Worst-Case Integrity Risk Sensitivity for RAIM with Constellation Modernization

Abstract

The integrity improvement of receiver autonomous integrity monitoring (RAIM) can benefit from a combination of constellations. With the rapid development of constellation modernization, integrity parameters, including the probability of satellite fault (P_sat) and user range accuracy (URA), have improved. The integrity loss of RAIM needs to be accurately characterized to control the effect of the improved integrity parameters. To reveal the sensitivity of integrity risk with respect to P_sat and URA, a conservative integrity risk estimation method is proposed based on the worst-case protection concept. Acceptable P_sat and URA were derived by comparing the estimated worst-case integrity risk with the required integrity risk. The simulation results showed that RAIM can meet the integrity risk requirement of LPV-200 when P_sat was 10⁻⁴ and URA was smaller than 0.88 m.

1. Introduction

A combination of constellations significantly increases the number of satellites and enhances the integrity performance of global navigation satellite systems (GNSS) [1,2]. With the implementation of the global positioning system (GPS) modernization program and the advancement of Beidou navigation satellite system (BDS), the ground facilities of GNSS and satellite manufacturing have been upgraded [3]. The prospect of better satellite geometry, more satellites, higher signal-in-space (SIS) accuracy, and lower probability of satellite fault can be therefore anticipated [4,5]. Based on the GPS Standard Positioning Service Performance Standard released in 2008 and 2020, the 95% global user range error (URE) under a nominal state improved from 6.0 to 3.8 m [6,7]. The probability of a GPS single-satellite fault P_sat and multiple-satellite faults P_const are 10⁻⁵ and 10⁻⁸ [7], respectively. Since 2018, the characterization of GPS anomalies has revealed P_sat to be 1.5 × 10⁻⁶ and P_const to be less than or equal to 3.8 × 10⁻⁶ [8]. The user range accuracy (URA) of GPS satellites, except for SVN 39, is below 1.0 m based on data analysis from 2008 to 2022 [9]. Through the statistical analysis of six years of data [10], the satellite fault probability of BDS was conservatively computed to be on the order of 10⁻³ and 10⁻⁴, with URA ranging from about 0.6 to 2.2 m. The BDS SIS performance analysis revealed fault rates between 4 × 10⁻⁵ and 3.5 × 10⁻⁴ for BDS-3 satellites. Meanwhile, the majority of BDS-3 satellites have a URA of about 1.0 m [11]. It is clear that the modernization of the GPS and BDS constellations significantly enhanced user range accuracy and reduced the probability of satellite faults. The influence of these improvements on integrity cannot be disregarded.

Integrity is indispensable for safety-of-life (SoL) navigational applications, so receiver autonomous integrity monitoring (RAIM) was developed to resist threats and increase the level of integrity [12,13]. Integrity parameters determine RAIM performance, but if they are overly conservative they will reduce the availability of navigation applications. In contrast, overly optimistic integrity parameters could be misleading and even threaten user safety [14]. Confronted with an increasingly better P_sat and URA, the integrity performance needs be characterized and the improved parameters need to be revisited to constrain any integrity loss.

Integrity risk (IR) is a critical metric for evaluating the integrity performance of RAIM [15], and the computation methods can be classified into two groups. The first group calculates the ratio of the number of integrity failure samples to the total number of samples. This method can obtain an accurate integrity risk because there is no limit to the distribution of samples; however, it requires long-term observation to obtain large samples, which may be impractical when implementing a very small probability such as 10⁻⁷. From the basic concept of integrity risk, the second group computes the probability of integrity failure by assuming a statistical distribution of samples such as Gaussian [16,17]. Since the first group of methods requires a sufficient number of samples and it would be unacceptable if the effect of different parameters on integrity risk needed to be accounted for. In contrast, the Gaussian distribution-based method requires fewer samples and can intuitively quantify the relationship between integrity risk and its parameters. Therefore, we computed RAIM integrity risk based on the Gaussian distribution. Using the worst-case protection concept, a conservative estimation method of worst-case integrity risk (WIR) was developed to obtain the maximum integrity loss caused by the improved integrity parameters.

