ship ( < 1 km). The first-stage algorithm, by contrast, requires no communication with the ship. The principle role of the first-stage algorithm is to provide substantial filtering (as much as fifteen minutes or more) to ensure the integrity of integer ambiguity resolution in the second stage.

### B. Fault-Free Navigation Algorithms

This section details the equations of the two-stage navigation strategy. This navigation solution consists of a sequential pair of algorithms that first estimates widelane integers from the smoothed code and that subsequently fixes L1 and L2 integers using those widelane estimates. The primary challenge for this navigation solution is fixing integer ambiguities reliably. The Probability of an Incorrect Fix (PIF) counts directly against the total integrity risk budget. We assume that the total integrity risk budget for JPALS is 10^{−7} (see Table 1) and thus suballocate a fraction of this budget (10^{−8}) to cover the PIF [6].

The first-stage algorithm calculates and filters the geometry-free observables [4], [5]. The geometry-free observable for the i-th satellite, *Z*_{GF}^{(i)}, linearly combines the carrier-phase range measurements on the L1 and L2 frequencies, φ_{L1}^{(i)} and φ_{L2}^{(i)}, with the code measurements on both frequencies, *PR*_{L1}^{(i)} and *PR*_{L2}^{(i)}. By its construction, the geometry-free combination eliminates large nuisance errors including clock biases, troposphere delays and ionosphere delays. The geometry-free observable is computed as follows, where λ_{L1} and λ_{L2} refer to the wavelengths of the L1 and L2 carrier frequencies
TeX Source
$$\hskip-10ptZ_{GF}^{(i)}=\left({\phi_{L1}^{(i)}\over\lambda_{L1}}-{\phi_{L2}^{(i)}\over\lambda_{L2}}\right)-\left({PR_{L1}^{(i)}\over\lambda_{L1}}+{PR_{L2}^{(i)}\over\lambda_{L2}}\right)\left({\lambda_{L2}-\lambda_{L1}\over\lambda_{L1}+\lambda_{L2}}\right).\eqno{\hbox{(1)}}$$The geometry-free observable, *Z*_{GF}^{(i)}, is an estimate of the widelane integer ambiguity, *N*_{GF}^{(i)}
TeX Source
$$Z_{GF}^{(i)}=N_{w}^{(i)}+\varepsilon_{GF}+b.\eqno{\hbox{(2)}}$$The widelane integer estimate is corrupted by random errors ε_{GF} and unobservable biases collectively labeled *b*. Biases are mitigated by the second-stage (inter-frequency biases), by integer monitoring (for antenna biases, as described in Section III), and by integrity monitors (for fault-mode biases, as described in Section IV).

To reduce the random error associated with the geometry-free observable, ε_{GF}, a moving-average filter is applied over the prefiltering duration, *T*. This filter is applied to both the ship and aircraft measurements. Given that the sample interval is Δ *t*, the filtered geometry-free estimate, , has the following form. It is assumed that the carrier signal is continuously tracked over all *M* epochs (*M* = *T*/Δ *t*) in the filter window
TeX Source
$$\overline{Z}_{GF}^{(i)}(t)={1\over M}\sum_{m=1}^{M}Z_{GF}^{(i)}(t-m\Delta t).\eqno{\hbox{(3)}}$$In the first stage, the aircraft computes its position using this floating point estimate of the widelane integers [4], [5].

The second-stage algorithm engages in the final phase of landing and resolves the carrier-phase integers. This algorithm uses measurements broadcast by the ship to form double-difference observables which subtract common-mode biases observed by two receivers (*b* and *c*) tracking two satellites (*i* and *j*). Double differences of both the carrier-phase measurements, ∇Δφ_{L1,bc}^{(ij)} on L1 and ∇Δφ_{L2,bc}^{(ij)} on L2, and of the filtered geometry-free observable, , are employed
TeX Source
$$\eqalignno{{\hskip-15pt}\nabla\Delta\phi_{{\rm L}1,bc}^{(ij)}=&\,\left(\phi_{{\rm L}1,c}^{(j)}-\phi_{{\rm L}1,c}^{(i)}\right)-\left(\phi_{{\rm L}1,b}^{(j)}-\phi_{{\rm L}1,b}^{(i)}\right)\cr\noalign{\vskip-1pt}{\hskip-15pt}\nabla\Delta\phi_{{\rm L}2,bc}^{(ij)}=&\,\left(\phi_{{\rm L}2,c}^{(j)}-\phi_{{\rm L}2,c}^{(i)}\right)-\left(\phi_{{\rm L}2,b}^{(j)}-\phi_{{\rm L}2,b}^{(i)}\right)\cr\noalign{\vskip-1pt}{\hskip-15pt}\nabla\Delta\overline{Z}_{GF,bc}^{(ij)}=&\,\left(\overline{Z}_{GF,c}^{(j)}-\overline{Z}_{GF,c}^{(i)}\right)-\left(\overline{Z}_{GF,b}^{(j)}-\overline{Z}_{GF,b}^{(i)}\right).&\hbox{(4)}}$$

In this section, the *b* and *c* antennas used in forming the double-differences are assumed to be the primary aircraft and shipboard antennas, labeled 1 and 3 in Fig. 4. (Secondary airborne and shipboard antennas, labeled 2 and 4, will be considered in the following section as a means to mitigate biases introduced in RFI suppression.)

Using the three double-difference observables of (4), it is possible to compute the relative position vector, **x**, between the aircraft and the ship. Significantly, the double-difference carrier-phase integers on the L1 and L2 frequencies, and , can be resolved along with the relative position vector using a least-squares solution
TeX Source
$$\displaylines{\left[\matrix{\nabla\Delta\overline{\bf Z}_{GF,bc}\cr\nabla\Delta{\mmb\phi}_{{\rm L}1,bc}\cr\nabla\Delta{\mmb\phi}_{{\rm L}2,bc}}\right]=\left[\matrix{0\cr-\Delta{\bf e}^{T}\cr-\Delta{\bf e}^{T}}\right]{\bf x}\hfill\cr\hfill+\left[\matrix{{\bf I}&-{\bf I}\cr\lambda_{L1}{\bf I}&{\bf 0}\cr{\bf 0}&\lambda_{L2}{\bf I}}\right]\left[\matrix{\nabla\Delta{\hat{\bf N}}_{{\rm L}1,bc}\cr\nabla\Delta{\hat{\bf N}}_{{\rm L}2,bc}}\right]+{\mmb\varepsilon}.\quad\hbox{(5)}}$$Each double difference in this equation is a vector quantity, where the vector elements represent the differences between all slave satellites (*i*) and the master satellite (*j*). The vector error ε describes the noise on these observables [5]. The equation also depends on a geometry-difference matrix Δ**e**^{T} for which each row is the difference of the line-of-site vectors, **e**^{(i)} and **e**^{(j)}, for the slave and master satellites used in the *i*-th element of the double-difference vector
TeX Source
$$\left(\Delta{\bf e}^{(i)}\right)^{T}=\left({\bf e}^{(j)}-{\bf e}^{(i)}\right)^{T}.\eqno{\hbox{(6)}}$$When the second-stage algorithm becomes active, the aircraft is close enough to the ship that their line-of-site vectors to a particular satellite may be assumed identical.

