Using Outage History to Exclude High-RiskSatellites from GBAS Corrections

SAM PULLEN and PER ENGEStanford University

Received March 2012; Revised May 2012

ABSTRACT: GNSS augmentation systems that provide integrity guarantees to users typically assume that all GNSSsatellites have the same failure probability. The assumed failure probability is conservative such that variations amongsatellites in a givenGNSS constellation are not expected to violate this assumption. A study of unscheduledGPS satelliteoutages from 1999 to 2011 shows that, as expected, older satellites are much more likely to fail than younger ones. Inaddition, satellites that have recently experienced unscheduled outages are more likely to suffer additional unscheduledoutages. Combining these two factors suggests that it is possible for a subset of GPS satellites to violate the overallsatellite failure probability assumption, although this has not yet been demonstrated. Potential rules for GPS satelliteexclusion based upon satellite age and recent outages are investigated, and suggestions for including satellite geometryare explored. Copyright # 2012 Institute of Navigation.

INTRODUCTION

GNSS applications with demanding requirementsfor real-time integrity verification must make a seriesof assumptions regarding the performance of thesatellite constellation(s) that they are using. One keyassumption is the probability of unexpected satelliteoutages or failures. Integrity monitors that operatedirectly on standalone (uncorrected) GNSS mea-surements, such as Receiver Autonomous IntegrityMonitoring (RAIM), aswell as systems that provide dif-ferential corrections such as Space Based and GroundBased Augmentation Systems (SBAS and GBAS,respectively), rely on this assumption to determinethe false-alert and missed-detection probabilities thattheir integrity monitor algorithms must achieve.

Regarding satellite failures, two different probabil-ities are important. One is the probability of anyunexpected satellite outage, which makes the affectedsatellite unusable and thus affects continuity. Theother is the probability of events that pose a potentialintegrity risk to SBAS and GBAS users. These prob-abilities can be represented as rates (e.g., probabilityof outage per satellite per hour) or as state probabil-ities, meaning the long-term average probability thata given satellite is in an “outage” or “failed” state.

For the purposes of verifying that integrity andcontinuity requirements are met, the systems men-tioned above assume that all satellites have the same

probability of outage or integrity failure. This assump-tion is made for simplicity, and the probabilitiesassumed are typically very conservative; thus littleor no risk arises due to potential violations of thisassumption. However, it is known from the historyand planning of GPS satellite operations (and satelliteoperations in general) that older satellites are muchmore likely to fail than younger ones. This was cap-tured earlier in the history of the GPS constellationby former GPS Joint Program Office director, Col.Gaylord Green (USAF, Ret.), who noted that “GPSsatellites are operated to failure.” [1] By this, he meantthat GPS satellites were not retired when they firstbegan experiencing problems or were approaching theend of their expected useful life but instead when theyfailed in a manner that was not recoverable (or wasrecoverable but no longer maintainable). This meansthat older satellites, and those which have recentlyexperienced outages, will generally keep being useddespite their higher propensity for further failures.This paper examines the degree to which unex-

pected GPS satellite outages and failures vary withsatellite age and prior outage history. It uses thearchive of GPS Non-Availability notices to NAVSTARUsers (NANUs) to compile a history of unexpectedsatellite outages from January 1999 to August 2011[2, 3]. These outages are examined to identify the like-lihood of outages as a function of satellite age andrecent outage history. These results show that, asexpected, older satellites are much more likely toexperience outages than younger ones, as are satelliteswith a history of recent outages (in the last year or two).

NAVIGATION: Journal of The Institute of NavigationVol. 60, No. 1, Spring 2013Printed in the U.S.A.

41

While these results do not immediately suggestthat the satellite-fault-probability assumptions madeby GBAS and other systems are violated for specificsatellites, they at least raise the possibility. Toaddress this risk, two potential satellite-exclusionheuristics are examined in terms of their impacton GPS user satellite geometry quality. The needto select a subset of satellites from the full set thatis in view is not new: it was a common need of fourand six-channel GPS receivers in the early 1990’s,when GPS rapidly expanded to a full constellationof 24 satellites by 1993. Since more than six satel-lites were commonly in view, some means wasneeded to down-select the 4 or 6 satellites that weremost worth tracking. Various methods were appliedto do this, including differentiation by satellitequality [4] and selection of the subset that givesthe best satellite geometry in terms of dilution ofprecision (DOP) [5]. Computationally efficient meth-ods for computing DOP and thus finding optimalsatellite subsets are still important [6].Past and present experience can be combined to

infer two general cases where satellite sub-selectionis desirable. In the channel-limited scenario, not allsatellites can be used due to hardware limitations.This includes both receiver limitations and databandwidth constraints for augmentation systemslike GBAS, which can only send differential correc-tions and integrity information for a limited numberof satellites. In the channel-unlimited scenario, hard-ware constraints do not apply, but satellites aredown-selected to remove those with poor perfor-mance or other negative traits. The former scenariois primarily a concern to future systems that makeuse of GPS in combination with other GNSS constel-lations such as GLONASS, Galileo, Compass, and/orQZSS. This paper will mostly consider the latterscenario with the intent of excluding satellites whosefault likelihoods might violate the integrity assump-tions made by GBAS or other high-integrity services.This paper describes the expected GPS satellite

fault probabilities and themore conservative numbersassumed by GBAS. It then provides the results of theunexpected satellite outage study, showing the degreeto which satellite age and number of recent outagesaffect the likelihood of future outages. The paperuses this information to propose example satellite-exclusion heuristics and examine their impacts onGPS-only satellite geometries asmeasured by VerticalDOP at two U.S. user locations. It also explains howthe multiple-hypothesis protection level approachutilized in Advanced RAIM (ARAIM) can be used tomake real-time trade-offs between the integrity riskposed by a weak satellite and the satellite geometrybenefit that it provides. The final section summarizesthis paper and briefly examines the impact that thefuture use of multiple satellite constellations mayhave on satellite exclusion.