Sensitivity analysis is an effective approach for studying the effect of the parameters on integrity risk. El-Mowafy et al. [18] conducted a sensitivity analysis on the availability of advanced RAIM (ARAIM) using real-world data from monitoring stations in Australia, and he demonstrated that a combination of GPS and BDS significantly improved availability. To clarify the impact of the integrity support message (ISM) on ARAIM performance, Lee et al. [19,20] used a sensitivity analysis to prove that GPS constellation integrity parameters had a significant impact on ARAIM performance. A corresponding analysis was carried out to assess the impact of different integrity parameters on ARAIM performance with BDS in the Asia-Pacific region [21]. A sensitivity analysis of RAIM is still absent according to our best knowledge. Although the baseline concept in this contribution was motivated by Lee et al. [19,20], the sensitivity analysis of RAIM is still necessary because of its stronger autonomy and greater number of applications in the GNSS community relative to ARAIM. Moreover, the effect of integrity parameters on RAIM is different from ARAIM because the protection levels are constructed to deal with different integrity risk resources. Specifically, besides the threat of satellite failure, which is the focus of RAIM, ARAIM also needs to account for atmospheric anomalies because ARAIM aims to satisfy higher grades of RNP in civil aviation than RAIM. To achieve the robust result of sensitivity analysis, we conducted a RAIM integrity risk sensitivity analysis based on the proposed WIR method to restrict the integrity loss caused by the improved P_sat and URA.

A conservative integrity risk estimation method is proposed based on the worst-case protection concept. The sensitivity of worst-case integrity risk to P_sat and URA is analyzed. Acceptable P_sat and URA are provided for different integrity risk requirements. Finally, we analyze the simulation experiment results and summarize the research findings.

2. Integrity Risk Estimation for RAIM

Integrity risk, also called the probability of hazardous misleading information (PHMI), is defined as the probability that a position error exceeds the alarm limit (AL) or the protect levels and test statistic remain below the detection threshold [16]:

$$IR=P\left(\left|\delta \right|>l\cap t<T\right)$$

(1)

where δ represents the position error; l is the alarm limit; t and T are the test statistic and detection threshold of RAIM, respectively. The integrity risk of RAIM based on (1) can be estimated when given the statistical distribution of position error δ and test statistic t. Generally, the nominal observation error is assumed to have a zero mean Gaussian distribution with a STD observation error σ determined by URA, and the tropospheric-delay and the user-related errors. With the least-squares estimator, the position error and test statistic distributions can be characterized by

$${\delta }_{q,i}~N\left(b_i\left|{\mathit{A}}_{q,i}^{}\right|,{\sigma }_q^2\right),t_i~{\chi }^2\left({\lambda }_i,n-m\right)$$

(2)

where the subscript i and q indicate the ith satellite and the qth state, respectively; n is the number of satellite signals tracked; m is the number of states to be estimated; b_i is the fault-induced bias of the ith satellite and is absent under the nominal mode, where the position error and test statistic follow the zero mean Gaussian distribution and chi-square distribution, respectively. Under the fault mode, the position error follows the non-zero mean Gaussian distribution, and the test statistic follows the non-central chi-square distribution. $\mathit{A}={\left({\mathit{G}}^T\mathit{G}\right)}^{-1}{\mathit{G}}^T$ is the transformation matrix from the observation domain to the position domain; G is the geometry matrix determined by satellite geometry and the user’s location; ${\sigma }_q^{}=\sigma \sqrt{{\left({\mathit{G}}^T\mathit{G}\right)}_{q,q}^{-1}}$ is the STD observation error for state q; ${\lambda }_i={\left(b_i/\sigma \right)}^2{\mathit{S}}_{i,i}$ is the non-centrality parameter; and $\mathit{S}=\mathit{I}-\mathit{G}{\left({\mathit{G}}^T\mathit{G}\right)}^{-1}{\mathit{G}}^T$ is the transformation matrix from the observation domain to the RAIM detection domain.

The statistical distribution of position error and test statistic is independent of each other based on the least-squares estimator [17]. The integrity risk can be computed under the mutually exclusive and exhaustive fault mode

$$IR={\displaystyle \sum _{i=0}^{n}P\left(\left|{\delta }_i\right|>l|{\mathrm{H}}_i\right)P\left(t_i<T|H_i\right)P\left(H_i\right)}$$

(3)

where P(H_i) is the probability of the fault mode H_i, which may be the nominal or fault mode. The integrity risk can be computed as the product of the probability of position error exceeding the alarm limit and the probability of the test statistic beyond the detection threshold. Provided the probability of the ith satellite fault is P_sat,i, the integrity risk in (3) can be expressed as follows under the single-satellite fault mode:

$$\begin{array}{ll}IR=& {\displaystyle \sum _{i=1}^n\left[Q\left(z_{\mathrm{i}}^{+}\right)+Q\left(z_i^{-}\right)\right]}P\left(T,n-m,{\lambda }_i\right)P_{\mathrm{sat},i}{\displaystyle \prod _{k=1,k\ne i}^n\left(1-P_{\mathrm{sat},k}\right)}\\ & +2Q\left(z_0\right)P\left(T,n-m\right){\displaystyle \prod _{k=1}^n\left(1-P_{\mathrm{sat},k}\right)}\end{array}$$