Once the second-stage algorithm fixes carrier-phase integers, it can exploit those integers to enhance the accuracy of the relative position solution [5]. The first time that the second-stage algorithm solves (5), both the relative position, **x**, and the vectors of carrier-phase integers, ∇Δ**N**_{L1,bc} and ∇Δ**N**_{L2,bc}, are unknown. As long as GPS tracking is continuous, the integer ambiguities remain constant in time, even as the aircraft's position relative to the ship changes. Hence, once the integers are known, they can be moved from the right hand to the left hand side of (5) to reduce the number of unknowns in the least-squares problem (and increase its accuracy). To increase the probability of correctly resolving the carrier-phase ambiguity, the well-known LAMBDA method is used to enforce the constraint that the ambiguities are integer quantities [7], [8]. A bootstrapping form of LAMBDA is used to fix only those integers with the lowest PIF. The LAMBDA algorithm is allowed to fix as many integer combinations as possible given the limited integrity budget (10^{−8}) devoted to PIF. In practice, the second-stage algorithm can nearly always fix the integers for all visible satellites when antenna calibration errors are negligible.

### C. Error Modeling and Availability Performance Under Nominal, Fault-Free Conditions

To demonstrate the guidance quality of the algorithms described in the previous section, we simulated their performance for carrier landing operations in three locations: the Central Atlantic Ocean (25° N, 30° W), the Pacific Ocean (5° N, 135° W), and the Persian Gulf (30° N, 50° E). The balance between integrity and availability was examined by defining a confidence bound called the Vertical Protection Limit (VPL). If the VPL for an approach ever exceeds a maximum tolerable vertical error labeled the Vertical Alert Limit or VAL (see Table 1), then the approach is declared unavailable. For the purposes of this paper, the VPL is a confidence level set to match the fault-free integrity risk allocation of 10^{−7}. To ensure this level of integrity (assuming Gaussian error distributions) the error bound must be 5.33 times the size of the standard deviation of the vertical positioning error σ_{v}, which is the error of the third component of the vector **x** computed by a least-squares solution to (5)
TeX Source
$$VPL=5.33\cdot\sigma_{v}.\eqno{\hbox{(7)}}$$

By simulating satellite geometries over the 1436 minutes in a full sidereal day, a geometric availability probability, *A*_{geom}, can be determined as the fraction of those minutes for which VPL does not exceed VAL (1.1 m)
TeX Source
$$A_{geom}=P(VPL\leq VAL).\eqno{\hbox{(8)}}$$These availability simulations were conducted assuming a standard 24 satellite constellation [9] with outages given by the historical constellation state model [10]. A mask angle of 7.5° was applied to screen out low elevation satellites that may suffer from frequent interruptions of carrier-phase tracking as they rise above or set below the horizon. Cross-correlations of errors among the antennas and between the L1 and L2 frequencies were assumed to be negligible. Accordingly, carrier phase errors from a given epoch were assumed independent with a one-sigma value of 0.71 cm. Code errors from a given epoch were also considered independent, with one-sigma values parameterized at multiple levels ranging between 30 cm and 50 cm. These statistics are representative of data taken with high-quality differential GPS systems. The code model may be somewhat aggressive given the severe shipboard multipath environment [11], [12]. To achieve these aggressive values of code sigma in practice, it may be necessary to exploit multi-element antennas to minimize large shipboard multipath [13].

The vertical noise, σ_{v}, that results from the least-squares solution of (5) is particularly sensitive to the correlation time constant of the geometry-free observables [14]. Higher correlation in the GPS observables results in fewer independent measurements over the 15 minute prefiltering time; as a consequence, the L1 and L2 double-difference integers are harder to fix (given the constrained PIF budget) and the overall vertical navigation accuracy suffers. The availability simulation described here uses a Markov noise model with time constants based on analysis of flight test data. The output noise that results from filtering a correlated variable can be overbounded formally using the principle of symmetric overbounding [15]. For the purposes of the simulation, the time constants of the Markov processes used to describe the airborne and shipboard noise, τ_{air} and τ_{ship}, were set to values of 5 s and 60 s, respectively. These values were conservatively inflated from the measured values of 2.5 s (air) and 46 s (ship) to account for statistical nonstationarity and estimation uncertainty.

Simulations indicate that the second-stage algorithm can achieve an availability of greater than 99% given 15 minutes of prefiltering in the first stage. As illustrated in Fig. 5, availability (vertical axis) depends weakly on the pseudorange one-sigma error (horizontal axis). For the nominal, fault-free case, antenna calibration errors are neglected (the standard deviation of the calibration error, σ_{wl}, is zero). The impact of calibration biases on the performance of the two-stage navigation strategy will be revisited in the following section in the context of RFI mitigating antennas, for which calibration biases are non-negligible.

SECTION III

## INTERFERENCE SUPPRESSION

This section assesses the overall impact of RFI suppression on JPALS availability. Because JPALS-equipped aircraft may encounter intentional or unintentional jamming, it is imperative that they employ interference suppression technologies. Unfortunately, these technologies do not uniformly benefit all aspects of guidance quality in JPALS. In fact, interference suppression methods may introduce calibration errors which degrade JPALS integrity and availability even as they reduce RFI vulnerability.

In particular, we discuss two technologies for RFI suppression: integration of GPS with inertial measurements and augmentation of GPS signal strength using Controlled Reception Pattern Antenna (CRPA) arrays. Because the use of a multi-element CRPA may introduce significant calibration errors, we also propose a modification to the two-stage navigation algorithm that adds an additional validation step to limit the increased integrity risk these errors introduce during ambiguity resolution. This modified algorithm exploits redundant measurements to perform a cross-check for inconsistent integer resolution. Availability simulations demonstrate that the modified hardware and navigation algorithm achieve the required JPALS guidance quality under moderate RFI conditions.