EXPECTEDGPSSATELLITEFAULTPROBABILITIES

The primary open source of GPS satellite outageinformation is the latest (2008) GPS StandardPositioning Service (SPS) Performance Standarddocument [7], which gives both historical informationon satellite outage rates and states the minimumperformance requirements that the U.S. Government,the GPS Wing, and the 2nd Space Operations Squa-dron (2 SOPS) hold themselves to in managing andmaintaining the system.

Section 3.5.1 of [7] expresses the SPS Signal-in-Space (SIS) Integrity Standard as a probability of 10-5

per hour or less that the SIS User Range Error (URE)exceeds �4.42 times the upper bound on User RangeAccuracy (URA) corresponding to the URA integerbroadcast by the satellite in question without a warn-ing that prevents use of the affected measurement(this event is called a “major service failure”). Over a32-satellite constellation, which is the maximumnumber of satellites that can be supported in the broad-cast almanac, the above probability implies an averageof three “major service failures” per year [7]. This isconfirmed by doing the reverse calculation as follows:

3 events=yr8766 hrs=yr

132 satellites

¼ 1:07� 10�5events=SV=hr

(1)

When applying this number to a civil system suchas GBAS, it is important to note that “major servicefailures” for SPS do not include all events thatrepresent potential integrity threats to GBAS. GBASseparates potential integrity threats due to satellitefaults into five classes [8]:

• Clock failures (excessive acceleration)• Low signal power• Code-carrier divergence (separate from that

caused by the ionosphere)• C/A-code signal deformation• Navigation data failures (e.g., large ephemeris

errors)

Because the “major service failure” definition doesnot cover these, and because the numbers cited in [7]cannot be taken as guaranteed, GBAS assumes asatellite integrity fault probability of 10-4 per satel-lite per hour instead of 10-5. Furthermore, this prob-ability is assumed for each of the above five failureclasses instead of all five combined [8]. This is veryconservative for fault classes that are known to havebeen observed once at most (e.g., signal deformationand code-carrier divergence). On the other hand, thesame probability is assumed for all usable GPSsatellites regardless of their age or current status.

Section 3.6.1 of [7] specifies a somewhat-differentsatellite outage probability related to continuity ofservice. This is stated as a probability of 0.9998 orgreater over any hour of “. . . Not Losing the SIS SPS

42 Navigation Spring 2013

Availability from a Slot Due to Unscheduled Interrup-tion.” In other words, given that a satellite (occupyingan orbit slot) is healthy and broadcasting usablesignals at the start of a given hour-long period, theprobability of losing usable signals from that slot (orsatellite) is 0.0002 or less. This translates into a lowerbound on theMean Time Between Outages (MTBO) of5000 hours, which is lower than the numbers assumedbyGBASbased on the previously-assessed operationalhistory of GPS satellites (e.g., 9740 hours in [9]). Ingeneral, the CAT I GBAS continuity sub-allocation tosatellite failures is conservative because it allows formany more “critical satellites” than normally occur inavailable satellite geometries (a “critical satellite” isone whose sudden loss would lead to loss of continuityfor the current operation – see [10]).

The probability given in Section 3.6.1 of [7] is directlyrelated to the results in this paper because unexpectedoutages tabulated from NANUs archives cannot beseparated into “outages affecting only continuity” and“outages that potentially threaten integrity” with-out more details. In almost all cases, the set of eventsthat creates integrity risk is a subset of the events thatcause outages. In the case of GPS, the OperationalControl Segment (OCS) detects and excludes (flags as“unhealthy” or triggers a switch to an unusable PRNor to “non-standard C/A code”) practically all faultsof significance within a few hours [7], although itsresponse is not fast enough to meet the time-to-alert

for most applications. The fraction of unexpectedoutages that pose a potential integrity threat is hardto estimate. It is likely to be much less than 1.0,although a significant fraction of unexpected outagesappear to occur from satellite clock anomalies, whichcan threaten civil user integrity if not quickly detected.

UNSCHEDULED OUTAGES OF GPS SATELLITESSINCE 1999

As noted above, the data source for this study ofunscheduled (or unexpected) GPS satellite outages isthe archive of NANUs that were issued at or nearthe time that the outages occurred. Most outages are“scheduled” for orbit and clock maintenance and areindicated by a forecast NANU (to alert users of theupcoming outage) followed by a report of the outageafter it has been completed. Unscheduled outages, ofcourse, are not preceded by any forecast. Two NANUstypically exist for them as well – one alerting that anunscheduled outage has begun and a report on itsduration after it is over and the satellite has beenreturned to service or has been decommissioned.Although the NANU archives cannot be regarded ascomplete or definitive outage records, they are suffi-cient to explore the degree to which satellite outagesare equally spread across the constellation.Table 1 lists the 31 GPS satellites that were

commissioned and healthy as of (approximately)