(4)

where $Q\left(z\right)$ is the tail cumulative distribution function (CDF) at z of a standard Gaussian distribution; $P\left(T,n-m,{\lambda }_i\right)$ is the non-central chi-square CDF at T, with n-m degree of freedom and non-central parameter λ_i; $P\left(T,n-m\right)$ is the chi-square CDF at T with an n-m degree of freedom; and $z_i^{+}$, $z_i^{-}$ and $z_0$ are defined as

$$z_{\mathrm{i}}^{+}=\frac{l+b_i\left|{\mathit{A}}_{q,i}^{}\right|}{{\sigma }_q^2},z_i^{-}=\frac{l-b_i\left|{\mathit{A}}_{q,i}^{}\right|}{{\sigma }_q^2},z_0=\frac{l}{{\sigma }_q^2}$$

(5)

From (4), the RAIM integrity risk is jointly determined by the probability of the position error exceeding the alert limit in the position domain and detection fails in the detection domain, while the baseline ARAIM computes integrity risk through the bounding and manipulating of inequalities in the position domain. The effect of the integrity parameters on RAIM is therefore different from those for ARAIM. The integrity-related parameters involved in (4) can be divided into four groups as follows:

• The first group of parameters is the fault-induced bias b_i, which is impractical to obtain accurately. However, based on the worst-case protection concept, the effect of the bias on the integrity risk can be strictly determined.
• The second group includes the parameters benefiting from the improvement in the aspects of SIS performance and probability of satellite fault, i.e., URA and P_sat. This second group will improve with the constellation modernization. The integrity loss introduced by the improved second group of parameters needs to be strictly characterized, which is the focus of this contribution.
• The third group is determined by the positioning, integrity and continuity requirement, including the alert limit and the probabilities of false alarm (P_fa) and missed detection (P_md). The third group of parameters is generally constant for the specific required navigation performance (RNP): e.g., the different flight phases in civil aviation defined by the international civil aviation organization (ICAO).
• The fourth group of parameters is the satellite geometry, which has a great impact on integrity performance. The influence of satellite geometry on the integrity performance cannot be neglected.

To investigate the integrity loss resulting from improved parameters in the second group, we needed to consider the impact of the first, third, and fourth group of parameters on the integrity risk. In the following section, we introduce the concept of worst-case integrity risk by varying the magnitude of the first group of parameters to acquire the maximum risk. Based on it, the integrity risk error with respect to P_sat and URA was deduced. The integrity loss introduced by the improved second group of integrity parameters can be therefore strictly characterized. The effect of the third and fourth group of parameters on integrity performance will be analyzed through a global simulation experiment.

3. Worst-Case Integrity Risk and Sensitivity Determination

To investigate the effect of the improved P_sat and URA on the integrity risk, the first group of parameters, i.e., the fault-induced bias b_i, should be strictly determined. The concept of worst-case bias (WCB) was used to acquire the worst-case integrity risk. The minimum hazardous bias (MHB) and the minimum detectable bias (MDB) can be calculated according to the requirements of P_fa and P_md. MHB and MDB can be defined as [22]

$$MH{B}_i=\frac{l-k_{\mathrm{md}}{\sigma }_q}{\left|{\mathit{A}}_{q,i}^{}\right|},MD{B}_i=\sigma \sqrt{\frac{\lambda }{{\mathit{S}}_{i,i}}}$$

(6)

where k_md is the quantile of Gaussian distribution that meets the requirement of P_md; λ is the non-central parameter determined by P_fa and P_md; MHB_i is the minimum bias leading to integrity risk; and MDB_i is the minimum detectable bias of RAIM. When bias b_i is within [MHB_i, MDB_i], the fault-induced bias cannot be detected by RAIM and yields the integrity risk.