### A. Deep Integration of GPS and Inertial Navigation

A first strategy for RFI mitigation exploits deep integration of GPS with the gyroscope and accelerometer outputs of an Inertial Measurement Unit (IMU). A combined experimental and modeling effort has shown significant benefits for the deep-integration architecture, also known as ultra-tight coupling [16], which is illustrated in Fig. 6. In this architecture, GPS receiver observables (code and carrier-phase pseudoranges on both frequencies) are used to calibrate IMU biases and scale factors while IMU velocity estimates are used to enhance the dynamic performance of the phase-locked loop used by the GPS receiver to obtain carrier-phase measurements. Thus, the navigation algorithm inherently combines GPS and inertial measurements to improve position determination. Moreover, under extreme RFI conditions that block reception of one or more satellites, the sensor fusion algorithm enables continuous positioning and “coasting” of carrier-phase integers to maintain ambiguity resolution during GPS outages as long as 60 s [6].

Deep integration also aids in preventing GPS outages due to RFI. Inertial sensors can be used to obtain estimates of the rate of change (Doppler) of the carrier-phase measurement. These Doppler estimates can be used by the GPS receiver's phase-locked loop to compensate for vehicle motion and thereby enable lower-bandwidth, lower-noise tracking of the carrier phase. As a consequence, the inertially-aided receiver maintains tracking at lower values of carrier-to-noise ratio (C/N_{0}) than possible using an unaided receiver.

To some extent, inertial coasting also assists in mitigating bad satellite geometry conditions by reducing the geometric sensitivity of the position error and hence of the VPL (7). However, this benefit only affects severely anomalous satellite geometries [17] and hence has a negligible impact on system availability.

To quantify the ability of deep integration to mitigate RFI events, we have conducted extensive studies to refine and empirically validate system models for GPS-inertial fusion. These studies indicate that a navigation-grade inertial can significantly improve carrier-to-noise ratio under RFI conditions (by 8 dB-Hz), but only when receiver timing is controlled by a very high-quality oscillator. This result was obtained by analyzing models for each noise source in the deeply integrated system [18], [19], [20]. The major error sources in carrier-phase tracking are dynamic stress (caused by vehicle motion), noise in the GPS receiver clock, and thermal noise. The bandwidth of the GPS phase-locked loop must be set to balance these conflicting error mechanisms. Two error sources, dynamic stress and clock noise, act as low-frequency offsets and introduce larger errors when the tracking-loop bandwidth is low. By contrast, thermal noise improves with smoothing so that larger errors result when the tracking loop bandwidth is high. In order to reduce the output noise of the tracking loop (and enable tracking under unfavorable RFI conditions), it is advantageous to lower the tracking loop bandwidth (to minimize thermal noise) given appropriate compensation for the low-frequency dynamic stress error (using inertial Doppler aiding) and clock noise error (using an enhanced clock).

The potential for improved RFI mitigation using an IMU and an enhanced clock is illustrated in Fig. 7. The figure characterizes the output of a 3rd order Phase-Locked Loop (PLL) by plotting the standard deviation of errors (called phase jitter) as a function of carrier-to-noise ratio, C/N_{0}. The highest tolerable phase jitter for reliable tracking is 15° one-sigma [21]; above this level of phase jitter (indicated with a solid horizontal line), bit errors and cycle slips introduce severe restrictions on continuity and availability. The left side of the figure shows phase jitter in the absence of inertial aiding. In this case, the minimum carrier-to-noise level that allows tracking is approximately 24 dB-Hz, independent of the choice of a clock technology. Three clock technologies were considered: a temperature-compensated oscillator (TCXO), a Rubidium-based atomic clock, and a high-quality oven-controlled oscillator (OCXO).

Significant performance gains are possible when the PLL bandwidth is reduced (from 15 Hz to 2 Hz) using inertial aiding, as illustrated by the right hand side of Fig. 7. Performance gains are strongly dependent on the clock. The deeply integrated system supports tracking at C/N_{0} of 20 dB-Hz (a 4 dB improvement over baseline) if an atomic-standard clock is used. By comparison, the system enables tracking with C/N_{0} as low as 16 dB-Hz (an 8 dB improvement) when a high-quality OCXO is used. Similar gains may be possible for GPS receivers that rely on frequency-locked loops rather than PLLs; however, this work is still in progress [22].

### B. Beam Forming Using Array Antennas

A second technology that assists GPS tracking under RFI is the CRPA array, which combines inputs from multiple antenna elements to form beam patterns pointed toward individual GPS satellites. This technology offers the potential for a dramatic improvement in C/N_{0} for many jamming scenarios; however, the calibration residuals associated with CRPA arrays significantly exceed those associated with conventional, single-element antennas.

The level of RFI mitigation achieved using CRPA arrays depends strongly on the jamming environment and the design constraints imposed by the aircraft and ships conducting JPALS operations. The jamming environment is particularly difficult to characterize *a priori*, as rejection is strongest when GPS satellites and jamming sources are separated by a wide angle. Interference rejection also depends strongly on the geometric layout of the CRPA, which can be optimized to best exploit the available antenna surface area, both for two-dimensional [23] and three-dimensional configurations [24], [25].

For a baseline jamming scenario [26], CRPAs improve C/N_{0} for carrier tracking by 10 to 20 dB-Hz. The specific level of noise attenuation depends on the type of CRPA processing applied. Two different types of CRPA processing were considered: deterministic beam forming algorithms [27] and time-varying adaptive algorithms [28]. Both types of algorithms determine how to combine signals from individual antenna elements into a single output signal for the antenna array. The deterministic beam forming algorithms sets weights based solely to maximize the receiver gain in the known directions of the GPS satellites (at a specific azimuth and elevation angle relative to the CRPA array). By contrast, adaptive algorithms steer the beam pattern to both maximize desired signal and minimize interference signals produced by jamming sources at locations which are not known, *a priori*. Accordingly, these adaptive capabilities enable additional interference rejection (as high as 10 dB more than deterministic algorithms) [29].

