PROGRAMME OUTLINE EEC Report No. 342 - Eurocontrol...Braunschweig TU Braunschweig Roke Manor...

EUROPEAN ORGANISATIONFOR THE SAFETY OF AIR NAVIGATION

EUROCONTROL EXPERIMENTAL CENTRE

EGNOS OPERATIONAL TEST AND VALIDATION FOR CIVIL AVIATION

PROGRAMME OUTLINE

EEC Report No. 342

Project NAV-4-E1

Issued: December 1999

The information contained in this document is the property of the EUROCONTROL Agency and no part should bereproduced in any form without the Agency’s permission.

The views expressed herein do not necessarily reflect the official views or policy of the Agency.

EUROCONTROL

REPORT DOCUMENTATION PAGE

Reference:EEC Report No. 342

Security Classification:Unclassified

Originator:EEC – SNA CoE

(Satellite Navigation ApplicationsCentre of Expertise)

Originator (Corporate Author) Name/Location:Avionik Zentrum Braunschweig GmbH & Co. KGHermann-Blenk-Strasse 36D- 38108 BraunschweigGermanyPhone: +49 - 531 - 2359 – 199Fax: +49 - 531 - 2359 – 172

Sponsor:EATCHIP Development Directorate

Sponsor (Contract Authority) Name/Location:EUROCONTROL AgencyRue de la Fusée, 96B -1130 BRUXELLESTelephone : +32 2 729 9011

TITLE:EGNOS OPERATIONAL TEST AND VALIDATION FOR CIVIL AVIATION

PROGRAMME OUTLINE

AuthorsAvionik ZentrumBraunschweig

TU Braunschweig

Roke Manor Research

Date

12/99Pages

x + 147Figures

10Tables

13Appendix

5References

17

EATCHIP TaskSpecification

-

Project

NAV-4-E1

Task No. Sponsor

-

Period

1998/1999

Distribution Statement:(a) Controlled by: Head of SNA CoE(b) Special Limitations: None(c) Copy to NTIS: YES / NO

Descriptors (keywords):EGNOS, Navigation, Positioning, GPS, GLONASS, GNSS, Validation

Abstract:EUROCONTROL and representatives from its Member States developed the GNSS missionrequirements for Civil Aviation. The Civil Aviation requirements will form the basis of a validationprogramme with the aim to demonstrate that the use of EGNOS in ECAC airspace meets the CivilAviation requirements.

This report presents the result of a study to define the scope of the work for the Operational Testand Validation of EGNOS. The study was initiated on request of the States that intend to provideservices based on EGNOS. The statement of work was developed by the System Research andDevelopment (SRD) Taskforce of the EATCHIP Satellite Navigation Applications (SNA) Group, inwhich forum the progress of the work was also monitored.

The work presented in this report has been carried out by the Avionik Zentrum Braunschweigsupported by the Technical University of Braunschweig and Roke Manor Research.

This document has been collated by mechanical means. Should there be missing pages, please report to:

EUROCONTROL Experimental CentrePublications Office

B.P. 1591222 – BRETIGNY-SUR-ORGE CEDEX

France

EGNOS Operational Test and validation for Civil Aviation –Programme Outline

EEC report No. 342 v

EUROCONTROL

FOREWORD FOR EGNOS OPERATIONAL TEST AND VALIDATION STUDY

The EGNOS system is being developed by the European Space Agency (ESA) in the frame of theEuropean Tripartite Agreement with the European Community and EUROCONTROL. Under theterms of this agreement one of EUROCONTROL’s roles is to carry out the Operational Test andValidation of GNSS-1 for civil aviation, with initial emphasis on EGNOS.

The EGNOS programme in ESA has entered the detailed design and development phase, the so-called Phase C/D. The current plans of ESA indicate that the EGNOS system will be ready for hand-over to the EGNOS management and operating entity by February 2003, the date of the OperationalReadiness Review (ORR).

EUROCONTROL and representatives from its Member States developed the GNSS missionrequirements for Civil Aviation, which were used as the basis for the ‘Multi-modal’ mission require-ments for GNSS-1, from which the requirements for EGNOS were derived. The Civil Aviationrequirements will form the basis of a validation programme with the aim to demonstrate that the useof EGNOS in ECAC airspace meets the Civil Aviation requirements.

This report presents the result of a study to define the scope of the work for the Operational Test andValidation of EGNOS. The study was initiated on request of the States that intend to provide servicesbased on EGNOS. The statement of work was developed by the System Research and Development(SRD) Taskforce of the EATCHIP Satellite Navigation Applications (SNA) Group, in which forum theprogress of the work was also monitored.

The project kick-off meeting was held in January 1998. A first workshop was held in March 1998 tocollect opinions of the various stakeholders: the Member States and EUROCONTROL representingthe service providers, ESA as the system designer, and the airlines as the users, although theinterest of the latter remained small. The workshop was successful and led to a report summarisingthe main conclusions. The workshop report and the study have resulted in EEC report No ***, ofwhich this is the Executive Summary. It is intended to provide the first layout of a full scale EGNOSValidation Plan to be presented to the new EATMP GNSS Programme Board in July 1999.

The work presented in this report has been carried out by the Avionik Zentrum Braunschweigsupported by the Technical University of Braunschweig and Roke Manor Research.

The GNSS Programme management under the responsibility of which this report is now publishedwishes to acknowledge the valuable contributions and assistance received from theEUROCONTROL Member States and the European Space Agency.

Richard FarnworthEdward Breeuwer

EUROCONTROL Project Officers


vi EEC report No. 342

EUROCONTROL

(Page intentionally left blank)


EEC report No. 342 vii

EUROCONTROL

SUMMARY

Europe is currently on the way to develop the European Geostationary Navigation Overlay Service(EGNOS) as the European contribution to the current constellation of satellite navigation systems.The preliminary EGNOS design was completed during 1998 and the system is expected to reachAdvanced Operational Capability (AOC) by 2003. EGNOS is a multi-modal system that will improvethe navigation performance of users in all transport domains and other areas of application. Withregards to civil aviation, the implementation of EGNOS will not only affect existing operations, butcould also allow new operations to be defined.

Within the European Tripartite Group (ETG), consisting of the European Commission, the EuropeanSpace Agency (ESA) and EUROCONTROL, it is the responsibility of EUROCONTROL to operation-ally test and validate EGNOS with regards to the user requirements of civil aviation. This documentis the Executive Summary of a report that has been developed by a team led by Avionik ZentrumBraunschweig (Germany) and that proposes a programme for the EGNOS Operational Test andValidation (EOT&V).

ESA and the EGNOS contractor will carry out a technical verification programme to establish that theservice provided by EGNOS conforms to the specified system requirements. More specifically, theESA verification programme will ensure that EGNOS meets the Signal-In-Space performance all overthe required coverage area. On top of this, EUROCONTROL will co-ordinate the Operational Testand Validation of EGNOS against the civil aviation performance requirements. The EOT&Vprogramme has to be undertaken in order to facilitate the acceptance (by the national aviationadministrations and Air Traffic Service Providers of the ECAC Member States) of aircraft operationsbased on the use of EGNOS.

The EOT&V process has to consider all those operational aspects that will not be covered by thetechnical verification activities. Strictly speaking, EGNOS is only an overlay service to GPS andGLONASS. Therefore, with regards to operational validation, three elements have to be considered:GPS and GLONASS, the overlay service for the augmentation of GPS and GLONASS, and thereceiver. The activities that have to be undertaken in the scope of the EOT&V process can bedivided into three broad categories, which are RNP (Required Navigation Performance) relatedissues, operational issues and safety issues. In this report, the focus has been set on the firstcategory, i.e., test and validation of EGNOS against the RNP parameters down to Category Iapproaches in the operational environment.

On the basis of the RNP requirements, a validation strategy has been developed for each of theRNP parameters. Appropriate validation activities are derived from this strategy considering theoperational influences that may occur. This is based on a statistical approach, which is needed todefine the number of necessary test samples (if test is an appropriate validation method for theconcerned parameter). An analysis of the operational influences allows the determination ofreasonable correlation time intervals and spatial correlation requirements that can be applied to thestatistical validation approach. This results in the definition of validation activities and of theproposed EOT&V programme.

The navigation performance which will be experienced by the user significantly depends on thefollowing operational influences on RNP, that are investigated in the report:• Dependency upon GPS and GLONASS• Aircraft Manoeuvres and Dynamics• Aircraft Types• Masking• Coverage Area• Multipath• Interference• Atmospheric Effects


viii EEC report No. 342

EUROCONTROL

Generally, it has to be considered that even if single operational influences on RNP are not critical tothe navigation performance, problems might arise when combinations of different effects occur.The proposed EOT&V programme definition contains a work package breakdown structure withdetailed work descriptions is given as well as a time schedule and a preliminary cost estimate.

It is recommended to begin the EOT&V programme as soon as possible in order ensure thatEGNOS can be used operationally as early as possible. The first activities that should be undertakencomprise initial reviews and analyses that are necessary for refining the EOT&V validation activitiesand to better plan the EOT&V programme. This task covers scientific as well as operational aspects.

Additionally, it is recommended to undertake so-called Early Trials. Although the EUROCONTROLmember states already gained experience with the use of GPS in their airspace, the step towards theuse of EGNOS is expected to result in notable changes to navigation operations. Therefore, it is verybeneficial for the member states to gain experience with the use of the system as soon as possibleby undertaking early trials. Such trials are of particular importance to EUROCONTROL because theywill support the development of suitable validation methods that will be applied in later stages of theEOT&V programme.

Based on these initial activities, the detailed definition of the remaining EOT&V programme can beundertaken. This definition phase will lead to the development phase and finally to the implementa-tion phase, in which the actual test & validation activities will be undertaken. ‘Real Life’ tests andmeasurements will provide the backbone of the implementation phase. It is important that therequirements for these operational tests are well considered, since a careful choice of operationaltests will minimise the number of (expensive) tests required whilst ensuring that sufficient data iscollected to allow the validation of the entire EGNOS operation. Further activities are necessary inorder to extrapolate the measurements made during the operational tests.

The EOT&V programme will be completed by the Member States’ operational approval of EGNOS-based flight procedures in their airspace.


EEC report No. 342 ix

EUROCONTROL

CONTENTS

1 INTRODUCTION ....................................................................................................................... 1

1.1 BACKGROUND ....................................................................................................................... 11.2 THE EGNOS LIFE CYCLE....................................................................................................... 31.3 SEPARATION OF TECHNICAL VERIFICATION AND OPERATIONAL VALIDATION................................... 41.4 OBJECTIVES OF TECHNICAL VERIFICATION ................................................................................ 51.5 MULTI-MODAL OPERATIONAL TEST AND VALIDATION .................................................................. 51.6 SCOPE OF EGNOS OPERATIONAL TEST & VALIDATION FOR CIVIL AVIATION................................. 61.7 PURPOSE OF THIS DOCUMENT................................................................................................. 7

2 GNSS-1 PROCEDURES AND OPERATIONAL REQUIREMENTS............................................ 9

2.1 OPERATIONAL USE................................................................................................................. 92.1.1 Flight Procedures based on EGNOS ..............................................................................................92.1.2 Operational Capabilities................................................................................................................10

2.2 GENERAL NAVIGATION PERFORMANCE REQUIREMENTS............................................................ 102.3 GNSS SIGNAL-IN-SPACE REQUIREMENTS.............................................................................. 112.4 EGNOS SYSTEM PERFORMANCE REQUIREMENTS USED FOR EGNOS PHASE B2-X DESIGN....... 12

2.4.1 Assumptions..................................................................................................................................122.4.2 EGNOS AOC Capabilities .............................................................................................................152.4.3 EGNOS FOC Capabilities .............................................................................................................16

3 PROPOSED ELEMENTS OF AN EGNOS TEST & VALIDATION PROGRAMME................... 17

3.1 METHODOLOGY FOR VALIDATING RNP COMPLIANCE ................................................................ 173.2 ANALYSIS OF OPERATIONAL INFLUENCES ON RNP ................................................................... 18

3.2.1 Dependency upon GPS and GLONASS .......................................................................................183.2.2 Aircraft Characteristics and Dynamics ..........................................................................................193.2.3 Masking .........................................................................................................................................213.2.4 Coverage Area ..............................................................................................................................213.2.5 Multipath........................................................................................................................................223.2.6 Interference ...................................................................................................................................233.2.7 Atmospheric Effects.......................................................................................................................23

3.3 DEVELOPMENT OF FLIGHT INSPECTION PROCEDURES FOR EGNOS BASED OPERATIONS ............. 253.3.1 Introduction ...................................................................................................................................253.3.2 Flight Inspection Procedures.........................................................................................................263.3.3 Normalisation of Results ...............................................................................................................283.3.4 Periodicity for EGNOS Flight Inspection .......................................................................................28