Under the different fault modes, WCB is defined as the bias with maximum integrity risk. Based on the worst-case protection concept, the worst-case integrity risk can be computed as the maximum integrity risk under different fault modes,

$$\begin{array}{l}WIR={\displaystyle \sum _{i=1}^n\left\{\underset{b_i\in \left[MH{B}_i,MD{B}_i\right]}{\arg \max }\left\{\left[Q\left(z_i^{+}\right)+Q\left(z_i^{-}\right)\right]P\left(T,n-m,{\lambda }_i\right)\right\}{P}_{\mathrm{sat},i}{\displaystyle \prod _{k=1,k\ne i}^n\left(1-P_{\mathrm{sat},k}\right)}\right\}}\\ +2Q\left(z_0\right)P\left(T,n-m\right){\displaystyle \prod _{k=1}^n\left(1-P_{\mathrm{sat},k}\right)}\end{array}$$

(7)

WIR is a conservative metric to estimate the integrity risk given the three groups of parameters, and acceptable integrity parameters can be obtained by comparing WIR with the required integrity risk. The integrity loss introduced by inaccurate integrity parameters can be strictly characterized. By assuming the probability of different satellite faults is identical, the worst-case integrity risk error with respect to the second group of parameters can be analytically derived as

$$dWIR=\frac{\partial \left(WIR\right)}{\partial URA}dURA+\frac{\partial \left(WIR\right)}{\partial P_{\mathrm{sat}}}d{P}_{\mathrm{sat}}$$

(8)

where dWIR represents the error of WIR, i.e., the integrity loss, and dURA and dP_sat represent the error of URA and P_sat, which are the difference results of the selected parameters minus the true parameters. If the results are greater than zero, the selected parameters are conservative. In contrast, the selected parameters are optimistic if the results are smaller than zero. $\frac{\partial \left(WIR\right)}{\partial URA}$ and $\frac{\partial \left(WIR\right)}{\partial P_{\mathrm{sat}}}$ represent the partial derivatives of WIR with respect to URA and P_sat:

$$\begin{array}{ll}\frac{\partial \left(WIR\right)}{\partial URA}=& P_{\mathrm{sat}}{\left(1-P_{\mathrm{sat}}\right)}^{n-1}{\displaystyle \sum _{i=1}^n\left\{c_{1}P\left(T,n-m,{\lambda }_i\right)+c_2\left[Q\left(z_i^{+}\right)+Q\left(z_i^{-}\right)\right]\right\}}\\ & +2c_3{\left(1-P_{\mathrm{sat}}\right)}^{n}P\left(T,n-m\right)\\ \frac{\partial \left(WIR\right)}{\partial P_{\mathrm{sat}}}=& \left[{\left(1-P_{\mathrm{sat}}\right)}^{n-1}-\left(n-1\right)P_{\mathrm{sat}}{\left(1-P_{\mathrm{sat}}\right)}^{n-2}\right]\\ & \times {\displaystyle \sum _{i=1}^n\left\{\left[Q\left(z_i^{+}\right)+Q\left(z_i^{-}\right)\right]P\left(T,n-m,{\lambda }_i\right)\right\}}-2n{\left(1-P_{\mathrm{sat}}\right)}^{n-1}Q\left(z_0\right)P\left(T,n-m\right)\end{array}$$

(9)

where c₁, c₂ and c₃ are defined as

$$\begin{array}{l}{c}_1=\frac{\partial \left[Q\left(z_i^{+}\right)+Q\left(z_i^{-}\right)\right]}{\partial URA}=\frac{URA}{\sqrt{2\pi }{\sigma }^2}\left[z_i^{+}{e}^{-\frac{{\left(z_i^{+}\right)}^2}{2}}+z_i^{-}{e}^{-\frac{{\left(z_i^{-}\right)}^2}{2}}\right]\\ c_2=\frac{\partial \left[P\left(T,n-m,{\lambda }_i\right)\right]}{\partial URA}=\frac{b_i^2\times {\mathit{S}}_{i,i}\times URA}{2\sigma 4}{\displaystyle {\int }_0^T{e}^{-\frac{\left(x+{\lambda }_i\right)}{2}}{\left(\frac{x}{{\lambda }_i}\right)}^{\frac{n-m}{4}-\frac{1}{2}}h\left(x,n-m,{\lambda }_i\right)dx}\\ c_3=\frac{\partial \left[Q\left(z_0\right)\right]}{\partial URA}=\frac{z_0\times URA}{\sqrt{2\pi }{\sigma }^2}{e}^{-\frac{z_0^2}{2}}\end{array}$$

(10)

$h\left(x,n-m,{\lambda }_i\right)$ is defined as

$$h\left(x,n-m,{\lambda }_i\right)=\frac{n-m-2+{\lambda }_i}{{\lambda }_i}{I}_{\left(n-m\right)/2-1}\left(\sqrt{{\lambda }_{i}x}\right)-\sqrt{\frac{x}{{\lambda }_i}}{I}_{\left(n-m\right)/2-2}\left(\sqrt{{\lambda }_{i}x}\right)$$