Although adaptive algorithms provide better interference mitigation than deterministic algorithms, they are also more difficult to calibrate. A careful antenna calibration is necessary for any CRPA used in an integrity application, as the location of the antenna phase center depends on many factors including the azimuth and elevation angles of the incoming signal and mutual coupling among antenna elements. Without calibration, the standard deviation of CRPA hardware and software biases can exceed one meter for code observables and 30° for carrier-phase observables [27]. To ensure integrity of integer fixing, calibration must reduce uncompensated biases by approximately an order of magnitude. For a deterministic algorithm, bias compensation can be determined simply as a function of the satellite elevation and azimuth relative to the hardware. For adaptive algorithms, an accurate calibration must also account for the directional frequency response of individual elements (gain and phase) and for the relative element weights determined on-the-fly by the adaptive algorithm.

Because the parameter space for the full adaptive-algorithm calibration is thousands of times larger than that for the deterministic algorithm [26], we propose using the simpler deterministic calibration curve for both cases. This calibration, a function of signal incidence angle only, is a precise calibration for deterministic algorithms and an approximate calibration for adaptive algorithms [27].

To assess the residual errors remaining after calibration for both the deterministic and adaptive CRPA algorithms, we analyzed a representative CRPA array consisting of seven elements distributed in a hexagonal pattern (Fig. 8). This array was implemented in hardware and also modeled using the finite-element package HFSS [30], [31]. Calibrations were performed on the physical hardware for several incidence angles using the anechoic chamber at the Avionics Engineering Center at Ohio University [32]. Chamber data were employed to validate the finite-element model, which was used subsequently to resolve antenna performance at 10° steps in elevation and 45° steps in azimuth.

Our research focused on antenna calibration using polynomial fit surfaces as a function of signal frequency and incidence angle. This approach is as easy or easier to implement than alternative calibration strategies that have been proposed [32], [33]. The antenna array illustrated in Fig. 8 is well fit by a sixth-order polynomial surface. Residual calibration errors (after applying the sixth-order correction) are plotted in Fig. 9. The figure plots residual errors for the L1 code and carrier signals over a hemispherical surface (projected onto the page) of incident azimuth and elevation. For code measurements, the calibration achieves a one-sigma error of 2 cm (and a maximum error of 15 cm); for carrier-phase measurements, the calibration achieves a one-sigma error of 4 degrees (and a maximum error of 8 degrees).

Simulations were used to evaluate the sensitivity of the calibration to manufacturing tolerances, temperature, and GPS signal variations. Considering all these error sources along with the residual error in the sixth-order curve fit, the one-sigma calibration error for the representative CRPA was estimated to be 8 degrees for carrier phase measurements and 7 cm for the code.

Using the same calibration strategy, adaptive CRPA algorithms experience comparable calibration biases except under severe interference conditions, when residual calibration errors may increase significantly. The reason the deterministic calibration strategy works so well for adaptive processing stems from the fact that adaptive beamforming patterns closely resemble those of deterministic beamforming under nominal and moderate interference levels. The calibration of the adaptive algorithm results in an estimated error of 10 degrees for carrier-phase measurements and 8.5 cm for code measurements under nominal and moderate interference conditions (considering manufacturing tolerances, temperature, signal variation and polynomial-fit effects).

Calibration errors for the adaptive array are somewhat worse under severe levels of interference (cases of interference for which the adaptive algorithm maintains tracking but for which the deterministic algorithm does not). In these cases, calibration errors rise to approximately 12 degrees (carrier) and 35 cm (code). These levels of bias are too large to enable integer fixing with integrity as required for autoland; a reduced level of JPALS service is still achievable, however (as described by the first column of Table 1).

Based on this analysis, we recommend that JPALS users employ a CRPA array using an adaptive algorithm, such as the Widrow Least-Mean Squares (LMS) algorithm [34]. Calibration biases, and their associated integrity implications, are nearly identical for both deterministic and adaptive processing under nominal conditions and also under moderate jamming conditions. Adaptive processing, moreover, offers the added advantage that GPS signal tracking is possible (though autoland may not be available) under severe jamming conditions when deterministic algorithms fail completely.

### C. Enhanced Navigation Algorithm for Mitigation of Calibration Residuals

Maintaining high-integrity integer-ambiguity resolution despite the elevated calibration biases for array antennas requires modification of the two-stage navigation algorithm. We recommend cross-checking of redundant measurements using a decoupled-estimation strategy [6] as a means of reducing the PIF. This method provides greatest benefit when measurements from two or more antennas are available from both the ship and the aircraft, as illustrated in Fig. 4. With dual aircraft antennas, labeled 1 and 2, and dual shipboard antennas, labeled 3 and 4, geometry-free observables are computed individually for all four antennas using (3). The double difference observables of (4) are computed across the primary navigation antennas, 1 and 3, and separately across the redundant secondary antennas, 2 and 4.

The decoupled-estimation strategy validates integers by comparing the two integer solutions generated by solving (5) separately for each of the antenna pairs. These two solutions, one for the primary measurements and another for the secondary measurements, are used to construct a test statistic, *S*^{(ij)}, which compares the measured relative positions to the known lever arms, **x**_{a} and **x**_{s}, between the airborne and shipboard antennas (see Fig. 4)
TeX Source
$$\displaylines{S^{(ij)}=\Delta\nabla\phi_{13}^{(ij)}-\Delta\nabla\phi_{24}^{(ij)}+\Delta{\bf e}^{T}({\bf x}_{a}+{\bf x}_{s})\hfill\cr\hfill-\;\Delta\nabla N_{13}^{(ij)}+\Delta\nabla N_{24}^{(ij)}.\quad\hbox{(9)}}$$If the test statistic for any satellite pair (*i* and *j*) exceeds an availability threshold, then the monitor flags that satellite pair as anomalous and excludes associated integer combinations when the LAMBDA method is applied [6].

Simulations demonstrate that high availability is possible when the decoupled-estimation monitoring strategy is used to mitigate the integrity risk associated with CRPA residual calibration errors. Decoupled-estimation monitoring greatly reduces integer-fixing risk in the presence of calibration errors which would otherwise cause PIF to exceed the allowed level (10^{−8}). The decoupled-estimation monitor detects all but a very small fraction of incorrect fix events (10^{−4}). Consequently, even if the LAMBDA method has a relatively high rate of incorrect fixes (10^{−4}), the combined probability of an undetected, incorrect integer fix remains below the allowed level of 10^{−8}.