Table 1—Healthy GPS Satellites as of 20 Sept. 2011

SVN PRN Block Launch Year Launch J-Day Orbit Slot (as of 9/20/11) Age as of 9/20/11 (years)

23 32 IIA 1990 330 E5 20.8124 24 IIA 1991 185 D5 20.2126 26 IIA 1992 188 F5 19.2039 09 IIA 1993 177 A1 18.2335 30 IIA 1993 242 B5 18.0534 04 IIA 1993 299 D4 17.9036 06 IIA 1994 069 C6 17.5333 03 IIA 1996 088 C2 15.4840 10 IIA 1996 198 E6 15.1843 13 IIR 1997 204 F3 14.1638 08 IIA 1997 310 A3 13.8746 11 IIR 1999 280 D2 11.9551 20 IIR 2000 131 E1 11.3644 28 IIR 2000 197 B3 11.1841 14 IIR 2000 314 F1 10.8654 18 IIR 2001 030 E4 10.6456 16 IIR 2003 029 B1-A 8.6445 21 IIR 2003 090 D3 8.4747 22 IIR 2003 355 E2 7.7559 19 IIR 2004 080 C3 7.5060 23 IIR 2004 175 F4 7.2461 02 IIR 2004 311 D1 6.8753 17 IIR-M 2005 269 C4 5.9852 31 IIR-M 2006 268 A2 4.9858 12 IIR-M 2006 321 B4 4.8455 15 IIR-M 2007 290 F2-A 3.9257 29 IIR-M 2007 354 C1 3.7548 07 IIR-M 2008 075 A6 3.5150 05 IIR-M 2009 076 E3 2.5162 25 IIF 2010 148 B2 1.3163 01 IIF 2011 197 D2-A 0.18

43Pullen and Enge: Using History to Exclude High-Risk SatellitesVol. 60, No. 1

20 September 2011. The rows are sorted by age, andthe first two rows are highlighted to indicate thattwo satellites (Block IIA SVNs 23 and 24) are nowmore than 20 years old. This is quite remarkable con-sidering that the Block IIA satellites had a design lifeof only 7.5 years, and it illustrates the truth of Col.Green’s claim in the Introduction. The two high-lighted satellites (among others now retired) werenot only “operated to failure,” but they were broughtback into active service after previously being decom-missioned (and retired) due to end-of-life failures ofother satellites.Figure 1 plots the ages of the satellites in Table 1

from newest to oldest (in blue) and shows a linearfit to these points (in red). This plot shows that thecurrent age distribution among the GPS satellitesis close to uniform, meaning that older and newersatellites are present with approximately equal fre-quencies (this appears in the plot as roughly linearfrom newest to oldest). A roughly uniform distribu-tion with age is expected from a “mature” constella-tion, and it suggests that outage frequencies shouldappear uniform as well if the underlying outageprobabilities are roughly the same for all satellites.It should be noted, however, that the distribution ofGPS satellites ages was not necessarily uniform overthe entire period in which outages were tabulated(January 1999 – August 2011).Figure 2 plots each of the 178 unscheduled outages

found in the NANU archives by year of occurrenceand age of the affected satellite at the time of the out-age. This graphmakes it clear thatmost outages occuron older satellites (for simplicity of wording, “outages”will often be used when referring specifically to“unscheduled outages”). It also shows that the defini-tion of “older satellites” has changed since 1999 asthe oldest satellites in the constellation continued tobe usable well past their previously-predicted design

lives. Except for a few “infant mortality” outagesamong new satellites and a brief period of outagesacross all satellite ages in late 2007, which are knownto have been caused by the OCS software changeoverthat occurred at that time (see [11]), outages amongnewer satellites (less than the original Block IIAdesign life of 7.5 years old [7]) are relatively infrequentand are scattered randomly across the plot.

Figure 3 shows a histogram of outages by satelliteage from 1 to 20 years (note that a given bin “x”represents all outages of satellite ages from x – 1 tox years). This histogram not only reinforces the rela-tionship between satellite age and outage frequencybut shows the variation of outage frequency withspecific phases of satellite life. As expected, satellitesnewer than two years of age experience moreoutages than satellites in the “prime of life” due tounexpected design or manufacturing problems that

Fig. 1–Distribution of GPS Satellite Ages on 20 September 2011

Fig. 2–Unscheduled Outages by Year and Satellite Age

Fig. 3–Histogram of Outages by SV Age

44 Navigation Spring 2013

were not discovered during testing. Outagesincrease in frequency as the expected satellite life-time (approximately 7.5 – 12.5 years, depending onsatellite Block type) approaches and increases furtheras the expected lifetime is reached and passed.

The relative frequency of outages is highest forsatellites that live beyond the 12.5-year expectedlifetime of the most modern GPS satellites. Figure 3does not make this clear because, as indicated inFigure 2, satellites aged 13 years or more are a rela-tively new component of the GPS constellation.Figure 4 emphasizes this point by re-plotting theoutage histogram in Figure 3 while combining allsatellites beyond 13 years of age into a single bin.This bin has 53 outages in it compared to the totalof 64 outages for satellites from 10 to 13 years old,but the total prevalence of satellites over 13 yearsold during the data collection period is significantlylower than the prevalence of satellites from 10 to13 years old. Figure 4 also clarifies that satellitesnewer than 10 years of age have significantly feweroutages than older satellites and can be treated as“nominal” relative to assumed satellite failure prob-abilities, even though significant outage variationswithin this class are visible in Figure 3.