(11)

where $I_{\left(n-m\right)/2-1}\left(\sqrt{{\lambda }_{i}x}\right)$ and $I_{\left(n-m\right)/2-2}\left(\sqrt{{\lambda }_{i}x}\right)$ are the modified Bessel function of the first kind of $\left(n-m\right)/2-1$ and $\left(n-m\right)/2-2$ order, respectively. The detailed derivation is shown in Appendix A. It can be found that the worst-case integrity risk error can be expressed as a linear combination of the URA and P_sat errors. Based on (8), the sensitivity of URA and P_sat on the worst-case integrity risk error can be determined.

To characterize the RAIM integrity loss resulting from the improved integrity parameters, a conservative integrity risk estimation method was proposed based on worst-case protection. The integrity-related parameters were categorized into three groups. The worst-case integrity risk was calculated by constraining the first group of parameters. By deriving the worst-case integrity risk error introduced by the improved P_sat and URA, the sensitivity of P_sat and URA on the worst-case integrity risk was determined. The acceptable P_sat and URA were obtained by comparing the worst-case integrity risk and the required integrity risk.

4. Simulation and Analysis

To investigate the impact of the improved second group of parameters (P_sat and URA on the RAIM integrity risk) the global integrity risk simulation experiment was conducted based on the proposed worst-case integrity risk method. The impact of satellite geometry and the third group of parameters on the integrity loss caused by the improved second group of parameters was discussed. By comparing the global worst-case integrity risk simulation result and integrity risk requirement, the acceptable second group of parameters was provided.

We mainly focused on the vertical direction because that is where the geometric diversity of the satellite constellation was the poorest [23], causing a vertical integrity risk larger than for the horizontal. The following error model was used to describe the STD of the ith satellite observation error [24]:

$${\sigma }_i^{}=\sqrt{UR{A}_i^2+{\sigma }_{\mathrm{trop},i}^2+{\sigma }_{\mathrm{user},i}^2}$$

(12)

where, σ_trop,i and σ_user,i are the STD tropospheric delay and user related errors, which are defined in [25]. URA is currently recommended to range from 0.5 to 2.5 m for GPS and BDS, respectively [9,10,11,24,25,26]. Considering practical application, we mainly discussed the influence of URA from 0.5 to 3.5 m on integrity risk performance. Moreover, the URA of 1.0, 1.5 and 2.0 m were specially chosen for discussing the integrity loss caused by improved URA. The P_sat for GPS satellites ranged from 10⁻⁵ to 10⁻⁴ according to [7,8,24,26,27] and for BDS it was usually from 10⁻³ to 10⁻⁴ [10,11,26,28]. Three different orders of P_sat (10⁻⁵, 10⁻⁴ and 10⁻³) were selected to indicate the GPS and BDS constellation performance.

We mainly focused on the integrity risk requirement of 10⁻⁷ for LPV-200. According to the minimum operational performance standards (MOPS) promulgated by RTCA [29], the third group of parameters—P_fa, P_md and VAL—were chosen as 10⁻⁵, 10⁻³ and 35 m, respectively. The vertical integrity risk requirement of LPV-200 was allocated as 9 × 10⁻⁸ [30]. A stricter requirement of vertical integrity risk should have been considered in this contribution because we only accounted for the single-satellite fault mode. We assume that the single-satellite fault mode is allocated half of the vertical integrity risk requirement of LPV-200: 4.5 × 10⁻⁸.

Based on the open-source software MAAST of Stanford University (https://gps.stanford.edu/resources/software-tools/maast, accessed on 4 June 2023), the GPS and BDS dual constellations were used for the global simulation experiment. The GPS almanac contained in MAAST was used, including 24 MEO satellites. The BDS almanac was provided by the Test and Assessment Research Center of China Satellite Navigation Office (http://www.csno-tarc.cn/system/almanac, accessed on 4 June 2023), including 24 MEO and 3 IGSO satellites. The global simulation experiment parameters are shown in

Table 1. Simulation experiment parameters.

