An Exemplary Ground Network for the Generation of the Galileo ARAIM ISM - Integrity Risk Assessment and a Novel High Sensitive SiS Monitor

Advanced Receiver Autonomous Integrity Monitoring (ARAIM) is a future Safety-of-Life (SoL) service which aims at proving global integrity using multiple GNSS constellations and dual-frequency services. The ARAIM concept foresees the provision to the user of an Integrity Support Message (ISM) specific for each constellation. The performance parameters included in the ISM allow the user to compute its own integrity service level. Constellation Service Providers (CSP) are responsible for the commitments published in the standards and for the dissemination of the message. An ISM Generator (ISMG) will be responsible for the content of the ISM and in charge of validating the CSP commitments by monitoring the nominal performance of the system and detect fault events. This work starts highlighting the main limitations and constraints an ISMG and in particular its ground monitoring network might face, first of all in terms of geographical distribution and extension of the sensor stations. Analysis and recommendations on the design and dimensioning of the ground monitoring network are provided, including recommendation on the handling of data gaps and the assessment of the corresponding integrity risk. The analysis comprises the derivation of the probability of coverage based on statistical analysis of the probability of cycle clips, loss-of-lock and carrier-to-noise ratio for a typical geodetic station. It follows the assessment of the estimation accuracy of the precise clock reference. The accuracy is based on an extensive statistical analysis on the receiver performance in terms of code and carrier phase error for a typical geodetic receiver. This works also presents a methodology allowing the ISMG to validate the system performance under nominal conditions, and to detect and validate Signal-in-Space (SiS) fault events, minimizing also the probability of missed detection. This validation process shall de-facto prevent the use of inaccurate or misleading products, cancelling the risk of artificial detection of satellite faults. The validation process has also the dual purpose of confirming a satellite faults in case this has been detected by the ISM generator. The validity of this method has been demonstrated by re-processing fault events and satellite anomalies from the past, like clock jump, clock drift, wrong navigation message, wrong precise reference, and carrier spikes on GPS due to the flex power adjustment, showing that the method not only enables a certain detection of a real fault and exclusion of artefacts, but also allows undoubtedly distinguish the nature of the fault, whether caused by wrong broadcast orbit and clock or caused by a satellite malfunction. A minimum Depth-of-Coverage (DoC) of 1 is required, allowing a very short time to detect.