Figure 5 changes the focus to individual satellitesand shows the number of unscheduled outagesexperienced on each satellite observed during thedata collection period. The x-axis is sorted by SVNinstead of launch order, but these two sequencesare highly correlated. What is most striking is thevariability of outage frequency among the satellites.A few SVNs show zero outages because they expiredbefore 1999 (e.g. SVNs 20 and 28), have not had anyunscheduled outages yet (e.g., SVNs 48 and 52), ornever entered service (e.g., SVN 42, which suffereda launch failure). Otherwise, some satellites of the

same type, such as Block IIA SVNs 25 and 31,experienced many more outages (12 and 13, respec-tively) than did other Block IIA satellites. Long lifeis not the sole explanation, as SVN 31 was decom-missioned “for good” after 12.57 years, while SVN25 lasted 17.82 years. While some variation of out-age frequency would be expected even if all satelliteshad equal failure probabilities, the degree of varia-tion shown in Figure 5 strongly suggests that “allsatellites are not made equal.”Figure 6 shows the outages for each satellite in

more detail by plotting each one as a function ofsatellite age. Satellites are again indexed by SVNon the x-axis, while the y-axis indicates the age ofeach satellite at the time an unscheduled outagebegan. Five different symbols are used to indicatethe approximate duration of each outage, as indicated

Fig. 4–Histogram of Outages by SVAge (Ages>13 years combinedinto a single bin)

Fig. 5–Histogram of Outages by SV Number

Fig. 6–Age and Duration of Outages on Each Satellite

45Pullen and Enge: Using History to Exclude High-Risk SatellitesVol. 60, No. 1

in the plot legend. Because many outages occurred inclose proximity to one another, they “overlap” onFigure 6 and are not clearly visible as distinct events.Also, the limits of the 1999–2011 data collectionperiod affect this plot, as “young” outages for earlierGPS satellites are not apparent, nor are “old” outagesfor satellites launched in the last few years.Of the 178 unscheduled outages observed during

this period, 13 were not repaired, meaning that thesatellite was instead decommissioned (five other satel-lites were also decommissioned during this period byOCS decision). Of the remaining 165 outages thatwererepaired, 36 lasted 3 hours or less, 41 lasted between3 and 30 hours, 61 lasted between 30 and 300 hours,and 27 lasted longer than 300 hours (the longestlasted 4,638 hours, or just over 6 months). This widerange of outage durations corresponds to the manypotential causes of anomalies that cause unsched-uled outages. A frequent pattern involves a rela-tively rapid initial repair followed by one or moreoutages with longer durations, indicating that theoriginal problem persisted or was incompletelyassessed.Figure 6 reiterates the fact that older satellites are

more likely to have unscheduled outages, and itshows the history of outages and repairs on eachsatellite to help clarify what separates “well-behaved”and “troublesome” satellites. “Troublesome” satellitesnot only experience many outages, but these outagesbecome more frequent as satellites age and passtheir expected lifetimes. In particular, the appear-ance of one or two outages within one to two yearson older satellites is a strong indication that moreoutages are coming.Figure 7 highlights this tendency by “zooming in”

on the unscheduled outage history of SVN 25, whichas noted above experienced 12 unscheduled outagesover a lifetime of almost 18 years before being

decommissioned (by OCS decision) in late 2009.The same data shown in Figure 6 is repeated inFigure 7 for SVN 25, but additional details are addedin text form. Since outage durations are now pro-vided by text, all outage start times are indicatedby the same symbol (a square).

As shown in Figure 7, SVN 25 experienced twooutages in 1999 and 2000 as it passed the originalBlock IIA design life of 7.5 years, and it experiencedone more outage in 2004 after passing 12 years ofage. Six months later, with the satellite now morethan 13 years old, it experiences a series of 5 outagesfrom February 2005 to May 2006. Two of theseoutages, on 23 and 25 December 2005, occurred soclose to each other that they appear as one overlap-ping square in Figure 7. Note that the earlier of thesetwo outages was resolved in about 8.5 hours, but theunderlying problem remained and led to the secondoutage shortly thereafter. That second outage lastedabout a month, but further outages followed, suggest-ing that the GPS OCS was fighting a persistentproblem on this satellite. Four additional outagesoccurred on SVN 25 after the period of 5 outagesended in 2006, showing that the problems affectingSVN 25 were never completely resolved before itwas decommissioned. Despite this, SVN 25 wascontinuously reactivated and kept in service untilthe level of maintenance and monitoring difficultlythat it posed to OCS was no longer worthwhile.

Thehistory of outages by individual satellites shownin Figures 6 and 7 suggests that recent outage historyis at least as relevant as age in predicting future satel-lite outages. Since older satellites experience a signifi-cant majority of outages, the two effects are highlycorrelated, but considering prior outage history helpsto separate older satellites with a particularly highrisk of future outages from thosewhose risk is not highenough to require additional mitigation. The benefitsof this will become apparent when example satellite-exclusion rules are examined in the following section.