Parameters	Value
URA	1.0/1.5/2.0 m
Psat	10−5/10−4/10−3
Pfa requirement	10−5
Pmd requirement	10−3
VAL	35 m
Constellation	GPS + BDS
Simulation duration	10 days
Time step	10 min
Cut-off elevation angle	10 deg

. The global simulation experiment was based on a 5 × 5° user grid, for 10 days with a sampling interval of 10 min, which generated 1440 worst-case integrity samples per user grid. The cut-off elevation angle was set to 10° to balance observation accuracy and the visible satellite. At each user grid, the 99.5 percentile of the worst-case integrity risk over the simulation duration was selected to show the worst-case integrity risk performance. The availability of a grid point was obtained by calculating the ratio of epochs where the WIR was smaller than the required IR_req to the total number of epochs during the simulation. The global availability coverage was used as the metric to reflect the global integrity performance, which was calculated as the ratio between the number of user grids with the worst-case integrity risk being smaller than the required integrity risk and total number of grids.

4.1. Impact of URA and P_sat

To explore the impact of the improved URA and P_sat on the integrity risk, a global simulation was carried out based on Equations (7) and (8). We discussed the influence of the improved integrity parameters on integrity risk from three aspects: global worst-case integrity risk, global availability and variation of the global worst-case integrity risk error. The corresponding results are shown in Figure 1, Figure 2 and Figure 3. When we analyzed the influence of the changes to URA or P_sat on integrity performance, the other parameters remained unchanged. The top and bottom panels of (a) and (b) in Figure 1, Figure 2 and Figure 3, respectively, represent selected parameters that increased by 15 and 30% from the true parameters. In panel (a), P_sat was set to 10⁻⁴ and URA varied in columns from left to right as 1.0, 1.5 and 2.0 m, respectively. In panel (b) of Figure 1, Figure 2 and Figure 3, URA was set to 1.5 m, and P_sat varied by column from left to right as 10⁻⁵, 10⁻⁴ and 10⁻³, respectively.

As shown in Figure 1, the global integrity risk increased with URA and P_sat growth. At equivalent deviation levels, URA had a significantly greater impact on global integrity risk than did P_sat. Figure 2 demonstrates that lower URA and P_sat values led to higher global availability. A 30% increase in P_sat had a negligible effect on global availability, but an increase in URA led to a substantial decrease in global availability. Figure 3 shows that an increase in URA resulted in a more substantial impact on the global worst-case integrity risk error than that of P_sat. However, in specific areas with poor geometry, such as North America, a P_sat increase resulted in a higher global worst-case integrity risk error compared to increased URA. Furthermore, in comparison to North and South America, the Asia-Pacific region demonstrated superior performance integrity due to a greater number of available IGSO satellites from BDS. Consequently, the regions featuring poorer geometry had higher vulnerabilities to URA and P_sat changes. Better satellite geometry can be advantageous for reducing integrity losses resulting from improved URA and P_sat.

Table 2. Global worst-case integrity risk performance and availability coverage with different URA and P_sat. # represents the different degrees of increase.

	Value	Increased by #	Worst-Case Integrity Risk				Coverage (99.5%)
			Average WIR	Maximum WIR	Average dWIR	Maximum dWIR	IRreq = 9 × 10−8	IRreq = 4.5 × 10−8
URA (m)	1.0	15%	1.37 × 10−8	4.65 × 10−6	4.20 × 10−9	1.43 × 10−6	98.17%	97.41%
		30%	3.14 × 10−8	8.14 × 10−6	8.70 × 10−9	2.96 × 10−6	96.23%	94.82%
	1.5	15%	2.92 × 10−7	2.57 × 10−5	9.62 × 10−8	8.11 × 10−6	73.55%	69.22%
		30%	7.23 × 10−7	3.57 × 10−5	1.97 × 10−7	1.67 × 10−5	63.01%	57.61%
	2.0	15%	2.24 × 10−6	5.07 × 10−5	8.54 × 10−7	1.53 × 10−5	41.51%	34.74%
		30%	4.84 × 10−6	7.57 × 10−5	1.73 × 10−6	3.12 × 10−5	19.71%	12.60%
Psat	10−5	15%	1.07 × 10−8	1.82 × 10−6	9.60 × 10−9	8.12 × 10−7	97.79%	96.00%
		30%	1.21 × 10−8	2.05 × 10−6	1.97 × 10−8	1.67 × 10−6	97.34%	95.78%
	10−4	15%	1.07 × 10−7	1.82 × 10−5	1.22 × 10−8	2.25 × 10−6	90.45%	85.65%
		30%	1.21 × 10−7	2.05 × 10−5	2.43 × 10−8	4.50 × 10−6	89.80%	84.67%
	10−3	15%	1.05 × 10−6	1.79 × 10−4	9.51 × 10−7	8.03 × 10−5	72.91%	69.56%
		30%	1.19 × 10−6	2.02 × 10−4	1.95 × 10−6	1.65 × 10−4	72.26%	68.91%

