operation has begun.  It is possible that integrity and continuity may have different

levels of acceptable risk.  In general, integrity faults are not obvious to the flight

crew and do not give an opportunity to mitigate the situation.  In contrast, loss of

the navigation function is usually obvious to the flight crew, causing a heightened

awareness and an opportunity to resort to alternate procedures.  It is likely that the

availability parameter will apply to the signals provided by the navaid infrastructure

rather than the airborne equipment.  It is assumed that the aircraft will not be

dispatched unless the proper navigation equipment is available.  Once the aircraft

is airborne, the continuity requirement supersedes any availability requirement for

the navigation equipment since the availability concept assumes the possibility of

repair, which is generally not feasible in flight.

12.4.3  Integrity Assurance

The two primary approaches to assuring GPS integrity are autonomous integrity

monitoring (AIM) and broadcast integrity messages (BIM).  AIM, as the name

implies, consists of analyses that the receiver or navigation system can perform

autonomously or in conjunction with existing on board navigation aids.  Algorithms

executed by the receiver are often called RAIM (Receiver AIM) and algorithms

executed elsewhere in the aircraft are often called AAIM (Aircraft AIM).  In the

general sense, a Kalman filter is a form of AIM since it can detect and neglect

certain types of anomalous measurements, however, it can fail to detect slow drift 

type integrity failures.  One common AIM technique relies on the principle that the

receiver can in most cases detect and isolate a satellite signal failure that impacts

integrity, if it has an overdetermined position solution.  For example, if five satellite

signals are available, five position solutions can be obtained using combinations of

four satellites. In the event of a large pseudorange error in one satellite, the four

solutions based on the faulty satellite will be similar to each other and significantly

different from the fifth.  In this case, the error can be easily detected and isolated. 

Much attention has been given to this subject by various researchers to evaluate

and enhance the effectiveness of this technique. Similar techniques can be used to

detect integrity failures using other sources of range or position information.  Many

of these techniques have been discussed in open literature, particularly in the

papers of the various technical societies associated with navigation as well as the

RTCA and EUROCAE.

The focus of recent AIM research has been primarily to enhance the availability of

the integrity decision and enhance the probability of continuing with navigation after

a fault has been detected.  The primary methods of improving the availability of the

integrity decision are to incorporate measurements from additional navigation

sensors or to reduce the receiver  mask angle to obtain more satellite

measurements.  The primary methods of improving the probability of navigation

after detection are termed fault "isolation", fault "exclusion", and "partial

identification".  Fault isolation requires identifying the satellite which is

broadcasting a faulty signal in order to remove it from the navigation solution. Fault

exclusion is a slightly different technique which requires only that an offending

satellite be excluded from the navigation solution when it is difficult to determine

which of several satellites is faulty.  Partial identification is a hybrid of the two

12 6