3.4 VALIDATION TOOLS AND EQUIPMENT ...................................................................................... 293.4.1 Test Equipment .............................................................................................................................293.4.2 Available Measurements ...............................................................................................................303.4.3 Requirements for Data Analysis Tools ..........................................................................................313.4.4 Requirements for Simulation Tools ...............................................................................................353.4.5 Identification of Existing Tools.......................................................................................................35

3.5 SUMMARY........................................................................................................................... 39

4 PROPOSED EOT&V PROGRAMME ....................................................................................... 43

4.1 PROJECT MANAGEMENT PLAN............................................................................................... 434.1.1 Work Package Descriptions ..........................................................................................................444.1.2 Time Scale ....................................................................................................................................53

4.2 COST ESTIMATES................................................................................................................. 534.2.1 Assumptions..................................................................................................................................554.2.2 Effort and Cost Assessment ..........................................................................................................554.2.3 Cost Summary...............................................................................................................................61

4.3 QUALITY ASSURANCE........................................................................................................... 614.3.1 Objectives......................................................................................................................................614.3.2 Verification Measures....................................................................................................................634.3.3 Quality Assurance Procedures......................................................................................................634.3.4 References ....................................................................................................................................64

5 CONCLUSIONS....................................................................................................................... 65


x EEC report No. 342

EUROCONTROL

Traduction en Français du préface, du résumé, de l’introduction, des objectives et des conclusions 67

APPENDIX A: TECHNICAL ANNEX............................................................................................... 81

APPENDIX B: EGNOS OT&V AS AN INPUT TO SAFETY REGULATION....................................125

APPENDIX C: ABBREVIATIONS ..................................................................................................133

APPENDIX D: DEFINITIONS.........................................................................................................139

APPENDIX E: REFERENCE DOCUMENTS ..................................................................................147


EEC report No. 342 1

EUROCONTROL

1 INTRODUCTION

The purpose of this document is to propose a programme for the EGNOS (European GeostationaryNavigation Overlay Service) Operational Test and Validation (EOT&V). This programme shall verifywhether EGNOS meets the requirements of civil aviation users in the operational environment.Operational Test and Validation of EGNOS, with regards to the civil aviation user requirements, isthe responsibility of EUROCONTROL as part of its commitment to the European Tripartite Group(ETG). Practically, EUROCONTROL will have a co-ordinating role for EOT&V with the relevantnational and international authorities contributing to the EOT&V process.

This document is the final delivery of the “EGNOS Operational Test & Validation RequirementsStudy“. It has been prepared on behalf of EUROCONTROL by a team led by Avionik ZentrumBraunschweig (Germany) with the participation of Roke Manor Research (UK), the Civil AviationAuthority of UK and the Technical University of Braunschweig (Germany).

1.1 Background

The European contribution to the current constellation of satellite navigation systems is the EuropeanGeostationary Navigation Overlay Service (EGNOS). Its preliminary design was completed during1998 and the system is expected to reach Advanced Operational Capability (AOC) by 2003.

The European efforts on future satellite navigation services (including EGNOS) are co-ordinated bythe European Tripartite Group (ETG), which brings together the European Organisation for theSafety of Air Navigation (EUROCONTROL), the European Space Agency (ESA) and the EuropeanCommission (on behalf of the European Union). Each organisation is contributing with its experience,expertise and funding to the EGNOS programme.

The ETG’s mandate is supported by government decisions at national and European Union level. Inparticular, the European Union is drafting an Action Programme with the support of the ETGmembers, European member states and international organisations to set up an institutional andtechnical framework for the development of GNSS for civilian use.

Within the ETG, the following responsibilities are defined:

• The European Commission is responsible for institutional and policy matters, ensuring thatviews of all potential users are taken into consideration in the framework of the overall pro-gramme. Additionally, the European Commission is responsible for multi-modal user issues.

• EUROCONTROL is defining the mission requirements for civil aviation and will be responsible forthe operational test and validation of EGNOS with regards to the aviation user requirements.EUROCONTROL’s work will be carried out in co-operation with the relevant national and supra-national aviation authorities.

• The European Space Agency (ESA) is responsible for the management of all EGNOSdevelopment, deployment and technical validation activities. ESA will make its contributionthrough its Advanced Research in Telecommunications Systems (ARTES) programme.

The EGNOS System

The existing satellite navigation systems GPS and GLONASS, as single systems, can not satisfy anumber of user requirements, especially for safety of life applications such as aviation. In order toovercome at least some of these problems, so-called augmentation systems have been developed.Currently, there are three Space-Based Augmentation Systems (SBAS) under development: theWide Area Augmentation System (WAAS) in the United States, the European GeostationaryNavigation Overlay Service (EGNOS) in Europe and the Multi-Transport Satellite-based Augmenta-tion System (MSAS) in Japan. These systems will broadcast data via navigation payloads ongeostationary satellites and are intended to meet primary or even sole means1 civil aviationrequirements for all phases of flight down to Cat I precision approach.

1 A remark on the use of the term “Sole Means of Navigation“ is given in Appendix D.


2 EEC report No. 342

EUROCONTROL

All wide area augmentation systems will provide three major functions:

• Ranging: GPS-like ranging signals will be provided, which will augment the number of navigationsatellites available to GPS users and therefore the availability of GPS-based navigation usingReceiver Autonomous Integrity Monitoring (RAIM).

• Integrity Channel: This function will provide a broadcast of GPS integrity data. This will increasethe availability and safety of GPS navigation services.

• Wide Area Differential (WAD): This function will provide broadcast of differential correction datavalid for GPS satellites. This will increase the GPS navigation system performance, mainly itsaccuracy (especially for approaches).

All three augmentation systems in combination will achieve a near global broadcast coverage.However, for parts of the systems’ functions dedicated ground networks are required. This fact limitsthe currently foreseen service areas.

In contrast to WAAS and MSAS, EGNOS also comprises an augmentation of the RussianGLONASS.

The EGNOS system will be developed in two phases, an Advanced Operational Capability (AOC)using the navigation transponders on-board two INMARSAT-III satellites (AOR-E and IOR) and oneon-board the ARTEMIS satellite, followed by a Full Operational Capability (FOC) implementing full-scale system deployment in order to meet primary or sole means civil aviation requirements for allphases of flight down to Cat I precision approaches.

EGNOS Time Schedule

The EGNOS system is designed for a lifetime of 15 years covering the AOC (Advanced OperationalCapability) and FOC (Final Operational Capability) phases. The time schedule for the development ofthe EGNOS AOC system is shown in Figure 1-1.

1996 1997 1998 1999 2000 2001 2002

Initial Phase

Baseline System Design

Early Trials

Phase B-Extension

Step 1: GEO Ranging

Development

Deployment & Verification

Operation (AOR-E + IOR)

Step 2: GIC/WAD Test Bed

Development & Integration

Verification

Operation

Step 3: Operational AOC

GIC/WAD Development


Initial Operation

Milestones ORRFQRCDRPDR

Figure 1-1: EGNOS AOC Schedule2

2 Source: ESA GNSS1 Program Office, 12 March 1998



EUROCONTROL

In Figure 1-1 the following milestones are shown:

• PDR - Preliminary Design ReviewThe PDR is the final milestone before the start of the GIC/WAD Development.

• CDR - Critical Design ReviewThe CDR represents the acceptance by ESA of the system design proposed by the industrialconsortium. The purpose is to check that the design is in accordance with the system require-ments and no disagreement can be identified.

• FQR - Factory Qualification ReviewOnce the system design has been accepted the following steps are the manufacturing and in-factory integration of the equipment. After the completion of all development activities this mile-stone takes place. The purpose of this review is to check that the system components have beensuccessfully developed according to the system requirements.

• ORR - Operational Readiness ReviewThe on-site deployment starts and is followed by the system integration and technical validationwhich, when successful, leads to this milestone. After the ORR, EGNOS is considered to betechnically validated. It implies the acceptance by ESA of the system developed by the industrialconsortium.

1.2 The EGNOS Life Cycle

The EGNOS system life cycle covers all phases from the mission requirements through the systemdesign and development phases to the system integration and validation and finally to the missionservice qualification (see Figure 1-2).

Subsystem Inte-gration & Validation

SubsystemSpec. & Design

Development

SystemDesign

SystemIntegration

SystemValidation

SystemRequirements

Mission Service Qualific.CA / Maritime / Land

Mission RequirementsCA / Maritime / LandUser Community Mission

System

Multi-modal OT&V

TechnicalVerification

CDR

FQR

ORR

ESA

PDR

PreliminaryDesign

PreliminaryDesign

DetailedDesign

DetailedDesign

Figure 1-2: EGNOS System Life Cycle

Figure 1-2 shows the EGNOS system life-cycle by means of a ‘V’ diagram that provides a graphicaloverview of the complete process that leads to the operation of EGNOS.The ‘V’ diagram starts with the translation of the mission requirements into a set of systemrequirements. The development process consists of the following steps:

• Top-Down:system requirements, system design, subsystem specification & design, development

• Bottom-Up:development, subsystem integration & validation, system integration, system validation



EUROCONTROL

Additionally, the major verification steps are also illustrated in Figure 1-2. The preliminary design isfinalised by the Preliminary Design Review (PDR), leading to the final design. After that, the CriticalDesign Review (CDR) is undertaken before the development starts. Before the system integration,the Final Qualification Review (FQR) is undertaken and the final step with regards to the technicalverification that is co-ordinated by ESA is the Operational Readiness Review (ORR).

The final step leads to the mission service qualification for the multi-modal use of EGNOS. Thisdocument addresses the operational test and validation with regards to the civil aviation (CA) sector.

The ‘V’ diagram also helps to distinguish between EOT&V and the technical verification programme.ESA developed the EGNOS system requirements on the basis of the operational user requirements(also called mission requirements). There is a potential problem because the mission requirementsfor civil aviation are not consolidated yet. They are based upon the ICAO RNP parameters and mayalso be influenced by regional operational aspects such as traffic density, airspace complexity,existence of alternate navigation aids, etc. It is important that the actual operational (mission)requirements will be consolidated before the detailed EOT&V activity definition starts. However, itcan be assumed that this requirement consolidation will only change some requirement values butnot the requirements itself. Therefore, the development of the EOT&V programme is mostlyindependent of the actual requirement values. The general validation activities that have to beundertaken remain the same.

1.3 Separation of Technical Verification and Operational Validation

ESA and the EGNOS contractor will carry out a technical verification programme to establish that theservice provided by EGNOS conforms to the specified system requirements [2], after which thesystem can be accepted by ESA. These verification activities will include practical measurements ofthe system performance with a prototype user receiver specifically designed for that process.

On top of this, EUROCONTROL will co-ordinate the Operational Test and Validation of EGNOS,against the civil aviation performance requirements. This process has to consider all thoseoperational aspects that will not be considered in the technical verification activities. EOT&V willassume that the technical validation process has successfully validated the EGNOS SIS (Signal inSpace) in accordance with the system performance requirements.

More specifically, the ESA verification programme will ensure that EGNOS meets the SIS perfor-mance, as specified in the system requirements document, all over the coverage area. After that,EOT&V needs to demonstrate, whether EGNOS actually fulfils the aviation user requirements forspecific flight phases.

The technical verification programme will ensure that the system requirements are met, whileEOT&V will validate EGNOS against the operational user (mission) requirements. A brief timeschedule, in which the different activities are shown, can be found in section 4.1.2 (Figure 4-3).

The technical verification process will be completed by the technical acceptance of the EGNOSsystem through ESA. After that, the initial operation phase of EGNOS will begin. The EOT&Vprogramme will begin as soon as reasonably possible with the main test campaigns to be undertakenas soon as a complete SIS will be available. However, initial measurements may also be undertakenwith a preliminary SIS (e.g. generated by the EGNOS System Test Bed - ESTB). The core of theEOT&V programme will be finished by the operational acceptance of the EGNOS system, whichconcludes the pre-operational EGNOS phase.

Due to the characteristics of the technical verification process and EOT&V, some validation activitieswill overlap. Additionally, it has to be noticed that the EGNOS System Requirements Document(SRD) is mainly based on the civil aviation mission requirements. This increases the potential foroverlapping activities. However, it is an important objective of the EUROCONTROL EOT&Vprogramme definition to limit these overlapping activities to the smallest possible extent. Therefore, aclose co-operation between the two teams undertaking the technical and the operational test andvalidation has to be established.



EUROCONTROL

1.4 Objectives of Technical Verification

The objective of the technical verification activities being co-ordinated by ESA is to qualify that thesystem meets its requirements and can sustain the performance throughout the lifetime of thesystem. The validation will be a dedicated process, as far as possible, independent from the systemdesign activities.

The performance verification will be End-to-End including the user segment in operationallyrepresentative environmental conditions making use of the signals from GPS, GLONASS and theEGNOS GEOs. This will include the detailed investigation of worst-case scenarios. ESA is planningpractical trials in all three major user domains (aircraft, ships, land mobiles).A number of verification tools will be developed under the ARTES-9 programme for the technicalverification process. A reuse of these tools in the EOT&V programme is recommended but the actualpossibilities need to be investigated in more detail. A description of these ESA tools is given insection 3.4.

