Overbounding Revisited: Toward a More Practical Approach for Error Modeling in Safety-Critical Applications Jason Rife, Tufts University Boris Pervan, Illinois Institute of Technology
BIOGRAPHY Jason Rife is an Assistant Professor of Mechanical Engineering at Tufts University in Medford, Massachusetts. He received his B.S. in Mechanical and Aerospace Engineering from Cornell University in 1996 and his M.S. and Ph.D. degrees in Mechanical Engineering from Stanford University in 1999 and 2004, respectively. After completion of his graduate studies, he worked as a researcher with the Stanford University GPS Laboratory, serving as a member of the Local Area Augmentation System (LAAS) and Joint Precision Approach and Landing System (JPALS) teams. At Tufts, he directs the Automation Safety and Robotics Laboratory (ASAR), which applies theory and experiment to characterize the integrity of autonomous vehicle systems. Boris Pervan is an Associate Professor of Mechanical and Aerospace Engineering at the Illinois Institute of Technology in Chicago. He received his B.S. from the University of Notre Dame in 1986, his M.S. from the California Institute of Technology in 1987, and his Ph.D. from Stanford University in 1996, all in Aerospace Engineering. After completion of his graduate studies, he was employed as a Systems Engineer at Hughes (Space and Communications Group) and subsequently as a Research Associate at Stanford University (Project Leader for LAAS Research and Development). Dr. Pervan was the 1996 recipient of the RTCA William E. Jackson Award and the 1999 M. Barry Carlton Award from the IEEE Aerospace and Electronic Systems Society. ABSTRACT Overbounding navigation measurement error is essential to ensuring integrity for safety-of-life applications. Most existing overbounding methods rely on representing the actual measurement error distribution with a continuous probability distribution model (e.g. a Gaussian). A key limitation of these methods is validation using empirical data, since it is not immediately evident how to develop
tests to establish the conservatism of a continuous distribution using a very large (and continuously growing) population of statistical samples. This problem is particularly acute in the distribution tails, where comparatively little statistical data is available. We propose a discretized overbounding methodology as a practical solution for safety validation. With a discrete overbound, it is possible to (1) define a clear and consistent set of empirical validation tests and to (2) introduce a distribution shape that directly accounts for uncertainty in modeling the distribution’s far tails. INTRODUCTION This paper presents a method for evaluating a GNSS positioning-error bound in a manner that streamlines the process of empirical validation. Relating experimental error data to theoretical bounds remains a key challenge for certifying GNSS integrity systems. In particular, the process of validating integrity is made difficult because (1) most theoretical approaches to integrity rely on continuous probability density functions which are difficult to estimate experimentally and because (2) most applied integrity systems exploit the properties of Gaussian distributions, which may not precisely represent experimental data, particularly in the distribution tails. The proposed approach addresses these limitations by introducing a discrete representation of the measurement error distribution. The discrete representation enables more rigorous experimental estimation of the error distribution, because integrity need only be assessed over specified intervals and not at every point in a continuum. Also, the discrete bounding approach enables variable precision in representing error distributions. Thus the discrete representation can be a tight bound in the distribution core, where experimental data is plentiful, and loose in the tails, where experimental data is sparse. The use of bounds that are everywhere as tight as possible, but no tighter, ensures conservatism without placing an undue penalty on navigation availability.
This paper’s central contribution is the introduction of a discrete distribution, labeled the Navigation Discrete Envelope (NavDEN) model, which attempts to balance tradeoffs that arise in using a discretized error model for safety-of-life navigation. Practical issues that must be addressed include validation of overbounds to certify system safety, broadcast of error distribution models over limited-bandwidth communication channels, and computing rigorous error bounds from discrete distributions in real time. Communication and processing constraints have motivated a nearly universal reliance on Gaussian error modeling in existing safety-of-life navigation systems. Unbiased Gaussian distributions are described by a single parameter: the standard deviation, sigma. The bandwidth for a Space Based Augmentation System (SBAS) or a Ground Based Augmentation System (GBAS) is just sufficient to transmit this single-parameter error representation for each GPS satellite. By contrast, discrete distribution models generally employ a great many parameters, making them less suitable for broadcast. In a similar vein, a closed-form equation exists to describe the error for a GNSS position solution when measurement error distributions are Gaussian. No compact, closed-form solution exists for computing the positioning-error distribution when the summed measurement error distributions are non-Gaussian. Thus, both communication and processing concerns favor the use of Gaussian distributions in navigation applications. An overreliance on Gaussian error modeling makes formal integrity validation difficult, however. As an alternative, this paper proposes a discrete distribution structure with the intent to achieve tighter error bounds, to facilitate easier and more rigorous overbound validation, and to promote communication and computation in as efficient a manner as possible.
1 0.9
Gaussian CDF Discrete Envelope Model
0.8 0.7
CDF
0.6 0.5 0.4 0.3 0.2 0.1 0 -3
-2
-1
0 Error x/σ
1
2
3
Figure 1. A Gaussian distribution represented by a NavDEN model consisting of eight envelopes.