To assess JPALS availability for users equipped with CRPA antennas, we modified the availability simulation described in Section II-C. Specifically the modified simulation incorporated residual CRPA calibration errors both in navigation accuracy and in the integer-fixing risk budget. In contrast with the typical methodology used for analysis of a land-based system [35], calibration errors were assumed uncorrelated among antennas and modeled using an overbounding Gaussian distribution. Residual errors were thus treated as random variables on a per-approach basis (given the day-to-day variability in ship position). Calibration errors were nonetheless assumed to remain highly correlated over the period of an individual approach. Hence prefiltering was conservatively assumed not to reduce the magnitude of calibration errors. For convenience, the calibration error magnitude was characterized in terms of a single parameter: σ_{wl}, the standard deviation of the calibration error, *b*, that causes the geometry-free observable to differ from the widelane integer, described by (2). The relationship of the calibration error, σ_{wl}, to the individual code and carrier-phase calibration errors is illustrated in Fig. 10.

Availability calculations are computed considering both geometric availability and availability lost due to false alarms of the decoupled-estimation monitor. False alarms may occur due to large nominal errors either in GPS measurements or in inertial attitude measurements, which are used to determine **x**_{a} and **x**_{s} in (9). The monitor threshold, *T*_{m}, is set to achieve a pass rate, *A*_{Tm}, of 0.999. Combining the monitor pass rate and the rate at which the constellation geometry passes the alert limit test (*A*_{geom} as described in the Section II-C), the total system availability, *A*_{tot}, is determined by multiplication
TeX Source
$$A_{tot}=A_{geom}\cdot A_{Tm}.\eqno{\hbox{(10)}}$$

A maximum tolerable calibration error was identified by running the availability simulation repeatedly for increasing values of σ_{wl}, until reaching the desired availability of 0.997 (see Table 2). For a code error of 30 cm, this maximum tolerable calibration error was a value of σ_{wl} equal 7 cm. By comparison, the σ_{wl} parameter for deterministic CRPA processing is only 6 cm (determined from Fig. 10 for the case of a 7 cm code error and 8 degree carrier-phase error). The σ_{wl} parameter for the adaptive algorithm is just tolerable, at a level of 7 cm, for nominal and moderate interference. More margin is expected in practice, as the CRPA arrays analyzed in the previous section were not specifically tuned for the JPALS application.

SECTION IV

## INTEGRITY UNDER FAULT SCENARIOS

In order to meet the aggressive guidance quality requirements of JPALS, the ship-based reference station must detect and isolate JPALS navigation system faults including satellite, receiver, and environmental anomalies. The fault modes for JPALS resemble those identified for other precision GPS landing systems, such as the Federal Aviation Administration's Local Area Augmentation System (LAAS) program. The impact of these fault modes on JPALS is specific to the proposed navigation algorithm and the system hardware configuration. This section defines a minimum set of monitors necessary to ensure JPALS integrity when using the two-stage navigation algorithm.

### A. Classifying JPALS Fault Modes

The fault modes relevant to JPALS are similar to those identified by the FAA in studies of LAAS [36], [37], [38], [39]. To account for the dual-frequency capability of JPALS, we introduce one additional failure mode not otherwise relevant to single-frequency LAAS: inter-frequency divergence. The inter-frequency divergence describes anomalous, rapid variation in clock synchronization between the L1 and L2 frequencies for one or more satellites. Table 2 summarizes the major fault modes for JPALS, which are defined in the subsequent text.

*Ionosphere Scintillation*: Scintillation events, which occur most frequently at high latitudes and near the Earth's magnetic equator, are anomalies that result from refraction patterns in the ionosphere. Scintillation degrades signal-to-noise ratio and may occasionally result in rapid recombination events which cause the ionosphere delay to diminish sharply [40].

*Anomalous Signal Deformation*: Distortions in the shape of the code signal may result in biases that depend on the characteristics of individual receivers. Signal deformation events are considered to be rare occurrences, as the only observed case occurred in 1993 on satellite SV19 [41].

*Cross-Correlation*: Cross-correlation between codes on different satellites may result in signal distortion of the correlator peak used in code tracking. The risk of this phenomenon is expected to be low for aircraft landing applications unless power levels vary significantly among satellites [42].

*Power Interruption*: A partial loss of power could corrupt navigation signals.

*Datalink Spoofing*: Certain architectures for the datalink between carrier and aircraft may be compromised by spoofing attacks, in which a nefarious user attempts to replicate the datalink message structure and offset the broadcast differential corrections (or otherwise corrupt the broadcast message).

*Clock Acceleration*: The most frequent faults that affect existing GPS satellites are clock accelerations [43]. During an acceleration fault, the clock on one satellite drifts rapidly away from the other clocks in the GPS satellite constellation.

*Code-Carrier Divergence*: Code-carrier divergence faults are a variant of the clock acceleration fault in which the time references for the code and carrier phases drift away from one another. Although satellite divergence has not been previously observed within the GPS constellation, satellite divergence has been observed to affect the GPS-like signals emitted by the geosynchronous satellites in the Wide Area Augmentation System (WAAS). Divergence may also be observed when the navigation signal raypath moves through an ionosphere gradient [44].

*Inter-frequency Divergence (Generalized Divergence)*: JPALS uses four types of measurement (code and carrier on L1 and L2). For this reason, JPALS should protect against a large or changing satellite inter-frequency bias. A bias between the clock references on L1 and L2 is always present in dual-frequency measurements. Because the inter-frequency bias generally changes slowly (over the course of many days), it is usually easy to calibrate. Were the L1 and L2 clock references to drift rapidly apart, however, a threat very much like code-carrier divergence would result. Although rapid divergence of the inter-frequency bias has not been reported, it is prudent to recognize the hazard such a fault presents. For the purposes of analysis, moreover, it is convenient to note that code-carrier divergence and inter-frequency divergence may be viewed as two specific forms of a “generalized divergence” fault in which any or all of the four pseudorange measurements might diverge relative to the others.

*Tropospheric Storms*: Tropospheric storms (thunderstorms) may introduce a spatially varying GPS bias. Moisture content in the troposphere always biases GPS measurements to some degree. This bias is generally identical for all code and carrier measurements (across all frequencies) over a wide geographical area. However, if a GPS raypath passes through a thunderstorm, a spatial troposphere delay gradient may result with a magnitude as large as 10 mm/km [45].