Finally, what comparisons can be drawn betweenthese results and the expected satellite failure andoutage probabilities described previously? If the178 outages observed in this study are divided bythe number of hours covered by the data collectionperiod (about 111,035 hours from January 1999through August 2011, inclusive), an outage rate of1.60� 10-3 per hour is obtained. Dividing this resultby 24 satellites (a conservative estimate of thenumber of satellites present in the constellation overthis period) gives an outage rate of 6.67�10-5 perhour per satellite, which is well below the SPSPerformance Standard of 2.0�10-4 per slot per hourfor unscheduled outages. Furthermore, even if all ofthese outages represent potential integrity threats forGBAS, the observed outage rate is below the 10-4 perhour per satellite fault probability assumed by GBASfor each fault mode.Fig. 7–Unscheduled Outage History of SVN 25

46 Navigation Spring 2013

While these numbers suggest that the averageoutage and failure rates over the GPS constellationare sufficiently low, the focus of this study is the pos-sibility that particular satellites might exceed whatis assumed by GBAS or other systems. SVN 25, high-lighted in Figure 7, is a good example. It experienced12 outages over the period from January 1999 to itsdecommissioning in mid- December 2009 (a periodof about 96,060 hours), giving an average outage rateover its lifespan of about 1.25�10-4 per hour. Thisis just under twice the overall outage rate for allsatellites – it is elevated but not a major concern.However, if we focus on the period from the fourthoutage (on 10 August 2004, when SVN 25 was about12.5 years old) until decommissioning, nine outagesoccurred within a period of about 46,920 hours, givingan outage rate of 1.92�10-4 per hour. A more pessi-mistic number is obtained by focusing on the fiveoutages that occurred between 24 February 2005and 18 May 2006 (a period of about 10,750 hours).This gives an outage rate of 4.65� 10-4 per hour,which exceeds the SPS outage rate and would exceedthe SPS failure rate if the fraction of unscheduledoutages that pose an integrity threat exceeds 10-5 /4.65� 10-4, or about 2.15%. As noted above, theactual fraction of outages that pose integrity threatsto GBAS or other civil systems is unknown but isalmost certainly higher than this.

EXAMPLE SATELLITE-EXCLUSION HEURISTICS

The possibility that individual GNSS satellitesmight exceed the failure probabilities assumed byhigh-integrity civil systems motivates the considera-tion of satellite-exclusion heuristics, or rules thatwould prevent high-risk satellites from being usedbased on characteristics that are observable to thesesystems. Two example heuristics are proposed andevaluated in this section:

Heuristic 1: Exclude all GPS satellites greater than13 years of age.

Heuristic 2: Exclude all GPS satellites greater than10 years of age that have experienced oneor more unscheduled outages within thelast two (2) years.

Heuristic 1 is suggested as a conservative exampleonly and is not intended to be practical when usingonly GPS for satellite navigation (i.e., without alsousing other GNSS satellites from GLONASS, Galileo,etc.). Recall from Figure 1 that the satellites in thecurrent GPS constellation shown in Table 1 (as of20 September 2011) are relatively uniformly distribu-ted in age between 0 and 20 years. Therefore, exclud-ing all satellites older than 13 years would eliminatea significant fraction of the constellation and wouldbe impractical for most users. In particular, applyingthis heuristic to the GPS satellites in Table 1 would

eliminate the following 11 satellites (in descendingorder of age): SVNs 23, 24, 26, 39, 35, 34, 36, 33, 40,43, and 38. Six of these 11 satellites are in “spare”orbit slots and thus contribute less to user geometry,but the other five remain in “primary” slots and areheavily relied upon.Heuristic 2 is still very conservative for users of

only GPS satellites, but it is less so than Heuristic1 because it requires both advanced age (10 or moreyears instead of 13) and one or more unscheduledoutages in the last two years. Table 1 shows thatthe 10-year age cutoff adds 5 more satellites (SVNs46, 51, 44, 41, and 54) to the above list of those eligi-ble to be excluded. However, the additional require-ment of an outage within the last two years allowsthemajority of these satellites to be used despite theirage. Only five satellites are excluded by Heuristic 2:SVNs 26, 35, 38, 40, and 51. Three of these five satel-lites are in “spare” orbit slots, and all but one (SVN51) is included in the larger set of satellites excludedby Heuristic 1.These two heuristics were evaluated using satellite

geometry simulations at two locations in the U.S.: amid-latitude site (Palo Alto, California, at 37.4o Northlatitude) and a high-latitude site (Fairbanks, Alaska,at 64.8o North latitude). One day of GPS satellitegeometries was simulated at 5-minute intervals over20 September 2011 (local time), and a satellite visibi-lity elevation “mask angle” of 5o was used for bothlocations. Trimble’s freely-available “Setup Planning”software for Windows (Version 2.9) was used to per-form this analysis [12].The two plots in Figure 8 show the number of visible

and usable GPS satellites on 20 September 2011 atboth Palo Alto (left-hand plot) and Fairbanks (right-hand plot) under three scenarios. The first scenario,shown in solid line, includes all visible satellites with-out any exclusion rules. The second scenario, shown indashed line, implements the satellite-exclusion rulesof Heuristic 2, while the third scenario, shown indotted line, implements the satellite-exclusion rulesof Heuristic 1. The same pattern is followed inFigure 9, which plots Vertical Dilution of Precision(VDOP) at both locations. VDOP translates the qual-ity of the usable satellite geometry into a measure ofuser error in the vertical dimension. Multiplying thecurrent VDOP by the one-sigma accuracy of eachranging measurement provides an approximateone-sigma estimate of vertical position accuracy.Figures 8 and 9 clearly show the disadvantages of

implementing the proposed satellite-exclusion heur-istics when only using GPS satellites for navigation.Heuristic 1, in particular, is clearly impractical.Although seven or more satellites are always visibleat both locations, and nine or more satellites are visi-ble at most times (10 or more at Fairbanks), theeliminations required by Heuristic 1 bring the num-ber of usable satellites down to four to six at times.