BACKGROUND The proposed approach for discrete modeling of measurement distributions in GNSS integrity applications builds on interval-based approaches for describing sampled data. Also known as discrete envelope methods, these techniques have been developed by several groups working independently [1]-[3]. Each discrete envelope describes a finite error probability and specifies right and left bounds between which that probability is confined. Thus, each envelope is characterized by three parameters: a right bound, a left bound, and a finite probability. The complete error distribution is modeled by a set of such envelopes. As an example, a discrete envelope model for a Gaussian distribution is illustrated in Figure 1. In the figure, the height of each envelope corresponds to a probability. The left and right edges of each envelope define the associated interval. As with conventional error distributions, the total probability over all envelopes sums to unity. The specific distribution of errors within each envelope, however, need not be known or modeled. For navigation integrity applications, it is essential that a conservative model for the positioning-error distribution can be established for any arbitrary set of ranging measurements [4]. The term overbounding is typically used to describe the process of ensuring conservatism in the conversion between individual measurement error models and the error model for the GNSS position solution. Discrete envelopes are inherently well suited for integrity applications, because they rigorously bound error Cumulative Distribution Functions (CDF) without dictating that distributions be Gaussian. Moreover, discrete envelopes give rise to a pair of bounding CDFs, one to the right and one to the left of the actual distribution [3]. When right and left bounds exists for each measurement error distribution, the paired bounding theorem [5] ensures that a conservative position-domain error bound can be computed. However, given statistical uncertainty in sampled data [6], validation is only possible if left and right bounds are separated by an offset, as discussed in the next section. The paired bounding theorem ensures a position error bound when individual GNSS ranging measurements are also bounded. This property applies for any set of independent measurement-error distributions, regardless of the shape of the actual distributions. For a discrete envelope model (which is an equivalent form of a paired bound), the ability to ensure integrity for arbitrary error distributions is critical, particularly for accommodation of non-Gaussian distributions, such as heavy-tail distributions that occur for some GNSS measurements [7]-[9]. Discrete envelopes also make it easy to model measurement biases [10]. The major limitation of discrete envelopes is that they apply only to sets of independent distributions. In fact,
correlated errors are important in some integrity applications [11]-[12]. It may be possible in the future, however, to extend the proposed work to correlated distributions, since dependent discrete envelope models are the subject of continuing research [13]. The remainder of the paper describes a discrete-envelope approach tailored for navigation integrity applications, called the NavDEN. The structure of the NavDEN model is described in the next section, followed by sections that discuss (1) experimental model validation, (2) efficient communication, and (3) computation of a position-error bound. Subsequently, error bounds for the NavDEN distribution are compared to more conventional error bounds, which assume a Gaussian error model. A final section summarizes significant results. NAVDEN, A DISCRETE ERROR MODEL FOR INTEGRITY APPLICATIONS Though small and moderate GNSS ranging errors are well described by Gaussian distributions, large errors may occur with non-Gaussian probability [14]. In some case large errors are absent altogether (truncated distribution tails). In other cases large errors occur with higher than Gaussian probability (heavy distribution tails). To reflect these characteristics of GNSS error distributions, the NavDEN approach uses a discrete distribution model in place of a continuous Gaussian representation. The discrete model is approximately Gaussian at its core but flares in its tails to enable bounding both of truncated and of heavy-tail distributions. The shape of the NavDEN CDF model is illustrated in Figure 2. In the figure, probability is mapped to Gaussian coordinates, such that a Gaussian CDF is a straight line. This transform converts a conventional CDF P(x) to a Gaussian-Quantile form G(x) by mapping through the inverse of the Gaussian cumulative distribution Q(x).
Gaussian CDF NavDENV Model
10
CDF
5
G ( x) = Q −1 ( P( x) )
(1)
As illustrated by the figure, salient features of the NavDEN distribution include the following. • • • •
The envelopes distribution is symmetric. Envelope edges fall on a regularly spaced grid, at integer multiples of a baseline spacing ∆. Envelope widths are not uniform, with width increasing toward the distribution tails. Probability is not distributed uniformly among the envelopes.
Subsequent sections exploit these properties. NavDEN symmetry and grid spacing ∆, for example, are essential for efficient computation of a positioning-error bound. The NavDEN model consists of three regions: a flared tail describing large negative errors, an approximately Gaussian core, and a second flared tail describing large positive errors. These regions (K1, K2, and K3 respectively) each correspond to a subset of envelopes identified by the integer index k.
K1 = K2 = K= 3
{k ∈ [ −k , −k )} {k ∈ [ −k , k ]} {k ∈ ( k , k ]} tr
max tr
tr
tr
(2)
max
Here kmax is the largest positive index for the NavDEN, and ktr is the index that demarcates the positive edge of the Gaussian core. The shape of the NavDEN model is defined by a set of six additional parameters. The most important parameter is the fundamental grid spacing ∆, which determines the resolution of the NavDEN model. Four additional parameters determine the shape of the flared regions which bound large errors. As shown in the figure, the inside edges of the NavDEN converges toward a vertical asymptote while the outer edges converge toward a horizontal asymptote. The asymptote parameters are xmax (vertical asymptote) and Gmax (horizontal asymptote). The vertical asymptote allows the NavDEN to accommodate truncated distributions, and the horizontal asymptote, to accommodate heavy-tail distributions.