*Ionospheric Storms*: Solar activity can result in electrical storms in the Earth's ionosphere which affect GPS measurements. Nominal ionosphere delays are equal and opposite for code and carrier phase measurements and scaled by a factor of (λ_{L2}/λ_{L1})^{2} between L1 and L2 measurements [46]. Under severe ionosphere conditions, however, higher-order terms arise that introduce a nonlinear relationship between the code and carrier phase and between the various GPS frequencies [47]. Although ionosphere biases are generally constant over a wide geographical area, anomalous ionosphere storm events have been observed that introduce spatial ionosphere delay gradients as large as 400 mm/km [48], [49].

*Antenna Motion*: Survey errors in the reference antenna locations affect all measurements and directly bias the GPS navigation solution. In JPALS, such errors may arise when the ship or antenna support structures flex, thereby shifting antenna positions relative to the touchdown point.

*Receiver Faults*: If antenna, amplifier, or electronics faults occur for a particular receiver, measurements on that receiver may be offset by a large bias.

*Antenna Calibration*: Sudden antenna calibration errors may be introduced if the ship-based system switches satellite tracking from one antenna to another [50]. Antenna calibration errors may also occur because of corrosion or damage to antenna elements or their feeds.

*Severe Multipath*: In JPALS severe multipath occurs when a navigation signal arrives at a particular receiver after reflecting off a surface such as an aircraft wing or the carrier superstructure. The reflected waveform distorts the correlation peak associated with the direct navigation signal and introduces a bias.

*Diffuse Multipath Variations*: Changes in environmental factors over time may affect the Probability Distribution Function (PDF) of the diffuse multipath error. An integrity violation results if the broadcast error bound does not protect these variations.

*Hardware Aging*: Receiver damage or aging may result in elevated random errors. An integrity fault results if broadcast error bounds do not overbound the PDF of these random errors.

*Erroneous Ephemeris Data*: An erroneous upload from the GPS master station or an unannounced satellite maneuver may cause a GPS satellite to report its orbital position incorrectly in the broadcast navigation message [51]. A significant ephemeris error event occurred on April 10, 2007 when SVN-54/PRN-18 was shifted to a new orbit while its status was still flagged as healthy [52]. The satellite's status flag was not corrected for 75 minutes, during which time user position errors of several hundred meters were reported.

*Low Satellite Power*: In LAAS and JPALS alike, broadcast error bounds and fault-monitor integrity algorithms depend strongly on an assumed minimum level of radiated signal power from GPS satellites and on an assumed maximum level of background RFI. If satellite power dips below or if RFI power rises above the tolerable limits, system integrity may be compromised.

### B. Fault Mitigation Within JPALS Architecture

The architecture of JPALS will alleviate several threats including scintillation, anomalous signal deformation, cross-correlation, power interruption and datalink spoofing.

The first three of these threat modes (scintillation, anomalous signal deformation, and cross-correlation) can be significantly mitigated in JPALS by exploiting the more sophisticated signal structures available to military users in the form of the present-day P(Y) code and the future M code. By tracking these military codes, JPALS users gain three immediate benefits over civilian users performing C/A code tracking on L1 and semi-codeless tracking on L2. Specifically, these benefits include (1) higher signal-to-noise ratio on L2, (2) a higher chipping rate, and (3) longer code sequences. First, higher power on L2 (along with INS-based Doppler aiding, as described in the previous section) allows JPALS users to coast through many scintillation events that would interrupt civilian dual-frequency processing. Although further study will be needed to assess the full impact of scintillation on JPALS users, it is clear that JPALS offers significantly greater robustness to scintillation than do existing dual-frequency differential-GPS processing methods for civilian aviation. Second, the tenfold higher chipping rate of the P(Y) code will result in a factor of ten reduction in the magnitude of the worst-case signal deformation errors (from 10 m in magnitude, for civilian LAAS users, to approximately 1 m in magnitude for JPALS). Signal deformation errors can be reduced to negligible levels by effective matching of the receiver hardware at the airborne user and at the ship-based reference station [53]. Third, longer sequences associated with military codes result in much smaller cross-correlation power between satellites than observed in civilian applications. As a consequence, signal distortion biases caused by cross-correlation are negligible for military users. Because of these mitigations, the need for sophisticated signal monitoring [41] is significantly reduced for JPALS in comparison to civilian systems like LAAS.

Two additional threats (power interruption and datalink spoofing) are addressed directly by system-level design of the JPALS reference equipment and user hardware. The power interruption threat can be mitigated in JPALS by a combination of redundancy, so that power failures are less likely, and fail-safe design, so that a power failure is not likely to compromise integrity by corrupting navigation data. The datalink spoofing threat to communications between the aircraft carrier and approaching aircraft can be mitigated through encryption and validation of the datalink message.

### C. Mitigation Through Bias Cancellation in JPALS Navigation Algorithms

The two-stage JPALS navigation algorithms, by design, cancel almost all measurement biases encountered under fault-free conditions with the notable exception of antenna-calibration errors. These proposed navigation algorithms also cancel many fault-induced errors. To demonstrate this effect, it is useful to relate measurement observables (geometry-free double-difference and carrier-phase double-difference observables) to biases in the raw measurements. These raw measurements biases include both the L1 and L2 code (*F*_{ρ 1} and *F*_{ρ 2}) and carrier phase (*F*_{φ 1} and *F*_{φ 2}) biases. The net bias on the geometry-free observable, *F*_{GF}, may be found by rewriting (1) in terms of these fault-induced biases
TeX Source
$$F_{GF}={(\lambda_{L2}F_{\phi 1}-\lambda_{L1}F_{\phi 2})\over\lambda_{L2}-\lambda_{L1}}-{(\lambda_{L2}F_{\rho 1}+\lambda_{L1}F_{\rho 2})\over\lambda_{L2}+\lambda_{L1}}.\eqno{\hbox{(11)}}$$The net error for the L1 carrier-phase double difference has the following form. (A nearly identical equation applies to the L2 carrier-phase double difference.)
TeX Source
$$F_{\nabla\Delta\phi 1,bc}^{(ij)}=\left(F_{\phi 1,c}^{(j)}-F_{\phi 1,c}^{(i)}\right)-\left(F_{\phi 1,b}^{(j)}-F_{\phi 1,b}^{(i)}\right).\eqno{\hbox{(12)}}$$By design, (11) and (12) cancel out all significant biases experienced under nominal conditions (including clock errors and spatially correlated ionosphere/troposphere biases). Equations (11) and (12) also cancel several fault-mode biases, as summarized by Table 3 and detailed in the subsequent paragraphs.