47Pullen and Enge: Using History to Exclude High-Risk SatellitesVol. 60, No. 1

The resulting penalty is most obvious in Figure 9,where the red curve representing Heuristic 1 hasmultiple undesirable “spikes” where VDOP growsto very high values, and a significant fraction of theday has VDOP above 3.0 for this case. In comparison,VDOP for Heuristic 2 (the green curve) stays muchcloser to the ideal VDOP for the no-SV-eliminationcase (the blue curve), although significant devia-tions are visible and will lead to lower availabilityif Heuristic 2 is implemented.Figure 9 suggests that, while Heuristic 1 is too

conservative, Heuristic 2 is a good starting point forrefinement of the exclusion rules for GPS satellites.An improved heuristic likely needs to exclude fewersatellites to be optimal for users of GPS satellitesonly. On the other hand, if GPS were combined withanother full or nearly-full satellite constellation ofsimilar ranging accuracy in the future (e.g., poten-tially Galileo, COMPASS, and/or GLONASS), Heuris-tic 2 might be usable as is, as many more satelliteswould be available to make up for the excluded ones[13]. Use of GPS with other satellite constellationsremains speculative, and the outage characteristics

of new GNSS satellites remain to be observed, but itis reasonable to expect that their behavior over timewill follow patters similar to those of GPS satellites.

Note that, while Fairbanks typically hasmore satel-lites in view (on average) than Palo Alto in Figure 8,VDOP at Fairbanks is worse than at Palo Alto inFigure 9. This is true for all three cases shown but ismost visible for Heuristic 1, and it is due to the weak-ness of satellite geometries viewed from latitudesabove the inclination angle of theGPS satellite constel-lation (55o). In general, locations with weaker satellitegeometries under nominal conditions (e.g., due to localobstructions causing higher elevation mask angles)will make the loss of performance due to satelliteexclusions that much worse, since “less margin” forthese exclusions is present to begin with.

Another consideration regarding satellite-exclusionrules is how to implement them in civil systems inreal time. The study used to develop these heuristicswas based on access to archived NANUs via theInternet [2, 3]. Internet access is one straightforwardmeans of obtaining NANUs, but somemeans externalto GPS receiver hardware is needed because NANU

Fig. 9–Vertical DOP (VDOP) at Palo Alto and Fairbanks

Fig. 8–Number of Usable Satellites at Palo Alto and Fairbanks

48 Navigation Spring 2013

information is not broadcast in the GPS navigationdata messages. Augmentation systems such as GBASand SBAS, could obtain this information externally,but are not necessarily designed to do so. For exam-ple, the Honeywell SLS-4000 LAAS Ground Facil-ity, which achieved CAT I System Design Approvalin 2009 (but not yet airport site approval), mirrorsthe much older Instrument Landing System inallowing no external contact (beyond GPS and VDBsignals) except for manual interaction with FAAmaintenance personnel.

Without access to NANUs or other external infor-mation about satellite constellation health, eventracking satellite age is difficult because satellitesdo not broadcast their SV numbers – only their PRnumbers, which can move from satellite to satellite(usually when a new satellite replaces an older onethat has been decommissioned). Therefore, someexternal input is needed to update a maintenancefile when a new GPS satellite is approved for use[14]. An opportunity for this exists for the SLS-4000because manual input is required to approve theC/A-code signal quality of each new satellite.

However, as this paper establishes, tracking recentsatellite outages is key to limiting the number ofsatellites that are excluded. Without regular NANUinputs, individual GBAS sites could observe satellitesbeing flagged unhealthy when in view of that site, butthey would miss the times when this occurs out ofview, and more importantly, they could not easilydistinguish between an unscheduled outage and ascheduled outage for maintenance unless that satel-lite was maneuvered. Ideally, augmentation systems(and ARAIM, which will rely on external integritymessages to some degree [13]) will expand theiraccess to NANU information as they mature, but fornow, its absence significantly limits our ability toimplement satellite-exclusion rules.

REAL-TIME EXCLUSION METHOD THATINCORPORATES SATELLITE GEOMETRY

The satellite-exclusion rules proposed in the pre-vious section are simple “open-loop” rules that wouldbe applied regardless of the usefulness of each satel-lite to a user’s position solution. This makes sense ifthe intent is to remove satellites whose potentialharm to user integrity is large and exceeds theassumptions made by user integrity algorithms toan unknowable extent. While this could be the case,the results in this paper suggest that any such viola-tions of existing assumptions will be a matter ofdegree rather than an immediate threat. If this isthe case, and the degree of violation can be esti-mated and/or bounded, the methods currently usedto verify integrity in civil-aviation navigation sys-tems can be adapted to determine in real time(or near-real-time) when the value of a given satellite

to the user’s positioning geometry outweighs itsfailure risk. This approach would blend the risk-sensitive heuristics proposed above with the commonmeans of channel-limited satellite selection describedin the introductory section, which selects the satel-lite subset that minimizes the position DOP ofinterest. Minimizing DOP may be sufficient whenall satellites have similar failure risks, but a gener-alized approach would handle the GPS satellitehistory shown earlier in this paper, where this isnot the case.The concept that makes this possible is known as