0
-5
-10
-10
-5
0 Error x/σ
5
10
Figure 2. The NavDEN model plotted on Gaussian quartile axes.
The NavDEN distribution does not transition abruptly from the Gaussian-like core to the horizontal and vertical asymptotes of the flared tail. Rather, the transition is somewhat curved. Two flare parameters, B and C, determine the rate of curvature in this transition. The first of these, B, governs the inner edges of the NavDEN (which transition to vertical asymptotes), while the second, C, governs the outer edges of the NavDEN (which transition to horizontal asymptotes).
Finally, the left and right bounds are shifted away from each other to provide robustness to sampled data uncertainty and to account for bounding mildly biased, asymmetric and multimodal distributions [5]. The magnitude of the shift, normalized by the fundamental spacing, is labeled kbias. In fact, since all the parameters that define the NavDEN have the same units, it is convenient to normalize them by the fundamental spacing. Normalized parameters are denoted by a tilde notation x , G , C , B , which
(
max
)
max
indicates that a parameters has been normalized by the fundamental spacing ∆. To define the shape of the Gaussian core and the flared tails, a NavDEN left bound lk is computed as follows.
k + ktr floor C ln 1 + 2 − ktr − kbias , k ∈ K1 Gmax − ktr lk = k − kbias , k ∈ K 2 (3) floor x − x − k + k ( max tr bias ) e2( ktr − k ) / B , k ∈ K3 max
(
product of a weighting factor Si and the raw measurement standard deviation σi. For this reason, it is useful to set the fundamental spacing as proportional to the product of these terms: Siσi. The probabilities pk associated with each envelope are obtained by integrating a Gaussian distribution between transition points, and extending the first and last intervals to negative and positive infinity.
Φ ( mk ) k= −kmax pk = Φ ( mk ) − Φ ( mk −1 ) −kmax < k < kmax (6) 1− Φ (m ) k = kmax k −1 By summing over all envelopes, it is trivial to show that this set of probabilities sums to unity. Table 1 summarizes a representative set of NavDEN parameters (those used to generate Figure 2). All but one of the parameters listed in the table can be specified independently. The exception is the normalized horizontal asymptote G max , which is defined in terms of kmax and ktr as follows.
)
2kmax − ktr G = max
(7)
Table 1: Representative NavDEN Parameters These terms were chosen to transition continuously from a Gaussian core, through a curved tail region, toward asymptotes at desired coordinates. The “floor” operator ensures regular spacing by rounding edges conservatively outward to the nearest integer multiple of ∆. The distribution of envelopes is symmetric about the origin. The normalized right-bound edges r can thus be obtained by mirroring the normalized left-bound edges about the origin (k = 0).
rk = −l− k
(4)
To complete the NavDEN, probability assignments for each envelope are required. Because the NavDEN model is a modified Gaussian, it is convenient to assign the envelope probabilities using a Gaussian CDF. The approach used here breaks the Gaussian CDF into a number of non-overlapping regions. Transition points mk, between subsequent envelopes are defined in the region of overlap (between the right edge rk of one envelope and the left edge lk+1 of the next).
mk=
1 2
( r + l ) S∆σ k
, −kmax ≤ k < kmax
i
k +1
i
(5)
i
Significantly, the probability between each pair of transition points depends on the standard deviation of the core distribution, which for the ith measurement is the
Parameter
Value
∆ i / ( Siσ i )
0.5
xmax
10
G max - see eq. (5)
16
B C
10
ktr
6
kmax
11
kbias
1
4
EXPERIMENTAL VALIDATION OF A NAVDEN A major advantage of NavDEN distributions is that they provide a robust framework for empirical validation. In particular, the discrete nature of the NavDEN means that bound validity can be assessed through a small number of ad hoc tests. Each unique right and left envelope bound must be checked. The total number of validation tests is approximately twice the number of envelopes. The shift between the left and right bounds, moreover, reduces sensitivity to sampling noise, which can otherwise plague validation of highly resolved overbounds [15].
Importantly, the NavDEN’s flared extremes help it tolerate a wide range of uncertainty in characterizing the distribution tails. As an example, the NavDEN can be used to model heavy distribution tails, either observed empirically or assumed conservatively in the absence of experimental data. (Given a relatively small sample population of error values, a Weibull or an exponential distribution might be assumed as a model for the far distribution tail.) The NavDEN can also bound truncated distribution tails, which end abruptly. The capability to bound both heavy and truncated tails is controlled by only a few tail flare parameters (see Table 1). Consequently, it is even conceivable that these tail parameters might be adapted over time, as a progressively larger population of validation data becomes available. For instance, the B and C parameters might initially be set to conservative values resulting in heavy flare; these parameters might be progressively relaxed, mitigating tail flare to better reflect sampled data. The NavDEN distribution promotes a simple, streamlined validation process. This process begins with the collection of measurement error samples, computed by comparing GPS measurements to a more accurate “ground truth.” The population of C samples is subsequently organized into a histogram, for which the bin edges align with the edges of a proposed NavDEN distribution. As new data points become available, they can be sorted continually into the same set of histogram bins. The NavDEN is a conservative representation of the data as long the probability in the tails of the histogram is less than or equal to the probability in the tails of the NavDEN (subject to sampling uncertainty). Where the data set is large enough to make sampling uncertainty negligible (e.g. for all but the histogram bins containing the outermost several hundred samples), the following
Required Validation Tests Range of Allowed Values Nominal Gaussian Histogram
6 4 2 CDF
A first set of test checks each left bound. In these tests, the notation H(x < X) refers to a cumulative histogram, which sums all samples up to a particular error value X.