Safety Aspects within the Technical Verification

The technical verification process will validate all performance requirements and be sufficient forESA to accept the system from the contractor. Further work will be necessary to satisfy Civil AviationSafety Regulators that the performances are met and ESA plans to provide support in this.

The technical validation leads to the acceptance of the system developed by the EGNOS industryteam. The technical validation considers a number of safety reviews, but it is important to highlightthat they are limited to system aspects. Safety aspects are limited to verify compliance with certaindevelopment standards and with the following general safety requirements, as specified by ESA inthe EGNOS AOC System Requirements Document (Issue 1, revision 1)[2]3:

• EGNOS system design for AOC steps 2 and 3 shall be such that no single failure or operatorerror could have critical or catastrophic consequences.

• Multiple failures resulting from a hardware or software common mode of failure shall be taken intoaccount as a single failure.

• EGNOS system design for AOC steps 2 and 3 shall be such that no combination of two failures ortwo operator errors or one failure and one operator error shall have catastrophic consequences.

With the following assumptions:• A ground segment event is considered as having catastrophic consequences when it may induce

at user level a loss of integrity of the navigation system.• A ground segment event is considered as having critical consequences when it may induce at

user level a loss of continuity of the navigation system.• A ground segment event is considered as having critical consequences when it may induce a loss

of the EGNOS system monitoring and control function during more than a specified time interval.

1.5 Multi-Modal Operational Test and Validation

The aim of the multi-modal operational test and validation is to verify that EGNOS fulfils the variousperformance requirements of the user community (civil aviation, maritime, land etc.). This reportcovers the civil aviation aspects of these multi-modal activities.

Although the EUROCONTROL EOT&V programme will only consider the applications of EGNOS withrespect to the aviation community, many of the results and conclusions can be extrapolated to landand maritime users. This is mainly due to the fact that the aviation sector has the most demandingperformance requirements of all potential EGNOS user groups (maybe with the exception of somesafety critical rail applications).

The EUROCONTROL EOT&V programme could provide important input for many applicationsoutside the civil aviation sector that require a comprehensive test and validation approach.

3 An updated version of the System Requirements Document does exist but is still under negotiation.



EUROCONTROL

Generally, all safety-of-life applications (e.g. in the maritime or railway sector) require dedicatedsystem validation procedures in order to ensure that the specific requirements for each applicationare fulfilled by the EGNOS system. There may also be some other applications (e.g. in the roadtransport sector) that are not safety-of-life critical but require stringent validation procedures due toother reasons, e.g. because of high financial risks that may be involved.

Within the European Tripartite Group, one task of the European Commission is to focus on multi-modal transport users. Therefore, the European Commission will launch a study in January 1998titled “Multi-modal Safety Satellite System for Transport (MUSSST)“. One objective of this project willbe to specify and develop a multi-modal test-bed for satellite-based navigation systems. The work willhave to be done under close consideration of available results from validation and certificationstudies on EGNOS.

1.6 Scope of EGNOS Operational Test & Validation for Civil Aviation

The EGNOS Operational Test & Validation (EOT&V) Programme shall validate the performance ofEGNOS versus the civil aviation requirements. As one of the first activities, EUROCONTROLlaunched the EOT&V Requirements Study of which the aim was to define exact requirements andparameters that have to be validated and to propose an appropriate plan for the forthcomingEUROCONTROL activities on EOT&V.

At the beginning of the EOT&V Requirements Study, the main steps towards the operational test andvalidation of EGNOS were defined as follows:

• Consolidation of Operational Requirements of Aviation on EGNOS• Identification of necessary test and validation activities and required tools• Procurement/Development of:

- analysis tools- test equipment- test procedures- test tools

• Conduct Test Campaigns

Principally, the activities to be undertaken in the scope of the EOT&V process can be divided intothree broad categories, which are:

1. RNP related issues2. Operational issues3. Safety Issues

In this report, the focus has been set on the first category, i.e. test and validation of EGNOS againstthe RNP parameters down to sole means Category I approach in the operational environment.Activities are proposed for RNP validation in the real operational environment considering aspectssuch as aircraft manoeuvres and dynamics, influences on the signal reception such as masking,multipath, interference etc.

The „operational issues“ category covers issues such as flight inspection, collision risk models,aspects relating to the EGNOS system operation and EGNOS maintenance issues as well asinterfaces with ATC. For the operational environment, validation is seen to include traffic manage-ment and controller workload aspects. Most of these aspects are not covered in this document,although during the course of this study it became obvious that these issues are of high importanceand should therefore be regarded in more detail later in the EOT&V process (see section 4.1.1.1 -EGNOS validation framework review).

The third category „safety issues“ is mainly covered by the ETG Safety Assessment Team. AppendixB describes the interfaces between the EOT&V process and safety regulatory issues.

EOT&V has to be seen as only an element of a full scale GNSS validation. Therefore, not all aspectsnecessary for the validation of GNSS fit into the scope of EOT&V. For example, some aspects would



EUROCONTROL

be part of a broad GNSS OT&V, such as SARPs validation, analysis of TLS in relation to GNSSconfiguration, SARPs to mission requirements translation etc.

1.7 Purpose of this Document

The objective of the EOT&V process for civil aviation is to demonstrate the qualification of EGNOSto meet the civil aviation operational requirements at all necessary levels.

The EOT&V process has to be undertaken in order to facilitate the acceptance (by the nationalaviation administrations and Air Traffic Service (ATS) Providers of the ECAC member states) ofaircraft operations based on the use of EGNOS. More specifically, EGNOS requires validation inrespect of the civil aviation performance requirements specified in terms of availability, integrity,accuracy and continuity of service.

Currently, the work regarding the EOT&V programme is part of the work of the EUROCONTROLSystem Research and Development (SRD) Task Force. The overall EOT&V programme was startedwith a so-called Requirements Study to define the objectives and requirements for the EOT&Vprocess.

This document proposes an outline of the EGNOS Operational Test & Validation Programme that isintended to be undertaken by EUROCONTROL in close co-operation with the Member States. Theaim of the EOT&V Requirements Study was to define the objectives of the entire EOT&V programmetaking into consideration the requirements of those European States that are intending to offeroperational services using EGNOS. This includes a consolidation of the operational requirements forthe system, definition of the boundary between technical validation and operational validation and topropose test and validation activities that will be necessary for the operational validation of EGNOSin terms of RNP. The study also includes the identification of the necessary test equipment and dataanalysis tools. Additionally, a project management plan has been proposed for the following phasesof the EOT&V programme.

The remainder of this document is structured as follows:

• Section 2 describes the operational procedures and requirements for the use of EGNOS. Theoperational performance requirements are listed and the section is completed by a summary ofthe GNSS Signal-In-Space requirements, as specified by the ICAO GNSS Panel, and the EGNOSsystem performance requirements used by ESA for the EGNOS development.

• Section 3 develops the requirements for the EGNOS Operational Test & Validation Programme.The principal validation methods are discussed and a theoretical approach to the validation ofEGNOS is developed. Additionally, the validation of operational influences on RNP is discussedand validation activities that are needed for EOT&V are proposed.

• Section 4 provides an outline of the EOT&V programme plan, including the definition of a projectstructure and a time schedule. Additionally, cost issues and quality assurance measures arediscussed

• Section 5 summarises the content of this document and provides its conclusion.

• Appendix A is the technical annex to this report providing a description of the EGNOS systemarchitecture and describing technical details relevant for the EOT&V process, for example theoperational influences on RNP and the impact of these operational issues as well as detailedinformation with regards to RNP parameter validation.

• Appendix B describes the interface of EOT&V to the Safety Regulation Process

• Appendix C provides a list of abbreviations used in this document.

• Appendix D provides definitions of important terms used in this document.

• Appendix E supplies a list of reference documents.



EUROCONTROL




EUROCONTROL

2 GNSS-1 PROCEDURES AND OPERATIONAL REQUIREMENTS

This chapter addresses the operations that EGNOS is expected to support, and the requirementsupon the EGNOS system to allow these operations, together with assumptions made on the EGNOSSignal-In-Space in order to meet these requirements.

Strictly speaking, EGNOS is only an overlay service to GPS and GLONASS. Therefore, with regardsto operational validation, the following three elements of GNSS-1 have to be considered:

• GPS and GLONASS;• the overlay service for the augmentation of GPS and GLONASS;• the receiver (including RAIM function and SBAS capability).

2.1 Operational Use

This section addresses the impact of EGNOS upon aviation operations and considers the potentialoperational use of the service.

The implementation of EGNOS for civil aviation will not only affect existing operations, but couldallow new operations to be defined. Current and new operations and capabilities are presented in thefollowing two sub-sections.

2.1.1 Flight Procedures based on EGNOS

The NPA and IPV (Instrument Procedure with Vertical Guidance) are two flight phases that havebeen identified to benefit from the introduction of EGNOS. RNAV in the En-route and Terminal Areaflight phases will also be supported by the introduction of EGNOS and is addressed in section 2.1.2.

En Route

EGNOS should allow all current en-route and TMA operations.

Non Precision Approach

EGNOS has the potential to improve NPA procedures. Currently, an NPA is performed using groundbased navigation aids, such as DME and NDB. In order for the pilot to capture the NDB and thenestablish the aircraft on the approach, several procedural turns may be required. This process canextend the flight time of the aircraft depending upon the entry point made into the TMA and theorientation of the runway. The navigation function provided by EGNOS may allow a more directrouting towards the airfield, thus reducing the overall flight time.

Instrument Procedure with Vertical Guidance (IPV) and Precision Approaches

The ICAO All Weather Operations Panel introduced this Operation which lies somewhere between aNPA and Cat I precision approach. In some States there are already operations being conductedwith lateral requirements consistent with NPA and also a vertical requirement on accuracy. Theseoperations are performed using a barometric altimeter as an input to the flight management system.This allows a smooth descent profile to be executed instead of the more usual step-down approach.

EGNOS is intended to provide a uniform navigation performance, which supports Cat I, precisionapproach operations over all the landmasses of ECAC. Even in degraded mode EGNOS is likely tosupport IPV procedures. This may prove to be most useful outside the core area of ECAC where thelow density of monitor stations will result in a degraded accuracy performance whilst maintaining theintegrity and continuity of service.

EGNOS is also intended to provide a precision approach capability to all airfields in the coverageregion. The RNP 0.02/40 (Cat I) will allow operators to perform approaches to airfields with bothlateral and vertical guidance down to a decision height of 200 feet. Although many major Europeanairports have at present precision approach aids (ILS, MLS), the ability to perform a precision



EUROCONTROL

approach anywhere within the coverage area has obvious benefits for operators who will beoperating to runways not currently equipped.

2.1.2 Operational Capabilities

This section identifies further new operational capabilities which EGNOS is foreseen to be able tosupport.

Uniform level of coverage

EGNOS will provide a uniform level of navigation performance across the ECAC Service Area. Thiswill provide benefits in regions where current ground based navigation aids are insufficient, or arenot maintained to a sufficiently high standard. The use of EGNOS in these regions will allownavigation concepts, such as B-RNAV and future P-RNAV, to be maintained and extended across alarge proportion of the ECAC airspace.

Area Navigation

Area Navigation (RNAV) is an airspace concept that allows routes to be defined independent of thelocation of ground based navigation aids. Two RNAV types have been defined in theEUROCONTROL RNAV-standard: Basic Area Navigation (B-RNAV) and Precision Area Navigation(P-RNAV). B-RNAV defines RNAV for European operations that satisfy a required track keepingaccuracy of +/- 5 nautical miles for at least 95% of the time (RNP5). This level of navigationperformance is comparable with that which can be achieved by conventional navigation techniqueson ATS routes defined by VOR/DME (when VORs are less than 100 nautical miles apart). P-RNAVdefines RNAV for European operations that satisfy a required track keeping accuracy of +/- 1nautical mile for at least 95% of the time (RNP1).

In the En-route phase of flight, EGNOS will be able to provide B-RNAV capability to areas of Europewhere there is currently insufficient ground infrastructure, or where the ground infrastructure is notmaintained to a high enough standard to support BRNAV. It is also possible that in the future P-RNAV may be supported through the use of EGNOS.

Departure and Arrival Routing

EGNOS has the potential to benefit aircraft departing a Terminal Manoeuvring Area (TMA). Onarrival and departure, both the aircraft operator and the airport are seeking to best route an aircraft inand out of the TMA. This will allow optimisation of the route structure in the TMA such that noisepollution is kept to a minimum while maintaining airport capacity. The additional navigation flexibilityprovided by EGNOS could provide alternative routes for aircraft above current Standard InstrumentDeparture (SID) and Standard Terminal Arrival Routes (STAR) routes.