The proposed algorithms completely eliminate clock-acceleration biases. During a runaway clock anomaly, the fault-induced clock bias on a particular satellite at a particular time is the same for all raw measurements (*F*_{ρ 1}, *F*_{ρ 2}, *F*_{φ 1} and *F*_{φ 2}). Clock acceleration causes these biases to grow from one epoch to the next. This growth does not impact the geometry-free observable, as its formulation automatically cancels out clock acceleration at each epoch. The carrier-phase double-difference observable, according to (12), also cancels clock biases for a particular satellite (*i*), but only if the aircraft and ship measurements (*b* and *c*) share the same time stamp. Such cancellation requires that the GPS measurement used by the aircraft be delayed slightly to match the time stamp of the differential-GPS message broadcast by the ship-based reference station. Accordingly, the delayed GPS measurement must be propagated forward to the present time using the navigation grade IMU onboard the aircraft. The error associated with inertial propagation is negligible compared to the overall navigation error budget (given the maximum delay time is less than 1 sec). This procedure simplifies JPALS by removing the need to install a specific monitor for the clock acceleration fault, which would require the expense of installing inertial sensors at each reference antenna aboard the aircraft carrier [54].

Generalized divergence is also eliminated by the second stage of the proposed navigation algorithm. Generalized divergence encompasses both code-carrier and inter-frequency divergence. In effect, the clock references for code and carrier (or for L1 and L2) are allowed to drift apart in time such that all raw measurements biases (*F*_{ρ 1}, *F*_{ρ 2}, *F*_{φ 1} and *F*_{φ 2}) may differ at an individual epoch. Because the divergence event occurs at the satellite, however, these measurement biases apply identically to the ship and aircraft receivers
TeX Source
$$\eqalignno{F_{\phi 1}=&\,\tau\cr F_{\phi 2}=&\,\tau-\Delta_{\phi 2}\cr F_{\rho 1}=&\,\tau-\Delta_{\rho 1}\cr F_{\rho 2}=&\,\tau-\Delta_{\rho 2}.&\hbox{(13)}}$$More specifically, the geometry-free double-difference has a zero bias as long as clock time stamps (and prefiltering periods) correspond for the airborne and ship receivers. Divergence biases also cancel for the carrier-phase double-difference. By comparison, biases are not fully eliminated in the first-stage, given by (11). However, since (12) must be solved to enable precision approach, integrity monitoring for anomalous satellite divergence is not required (though it may be desirable to help identify occasions when a satellite is behaving in an anomalous manner).

By contrast with the clock-acceleration and generalized-divergence faults, troposphere and ionosphere storms may both result in biases despite double-differencing. The impact of troposphere biases is negligible, however. Anomalous troposphere gradients have been observed to be as large as 10 mm/km, one-sigma [45]. If integers are only fixed immediately prior to landing, when the aircraft is as near as possible to the ship (approximately 0.5 km), the resulting troposphere delay error is smaller than 5 mm (one sigma). This 5 mm bias term is negligibly small compared with JPALS antenna calibration errors; hence no additional monitor is required for the troposphere threat.

Ionosphere storms may have a somewhat more significant impact on JPALS integrity. Storm gradients have been observed to induce ionosphere delay gradients as large as 400 mm/km [49]. A gradient of this size would result in a 15 cm ranging bias, almost a full wavelength at the L1 frequency, if integers were fixed at a distance of 0.5 km from the ship. Although ionosphere gradients of this type are believed to be extremely rare [55], they would virtually guarantee incorrect cycle resolution for the L1 and L2 integers, as computed using (5). Thus, additional ionosphere storm monitoring is required, as described in the following section.

It is also worth noting the impact of two additional ionospheric effects: higher-order errors and code-carrier divergence. Neither of these phenomena impacts JPALS navigation. Nonlinear distortions affect closely spaced antennas (such as those within a radius of 0.5 km) in a similar manner. Thus, the process of double differencing generally cancels out nonlinear ionosphere effects. Ionosphere divergence does not impact JPALS as the measurement filter, (3), operates on the geometry-free observable, which is ionosphere-free.

### D. Mitigation Through Integrity Monitoring at JPALS Reference Station

Fault modes not otherwise mitigated by the JPALS architecture or navigation algorithms must be addressed through integrity monitoring. Integrity monitors are algorithms that continually check the quality of the GPS signal to ensure its statistics fall within an acceptable operational range. The faults for which JPALS must monitor are listed in Table 4. The table also lists appropriate monitoring strategies which have been developed and published in the open literature. This section summarizes the monitors listed in the table. In each case, monitors are designed to exclude individual measurements they deem invalid. An executive monitor (described in the following section) synthesizes the individual monitor results to identify faulted reference receivers, satellites, and GPS frequencies.

*Ionosphere Gradient Monitoring*: At least two monitoring options exist to mitigate the threat of large spatial gradients in the ionosphere. A first method measures the single-frequency code-carrier divergence rate to detect temporal ionosphere changes and, from these, to infer the presence of a spatial gradient [49]. Divergence rate monitors are most effective when deployed both at the reference station and at the airborne user [56]. As an alternative, direct gradient detection may be used. This approach extends the concept of Receiver Autonomous Integrity Monitoring (RAIM). RAIM methods for ionosphere gradient detection take advantage of the long baseline between the ship and the approaching aircraft to detect spatial gradients [57]. This method requires a long prefiltering time and isolates the ionosphere gradient only if it affects a single satellite; nonetheless, RAIM-based ionosphere gradient detection has a much lower noise floor than conventional divergence-rate monitoring.

*Multiple Reference Consistency Checks*: Multiple Reference Consistency Checks (MRCC) have been defined as a means to compare like measurements to identify significant errors that result from faults occurring on individual measurements (such as multipath or sudden antenna calibration faults) [38], [58]. To protect integrity, the reference station flags as invalid any measurement for which the B-value, described by the following equation, exceeds a predefined threshold. The B-value is the difference between a particular measurement, *M*_{m}, and the average of *N* other measurements, which, absent noise, would all be identical in the fault-free case
TeX Source
$$B_{m}=M_{m}-{1\over N}\sum_{n=1}^{N}M_{n}.\eqno{\hbox{(14)}}$$For JPALS, B-values should be computed for each measurement observable, i.e. for the geometry-free integer estimate and the raw carrier phase measurements used in (5). By comparing these observables over all shipboard reference antennas (two as illustrated in Fig. 4 or more if available) inconsistent measurements can be eliminated.