H ( x < lk ) ≤ C
k −1
∑
i = − ktr
pi
(8)
The accumulated probability to the left of each left bound must be smaller for the empirical distribution than for the NavDEN model. After this first test is used to validate “left” bounds, a subsequent set of tests is used to validate “right” bounds (i.e., the right bounds for each envelope).
H ( x ≤ rk ) ≥ C
k
∑
i = − ktr
pi
(9)
It is significant to note that the right edge of any envelope should not be coincident with the left edge of the subsequent envelope. Were these two edges coincident, such that lk were equal rk-1, then (8) and (9) could only be mutually satisfied for a single, precise value of the histogram:
H= ( rk −1 ) H= ( lk ) C
k −1
∑
i = − ktr
pi .
(10)
It is for this reason that the NavDEN model (illustrated in Figure 2) is defined with overlapping envelopes (in contrast with the earlier discrete envelope example shown in Figure 1). Overlapping bounds allow for both sampling uncertainty in the tails and in estimating distribution parameters (like the mean and standard deviation of the distribution core). The full suite of validation tests for the baseline NavDEN distribution is illustrated in Figure 3. Each circle represents a constraint imposed either by an right bound or a left bound. Accumulated histogram values must lie along the dashed vertical lines. The dashed lines are longest where discrete envelope widths are large compared to the spacing between adjacent envelopes (indicating a large degree of overlap).
10 8
tests can be applied to validate the left and right bounds of the discrete envelopes in the NavDEN distribution.
0 -2
EFFICIENT COMMUNICATION
-4 -6 -8 -10
-10
-8
-6
-4
-2
0 Error x/σ
2
4
6
8
10
Figure 3. To validate the NavDEN model, the data histogram must fall in the range indicated by the vertical dashed lines.
The NavDEN structure permits the broadcast of concise error models via a limited bandwidth communication channel. At its heart, the NavDEN is an approximately Gaussian error distribution. In both the case of a conventional Gaussian and the case of a NavDEN, the major parameter that governs distribution shape is a scaling parameter. This scaling parameter is the standard deviation Siσi for a weighted Gaussian distribution and
the fundamental spacing ∆i for a NavDEN. It is convenient to define the fundamental spacing for a NavDEN as directly proportional to the standard deviation of the Gaussian distribution which the NavDEN approximates. It is for this reason that the fundamental spacing parameter is defined proportional to Siσi (see Table 1). If the NavDEN parameters of Table 1 are known to all users, then only one variable need be broadcast on-the-fly to completely describe each measurement error distribution. This parameter is σi, the standard deviation of the Gaussian core for the ith measurement distribution. (The weighting parameter Si is determined by the user.) In this sense, the broadcast requirement is identical for either a Gaussian or a NavDEN overbound. In fact, no change would be needed to the message types for existing navigation integrity systems, like WAAS or LAAS, to implement a NavDEN approach [16]-[17]. The compatibility of NavDEN error models with standard message definitions is a significant benefit. To preserve a degree of flexibility during certification, it is recommended that the complete set of NavDEN parameters be broadcast via a new low-rate message (once every several minutes); however, it would also be possible to hard-code distribution parameters into user avionics to avoid any requirement for a new message type. COMPUTING PROTECTION LEVEL To obtain an error bound based on a set of measurements modeled by NavDEN distributions requires that a series of discrete convolutions be computed. To minimize the computational costs, the resolution of the NavDEN distribution must be as coarse as possible. A common means for checking integrity on-the-fly is to evaluate a protection level (PL), which is the smallest error magnitude beyond which the cumulative error probability is less than or equal to the risk specification [18]. Since position error varies in time as the geometry of observed GNSS satellites changes, users must evaluate integrity risk on-the-fly. The protection level can be compared to an alert limit (AL), the maximum allowable error for a safety-critical operation. So long as the PL does not exceed the AL, the user may conduct the desired operation with an integrity guarantee. Typically, errors are modeled as Gaussian. For a purely Gaussian position-error distribution, the PL can be computed by inverting the unit-variance Gaussian cumulative distribution function Q (at a specified risk Rint) and scaling by the position-error standard deviation in a particular axis σp. For aviation applications, the integrity
risk specification is generally very small. Representative values are on the order of 10-9.