Curved Approaches

Approaches to airfields are currently achieved by procedural turns using ground based navigationaids, and landing guidance provided by navigation aids installed at the airfield. EGNOS has thepotential to improve operations limited by the location of ground based navigation aids, and providethe capacity to perform curved approaches. This ability to perform curved approaches not onlyprovides improved routing, but also allows additional flexibility where terrain may limit the potentialoperations at a given airfield.

2.2 General Navigation Performance Requirements

The International Civil Aviation Organisation (ICAO) has defined aviation performance requirementsby the development of the Required Navigation Performance (RNP) concept. The navigationperformance required for various phases of flight (e.g. En-route, or non-precision approach) aredefined by various RNP levels.

The RNP levels are generally referred to by the total system accuracy requirement in nautical miles.For example, RNP20 would be the set of RNP parameters with a minimum accuracy requirement of+/-20 nautical miles from the desired track.



EUROCONTROL

The RNP concept does not specify how the aircraft is to meet a given RNP level, but only whatperformance criteria must be met in order to maintain it. The RNP levels are defined by fourparameters, which are:

• Accuracy• Integrity• Availability• Continuity of Service (CoS)

The RNP parameters define the performance requirements for the total navigation system. The term‘Total System’ refers to the total system employed to determine and control the aircraft’s positionrelative to the desired trajectory, and includes both the navigation system and the pilot or auto-pilotcontrolling the aircraft. This definition for the RNPs determines a Total Navigation Performancerequirement. The error associated with the total system is the Total System Error (TSE, seeAppendix A.6.2 and Appendix D).

At present, the only available official ICAO document on RNP is the „Manual on the RequiredNavigation Performance (RNP)“. This document only covers the parameters down to RNP1 and onlydescribes accuracy requirements. The ICAO AWO panel has worked on the extension of the RNPconcept below RNP1. AWOP has developed draft material on this subject (including requirements forintegrity and continuity) that has not been approved yet.

The following Table 2-1 details the navigation system performance requirements as defined by ICAO(including the preliminary AWOP material). The integrity and continuity risk for RNP1 and RNP4were taken from RTCA DO-236 and EUROCONTROL RNAV standards. It must be noted however,that the values quoted in these tables are the latest values available, and that in the test andvalidation programme the latest values at that time shall be used.

RNP Value (95% TSE)

Parameter 20 12.6 4 1 NPA Cat I

Accuracy 20 nmi 12.6 nmi 4 nmi 1.0 nmi 0.3 nmi 37m horiz.12m vert.

IntegrityRisk

10-5 / h 10-5 / h 10-5 / h 3.5 10-7 peroperation

(6s time to alert)

Availability 0.95 0.9975

ContinuityRisk

10-4 / h 10-4 / h 10-4 / h 10-5

in any 15sSource: Eurocontrol, 9th April 1998Note: Where no value is given there is no published requirement.

Original Sources: ICAO RNP Manual ICAO AWOP RTCA

Table 2-1: RNP Requirements

2.3 GNSS Signal-In-Space Requirements

This section lists the GNSS Signal-In-Space Requirements as defined by the ICAO GNSS Panel(Working Group B) in the draft SARPs document. It has to be noted that the requirement valueshave not been finalised yet and are still evolving.

Figure 2-1 describes the desirable derivation of these requirements. At the top of the diagram the so-called ICAO overall Target Level of Safety (TLS) is shown. The TLS is usually established by ICAObased upon historical records of aircraft accidents and incidents and takes into account the desiredaim to improve safety in circumstances where a steady annual growth in the number of air transportoperations occurs. The TLS is based upon the probabilities associated with risks from all causes andtakes into account the time of exposure to risk. [8]



EUROCONTROL

ICAO TLS

ICAO RNP(TSE)

FTE Assumptions

ICAO GNSSSARPs (NSE)

Figure 2-1: Derivation of ICAO GNSS SARPs [8]

From the desired overall TLS, ICAO has derived a set of performance requirements for the differentRNP levels. This is a very difficult process and is in Europe currently being addressed by the safetywork co-ordinated by EUROCONTROL. Table 2-2 lists the requirements as they were proposed atthe ICAO GNSS Panel meeting in August 1998 [6]. The requirements only apply to the Signal-In-Space, i.e. the GNSS receiver is considered to be fault-free. The fault-free receiver is defined to be areceiver with nominal accuracy performance and it is assumed to have no failures contributing to theintegrity and continuity performance.

It is important to notice that a range of values is given for a number of the GNSSP requirements. Theselection of target values within the given margins has to be based on factors such as the intendedoperations, air traffic density, airspace complexity and existence of alternate navigation aids. Theresponsibility for the target value selection is with the European Civil Aviation Authorities.

2.4 EGNOS System Performance Requirements used for EGNOSPhase B2-X Design

This section addresses the EGNOS system performance requirements as defined by ESA for theEGNOS Phase B2-X design. The requirements in this section have been taken from the EGNOSSystem Requirements Document (Issue 1, revision 1)[2]. These requirements are based on theGNSS Signal-in-Space requirements as developed by the ICAO GNSS Panel (see section 2.3). TheEGNOS requirements are intended to be compliant with or encompass the ICAO GNSSP require-ments.

2.4.1 Assumptions

The EGNOS performance requirements are intended to be met under the assumptions described inthis section regarding the space segment and the user segment [2].

GEO Space Segment

There is no replacement policy established for the INMARSAT satellites in case of definitive failure ofthe navigation service. Therefore, the long-term outage duration can not be derived. But without thisdata the derived availability prediction is impossible. In order to provide the user some indication onthe availability of the AOC navigation service, all availability requirements have been based on theassumption that the long term outage duration of the space segment is zero. However, short-termoutages of the INMARSAT satellites are considered.

With regards to FOC, a GEO satellite policy will be established and in orbit spare satellites will beprovided at FOC. This would significantly reduce the probability of long term outages.



EUROCONTROL

GPS and GLONASS Space Segment

It is assumed that the GPS and GLONASS constellations and SIS are compliant with their relevantspecifications.

The assumed GPS performance is mainly derived from the WAAS specification by the US FAA. Thefailure model is limited to three simultaneous GPS satellites declared in failure.

The outage rates and outage duration of the GLONASS satellites as well as the integrity outage ratesare not published, and are therefore assumed as being identical to those of GPS. This assumptionhas a low level of confidence and is therefore planned to be refined during the EGNOS developmentphase.

GNSS SIS En Route En Route,Terminal

Initial Appr.,NPA,

Departure

InstrumentApproach withVertical Gui-dance (IPV)

Cat IPrecisionApproach

Associated RNP Types 20 to 10 5 to 1 0.5 to 0.3 0.3/125 0.3/50 to0.02/40

Accuracy, lateral (95%) 2.0 nmi 0.4 nmi 220 m 220 m 16.0 m

Accuracy vertical (95%) n/a n/a n/a 9.1 m 7.7 to 4.0 msee note 3

Integrity 1-10-7/h 1-10-7/h 1-10-7/h 1-2x10-7

per approach1-2x10-7

per approach

Time to Alert 5 min 15 s 10 s 10 s 6 s

Alert Limit, lateral 4 nmi 2 to 1 nmisee note 4

0.3 nmi 0.3 nmi 40m

Alert Limit, vertical n/a n/a n/a 22.8 m 20.0 to 10.0m

see note 3

Continuitysee note 1

1-10-4/h to1-10-8/h

1-10-4/h to1-10-8/h

1-10-4/h to1-10-8/h

1-8x10-6

in any 15 s1-8x10-6

in any 15 s

Availabilitysee note 2

0.99 to0.99999

0.999 to0.99999

0.99 to0.99999

0.99 to0.99999

0.99 to0.99999

Note 1: A range of values is given for the continuity requirement for en route operations, initial approach, NPA, departureoperations, as this requirement is dependent upon several factors including the intended operation, traffic density, complex-ity of airspace and availability of alternative navigation aids. The lower value given is the minimum requirement for areaswith low traffic density and airspace complexity.

Note 2: A range of values is given for the availability requirements as these requirements are dependent upon the size and durationof the outages, availability of alternate navigation aids, radar coverage, traffic density, reversionary operational procedures.The lower values given are the minimum availability requirements for which a system is considered to be practical but arenot adequate to replace non-GNSS navigation aids. For en route navigation, the higher values given are adequate for GNSSto be the only navigation aid provided in an area. For approach and departure, the higher values given are based upon theavailability requirements at airports with a large amount of traffic assuming that operations to or from multiple runways areaffected but reversionary operational procedures ensure the safety of the operation.

Note 3: A range of accuracy performance requirements is specified for Cat. I precision approaches. The minimum value is basedupon ILS specifications to minimise the validation and aircraft certification impact. For performance that is not consistentwith ILS specifications, operational procedures or restrictions may apply. These may include: increased decision height (e.g.350 feet), increased visibility requirements, use of a caution to indicate when performance is marginal to raise the decisionheight or visibility during these times, mandatory carriage of specific airborne equipment to reduce the flight technical error.

Note 4: The horizontal alarm limit of 2 nautical miles is valid for RNP2 to RNP5. The value 1 nautical mile is valid only for RNP1.

Table 2-2: GNSS Signal-In-Space Performance Requirements from ICAO GNSS Panel [6]



EUROCONTROL

EGNOS Coverage Area / Service Volume Assumptions

The EGNOS ranging service will be available over an area defined by the Geostationary BroadcastArea (GBA) of the SIS. The GBA is defined as the area on ground where a GEO satellite is alwaysvisible with an elevation angle higher than 5°.

-40 -30 -20 -10 0 10 20 30 4020

30

40

50

60

70

Figure 2-2: Required EGNOS Coverage Area

State EURO-CON-TROL

EU EOG ESA State EURO-CONT-ROL

EU EOG ESA

France ✔ ✔ ✔ ✔ FYROM ✔

Germany ✔ ✔ ✔ ✔ Hungary ✔

Italy ✔ ✔ ✔ ✔ Malta ✔

Spain ✔ ✔ ✔ ✔ Monaco ✔

UK ✔ ✔ ✔ ✔ Norway ✔ ✔

Austria ✔ ✔ ✔ Romania ✔

Belgium ✔ ✔ ✔ Slovak ✔

Denmark ✔ ✔ ✔ Slovenia ✔

Greece ✔ ✔ Switzerland ✔

Ireland ✔ ✔ ✔ Turkey ✔

Luxembourg ✔ ✔ Finland ✔ ✔

Netherlands ✔ ✔ ✔ ArmeniaPortugal ✔ ✔ EstoniaSweden ✔ ✔ ✔ IcelandBulgaria ✔ LatviaCroatia ✔ LithuaniaCyprus ✔ MoldovaCzech Republic ✔ Poland

EOG: EGNOS Operators GroupFYROM: Former Yugoslavian Republic of MacedoniaSource: EUROCONTROL Experimental Centre

Table 2-3: ECAC Member States



EUROCONTROL

The EGNOS integrity service will be available over the European Air Space Region of ECAC. TheECAC service area is comprised of the footprint of all the Flight Information Regions (FIRs) of theECAC member states (including the Canary Islands) and the Oceanic control areas of Reykjavik,Shanwick and Santa Maria. The European Civil Aviation Conference is comprised of thirty-fivestates, of which twenty-seven are members of EUROCONTROL, and fifteen of the European Union.Listed in Table 2-3 are the ECAC member states, and their affiliation to either EUROCONTROL, theEuropean Union (EU) and/or the EGNOS Operators Group (EOG).The full EGNOS service area will cover the ECAC service area, bounded on the Northern regions thelatitude of 70 degrees North, and on the Western regions by 40 degrees West. Figure 2-2 details theECAC service area.

2.4.2 EGNOS AOC Capabilities

At the AOC level, EGNOS will provide navigation system performances compatible with thoserequired for FOC in terms of accuracy, integrity, and continuity (with limited exceptions) but with areduced availability and a reduced service volume [2].

The intended EGNOS performance for AOC is described in the following Table 2-4. It has to beconsidered, that the table only shows system requirements which do not necessarily represent theoperational performance that can be achieved, e.g. EGNOS will be used in combination with RAIMalgorithms and therefore the actual operational performance will be far better than the valuesmentioned in the table.

The EGNOS AOC performance is intended to enable a precision approach with a decision height of

EGNOS AOC Non PrecisionNavigation Service

PrecisionNavigation Service

PA 350 feet


Cat Isee note 2

Accuracy (95%)see note 3

100m (tbc) n/a n/a

NSE (95%)see Note 1

tbd 10m7.7m 1

6m5m 1

NSE (10-7)see Note 1

556m (tbc) 25m19.25m 1

15m12.5m 1

Integrity Risk 10-7 / h 10-7 / approach 10-7 / approach

Time to Alarm 6s 6s 6s

Continuity Risk 10-5 / h 8x10-5 / approach 8x10-5 / approach

Availability 0.999 0.99 0.99

Service Volume(Full)

GBA(IOR) ∩GBA(AOR-E) ∩

ECAC


ECAC landmasses


ECAC landmasses

Note 1: The italicised values were introduced by ESA to reflect the latest consolidated version of the ICAOGNSS SARPs. Industry has been requested by ESA to consider these values as performance objec-tives for the EGNOS development.