presents the global worst-case integrity risk performance and availability coverage for different URA and P_sat. Table 2 shows that the global average WIR, dWIR and availability are significantly more affected by an increase in URA than P_sat. When IR_req = 4.5 × 10⁻⁸ and URA increased by 15 to 30% from 1.5 m, the average WIR and dWIR increased by 4.31 × 10⁻⁷ and 1.01 × 10⁻⁷, respectively. As a consequence, global availability coverage decreased by 22.14%. When P_sat was 10⁻⁴, an increase of 15 to 30% resulted in an increase of only 1.4 × 10⁻⁸ and 1.21 × 10⁻⁸ in average WIR and dWIR, respectively, and global availability dropped by 0.98%. Under the same conditions, when P_sat was 10⁻³, the impact of increased P_sat on average WIR and availability was also not significant. However, the maximum WIR and dWIR increased by 2.3 × 10⁻⁵ and 8.74 × 10⁻⁵, respectively, which was higher than the maximum WIR and dWIR caused by an increase of 30% in URA from 2.0 m. This indicated that changes in URA had a significant impact on the integrity risk and availability of all regions worldwide. On the other hand, P_sat changes had a relatively smaller impact on the global average integrity risk and availability but posed a more significant threat to areas with poor satellite geometry. The RAIM integrity risk was more sensitive to URA than P_sat. Therefore, more attention should be paid to determining URA.

4.2. Acceptable URA and P_sat

To obtain an acceptable second group of parameters, the effect of a different second group of parameters on the integrity risk was further discussed. Based on the analysis, the change in P_sat had a negligible effect on global integrity performance. Therefore, we mainly focused on analyzing acceptable URA under a different P_sat. The 24 GPS + 27 BDS and 23 GPS + 26 BDS satellites (by removing one MEO satellite from GPS and BDS) were chosen as the baseline and depleted constellation configurations, respectively. The global coverage results are shown in Figure 4. The P_sat in the left, middle and right panels are set to 10⁻³, 10⁻⁴ and 10⁻⁵, respectively.

It can be observed from Figure 4 that the global coverage decreased with increasing URA. Due to the poorer satellite geometry, the coverage of the depleted constellation was always smaller than that of the baseline constellation.

Table 3. Acceptable URA with different P_sat and integrity risk requirement.

	Psat	Constellation	Coverage	Integrity Risk Requirement
				2 × 10−7	10−7	9 × 10−8	4.5 × 10−8	2 × 10−8	10−8
URA (m)	10−5	24 GPS + 27 BDS	99.5%	1.36	1.26	1.24	1.14	1.04	0.98
			95.0%	1.84	1.70	1.68	1.58	1.46	1.38
		23 GPS + 26 BDS	99.5%	0.84	0.70	0.68	0.56	/	/
			95.0%	1.32	1.20	1.18	1.08	0.96	0.88
	10−4	24 GPS + 27 BDS	99.5%	1.04	0.98	0.96	0.88	0.80	0.72
			95.0%	1.46	1.38	1.36	1.28	1.20	1.14
		23 GPS + 26 BDS	99.5%	/	/	/	/	/	/
			95.0%	0.96	0.88	0.86	0.78	0.68	0.60
	10−3	24 GPS + 27 BDS	99.5%	0.80	0.72	0.72	0.66	0.56	/
			95.0%	1.20	1.14	1.14	1.08	1.00	0.96
		23 GPS + 26 BDS	99.5%	/	/	/	/	/	/
			95.0%	0.68	0.60	0.58	0.52	/	/

shows acceptable URA with different P_sat and integrity risk requirement. From Table 3, under the baseline constellation, URA should be better than 0.88 and 1.14 m when P_sat is 10⁻⁴ and 10⁻⁵, respectively, such that more than 99.5% of global regions can satisfy the allocated integrity risk requirement of a single-satellite fault mode: 4.5 × 10⁻⁸. More than 95% of global regions can meet the integrity risk requirement of 10⁻⁷ when P_sat is 10⁻³ and URA is smaller than 0.72 m. Under the depleted constellation, URA should better than 0.6 m with P_sat at 10⁻³ and the required integrity risk at 10⁻⁷. As revealed by the literature [7,8,9,10,11], P_sat for GPS and BDS ranged from 10⁻⁵ to 3.5 × 10⁻⁴, which indicated that the combination of GPS and BDS had the potential to satisfy the integrity risk requirement of LPV-200 concerning P_sat. For the Galileo, greater attention should be paid to constellation faults because their probability, P_const, is equal to or greater than that of single-satellite faults [8]. The representative SISRE values of 0.2–0.58 m and 2 m were demonstrated for Galileo and GLONASS [31,32]. URA can be empirically expressed as 1.5× SISRE [24]. Consequently, the SIS performance of Galileo had the potential to support the integrity risk requirement of LPV-200. It was expected that the comparable integrity level could not be achieved by GLONASS unless URA improved by 2.34 m and P_sat was constrained within 10⁻³.