PL = Q −1 ( Rint ) σ p
(11)
For GNSS position solutions, the error Ep along a particular axis is a linear combination of ranging measurement errors Ei, each weighted by a geometric scaling factor Si for a particular satellite i [19]. N
E p = ∑ Si Ei
(12)
i =1
For measurement errors that are Gaussian (with standard deviations σi), the position-error standard deviation σp is:
σp =
N
∑S σ i =1
2 i
2 i
.
(13)
PL equations of the form of (11) are used commonly in integrity applications. This PL equation is advantageous in that it is closed-form and computationally efficient to evaluate; however, the equation only applies to distributions that are well represented (or rigorously overbounded) by a Gaussian distribution. By comparison, a protection level is somewhat more complicated to evaluate for the case of distributions of arbitrary tail shape, such as those that the NavDEN model is designed to bound. For these cases, it is necessary to employ a numerical algorithm to compute the PL. As long as measurement error distributions are independent, this numerical algorithm can be implemented as a series of discrete convolutions. To compute discrete convolution efficiently, it is essential that a uniform and consistent grid spacing be used for each pair of distribution being convolved. Accordingly, satellite error distributions must be resampled. Resampling is required because the fundamental spacing ∆ is different from satellite to satellite. As stated in the previous section, the “width” of each distribution is proportional to the standard deviation of the distribution core σi multiplied by a geometric weighting factor Si. The relationship between the fundamental spacing, the standard deviation of the distribution-core, and the geometric weighting factor is a basic parameter that defines a NavDEN. In the baseline NavDEN distribution, described in Table 1, the fundamental spacing ∆i is set to a value of 0.5 Siσ i . Of the two convolved NavDEN distributions, it is recommended that only the narrower be resampled. Downsampling the narrower distribution (the one with the smaller fundamental spacing ∆i) maintains or reduces its number of discrete envelopes. Thus, downsampling the
narrower distribution ensures that convolution can be computed in bounded time. By comparison, upsampling the wider distribution (to a uniform grid based on the smaller fundamental spacing) might result in an arbitrarily large number of new discrete envelopes. Consequently, when upsampling the wider distribution, the time required to compute the discrete convolution is unbounded.
This distribution is not itself symmetric about the origin; however, the distribution of right and left envelope edges is reflected about the origin, so the right bound pk is a
To maintain conservatism during downsampling, envelope right bounds must be rounded upwards (a ceiling operation) and left bounds must be rounded downwards (a floor operation). This method of downsampling ensures that formal left and right CDFbounds can be constructed, as needed to ensure integrity using the paired bounding theorem [5]. For the narrower distribution, the downsampled right and left envelope bounds, rk and lk , can be computed from the original right and left bounds (rk and lk), using the fundamental spacing of the wider distribution, ∆W.
Because of this one-to-one relationship between the left and right bounds, only one of the two needs to be computed to define a PL.
u = rk ceiling k ∆W ∆W l = lk floor k ∆W ∆W
(14)
The probability at each point on the resampling grid is assigned using the new envelope boundaries. At some points on the resampling grid, the assigned probability may be zero if no right or left envelope edge was mapped to that grid point. In other cases, multiple right (or left) envelope edges may align with the same grid point. In these cases, the total probability at that grid point is summed over all associated envelopes. To be more precise, a pair of discrete bounds are defined for each convolution input. One of these distributions is a left bound (with envelope probability shifted as far to the left as possible, to the left bound lk ) and the other is a right bound (with envelope probability shifted as far to the right as possible, to the right bound rk ). Applying the paired bounding theorem, the two left bounds should be convolved together to generate a conservative left bound for the output distribution. Correspondingly, the two right bounds should be convolved to generate a conservative right bound for the output. This convolution has the following form for the left-bound case. Here the left bounds for the narrow and wide distributions are labeled p N , k and pW , k , respectively, and the output distribution is labeled p k . The set of all envelope indices in the wider distribution is labeled L.
p k = ∑ p N , k − l pW , l l ∈L
(15)
reflection about the origin of the left bound p k .
p k = p− k
(16)
To compute a PL (based on the left-bound distributions for each measurement), discrete convolutions are repeated until each of the N satellite errors is factored into the position-error distribution (along a particular axis). Thus, N-1 discrete convolutions are required to compute the PL. Each convolution calls for resampling, and each resampling introduces mild additional conservatism. In resampling, the degree of overconservatism is larger when envelope edges are shifted farther. To keep these shifts small, it is recommended that each successive convolution involve the narrowest remaining distribution (with the smallest fundamental spacing). This algorithm is summarized below in Table 2.
Table 2: Algorithm to Obtain Position-Error Distribution for Multiple Independent Measurements 1.
Sort NavDEN models for all measurements and assign an index i corresponding to the order of ascending fundamental spacing ∆i.
2.
Assign the left bound for the ith NavDEN to a (i ) distribution f k .
3.
Initialize the position-error left-bound setting p k =
4.
(1)
p k by
fk .