the “multiple-hypothesis” (MH) approach to estimat-ing integrity risk, which was first developed in[15] and has been used more recently as the basisfor computing real-time user protection levels inARAIM [16]. ARAIM computes protection levels byevaluating the probabilistic impacts of nominalconditions and each faulted or anomalous threatmode whose probability is significant relative to theoverall loss-of-integrity probability that the systemaims to protect (e.g., 10-7 per operation for the mostdemanding flight modes to be supported by ARAIM).Threats due to satellite faults are weighted by theassumed prior probability of that fault. Protectionlevels are output at each epoch that bound the max-imum position errors at the required loss-of-integrityprobability (or “PHMI”) based upon the current mea-surements and a prior allocation of that probabilityto each fault and to the fault-free case [16]. Whilethis approach is used directly by ARAIM, the theorybehind it underlies the calculation of protectionlevels for all civil-aviation applications and is thuswidely applicable [17].An addition to the ARAIM multiple-hypothesis

method could handle potential satellite exclusionsby treating them as potential “failures” whose riskcould be accepted by including the satellites in ques-tion or rejected by excluding them. First, a listof “satellites of concern” with higher-than-normalfailure probabilities would be built using a refinementof Heuristic 2, for example. The nominal protection-level calculation would exclude all of these “troubled”satellites, meaning that it would enforce the exclusionheuristic as an “in or out” rule. Next, each satelliteexcluded by the heuristic is re-included in a separateprotection level calculation in which failures of there-included satellite are evaluated with a higherprobability based on the GPS satellite historyreported earlier. If the resulting protection levelsare meaningfully lower than for the nominal case(with all “troubled” satellites excluded), then thatsatellite should be included in the position solutionbecause its improvement to user geometry outweighsthe additional failure risk that it brings with it. Tothe degree that computational resources permit,this would be repeated for all satellites excludedby the heuristic being used.

49Pullen and Enge: Using History to Exclude High-Risk SatellitesVol. 60, No. 1

The advantage of using heuristics as “in or out” rulesis that there is no need to assess how much higher theprobability should be for “satellites of concern” relativeto the assumed probability for all satellites. However,themultiple-hypothesis approach requires a numericalassessment to support the quantitative trade-off thatit performs. The GPS satellite outage results shownearlier suggest that assuming an integrity failure ratefor “satellites of concern” that is two orders of mag-nitude greater than the number given by the SPSPerformance Standard (i.e., about 10-3 per “troubled”SV per hour) would be sufficiently conservative foralmost all of these satellites (note that the ARAIMmultiple-hypothesis method does not require thatthe same failure probability be used for each satellite).One concern of using a probability this high for

“troubled” satellites is that independent, simulta-neous failures of two “troubled” satellites wouldhave a probability of roughly 10-6 per satellite perhour, and independent, simultaneous failures ofone troubled satellite and one nominal satellite(using 10-4 per satellite per hour as conservative fornominal satellites) would have a probability ofroughly 10-7 per satellite per hour. These probabil-ities are significant compared to the 10-7 PHMIrequirement for many civil operations, which meansthat the multiple-hypothesis risk calculation mightnot be able to neglect dual-satellite failure scenariosfor “troubled” satellites that it might have neglectedpreviously because their probabilities were lowenough to neglect. This is not a problem for the algo-rithm, but it points out one reason why the addi-tional risk of using “troubled” satellites might notbe worth the benefit.

SUMMARY AND FUTURE STEPS

This paper has examined the history of unsched-uled GPS satellite outages from January 1999 toAugust 2011 (based upon NANU archives) and iso-lated two factors that can be used to identify satel-lites with much higher than average risk of futurefailures. As expected, satellite age is the primaryobservable factor. GPS satellites routinely outlivetheir predicted design lives by many years, but asthey do so, they become much more susceptible tofailures that require them to be declared unhealthyand repaired by the GPS OCS. In addition, certain“problem” satellites have a much greater propensityfor recurring unscheduled outages than others.Therefore, once one or two recent outages have beenobserved on an older satellite, the probability offurther outages increases significantly.Since satellite age and number of outages are obser-

vable to GPS users (at least those who have access toNANUs or who independently monitor the constel-lation on a semi-worldwide basis), they can be usedin heuristics that pre-emptively exclude “troubled”

satellites from use to avoid the potential integrity riskthat they might pose. Doing this with today’s GPSsatellite constellation is painful in terms of thenumber of satellites that would be excluded and theresulting degradation in positioning geometry, butthis may change in the future as GPS is combinedwith other satellite constellations such as Galileo,GLONASS, Compass, or regional satellites such asSBAS GEOs or QZSS. In addition, a modificationof the existing multiple-hypothesis protection levelalgorithm used in ARAIMwould allow the positioningbenefit of using troubled satellites to be traded againstthe increased failure risk that they add.

Much work remains to refine the satellite-exclusionheuristics proposed in this paper and to develop themultiple-hypothesis (MH) exclusion method into apractical algorithm. Computational workload is a con-cern for the MH method because the current proposalrequires that a separate set of MH protection levelsbe computed for each satellite that is a candidatefor exclusion. The performance benefit of the MHapproach relative to using heuristics alone (meaningexclusion of all “troubled” satellites) should be evalu-ated for both the GPS-satellites-only case and oneor more GPS+GNSS-satellites cases. Simulations ofGNSS satellites in addition to GPS are complicatedby the fact that most potentially usable non-GPSsatellites are very new and have limited outage his-tories; thus the exclusion rules that should apply tothem must be extrapolated from those that have beenderived for GPS satellites.