Note 2: Assumes that the GLONASS service is available.Note 3: Accuracy is expressed as 24-hour average in contrast to the NSE value that represents an

instantaneous accuracy.

Table 2-4: EGNOS AOC Performance used for Phase B-2X Design [2]



EUROCONTROL

350 feet to users equipped with a standard GPS/WAAS receiver. It shall enable a Cat I precisionapproach to users equipped with enhanced receivers having a GLONASS capability.

The EGNOS AOC configuration will provide the above mentioned navigation system performances ina full service volume covering the part of ECAC land masses where the two GEO satellite links (IOR,AOR-E) are available. A partial service where only accuracy and integrity are to be met will beprovided over ECAC landmasses where only one GEO link is available.

2.4.3 EGNOS FOC Capabilities

The final objective of EGNOS is to provide civil aviation with an operational sole means of naviga-tion4 capability supporting all flight phases from En-route oceanic to category I precision approachover ECAC [2].The FOC performance will be achieved by upgrading the AOC performances through a complemen-tary implementation. The intended EGNOS performance for FOC is described in the following Table2-5. It has to be considered, that the table only shows system requirements which do not necessarilyrepresent the operational performance that can be achieved, e.g. EGNOS will be used in combina-tion with RAIM algorithms and therefore the actual operational performance will be far better than thevalues mentioned in the table.

EGNOS FOC Non PrecisionNavigation Service


PA 350 feet


Cat Isee note 2

Accuracy (95%)see note 3

100m (tbc) n/a n/a

NSE (95%)see Note 1

tbd 10m7.7m 1

6m5m 1

NSE (10-7)see Note 1

556m (tbc) 25m19.25m 1

15m12.5m 1

Integrity Risk 10-7 / h 10-7 / approach 10-7 / approach

Time to Alarm 6s 6s 6s

Continuity Risk 10-6 / h 8x10-5 / approach 8x10-5 / approach

Availability 0.9999 0.999 0.999

Service Volume(Full)

ECAC ECAC landmasses

ECAC landmasses

Note 1: The italicised values were introduced by ESA to reflect the latest consolidated version of the ICAO GNSS SARPs. TheEGNOS bidder is requested by ESA to consider these values as performance objectives for the EGNOS development.

Note 2: assumes that the GLONASS service is availableNote 3: Accuracy is expressed as 24-hour average in contrast to the NSE value that represents an instantaneous accuracy.

Table 2-5: EGNOS FOC Performance used for Phase B-2X Design [2]

These performances are mainly characterised by an upgrade of the AOC Level 3 performances foravailability and service volume coverage. They should be provided by adding redundancies with aproper expansion over the service area and the implementation of a replacement capability of theGEO space segment.The FOC performances will be achieved with only two satellites in view of each point of the servicevolume.




EUROCONTROL

3 PROPOSED ELEMENTS OF AN EGNOS TEST & VALIDATIONPROGRAMME

This section proposes validation activities that should be undertaken within the EOT&V Programme.The general validation methods are review, analysis, inspection, demonstration and test. For eachRNP parameter a validation strategy is defined that is suitable to validate the operational perform-ance of EGNOS. Additionally, a strategy for the validation of operational influences on the RNPparameters is defined. This approach leads to requirements for each validation method, which formthe baseline for the definition of the actual validation activities.

The remainder of this section is structured as follows:

• Section 3.1 describes the methodology which has been taken to define the validation activitiesthat are necessary for EOT&V;

• Section 3.2 analyses the operational influences on RNP and investigates, how these influencescan be validated;

• Section 3.3 develops an approach for the flight inspection of EGNOS based flight procedures;• Section 3.4 identifies existing tools and equipment for the EOT&V programme;• Finally, section 3.5 provides a summary and proposed validation activities for EOT&V.

3.1 Methodology for Validating RNP compliance

The principle methodology for the development of the EOT&V Programme Outline is shown in Figure3-1. As baseline, the RNP requirements as described in section 2.2 (see also Table 2-1) are used.For each of the RNP Requirements a validation strategy will be developed and appropriate validationactivities can be derived from these considering the operational influences that may occur. This isbased on a statistical approach (see Appendix A.6) which is needed to define the number ofnecessary test samples (if test is an appropriate validation method for the concerned parameter).After that, the operational influences on the EGNOS performance are analysed.

On this basis, correlation time intervals and the appropriate spatial correlation requirements can bedetermined and applied to the statistical validation approach (see also Appendix A.6). This results inthe definition of validation activities and the proposed EO&V programme.

However, it is not sufficient for the validation of EGNOS within EOT&V to rely solely on a statisticalapproach. For example, the statistical validation approach is based on the assumption that theEGNOS performance has a Gaussian error distribution. This assumption is probably not correct withregards to many operational influences. Additionally, it has to be considered that the statisticalvalidation approach does not reflect long term influences on the EGNOS performance, e.g.ionospheric effects vary significantly in the long term.

It is important to notice that for all EOT&V validation activities covered in this document it has beenassumed that the EGNOS system will be technically validated by ESA, such that it will be ensuredthat a MOPS compliant EGNOS receiver will function in the correct manner in an ideal environment.This general assumption was principally used for the development of the EOT&V Programme.

It has to be noticed that EGNOS AOC does not require the validation of availability and continuitybecause the AOC system is only intended to be used as primary means of navigation. Full availabilityand continuity performance as defined by ICAO RNP is only applicable to EGNOS FOC.

The most preferable validation method is test, especially with regards to operational test andvalidation. However, the high requirements of civil aviation towards radionavigation aids do not allowto validate the requirements by tests completely. This is mainly because of the high percentilerequirements, which require a very large number of independent test samples (requiring many years)for validation. A second reason is, that tests can only cover a limited geographical area while theperformance of EGNOS has to be validated for the whole of ECAC. The solution for this problem isto define an appropriate validation strategy by defining a dedicated mix of validation methods.

Appendix A.6 provides detailed information on the statistical theory for validating RNP compliance.



EUROCONTROL

The principal validation methods that are available for the EOT&V programme are:

• Review• Analysis• Inspection• Demonstration• Test

A detailed definition of these terms is given in Appendix D.

3.2 Analysis of Operational Influences on RNP

For the definition of a test and validation programme it is important to identify the issues on whichthe operational performance depends. The identification of these issues and parameters will lead tothe definition of appropriate validation activities and test scenarios.

Appropriate methods for the validation of the operational influences that affect the EGNOSperformance are outlined. A special focus has been set on the investigation of the correlation timeand spatial correlation necessary for validation of the operational influences by test.

For the development of the EOT&V programme it has to be considered that single operationalinfluences on RNP will most likely be not critical to the navigation performance but the combination ofdifferent effects each having a distinct error behaviour may lead to a problem. For example, errorsinduced by multipath are usually not very high and will not be critical to the navigation performance inan ideal environment. However, if at the same time, for example the ionospheric influences rise ormasking hinders the reception of a number of satellites, a problem for the navigation performancemight arise.

More detailed information on operational influences on RNP is provided in Appendix A.4.

3.2.1 Dependency upon GPS and GLONASS

EGNOS provides an augmentation to GPS and GLONASS, and therefore, the entire EGNOS systemperformance is dependent upon these two constellations. GPS and GLONASS are owned and opera-

RNP Requirements

Validation Activity Definition

EOT&V Programme Outline

Validation Strategy Operational Influences:- Aircraft manoeuvres/dynamics- Aircraft types- EGNOS coverage area- Multipath- Interference- Masking/Geometry- Atmospheric Effects

Figure 3-1: Methodology for Development of EOT&V Programme Outline



EUROCONTROL

ted by two different authorities, both of which are beyond the control of the EGNOS systemoperators.

With regards to the performance it is particularly important to consider the GLONASS constellationwhich has seen a steady decrease in the number of operational satellites. Difficulties may also arisedue to the fact that no reliable data concerning the reliability of GLONASS satellites are available.Generally, long term influences of GPS/GLONASS on the EGNOS performance will not be regardedby EOT&V, since it can be assumed that these influences will be sufficiently monitored by theEGNOS system itself and timely warnings will be generated, if the EGNOS system performance isdegraded.

EOT&V should investigate the ability of the user receivers to correctly integrate the measurementsfrom GPS, GLONASS and GEO satellites to a combined navigation solution, although this mainlyshould be an issue to be covered by the receiver manufacturer.

3.2.2 Aircraft Characteristics and Dynamics

The characteristics and the flight manoeuvres of an aircraft have a strong influence on the navigationperformance of the on-board EGNOS receiver. For example, the antenna position at the aircraft hasan influence on the potential masking of satellites. Additionally, it has to be considered that duringsome aircraft manoeuvres (especially during approaches and departures) strong vertical accelera-tions occur that may cause a reduced receiver performance.

Aircraft Types

The platform upon which the user receiver is installed is important to consider for the validation ofthe operational use of EGNOS. With regards to aircraft types a number of possible configurationsexist. These include:

• High (e.g. BAe 146) and Low (e.g. B737) wing installations;• Single and multi-engine types.• Engine types (propeller, or jet).• Engine position (at front, under wing, fuselage mounted).• High and low tail plane installations.• Aircraft size (e.g. B747, Gulfstream V).• EGNOS antenna location.

The potential effects that these parameters may have upon the navigation performance obtained willmostly be due to either masking or multipath.

All test campaigns that will be undertaken within the EOT&V programme should consider a numberof aircraft types which differ in size, wing position and antenna position. This is necessary in order toappropriately consider multipath and masking effects.

Impact of Aircraft Dynamics

This section addresses the possible mechanisms by which the aircraft and its dynamics maydegrade the navigation performance of the on-board EGNOS receiver. In particular, it is assessedhow flight profiles may introduce error mechanisms, which may degrade the navigation performanceof the EGNOS user.

High roll and high pitch rates may cause masking of either the EGNOS geostationary satellites,and/or the GPS and GLONASS satellites. These are most likely to have an impact upon thenavigation performance when the aircraft roll or pitch is uncommanded, since a crew would notunduly put an aircraft in a severe attitude (with the exception of collision avoidance, for example).Uncommanded aircraft perturbations will occur either due to control surface failure, or turbulence. Ofthese, only turbulence is relevant to this study. Turbulence can occur during any flight phase, forexample, in the En-route phase where the aircraft will be flying at altitude, Clear Air Turbulence



EUROCONTROL

(CAT) may cause uncommanded roll or pitch perturbations, and in the approach phase, the effect ofturbulence will increase due to ground structures/terrain in the locality of the airport.

However, there are additional error mechanisms, which can be introduced, without the aircraftachieving high dynamic rates, or severe attitudes. These effects are due to the normal flight profile ofthe aircraft, with no assumed extreme flight deviations.

The aircraft is more likely to increase its masking potential of the EGNOS geostationary satellites ifflying North in the Northern hemisphere (or South in the Southern hemisphere). This is due to thealignment of the aircraft’s EGNOS antenna, fin, and an EGNOS geostationary satellite. In thisconfiguration, the fin provides the greatest possibility of masking out an EGNOS geostationarysatellite. This effect will be made worse if the aircraft has a ‘T’ tail configuration. In this case, themasking potential is increased by the ability of the tail to provide masking over a greater aircraftheading, and pitch range.

For both simulation and flight tests, the maximum expected flight dynamics as identified in AppendixA.4 should form the minimum dynamic conditions to be applied to the receiver. Therefore, the flighttests can not be made during passenger flights. Instead, there will probably be the need to useresearch or special mission aircraft.

Receiver Dynamics

Generally, high Doppler rates as they occur during flight phases with high dynamics are difficult forGNSS receivers to handle. Eventually, cycle slips may occur which reduce the positioning accuracy.Even loss of lock to certain satellites may occur. Another aspect that has to be considered is theinfluence of accelerations on the stability of the receiver’s quartz oscillator.

The most demanding dynamic environment for the EGNOS receiver will be in conditions where high‘g’ forces exist. On a commercial airliner, high ‘g’ loading should not occur, unless in an emergency.The highest ‘g’ loading will potentially occur during either the departure or arrival phase of flight. Eventhese loads would not be expected to exceed more than 3g which would be well within the nominaloperating limits of a good receiver. Nevertheless, the performance of the receiver may be degradeddue to the high ‘g’ forces.

GNSS range determinations between space vehicles and mobile receivers are the bare essentials ofany GNSS position fix. Even under optimum conditions which means that it is assumed that thereceiver is designed properly and the measurements are undisturbed, these measurements aresuperimposed by noise. The reason for this, is the comparatively large distance between transmitterand receiver which results in high spatial losses and therefore makes it necessary to correlate andfilter the code as well as the carrier signals in the receiver to reduce the measurement noise [9].

There is a clear relationship between the measurement noise and the filter bandwidth: The larger thebandwidth the higher the noise, or in other words if the measurement noise shall be kept below athreshold a certain maximum receiver bandwidth will result.