For each index i (greater than one): a. Downsample
p k to the next fundamental
spacing ∆i. b. Update
pk
by convolving it with the
measurement error distribution
= pk
∑ l ∈L
(i )
f l ⋅ pk − l
(i )
fk:
A PL can be computed from the final convolved distribution. The PL corresponds to the grid point beyond which the total integrated probability is no more than the integrity risk allotment for the distribution tail, Rint. For a position error distribution p v , k this grid point is k*:
k * max k =
∑p i
i
≤ Rint .
(17)
This dimensionless index can be converted to a PL when multiplied by ∆max, the fundamental spacing of the final distribution (and also of the widest individual measurement error distribution).
PL = ∆ max k *
(18)
The absolute value operator accounts for the fact that the index k* is generally a negative integer (on the left side of the origin), but that the PL is always reported as positive. EFFECT OF MULTIPLE CONVOLUTIONS One of the NavDEN’s important features is that its tail flair diminishes with repeated convolutions. This analytical result could be anticipated as a consequence of the central limit theorem, which states that most probability distributions become increasingly Gaussian
when repeatedly convolved with themselves. Figure 4 provides an illustration of the NavDEN’s convergence toward a Gaussian distribution following repeated convolutions. The left side of the figure depicts a baseline NavDEN distribution; the right-hand side depicts the result of convolving together ten independent, identical distributions (IIDs). In both cases, the NavDEN cumulative distribution functions are plotted using Gaussian quartile scaling, in which Gaussian distributions appear as straight lines. The nearly straight right and left bounds illustrated in Figure 4(b) are clearly indicative that repeated convolutions result in a pair of distributions that are very nearly Gaussian. These nearly straight paired bounds stand in stark contrast to the original NavDEN distribution, illustrated in Figure 4(a). That heavy-tail distributions become increasingly Gaussian with repeated convolutions is a potential benefit, one that can only be realized by introducing a nonGaussian overbound. By default, the standard deviation for the NavDEN core is set to match the accuracy of nominal measurement data. In computing a PL involving multiple NavDENs, the heavy-tails become less pronounced, and the PL approaches the value which would be computed considering accuracy, alone. By contrast, if conventional Gaussians are inflated to bound heavy tails [20], this inflation remains at a constant level, unmitigated by repeated convolutions. A
10
10 Bound Allowed Risk Gaussian PL
8
6
6
4
4
2
2
CDF
CDF
8
0
0
-2
-2
-4
-4
-6
-6
(a)
-8
-10
-10
-8
-6
-4
-2
2 0 Error x/σ
4
6
8
(b)
-8
10
-10
-10
-8
-6
-4
-2
2 0 Error x/σ
4
6
8
10
Figure 4. Assessing a protection level using the NavDEN model for (a) the case of one measurement and (b) the case of ten identical, independent NavDEN distributions
conventional Gaussian error bound thus fails to capture the benefits of repeated convolutions. When using a NavDEN distribution, the benefits of heavy-tail mitigation with repeated convolutions are partially offset by the inherent shift between the left and right NavDEN edges. The left and right bound edges were intentionally offset to ensures tolerance for sampling errors and for uncertainty in distribution shape (see Figure 3). In exchange for these benefits, the offset increases PL and potentially decreases availability. The opposing benefits of heavy-tail mitigation and liabilities of bias accumulation can be observed in Figure 4. To be more quantitative, biases accumulate linearly when distributions are convolved. In other words, if a single distribution is offset by a bias b, then the convolution of N IIDs results in a bias equal to Nb. By comparison distribution standard deviation generally grows less rapidly (as the square root of N for Gaussian convolutions, for instance). A formula for the PL for N biased Gaussian IIDs can be obtained analytically, as follows, given that each Gaussian IID has a bias b and a standard deviation σ [5].
PL Q −1 ( Rint ) N σ + Nb =
(19)
As N grows, the bias term of this PL equation becomes increasingly dominant. To some degree, this effect counteracts the decreased inflation that occurs for NavDENs as repeated convolutions mitigate heavy tails. This tradeoff is illustrated in Figure 5. The figure assesses protection level “inflation” as a function of the number of times that a NavDEN is convolved with itself. In order to minimize grid discretization effects (described in the next section), the number of discrete envelopes was
1.5
increased above that of the baseline NavDEN illustrated in Figure 1. Specifically, the number of envelopes was set to 177, eight times the baseline number. A PL ratio was defined to quantify the simultaneous impact of biases and heavy tails. The ratio compares the PL for the NavDEN, given by equation (18), to the PL for a zero-mean Gaussian distribution with the same core sigma, given by equation (11).
ξ=
(20)
As shown in Figure 5, the ratio is large when the number of convolved distributions is small (at the left side of the plot). This indicates that heavy-tail effects are extremely important when only one measurement error dominates the position error. At this side of the plot, the size of the PL for the heavy-tail case is 1.2 to 1.4 times larger than the PL for the Gaussian-tail case (over six orders of magnitude variation in the allocated integrity risk from 10-6 to 10-12). For progressively higher numbers of convolutions, the PL ratio first dips (due to heavy tail mitigation) and then increases again (due to uncertain biases). For reference, a second ratio ξref is introduced to illustrate the role of biases alone (in the absence of heavy tails). This second ratio compares the PL in the absence of heavy tails, as described by (19), to the PL for an unbiased Gaussian, as described by (11). This reference ratio is plotted as a set of gray dashed lines in Figure 5 (one line for each integrity risk level).