Since the selection of the third group of parameters affected the integrity performance, acceptable URA under a different third group of parameters needs to be considered. The effect of the third group on global integrity performance was analyzed. The selection of the third group of parameters was referenced from the requirement of LPV-200 and APV-II [33]. Acceptable URA with a different third group of parameters has been shown in

Table 4. Acceptable URA with different third group of parameters.

	Third Group of Parameters		Coverage	Integrity Risk Requirement
				2 × 10−7	10−7	9 × 10−8	4.5 × 10−8	2 × 10−8	10−8
URA (m)	Pfa	8 × 10−6	99.5%	1.04	0.96	0.94	0.88	0.78	0.70
			95.0%	1.44	1.36	1.34	1.26	1.20	1.14
		4 × 10−6	99.5%	1.00	0.92	0.92	0.82	0.74	0.68
			95.0%	1.40	1.32	1.30	1.24	1.16	1.10
	Pmd	10−4	99.5%	1.04	0.98	0.96	0.90	0.80	0.72
			95.0%	1.46	1.38	1.36	1.28	1.20	1.14
		10−5	99.5%	1.04	0.98	0.96	0.90	0.80	0.72
			95.0%	1.46	1.38	1.36	1.28	1.20	1.14
	VAL (m)	20	99.5%	/	/	/	/	/	/
			95.0%	/	/	/	/	/	/
		30	99.5%	0.64	0.50	/	/	/	/
			95.0%	1.08	0.98	0.98	0.90	0.80	0.74

.

From Table 4, the URA requirement is tighter with smaller P_fa and VAL because the probability of detection failure and position error exceeds the alarm limits, which become greater with either stricter P_fa or smaller VAL. The selection of P_md had little effect on acceptable URA because the estimate of integrity risk could not be directly affected by P_md. If the global coverage is 99.5%, acceptable URA should be better than 0.88 m when P_fa is set as the continuity risk requirement of LPV-200, i.e., 8 × 10⁻⁶. When VAL was set to 20 m, which is required for APV-II, it was impractical for RAIM to meet the integrity risk requirement of 10⁻⁷ by improving URA because the observation error introduced by the other threat sources, such as tropospheric delay error, had not been mitigated. Monitoring threat sources with an auxiliary ground facility, such as a ground-based augmentation system (GBAS), can satisfy the higher integrity requirement.

5. Conclusions

To investigate the effect of improved integrity parameters on RAIM integrity risk, a conservative integrity risk estimation method based on the worst-case protection concept was developed. The integrity-related parameters were divided into four groups. The worst-case integrity risk was estimated by varying the magnitude of the first group of parameters to acquire the maximum integrity risk. A sensitivity analysis was conducted for the second group of parameters, P_sat and URA, while considering the influence of the third and fourth groups of parameters on integrity risk. The acceptable second group of parameters was provided based on the global simulation experiment.

The simulation results demonstrated that changes in URA significantly affected integrity risk and availability. Conversely, alterations in P_sat had a relatively minor impact on integrity risk and availability, except in areas with disadvantaged satellite geometry. The determination of URA requires closer attention. When IR_req = 4.5 × 10⁻⁸, P_sat was 10⁻⁴ and URA was 1.5 m, URA and P_sat both increased by 30%, whereas the global availability coverage decreased by 22.14 and 0.98%, respectively. With the higher requirement of P_fa and VAL, the restriction on URA became more stringent. Moreover, when the single-satellite fault mode was allocated half of the vertical integrity risk requirement of LPV-200, URA values had to be better than 0.88 and 1.14 m, respectively, when P_sat was 10⁻⁴ and 10⁻⁵ so that more than 99.5% of global regions could meet the allocated integrity risk requirement. Currently, GPS, BDS and Galileo have the potential to support RAIM to satisfy the requirement for LPV-200.