In general, low bandwidths have the advantage of an improved signal to noise ratio under stationaryor low dynamic conditions. This results in an improved signal quality as well as in an improvedconfidence in the results of the data decoding process. Nevertheless, under dynamic stress theseloops will easily lose signal lock, which results in a decreased availability.

With regards to validation, the receivers chosen for the EOT&V programme should be tested insimulations using an EGNOS signal generator. Additionally, special flight tests should be undertakento investigate the receiver behaviour under high dynamic loading as it may occur during special flightmanoeuvres. These flight tests should be undertaken at different times of the day in order toconsider the changing satellite geometry.



EUROCONTROL

3.2.3 Masking

The availability of the EGNOS service is strongly dependent on the ability of the user receiverantenna to receive the signals in space. The operational validation of EGNOS must, therefore,consider possible masking effects, which would prevent the EGNOS signals being received.

Masking reduces the potential number of visible satellites. The effect is caused by an object blockingthe line of sight between the EGNOS antenna and a satellite, and preventing the satellite’s signalfrom being received at the user antenna. The satellite is therefore not available for use in thenavigation solution. Masking may be caused by local effects, such as the masking of the antenna bythe surface of the aircraft, or by external factors, such as terrain.

The effect of masking requires testing to determine under which flight phases and aircraft attitudes itis most likely to occur such that the sudden potential loss of two satellites (for example) does notimpact upon the safe operations of the aircraft.

Masking can be caused for two reasons. Firstly, the terrain may block the visibility of a satellite(s).This could be caused, for example, by an approach to an airfield located in a mountainous region.Secondly, the surfaces of the aircraft may present an obstacle between the EGNOS antenna and asatellite(s). This second scenario is most likely to occur under conditions of high/low attitudes, and/orhigh angles of bank.

The effects of masking can vary in the number of satellites, which are rendered unavailable to theuser. It is possible in potentially high masking environments that the constellation is such that thearea(s) of the sky that are masked do not contain satellites. Conversely, in a potentially low maskingenvironment, a single object may remove several satellites from the user antenna’s line-of-sight dueto the constellation at that point in time.

The most critical period for the effects of masking will be when the number of usable visible satellitesis low. This may be to due to scheduled outages, unpredicted outages, or just to a poor satelliteconstellation at a particular location and time. It is under these conditions when the effect of maskingcould further reduce the number of available satellites to the user, and potentially degrade thenavigation performance to an unsafe level.

Of particular concern is the masking of the EGNOS GEO signals when the user receiver can notreceive the EGNOS integrity information and correction data. Masking of the GEO(s) thereforesignificantly degrades the system performance.There should be no dedicated process to validate masking and geometry effects. However, the flighttest programme has to consider the spatial correlation of measurements due to the satellite geometry(see Appendix A.4).

Additionally, some flight demonstrations should be made with regards to masking of the EGNOSGEO(s). One aim during these flights should be to induce masking of the GEO(s) intentionally, i.e. byflying various manoeuvres. By this, it is possible to identify critical aircraft attitudes in which thereception of EGNOS is not possible. If such cases occur, it is necessary to investigate whether it islikely that such a situation occurs during typical flights. Potential “critical“ flight manoeuvres arediscussed in Appendix A.4.

Since masking strongly depends on the aircraft type and the location of the EGNOS antenna on thefuselage, these demonstrations should be made with several aircraft types. However, due to the factthat special manoeuvres have to be flown for these demonstrations, they have to be undertaken withresearch or special mission aircraft.

3.2.4 Coverage Area

The availability of the EGNOS service assumes that the signal can be received at all locations in thespecified service area. Another aspect to consider is the fact that the performance of EGNOS willvary over the service area. Due to the footprints of the geostationary satellites, users will have avarying number of GEO satellites in view, depending on their location within the service area.



EUROCONTROL

The validation of the coverage area should be undertaken by simulation, i.e. by extrapolation of themeasurement made at various locations. Additionally, some test flights at the edge of the coveragearea should be made in order to demonstrate that the simulation results are correct.

Additionally, the receiver behaviour should be tested when the aircraft enters or leaves the coveragearea. In the moment of EGNOS signal acquisition there is the potential risk of step errors in thenavigation solution due to the differential correction data starting to be applied. Another reason forsuch errors might result from switching between the use of WAAS (or MSAS) and EGNOS which anEGNOS receiver might experience. It should be investigated whether such steps may become a riskfor fulfilling the navigation performance requirements.

3.2.5 Multipath

Multipath is the effect where a signal arrives at a receiver via two or more different paths. Thereceived signals will each have a different path length, and these differences in the path lengthscause the signals to interfere which each other. This interference causes an error to the calculatedsatellite ranges, and hence to the accuracy of the position solution.

Since airports generally present a high multipath environment, it will be important to determine theeffect of multipath upon the navigation performance of EGNOS. The consideration of the airportenvironment is particularly critical due to the flight phases associated with operations at airports. Inthe airport environment, there also exists the possibility of quasi-static multipath due to the positionof the EGNOS GEOs that hardly move relative to the user antenna. Additionally, multipath effectsmay be created by the host aircraft. The surfaces of the aircraft such as the wings, tailplane, fin,fuselage and engines have the ability to cause multipath. The multipath can be caused locally in thismanner due to reflections from these surfaces, should the reflected EGNOS signals be detected atthe antenna, the user receiver will experience multipath effects.

Since very large range errors due to multipath only occur for large delay lengths, which exceedthose, which can be generated within the physically limited dimensions of an aircraft, multipath will bemost prevalent for EGNOS when the user is operating near large reflecting objects, such asbuildings. Reflections of the signals can additionally be caused from the ground and roofs. Therefore,multipath will be most critical for the final approach phase when the aircraft is close to the ground.

Nevertheless, multipath can also be a problem without the interaction between the ground reflectorsand the airborne antennas. Reflections caused by the airframe itself may lead to errors, which aredisplayed in Figure 3-2.

Measurements of the GPS signal have shown that pseudorange errors due to multipath are about0.5 meters in a benign environment, and up to 4 or 5 meters in a highly reflective environment.

0.001

0.01

0.1

1

10

100

-50-45-40-35-30-25-20-15-10

MCR [dB]

Mm

ax [m

]

Figure 3-2: Resulting Maximum Multipath Error Mmax for One (blue), Two (green) and Three(red) Independent Reflections at the Airframe (Maximum Delay Limited to 5m).



EUROCONTROL

Multipath is a parameter that is particularly dependent on the architecture of the test receiver.Unfortunately, multipath errors are very difficult to isolate. However, code to phase measurementsprovide at least a tendency.

It is difficult to validate multipath in practical tests during EOT&V. This is mainly due to the fact thatmultipath is difficult to detect and errors due to multipath are hardly possible to isolate. A simplifiedsimulation should be undertaken in order to estimate the typical multipath errors to be expected forthe aircraft to be used for the EOT&V flight tests.

Additionally, some dedicated real tests should be undertaken in conditions where multipath isexpected to be high, i.e. during approach and departure. Also, ground tests will be useful in order tolook for quasi-static multipath at airports due to reflections from the ground or from the airportinfrastructure (buildings, etc.).

3.2.6 Interference

When considering the operating environment, in which the EGNOS signal shall be used, it will beimportant to consider the effects which interference or jamming may have upon the navigationperformance.

Interference is caused by other RF transmissions, on similar frequencies. The effect is that the signalthe user is attempting to acquire is becoming corrupted due to the other signal interference in thesame RF band. The interference can disrupt the signals by either in-band Radio FrequencyInterference (RFI), or out-of-band RFI.

Commercial receivers will be susceptible to unintentional and intentional (jamming) interference.There exist several sources that can potentially provide interference to the EGNOS signals. Thesecan be from Radio Frequency (RF) transmitters on board the host aircraft, from aircraft in thevicinity, or from ground installations.

Within the scope of EOT&V, intentional interference (jamming) is not considered. Only non-hostileinterference will accounted for, and is generally taken to be other users in the same RF region (e.g.mobile telephones).

Interference can also occur from other avionics on-board the aircraft. However, this will not beconsidered in EOT&V because aviation equipment must adhere to EMI regulations, which shouldminimise this effect. That noted, it has been highlighted here as a potential error source for theoperational test and validation programme.

When a receiver is subject to interference, the bit and word error rates of the received signals willrise. In heavy interference, the receiver also may loose lock to the satellites.

The behaviour of the EGNOS receiver used for EOT&V flight trials should be tested under theinfluence of interference (in accordance with the receiver MOPS). Although this principally is to bedone by the receiver manufacturer, it would be useful for EOT&V to know the receiver behaviour incase of interference, in order to get a better understanding of the receiver characteristics and foridentification of receiver malfunctions caused by interference.

Before flight trials are undertaken at a specific location (i.e. an airport), it is recommended to domeasurements with a frequency spectrum analyser in order to detect interference sources that mightinfluences the local EGNOS performance. If such interference sources exist, it should be the aim toeither eliminate the sources or limit its influence in the EGNOS frequency band.

3.2.7 Atmospheric Effects

The ionosphere is perhaps the most important issue for the final performance of EGNOS andrequires careful consideration. The main effects are scintillation, i.e. amplitude and phase fluctua-tions, and rapid spatial and temporal gradients. Important items to investigate are the influence of the



EUROCONTROL

imminent peak in ionospheric activity expected around the year 2000, which will occur during theimplementation phase of EGNOS.

The ionosphere has the largest error contribution to the position accuracy by an order of magnitude.Furthermore, the troposphere effects are very local (since the main contributing factor is theweather) and would be difficult to compensate for. The observed error budget for GPS is included inFigure 3-3 to highlight the ionospheric component to the total error. Note that these figures aretypical values for a general environment, which may differ for others.

As can be seen, the ionospheric contribution accounts for over 18% of the total error. It is for thisreason that the effect of the ionosphere should be evaluated to determine the effect it has upon thenavigation performance of EGNOS.

For the ionospheric part of the influence a linear correlation between the delay of the signal and theTotal Electron Content (TEC) of the ionosphere can be found. Thus the TEC value plays the majorrole for the effects of the ionosphere on the signal propagation. The TEC value oscillates with aperiod of 24 h due to earth rotation and a certain amplitude, which can vary by time due to variousother influences, which superimpose the timely behaviour of the TEC. These effects can bedescribed by a model to enable the user to calculate a correction for the error induced by theionosphere. Nevertheless, due to the deviations of the model from the reality, an uncorrectable errorcan remain in the measured values. This remaining error and its variations by time and place shouldbe given attention in the verification of EGNOS. As the ICAO performances have to be fulfilled underthe condition of reduced redundancy of degraded service, location and time point of the testcampaigns must ensure that the results represent the situation under worst circumstances.

The second part of the atmospheric influences on the signal propagation, which is the troposphericinfluence, can be neglected due to its minimal contribution to the total error (<6cm).

A simulation should be undertaken to determine the ionospheric influences on the long term EGNOSperformance, especially with regards to the solar maximum (around the year 2000). Nevertheless, itstill remains difficult to assess the influence of locally unpredictable ionospheric effects, which inextreme cases might cause substantial local disturbances to the satellite signal making it impossiblefor a receiver to continuously track satellites. As a consequence, even a total loss of navigation couldoccur. This should be analysed in more detail within the EOT&V programme.

GPS Error Budget24

7

0.7

3.6

1.5 1.2

0

5

10

15

20

25

Sel

ectiv

eA

vaila

bilit

y

Iono

sphe

ric

Tro

posp

heric

Clo

ck a

ndE

phem

eris

Rec

eive

r N

oise

Mul

tipat

h

Error Source

Typ

ical

rm

s R

ang

e E

rro

r (m

)

Source: GPS World, March 1997.Figure 3-3: Observed GPS Error Budget



EUROCONTROL

3.3 Development of Flight Inspection Procedures for EGNOS based Operations

The navigation with the use of satellite navigation is significantly different than the traditional flightguidance concepts based on terrestrial radionavigation systems. This section describes the effect ofthese differences on flight inspection issues, especially with regards to EGNOS.

The operation of conventional radionavigation aids requires regular flight inspections in order toassure that the systems meet their performance specifications and to calibrate the systems, ifnecessary. For EGNOS, a similar inspection scheme will have to be implemented. Generally, flightinspection should make use of similar procedures and techniques as EOT&V. Flight inspection willensure that the principle usability of EGNOS for European civil aviation can be verified for individualflight procedures.

This section provides a first brief approach to the flight inspection of EGNOS-based flight proce-dures. It has to be noticed that there is a need for the development of agreed recommendations forinternational use. The actual procedures will have to be defined on a national level but internationalco-ordination (e.g. by ICAO) would be useful for the development of a common internationalstandard.

3.3.1 Introduction

Compared to conventional terrestrial radionavigation aids, function and usage of EGNOS issignificantly different. Therefore, also the flight inspection procedures have to consider thesedifferences.