ξ ref =
1.35
Q −1 ( Rint ) N σ
This ratio was computed for several levels of allocated integrity risk: 10-6, 10-9, and 10-12. In each case, the normalizing PL was computed assuming that half of the allocation was dedicated to each distribution tail. (That is Rint was set equal to 5⋅10-7, 5⋅10-10, and 5⋅10-13).
1.45 1.4
∆ max k *
Q −1 ( Rint ) N σ + Nb Q −1 ( Rint ) N σ
(21)
PL Ratio
1.3
The NavDEN PL converges to the biased-Gaussian PL as the number of convolved IIDs becomes large. This trend emphasizes the decreased significance of heavy tails and the increased significance of the shift between the left and right bounds when the number of convolved IIDs is large.
1.25 1.2 1.15 1.1 1e-006 1e-009 1e-012
1.05 1
0
2
4
6
8 10 12 Number of Distributions
14
16
18
20
Figure 5. PL Ratio (for NavDEN as compared to Gaussian of same sigma) for various allocations of integrity risk
EFFECT OF GRID RESOLUTION Whereas the NavDEN intentionally introduces inflation to bound heavy tails and statistical uncertainty, the NavDEN also introduces an unintentional inflation source: inflation due to grid resolution. The discrete nature of the NavDEN distribution is both its advantage and its
disadvantage. A coarse grid with fewer discrete envelopes promotes efficient communication, reduces the computational costs for convolution, and reduces the number of tests required to validate the overbound. However, a coarser grid is limited by the conservative assumption that all probability in a given discrete envelope must, in the worst case, be assumed to lie at either envelope edge. When grid resolution is low, and discrete envelopes are wide, this worst case condition substantially differs from the “tight” bound provided by a higher resolution NavDEN. A grid resolution study was performed to determine the sensitivity of the PL to the number of envelopes in the NavDEN. The baseline NavDEN distribution (defined by the parameters in Table 1 and illustrated in Figure 2) has 23 envelopes. Three other cases were also generated by successively doubling the grid resolution, through a “2x” case (with 45 envelopes), a “4x” case (with 89 envelopes) and an “8x” case (with 177 envelopes). For each grid resolutions, the PL ratio was computed from equation (20) and the results were plotted in Figure 6. The integrity allocation was held constant (at 10-9). The grid resolution of the baseline distribution is intentionally low, to simplify validation and to enhance PL computation efficiency. However, significant excess inflation is the consequence of low resolution. With enhanced resolution, as illustrated in Figure 6, this excess inflation quickly disappears. The vast majority of excess inflation is eliminated by doubling the grid resolution (from “1x” to “2x”). Further resolution doubling has a relatively minor impact on excess inflation. It can be inferred that the highest resolution case considered (the “8x” case) is very nearly converged to the continuum result. Convergence is evidenced by the proximity of the convolved NavDEN PL ratio curve (ξ) to the biased1.5 1.45
PL Ratio at 10-9 integrity risk
1.4 1x 1.35 1.3 2x
1.25 4x 1.2 8x 1.15 1.1
Baseline Resolution Increased Resolution Gaussian Reference
1.05 1
0
2
4
6
8 10 12 Number of Distributions
14
16
18
20
Figure 6. PL Ratio (for NavDEN as compared to Gaussian of same sigma) for various allocations of grid resolution
Gaussian PL ratio curve (ξref), given by equation 21, toward the right side of the figure. Since the availability of GPS navigation often depends on establishing a tight integrity bound, with minimal excess inflation, the “2x” grid resolution (with 45 envelopes) is the minimum recommend resolution for a NavDEN. A topic for future work will be enhancing the computational efficiency of computing a PL using NavDEN models for the measurement error. Computing the PL for a NavDEN distribution requires multiple discrete convolutions, operations which are somewhat processor intensive for aviation applications. Even at moderate grid resolution (e.g. “2x” grid), processing is significantly greater than that required to compute a PL from a set of Gaussian measurement-error sigma values. To be precise, because each convolution operation requires approximately M2 operations (where M is the number of envelopes in the distribution), the total processing time to implement a NavDEN PL is approximately M2 larger than the time to compute a conventional PL from Gaussian error distributions. SUMMARY AND CONCLUSIONS A discrete error model, called the NavDEN, was introduced to overbound GNSS positioning error distributions, which are not necessarily Gaussian. Whereas the NavDEN is essentially Gaussian in its core, the distribution flares dramatically in its tails to bound empirically observed error data. The structure of the NavDEN distribution is based on the notion of discrete probability envelopes. Overlapping discrete envelopes are used to allow for sampling uncertainty in defining error bounds from actual data. The NavDEN is customized for use in typical GNSS applications. The discrete structure