Derivation of Vertical Alert Limit for LAAS CAT III Autoland Considering Limit Risk Requirement

Curtis A. Shively

Abstract:	For the GPS Local Area Augmentation System (LAAS), the vertical alert limit (VAL) represents an error level that the navigation sensor error (NSE) can only exceed with a small probability (2.5x10-11) without annunciation to the user. To achieve such a small integrity risk, the VAL is used in part to limit the worst satellite geometry that may be employed by the airborne receiver. However, EUROCAE has sought to base VAL on meeting a limit risk requirement applied to the total system longitudinal error (TSE) as composed of the sum of NSE and flight technical error (FTE). For addressing the limit risk requirement, the NSE is set to a maximum value (assumed equal to VAL), while the FTE is assumed to be random. For the limit risk case the EUROCAE analyses have produced small values of VAL (2.1 m to 4.7 m), which are difficult to achieve with acceptable availability of satellite geometry. This paper documents an alternative analysis to base an acceptable VAL for CAT IIIb autoland on landing risk requirements of concern to EUROCAE. These requirements in general consist of the limit risk case (mentioned above) and an average risk case. Corresponding to these requirements the analysis is divided into the faulted NSE (integrity) case and the faultfree NSE (accuracy) case, respectively. In both cases the results are presented as an aircraft performance boundary beyond which the risk requirement is met for a given value of VAL. This boundary defines an acceptable region of the relationship between the standard deviation of the presumed normally distributed FTE (óFTE) and nominal longitudinal touch down point (NTDP) of the aircraft on the runway. For fault-free NSE, a VAL of 10.0 m would meet the average risk requirement (10 -6 ) applied to a short landing (less than 200 ft past the runway threshold) for notional values of óFTE and NTDP typically associated with transport aircraft. However, for the landing long case, the maximum allowed longitudinal touch down point would have to be extended slightly from 2,700 ft to 2,765 ft past the runway threshold for the average risk requirement to be met for VAL = 10.0 m. To analyze the case of faulted NSE, the magnitude of the fault that produces the worst conditional risk is found, rather than assuming that VAL equals the maximum NSE allowed by the limit case requirement (10 -5 ) as was done in the EUROCAE analyses. This worst-case NSE value is near the fault monitor test threshold, a level which is significantly less than VAL. For faulted NSE, the results are dominated entirely by the landing short case, since the landing long maximum is now 3,000 ft instead of 2,700 ft past the runway threshold. For reference receiver faults, the limit risk requirement would be met only for VAL up to 7.5 m, if such faults are assumed to be detected only by monitoring in the aircraft. If however, credit is taken for monitoring of reference receiver faults in the LAAS ground facility (LGF), the limit risk requirement is essentially met for VAL up to 10.0 m. Ranging source faults due to satellite ephemeris error or satellite signal deformation were also analyzed. For both these types of faults, the limit risk requirement would be met for VAL = 10.0 m, assuming state-of-art performance of corresponding monitors in the LGF.
Published in:	Proceedings of the 60th Annual Meeting of The Institute of Navigation (2004) June 7 - 9, 2004 Dayton Marriott Hotel Dayton, OH
Pages:	281 - 299
Cite this article:	Shively, Curtis A., "Derivation of Vertical Alert Limit for LAAS CAT III Autoland Considering Limit Risk Requirement," Proceedings of the 60th Annual Meeting of The Institute of Navigation (2004), Dayton, OH, June 2004, pp. 281-299.
Full Paper:	ION Members/Non-Members: 1 Download Credit Sign In