The major differences are:

• Each conventional radionavigation aid is located in such a way that it provides specific en-routeor approach instrument flight procedures. The location of the navigation aid and the correspond-ing procedure are tightly coupled. On the other hand, EGNOS provides coverage over the com-plete ECAC area. A relation to the location is only established by a mathematical process.

• The navigation signals of conventional aids are radiated with relatively high power. The distancesbetween the transmitting station and the aircraft user are usually in the order of a few miles to onehundred miles. In comparison, the EGNOS signals are extremely weak at the receiving antennaand the distance to the transmitters is much larger. Due to this fact, interference problems willarise more frequently with EGNOS than with conventional systems.

• Conventional radionavigation aids provide a constant, invariable constellation of navigationequipment. In contrast to this, the satellite constellations of GPS and GLONASS are varying andthe number of received transmitters (i.e. satellites) changes during operation.

• An additional important difference is related to the importance of flight inspection of EGNOS-based navigation procedures. For EGNOS, flight inspection has not the possibility to take directinfluence on the local navigation performance of the system while the flight inspection of conven-tional radionavigation aids includes the manual calibration of the systems based on the result ofthe inspection in order to optimise the performance. EGNOS flight inspection may only prove thenavigation procedures and assess local characteristics of the navigation performance, which as aconsequence may result in changes or extensions to the published procedures.

As a result of these differences some consequences for the flight inspection of EGNOS based flightprocedures arise. An accuracy and way point check for each published en-route, terminal orapproach procedure has to be performed. The proper signal coverage has to be determined inrepresentative scenarios. Ground monitoring in conjunction with simulation techniques applied torecorded data may be used to evaluate various scenarios. Additionally, it has to be ensured that co-ordinate transformations are correct that no data base errors occur. During all procedure checks, theflight inspection has to ensure that the interference level does not exceed tolerable values.

Although simulation techniques may provide the evaluation of various constellations, it is recom-mended to perform EGNOS inspections during different constellations, e.g. optimal coverage,minimum coverage and a standard coverage, at least during commissioning of a procedure orground facility.



EUROCONTROL

3.3.2 Flight Inspection Procedures

This section describes the activities to be undertaken for the flight inspection of EGNOS basednavigation procedures. The activities start with an initial investigation followed by in-flight investiga-tions and accompanied by ground tests.

3.3.2.1 Initial Investigation

For the inspection of approach procedures, a simulation model should be developed that maydetermine the best and worst case satellite geometries (in terms of DOP values) to be expected.This simulation model has to consider the geographical position of the airport as well as potentialmasking effects, e.g. due to buildings or terrain.

3.3.2.2 Ground Monitoring

Generally, ground monitoring of the EGNOS performance is within the responsibility of the systemground segment and thus not part of the flight inspection activities. However, for the inspection ofapproach procedures a few aspects still should be considered by undertaking measurements onground:

• A continuous measurement of a few days duration should verify the principal satellite visibility andavailability.

• Ground measurements should determine the existence of interference sources.• In case of an initial inspection at a specific airport, the co-ordinates of geographical reference

points at the airport should be verified by EGNOS measurements at these points.

3.3.2.3 In-Flight Investigations

Generally, the in-flight investigations have to cover all variants of the respective flight procedures. Atan airport for example, approaches from all allowed directions, all possible departure routes,procedures for missed approaches, etc.

The central element of the in-flight investigations is the measurement of the NSE and its confidenceinterval. Additionally, external influences on the navigation performance (e.g. due to masking,multipath or interference) should be assessed, if possible.Furthermore, all data acquired during the inspection flights should be recorded and stored forarchiving as well as for later post-processing purposes.

Accuracy

Accuracy is a parameter that will be validated during the EOT&V programme, which also will ensureby simulations that the accuracy requirements can be fulfilled over the complete ECAC area.However, accuracy should be monitored during flight inspection in order to detect local influencesthat might lead to an accuracy degradation.

With regards to approaches and the associated high accuracy requirements the flight inspection alsohas to prove that no major bends occur on the flight path of an aircraft during the approach phase offlight. Principally, such bends could occur due to changes in the satellite geometry used for theaircraft position determination during the approach. Such bends are unacceptable when theypreclude an aircraft under normal conditions and in stable air conditions from reaching the decisionheight in a stable attitude and at a position, within acceptable limits of displacement from theintended flight path, from which safe landing can be effected.

The following list shows the main parameters to be investigated:

• Cross track distance(A continuous comparison of the reference position with the intended flight path enables thecalculation of the error component perpendicular to the desired track segments. The deviation isequivalent to the TSE.)



EUROCONTROL

• Across, along and vertical track errors(A continuous comparison of the reference position with the EGNOS-derived position enables thecalculation of the three error components. The deviation is equivalent to the NSE.)

• Satellite geometry(in terms of DOP values)

• Normalised across, along and vertical track errors(determination of these values as described in section 3.3.3)

Way Point Verification

The aim of this activity is to examine the validity of the relevant waypoints. This should be done bycomparing EGNOS data collected during the flight inspection with parallel measurements carried outwith an independent position reference system.

A special focus has to be set on the reliability and integrity of the waypoint database. An importantpoint to consider is the co-ordinate transformation that may take place for the definition of waypoints.This is particularly important for the approach and landing phase of flight where high accuracyrequirements exist. Therefore, the coherence between the local geodetic reference system at thespecific airport and the globally defined EGNOS reference system (WGS84) has to be checked.

The way point verification has to prove that a specific flight procedure can be used under allcircumstances, under consideration of environmental conditions and the availability and coverage ofthe satellite signals. One major difficulty results from the fact that the GPS and GLONASS satellitesare continuously moving, i.e. for the EGNOS receiver the satellite constellation is changingpermanently. In contrary to this, the measurement duration of the flight inspection is very short.Therefore, the single deterministic measurements have to be normalised to a ‘standard satellitegeometry’.

The following list shows the main parameters to be investigated:

• distance and bearing to next way point• way point displacement errors

(determination of across, along and vertical track error directly at the respective way point, basedon the reference position measurement)

• data base errors

Availability

The major aspect that influences the availability (and continuity of service) of the flight procedure isdriven by the satellite constellation that can be received by the EGNOS receiver on-board an aircraft.The number of satellites in view depends on the GPS and GLONASS constellations but additionalshadowing also may occur. Shadowing is particularly important with regards to the geostationarysatellite(s) because the EGNOS signal has to be received in order to ensure the integrity of thenavigation system. Satellite signals may be obstructed by the topography (e.g. in mountainousareas) or by the aircraft itself.

Since availability and continuity of service are statistical values, the single measurements during theflight inspection should be normalised for in order to extrapolation the results to longer time scales.

It has to be noted that the principal availability and continuity of service of EGNOS will be validatedby the EOT&V programme. On top of that, the flight inspection has to ensure that these performanceparameters are not degraded by the local environment of the EGNOS flight procedure to beinspected. For this, all relevant data collected during flight inspection has to be analysed and used fora simulation of the same flight procedures under different satellite geometry conditions. Principally, itcan be recommended to undertake this activity by the European Civil Aviation Authorities with acommon tool developed within the EOT&V programme.



EUROCONTROL

Interference and Multipath

Because of the low signal power of GPS, GLONASS and the GEO satellites the risk of disturbednavigation signal reception due to interference sources is high compared to conventional radionavi-gation aids. Therefore, the detection of such interference sources during the flight inspectionprocedure is of significant importance. For this, the flight inspection aircraft should make use of aspectrum analyser or other suitable techniques to detect the presence of interference. Additionally, itcould be useful to have a permanent monitor station in the vicinity of airports in order to timely detectnew interference sources.

As experiences from the past have shown, a difficult problem remaining is to exactly locate theinterference source detected. The difficulty of this task varies with the signal power and the signalcharacteristics of the interference source and whether it is intentional or non-intentional interference.

With regards to multipath it is assumed that multipath problems caused by the flight inspectionaircraft itself can be neglected, i.e. such problems are assumed to have been sufficiently regardedduring the airborne equipment installation. The remaining issue is multipath from the ground,buildings and terrain, which is only relevant for the approach phase flight. Therefore, it would beadvantageous for the flight inspection to have a means to detect such multipath effects. A possiblemeasurement method is to use the EGNOS receiver raw data and to subtract integrated carrierphase from the measured code phase. A simultaneous signal to noise ratio measurement can givesome indications for the signal to multipath ratio.

3.3.3 Normalisation of Results

One of the major difficulties of EGNOS flight inspection is the dependence of the measurementresults from the satellite geometry. Since flight inspection due to its short duration can only cover asmall fraction of the possible geometrical conditions, a normalisation of the results is proposed. Thisensures that the results from different measurement flights can be compared with each other. Thisnormalisation can be performed by setting the geometry (measured in terms of DOP values)observed during the actual measurement in a relationship to a previously defined ‘normal’ satellitegeometry. Thus, this relationship can be used to normalise the measured position deviations.

For precision approaches, a further step for the normalisation would be to consider the runwaydirection, i.e. to separately evaluate the ‘Along DOP (ADOP)’ and the ‘Across DOP (XDOP)’. Thiswould enable a more precise normalisation since the usually taken HDOP only provides a commonvalue for position deviation in longitude and latitude direction.

As basis for DOP values associated with the ‘normal’ satellite geometry, the values of the worstacceptable geometry should be taken that still fulfils the required performance for the respective flightprocedure.

3.3.4 Periodicity for EGNOS Flight Inspection

This section describes the recommended periodicity that the flight inspection activities should follow.It is distinguished between commissioning, routine and special inspection.

Commissioning Inspection

Each EGNOS flight procedure should be inspected before it is published for operational use. Thefollowing parameters have to be checked:

• flyability• accuracy, availability• interference and multipath

The flight inspection should be performed under different satellite constellation and should besupporter by simulation for extrapolation of the results.



EUROCONTROL

Routine Inspection

A routine inspection has to be performed after any change of the flight procedures.

Additional routine inspections might be necessary in certain time intervals. Obviously, the timeintervals for routine inspections of EGNOS based flight procedures could be much longer comparedto conventional radionavigation aids. Such inspections could be nonessential, if the continuousperformance of EGNOS may be sufficiently monitored by ground stations. In addition to groundmonitoring it would be useful, to continue the flight data collection of EOT&V to a limited extent asbasis for the long-term performance inspection of EGNOS.

Special Inspection

Special Inspections have to be concluded, if any problems with a published EGNOS flight procedureare reported from a ground monitoring station or by aircraft during flight operations. A possiblereason for such a problem occurring could be the existence of an interference source.

3.4 Validation Tools and Equipment

3.4.1 Test Equipment

The validation of EGNOS will require practical tests to be undertaken with representative test userreceivers. Additionally, further test equipment will be necessary. This includes data acquisition andrecording equipment (e.g. from the SAPPHIRE project) but also other special equipment might beuseful as described in the following.

User Receiver Assumptions

The results of EOT&V will be strongly affected by the characteristics of the test receiver(s) becausemost operational influences have a direct influence on the receiver performance, which may differdepending e.g. on the receiver architecture. Therefore, the function and performance of the testreceivers must be well known and proven both analytically and by the use of simulators.

It also has to be noted that tests should be undertaken tests with more than one type of test userequipment in order to make sure that the test results are not dependent on one special receiver type.For example, it might be necessary to consider different receiver correlator techniques or antennacharacteristics.

It has to be ensured that the test receiver performance is not better than of those receivers that willbe used in nominal flight operations after EGNOS has been validated. At least, the differences inperformance have to be well known. If available, near-market receivers should be used for EOT&V.To recommend the use of receivers which do not significantly over-fulfil the MOPS receiverrequirements is critical because this would strongly limit the ‘allowed’ performance of the testreceivers. The experiences with today’s GPS receivers show that most receivers perform muchbetter than required by MOPS. However, the EOT&V results will only be valid for receiver types withan equivalent performance as the test receivers!

The measurements of the test user receivers will be compared to the measurements of a positionreference system (see section 3.4.3.2.2 for more information).

The user receiver has to be capable of providing raw navigation data for the purposes of flight datarecording. Section 3.4.2 provides a list of parameters that should be made available.

Data Acquisition and Recording Equipment

To serve the purpose of the data evaluation that is foreseen in the EGNOS OT&V project, datarecording equipment has to be set up onboard aeroplanes. Several different aircraft types have to beused during the data gathering campaign to satisfy the requirements of different scenarios, all usingdifferent onboard equipment. In order to allow data to be recorded under these circumstances acommon data format has to be defined in a first step. It has to describe in detail, which raw



EUROCONTROL

measurements and computed data are needed to be recorded from the EGNOS receiver. Additionaldata from various other sensors such as inertial sensors, the air data computer, Instrument LandingSystem (ILS) and Distance Measurement Equipment (DME) has to be described in the interfacecontrol document as well, to provide a comprehensive description of the aircraft status vector.Therefore the interface control document from the SAPPHIRE program that is already including allthese different sensor options should be used. This would guarantee a compatibility to theSAPPHIRE program allowing for a partly evaluation in an already existing tool in an early stage.