of the NavDEN streamlines empirical validation of paired overbounds. The NavDEN also promotes efficient communication over band-limited channels, such as those common in GNSS augmentation systems. More specifically, the scale of the NavDEN is based on a single broadcast parameter (a sigma value that represents the approximate standard deviation for the distribution core). The relatively coarse discretization of the NavDEN promotes efficient convolutions, which are needed to compute PLs for position error. Such processing is still significantly more computationally intensive, however, than computing PLs using more convention overbounds based on Gaussian distributions. Faster methods for constructing PLs will be considered in the future. A significant contrast between the NavDEN distribution and a conventional Gaussian overbound is the treatment of inflation for cases of statistical uncertainty and for
uncertain distribution tails. Inflation factors for the NavDEN distribution were shown to be a function of the number of NavDEN distributions contributing to the total positioning error. When one (or a small handful) of measurements dominate the positioning error, then the NavDEN distribution captures the large inflation required for heavy tail bounding. By contrast, when no individual measurements dominate the positioning error, the level of NavDEN inflation decreases, since the convolution process mitigates the heavy-tail bounding process. Also, the NavDEN captures the impact of uncertain biases on inflation, an effect which will become increasingly important for position solutions involving a large number of satellite measurements. REFERENCES [1] Williamson, R.C., and Downs, T, Probabilistic Arithmetic. I. Numerical Methods for Calculating Convolution and Dependency Bounds, International Journal of Approximate Reasoning, 1990, Vol. 4, No. 2, pp. 89-158. [2] Tonon, F., Bernardini, A., and Mammino, A., Reliability Analysis of Rock Mass Response by means of random set theory, Reliability Engineering & System Safety, 2000, Vol. 70, No. 3, pp. 263-282. [3] Berleant, D., Xie, L., Zhang, J., Statool: A tool for distribution envelope determination (DEnv), an interval-based algorithm for arithmetic on random variables, Reliable Computing, 2003, Vol. 9, No. 2, pp. 1385-3139. [4] DeCleene, B., Defining Pseudorange Integrity – Overbounding, Proceedings of the ION-GPS, 2000, pp. 1916-1924. [5] Rife, J., Pullen, S., Pervan, B., and Enge, P., Paired Overbounding for Nonideal LAAS and WAAS Error Distributions, IEEE Transactions on Aerospace and Electronic Systems, 2006, Vol. 42, No. 4, pp. 13861395. [6] Pervan, B., and Sayim, I., Sigma Inflation for the Local Area Augmentation of GPS, IEEE Transactions on Aerospace and Electronic Systems, 2001, Vol. 37, No. 4, pp. 1301-1311. [7] Braff, R., and Shively, C., A method of over bounding Ground Based Augmentation System (GBAS) heavy tail error distributions, Journal of Navigation, 2005, Vol. 58, No. 1, pp. 83-103. [8] Lee, J., LAAS Position Domain Monitor Analysis and Test Results for CAT II/III Operations, Proceedings of the Institute of Navigation’s IONGNSS, 2004, pp. 2787-2796. [9] Rife, J., Pullen, S., and Pervan, B., Core Overbounding and its Implications for LAAS
Integrity, Proceedings of the ION-GNSS, 2004, pp. 2810-2821. [10] Walter, T., Blanch, J., and Rife, J., Treatment of Biased Error Distributions in SBAS, Journal of Global Positioning Systems, 2004, Vol. 3, No. 1-2, pp. 265-272. [11] Raytheon. Algorithm Contribution to HMI for the Wide Area Augmentation System, Raytheon Company Unpublished Work, 2002. [12] Rife, J., and Gebre-Egziabher, D., Symmetric Overbounding of Correlated Errors. NAVIGATION, the Journal of the Institute of Navigation, 2007, Vol. 54, No. 2, pp. 109-124. [13] Berleant, D. and Zhang, J., Using Pearson Correlation to Improve Envelopes around the Distributions of Functions, Reliable Computing, 2004, Vol. 10, No. 2, pp. 1385-3139. [14] Warburton, J., LGF Sigma Pseudorange Ground Establishment, Overbounding and Monitoring: Support Data, Presented by the FAA William J. Hughes Technical Center to RTCA SC-159, 2002. [15] Rife, J., Walter, T., and Blanch, J., Overbounding SBAS and GBAS Error Distributions with ExcessMass Functions, Proc. IGNSS, Sydney, Australia, Dec. 6-8, 2004. [16] RTCA Inc., Minimum Operational Performance Standards for GPS/Wide Area Augmentation System Airborne Equipment, RTCA/DO-229D, 2006. [17] RTCA Inc., GNSS-Based Precision Approach Local Area Augmentation System (LAAS) Signal-in-Space Interface Control Document (ICD), RTCA/DO246B, 2001. [18] Rife, J., and Pullen, S., Aviation applications, GNSS Applications and Methods, S. Gleason and D. Gebre-Egziabher, Eds., Artech House (in press). [19] Misra, P., and Enge, P., Global Position System: Signals, Measurements, and Performance. Ganga-Jamuna Press, 2006. [20] Xie, G., Pullen, S., Luo, M., Normark, P-L., Akos, D., Lee, J., and Enge, P. Integrity design and updated test results for the Stanford LAAS integrity monitor testbed, Proc. of ION Annual Meeting, 2001, pp. 681-693.