ACKNOWLEDGMENTS

The authors would like to thank the FAA SatelliteNavigation Program Office and the FAA William J.Hughes Technical Center for their support of StanfordUniversity’s research on LAAS and WAAS. However,the opinions expressed here are solely those ofthe authors. The authors would like to thank Col.Gaylord Green (USAF, Ret.) for inspiring this workand Tim Murphy of Boeing and Dean Rudy ofSierra Nevada for their work in deriving continuityallocations for GBAS and the impact of unscheduledsatellite outages on them.

REFERENCES

1. Green, G., Personal Communication, c. 1992.2. USNO GPS Timing Operations website, http://tycho.

usno.navy.mil/gps.html3. U.S Coast Guard Navigation Center (NavCen) website,

http://www.navcen.uscg.gov/?pageName= gpsNanuInfo4. Lavrakas, J.W. and Shank, C., “A Study into the Use of

URA in Satellite Selection,” Proceedings of 49th IONAnnual Meeting. Cambridge, MA., June 21–23, 1993,pp. 261–270.

50 Navigation Spring 2013

5. Park, C.W. and How, J.P., “Quasi-optimal SatelliteSelection Algorithm for Real-time Applications,”Proceedings of the 14th International TechnicalMeeting of the Satellite Division of The Institute ofNavigation (ION GPS 2001). Salt Lake City, UT.,September 2001, pp. 3018–3028.

6. Blanco-Delgado, N. and Nunes, F.D., “A ConvexGeometry Approach to Dynamic GNSS Satellite Selec-tion for a Multi-Constellation System,” Proceedings ofthe 22nd International Technical Meeting of the SatelliteDivision of The Institute of Navigation (ION GNSS2009). Savannah, GA., September 2009, pp. 1351–1360.

7. Global Positioning System Standard PositioningService Performance Standard. U.S. Department ofDefense, Washington, DC, Fourth Edition, September2008.

8. Pullen, S., Rife, J., and Enge, P., “Prior ProbabilityModel Development to Support System SafetyVerification in the Presence of Anomalies,” Proceed-ings of IEEE/ION PLANS 2006, San Diego, CA,April 24–27, 2006, pp. 1127–1136.

9. Minimum Aviation System Performance Standardsfor the Local Area Augmentation System (LAAS).Washington, D.C., RTCA SC-159, WG-4, DO-245A,December 9, 2004. http://www.rtca.org

10. Kline, P., Murphy, T., and Van Dyke, K., “LAAS Avail-ability Assessment: The Effects of Augmentations andCritical Satellites on Service Availability, ” Proceed-ings of of the 11th International Technical Meeting ofthe Satellite Division of The Institute of Navigation(ION GPS 1998), Nashville, TN, September 1998, pp.503–516.

11. Kovach, K., Berg, J., and Lin, V., “Investigation ofUpload Anomalies Affecting IIR Satellites in October2007,” Proceedings of the 21st International Technical

Meeting of the Satellite Division of The Instituteof Navigation (ION GNSS 2008), Savannah, GA,September 2008, pp. 1679–1687.

12. Trimble Planning Software website, http://www.trimble.com/planningsoftware.shtml

13. Blanch, J., Wallner, T., Enge, P.,Wallner, S., Fernandez,F.A., Dellago, R., Ioannides, R., Pervan, B., Hernandez,I.F., Belabbas, B., Spletter, A. and Rippl, M., “A Propo-sal for Multi-constellation Advanced RAIM for VerticalGuidance,” Proceedings of the 24th InternationalTechnical Meeting of the Satellite Division of The Insti-tute of Navigation (ION GNSS 2011). Portland, OR,September 2011, pp. 2665–2680

14. Brenner, M., Liu, F., Liu, F., Class, K., Reuter, R. andEnge, P., “Natural Signal Deformations Observed inNew Satellites and their Impact on GBAS,” Proceed-ings of the 22nd International Technical Meeting ofthe Satellite Division of The Institute of Navigation(ION GNSS 2009). Savannah, GA, September 2009,pp. 1100–1111.

15. Pervan, B., Pullen, S., and Christie, J., “A MultipleHypothesis Approach to Satellite Navigation Integ-rity,” NAVIGATION, Vol. 45, No. 1, Spring 1998, pp.61–71.

16. Blanch, J., Ene, A., Walter, T., and Enge, P., “An Opti-mized Multiple Hypothesis RAIM Algorithm for Verti-cal Guidance,” Proceedings of the 20th InternationalTechnical Meeting of the Satellite Division of The Insti-tute of Navigation (ION GNSS 2007). Fort Worth, TX,September 2007, pp. 2924–2933. http://waas.stanford.edu/~wwu/papers/gps/PDF/ BlanchIONGNSS07.pdf

17. Pullen, S., “A Comparative Overview of the ProtectionLevel Concept for Augmented GNSS and LORAN,”Stanford University, GPS Laboratory Meeting,December 20, 2002.

51Pullen and Enge: Using History to Exclude High-Risk SatellitesVol. 60, No. 1