*Antenna Baseline Monitor*: The JPALS navigation algorithm depends strongly on accurate position transfer between the ship-based reference antennas and the touchdown point located on the deck of the carrier. In order to ensure accurate position transfer, JPALS must continually monitor the lever arms between each antenna and the touchdown point. These lever arms can be validated with a Position-Domain Monitoring (PDM) strategy analogous to pseudo-user PDM strategies defined for LAAS [59], [60]. In these strategies, each antenna on the aircraft carrier (see Fig. 4) can be treated as a pseudo-user for the other antennas. A relative position error can be computed by double-differencing measurements from each antenna, computing a relative position between the antennas using (5), and comparing this GPS measurement to the relative positions derived for position transfer (using inertial measurements and modeling).

*PDF Monitors*: Monitors designed for rapidly detecting large faults may fail to detect minor faults that alter or distort measurement error distributions. Left undetected these distortions would invalidate the integrity of the protection level confidence bound. Minor faults that may affect the user error bounds include those caused by aging hardware or changing environmental conditions which alter hardware biases or noise levels. Monitors developed for LAAS that detect variations in PDF shape include the chi-squared and sigma-mean CUSUM monitors [61]. Each of these approaches detects small PDF variations by computing statistics for a large sample population of B-values, as defined by (14).

*Erroneous Ephemeris Monitoring*: Multiple monitoring methods exist for detecting ephemeris errors. One proposed method, called Yesterday's Ephemeris-Today's Ephemeris (YETE), compares broadcast ephemeris parameters with measured parameters from the previous day [62], [63]. Thresholding the difference between yesterday and today enables the isolation of satellites with anomalous ephemerides. Alternatively, erroneous ephemeris errors may be detected with a modified RAIM strategy, similar in nature to the method described for ionosphere gradient detection [57]. Prompt detection of ephemeris errors is not critical if users are required to continue using old ephemeris data for one hour after the first broadcast of a new set of ephemeris parameters.

*RFI Monitors*: Satellite low-power and RFI conditions are relatively easy to detect but harder to classify [64]. Interferers may broadcast a pure tone, chirp, narrowband, wideband, or pulsed signal. Many monitors have been constructed to detect anomalous RFI. Among the options are monitors based on the receiver automatic gain control or the correlator C/N_{0} [65], on the noise estimate for adaptive CRPA processing [28], or on software-receiver processing [66], [67]. Although these monitors quickly detect interference, they have more trouble classifying the interferer's impact on monitoring and navigation algorithm noise levels. By contrast, a monitor can be defined based directly on the code and carrier-phase measurements [68]. This last strategy does not match the sensitivity of other detection methods but does offer a means of directly identifying the standard deviation of measurement errors and thereby inferring the impact of jamming (or low signal power) on navigation accuracy. As the latter type of monitor can enable protection level adjustments to ensure integrity under jamming, we recommend its use in JPALS.

### E. Executive Monitoring

JPALS will rely on an executive monitor, abbreviated EXM, to synthesize the results of the individual integrity monitors. The executive monitor, illustrated in Fig. 11, plays three major roles in JPALS: 1) exclusion of system components for which a fault is detected, 2) re-admittance of those components once the fault condition is resolved, and 3) determination of the set of measurements broadcast to the airborne user(s) via the datalink.

The most important role of EXM is to exclude system components intelligently after fault detection by one of the above-described monitors. This function plays a significant role in determining JPALS availability. Generally, the EXM will trigger the exclusion of an entity (receiver, satellite, or the entire system), if enough measurements associated with that entity are anomalous. The EXM identifies anomalies by detecting multiple measurements that have exceeded their monitor thresholds, by averaging multiple related measurements to compare to an EXM-specific threshold, or by a combination of these approaches [38], [69]. If an entity fails the EXM test, all of the measurements associated with that entity are marked as unhealthy and unavailable for navigation. Because these exclusions may cause a sudden availability interruption during an aircraft approach, the EXM thresholds must be set no tighter than permitted by the continuity risk budget, which limits the allowed frequency of false alarms. Also, a small fraction of the total system integrity budget must be allocated to cover the small but finite possibility that the monitor fails to detect a fault event and to warn an approaching aircraft [70].

After an exclusion period of several hours, the EXM attempts to distinguish between transient and permanent fault conditions by applying a re-admittance criterion. Some faults modes are transient phenomena, such as those associated with an ionosphere storm. Others involve a permanent change, such as in the case of broken receiver hardware [38]. The re-admittance criterion resembles the exclusion rule, with a tighter threshold (a 5% false-detection threshold for re-admittance compared to a 10^{−8} threshold for measurement exclusion). Unless the excluded entity repeatedly exceeds the re-admittance threshold (after three tests each separated by several hours), the re-admittance test eventually approves the excluded satellite or hardware and allows its measurements to be used, once again, in the user navigation solution.

If the EXM approves more measurements than required for navigation, the EXM has responsibility to determine which measurements are broadcast in the datalink message. This capability can be used to maximize system availability. It is expected that redundant antennas will be placed on the ship to prevent single-point hardware failure from interrupting system continuity and availability. Thus, even though the navigation algorithm described in Section II-B only requires two antennas on the ship, the JPALS reference station will likely consist of three or more antenna/receiver pairs positioned at different points about the aircraft carrier. Deck obstructions or jamming may result in each antenna observing a different subset of the satellites above the horizon. Given these different sets of measurements for each antenna, the EXM can select among available antennas to decide which to use as the primary navigation antenna and which to use as the secondary antenna (for decoupled-estimation monitoring). A useful method for determining this common-set selection involves estimation of user VPL for each possible set of measurements broadcast. The common set is selected to provide the best (lowest) VPL error bound to maximize availability [71]. This method is particularly effective if two-way datalink communication is available, in which case the EXM can exactly determine user VPL to optimize system performance.

JPALS must continue to detect system faults even under jamming conditions. The RFI mitigation strategies that maintain integer tracking and increase signal-to-noise ratio, as discussed in the previous section, also aid in preserving fault detection under RFI. The major impact of RFI on monitoring is that threshold levels must be increased along with the increase in RFI noise levels to prevent elevated continuity risk [68]. Protection level error bounds should also be inflated to ensure integrity. The EXM manages these integrity adjustments under RFI conditions and, in extreme cases, may exclude an entire frequency that has been compromised by interference [69].