The recording equipment beside the EGNOS receiver that is used during the flight trials will differfrom aircraft to aircraft and will therefore be hard to define. It will be more likely that the different testaircraft that will participate in the program use their own data recording device. In aircraft that areused for the tests but are not equipped with such systems a standardised recording unit should beimplemented. Special care has to be taken in the time synchronisation process of the different datasets. All time tags have to be in the same time scale in order to allow for an appropriate assignmentduring the data evaluation process. Once again it is possible to follow the example from theSAPPHIRE program that is using such a system in order to record data onboard commercialairliners.

Another important role will be the storage medium that is going to be used. A state of the art devicelike a CD or a optical disk should be chosen for these purposes in order to minimise the probability ofa data loss and to ease the down-loading of the data.

Equipment for Data Evaluation

The data evaluation tools that are going to be used in the EGNOS OT&V program have to be buildon top of a high performance database systems that allow an easy handling of the huge amount ofdata that has to be evaluated. In order to download the data into the database it is essential that thecounterpart to the storage devices that are used in the recording units are available. A transforma-tion of the recorded data into engineering units has to be accomplished. Afterwards possibilitychecks have to secure the completeness and correctness of the data.

Other Equipment

Beside the equipment onboard of the aircraft and the data evaluation tool, the reference equipmenthas to be taken into consideration as well. Laser tracker, GNSS reference stations, precision radaretc. form this part of the evaluation system. Their data has to be collected in the same way as it wasmentioned above using appropriate time tags, a defined data format and a standardised storagemedium.

An EGNOS signal simulator is needed for a number of tests. This equipment has to provide themeans to model realistic signal errors for testing the RAIM performance of the test user receiver.

3.4.2 Available Measurements

The following parameters have been identified as providing a possible means to determine theperformance of the EGNOS system:

• User Position (EGNOS)The user position as derived by the EGNOS system will be measurable, and would provide ameasure of the accuracy by comparison with the actual position.

• User Position (Reference Systems)The user position as defined by a reference system will be required in order to determine thenavigation errors.

• Satellite PRN NumbersThe identification numbers of the satellites.

• Satellites in ViewThe number of satellites that the user receiver determines is visible.

• Satellites in Navigation SolutionThe number of satellites which the user receiver uses in the computation of a navigation solution.



EUROCONTROL

This differs from the Satellites in View, since the receiver may impose a mask angle, whicheliminates low elevation satellites from the navigation solution.

• Aircraft HeadingThe aircraft magnetic heading can be used as a performance measure. In particular, the com-parison of an aircraft heading against possible masking effects (due to the host aircraft structure)can be performed.

• Aircraft PitchThe nose up attitude of the host aircraft (angle between the longitudinal plane of the aircraft andthe horizontal).

• Aircraft RollThe angle of bank of the host aircraft (angle between the lateral plane of the aircraft and thehorizontal).

• Aircraft IASThe speed of the aircraft relative to the air in which it is flying.

• Aircraft Ground SpeedThe speed of the aircraft over the ground.

• Longitudinal Aircraft AccelerationThe load forces (measured in ‘g’) which act upon the aircraft in longitudinal direction.

• Lateral Aircraft AccelerationThe load forces (measured in ‘g’) which act upon the aircraft in lateral direction

• Normal Aircraft AccelerationThe load forces (measured in ‘g’) which act upon the aircraft in normal direction

• PseudorangeThe measured range to an individual satellite as derived from code measurements out of theDelay Lock Loop.

• Phase MeasurementsAs derived from the Costas Loop.

• Signal Reception TimeThe time that an individual pseudorange measurement is observed.

• Signal to Noise RatioThe measured Signal to Noise Ratios (SNR) of the satellites in view.

• Dilution of Precision FiguresThe dilution of precision figures generated by the user receiver. These can include: GeometricDilution of Precision (GDOP); Horizontal Dilution of Precision (HDOP); Vertical Dilution of Preci-sion (VDOP); and Time Dilution of Precision (TDOP).

3.4.3 Requirements for Data Analysis Tools

This section describes the requirements toward data analysis tools that are needed for undertakingthe EOT&V programme.

3.4.3.1 General Requirements

Requirements for data analysis tools can be divided into technical requirements and safetyrequirements.

The technical requirements can be determined after the exact data parameters have been specified.Examples for such technical requirements are computing and data storage capacity.

Since the validation of EGNOS is a safety issue, data analysis tools are required to guarantee a highlevel of quality. This relates to hardware but also to data analysis software. The data analysissoftware should be based on proven algorithms and has to ensure a high reliability. The implementa-tion has to be undertaken in compliance with high software quality levels.

Another major issue is the traceability of the analysis results, e.g. it has to be ensured that the exactconfiguration (hardware and software) that was used for the data collection is appropriatelydocumented and archived.



EUROCONTROL

Finally, it has to be ensured that the data evaluation is undertaken by an independent organisationnot being influenced by any commercial interests with regards to EGNOS, e.g. companies having asignificant own interest in EGNOS (such as receiver manufacturers) should not be directly involvedin the data evaluation process.

The analysis tools need to provide the means to derive statistics on the RNP parameters based onreal data that have been acquired during the test campaigns. It should be possible to specify thegeographical area and the time span over which the RNP statistics shall be derived.

3.4.3.2 Requirements for Data Base Content

The purpose of this section is the analysis of the database content which is needed to perform thetest and validation of the received signal. A compromise has to be found between the versatility ofthe data acquisition tool and the need to keep the complexity of the data base as low as possible.This section is subdivided into different sub sections which specify the minimum requirements for thedata that is to be recorded in order to perform tests under the operational influences stated inchapter 3.2.

3.4.3.2.1 EGNOS Receiver RequirementsGenerally, it is possible to distinct between two different receiver types: Transmit-time receivers andreceive-time receivers. The first uses the transmission time of the signal as a time standard for allinternal computations. Due to the different distances to the different satellites the receiver will receivethe signals at slightly different times. In between these reception times the receiver motion must beknown to keep the measurements focussed. The latter defines a receiver internal reception time as astandard for all measurements. Due to the different ranges it must determine the satellites’ motion atthe different times of transmission. Both receiver types can be used for the validation programme.Nevertheless, for both receiver types a precise time tag for the validity of the range measurementsmust be given with the highest possible resolution and precision including the internal receiver timeoffset in comparison to the EGNOS time scale. The receiver must provide a suitable means, liketime tagging for the synchronisation of different systems.

Computed Data Requirements

The set of computed data of a receiver must include a precise time tag, the receiver’s computedposition in a standardised co-ordinate system and the velocity of the receiver in the same standard-ised co-ordinate system. The computed data can be used for a validation of the system accuracy.Nevertheless, the results should be checked by independent software, which determines the positionby means of the receiver raw data. So it can be guaranteed that no position filtering algorithm affectsthe quality of the computed data determined by the receiver.

Raw Data Requirements

All raw data must be available with the highest possible resolution and precision since these data areneeded to analyse various operational influences. The raw data must be generated in a documentedformat including time tag, receiver clock offset and number of measurements. Each measurementmust at least contain the channel number of the receiver used for the measurement, the satellitenumber, a code range measurement, a carrier phase measurement, all related integrity informationand a signal to noise ratio measurement. When the differential correction service of EGNOS isavailable it must contain all available differential and atmospheric corrections for the tracked satellite.If a receiver is designed as a transmit-time receiver the time of signal reception for each independentchannel is needed. Below, some examples are given which information can be derived from themeasurements. These examples are not intended to be complete. They only give a justification forthe effort and extent of the comprehensive data.

Multipath measurements can be performed by subtracting the integrated carrier phase from themeasured code phase. A simultaneous signal to noise ratio measurement can give some indicationsfor the signal to multipath ratio. The results of these measurements can be used to determine someparameters for a channel propagation model depending on the position and attitude of the aircraft.



EUROCONTROL

This model can be simulated to validate the word error rate and bit error rate of EGNOS underoperational conditions. To perform this analysis the following raw data are needed:

• Code range measurement• Carrier phase measurement• Signal to noise measurement

Another experiment will be the behaviour of the receiver under dynamic conditions. This topic will behelpful for an operational validation process, since the influences of some parameters, which makeup the efficiency of a receiver under dynamic conditions like tracking loop bandwidth or the g-sensitivity of the internal oscillator, are difficult to overview in the design phase of a new system. Toanalyse this issue the following quantities are needed:

• Code range measurement• Carrier phase measurement

3.4.3.2.2 Position Reference SystemThe reference system is needed especially for the validation of the accuracy and integrity parame-ters. The position indicated by the reference system can be compared either with the positionindicated by the EGNOS receiver or with the position calculated in an off-line process performedusing the raw data by independent software.

The technical requirements for the reference system’s data are mainly concentrated on the timelysynchronisation of the different data sources. For a position based comparison of the results ofdifferent sensors an accuracy of 10-4 s would be sufficient. If a raw data based comparison isperformed the accuracy has to be much higher in the order of 3ë10-11s.

The reference system should have a significantly better accuracy than the required EGNOSaccuracy for the specific phase of flight. The following position reference system types may be used:

• INSIf the test aircraft is equipped with an inertial navigation system (INS) the data of this systems canbe used to determine the attitude of the aircraft. Since it must be assumed that the INS has noinformation on the EGNOS system time scale an appropriate means has to be found that guar-antees a synchronisation of the INS data and the EGNOS data. INS data will not be an appropri-ate means to validate the EGNOS system accuracy for precision approach. Nevertheless, it maybe helpful to analyse the dynamic behaviour of the EGNOS receiver.

• Local Area DGPS (LADGPS)For those flight phases with the highest demands on accuracy in the vicinity of an airport it maybe appropriate to check the EGNOS differential corrections available on board the aircraft againstthe differential corrections generated by an independent local area ground station. Hence, it maybe feasible to demonstrate the quality of the wide area differential corrections under operationalconditions.

• Wide Lane DGPS Carrier Phase SolutionThe validation of accuracy may be significantly based on a wide lane DGPS carrier phase solutionsince it has the highest potential of accuracy of all known reference systems. Nevertheless, it hasto be mentioned that it may be difficult to proof the accuracy of EGNOS that incorporates GPS byanother system that is also based on GPS. Hence, it is recommended to use this technique onlyin conjunction with alternative sensors like laser trackers.

• Optical Reference Systems (Laser Trackers)A laser tracker is a three-dimensional distance measurement system that has to be located on theground at a position with known geographical co-ordinates. If directed towards an approachingaircraft, the laser tracker scans the target area in the sky and then automatically locates thereflectors the aircraft has to be equipped with. After that, the laser tracker determines distance,elevation and azimuth continuously. In this way, the aircraft is detected and exactly monitored



EUROCONTROL

during the whole observation period. Principally, a laser tracker is only suitable for the approachphase of flight.

Laser trackers have an accuracy that depends significantly on the distance between the aircraftand the laser tracker since laser trackers perform a combined range and angular measurement.For short distances its accuracy is sufficient to validate the EGNOS system. Hence, a combina-tion of laser trackers and wide lane DGPS carrier phase solution is suggested: If the accuracy ofthe wide lane carrier phase solution is affirmed for short distances by means of laser trackers andthe constellation remained unchanged for the whole approach there is no reason to doubt aboutthe accuracy of the phase solution at the beginning of the approach. Nevertheless, it must bestated that the effort to synchronise the data of the various sensors is enormous. Laser trackersalso need a special airborne infrastructure, a prismatic mirror, which has to be designed retract-able for fast aircraft. Hence, this necessity may preclude this method for tests on board of com-mercial airliners.

• Conventional Radionavigation AidsRadionavigation aids like ILS or DME can be used as well in order to crosscheck the results thatwere obtained by the EGNOS receiver. Especially the DME information could be used in order tocheck the performance EGNOS during the En Route phase of flight in a GNSS independent way,rather than only comparing it to DGPS or carrier phase solutions that arise more or less from thesame source. Furthermore, the information of the radionavigation aids is available onboard of theaircraft, which allows a direct data recording without needing a large-scale terrestrial referencesystem. Nevertheless it has to be kept in mind that these systems should only be used as back-up or for plausibility checks.

3.4.3.3 Required Data Base Analysis Capabilities

It should be possible to perform the following analyses with the data base system:

Signal to Noise Ratio (SNR)

The signal to noise ratio (SNR) for a particular measurement has a direct influence on the rangemeasurement accuracy standard deviation and the probability of a decoder error for integrity orrange correction information. The SNR depends on various operational influences like dynamicstress applied to the tracking loops or the receiver quartz and multipath or other interference in thevicinity of the reception antenna. Hence, SNR measurements will help to validate the resistance ofthe receiver against adverse operational conditions.

Dilution of Precision, Masking

The dilution of precision (DOP) has a direct influence on the accuracy of the position determinationfor a given set of range measurements depending on the current geometry of the space vehicles.For a given position the satellites’ position can be determined by almanac or ephemeris data. Withthe knowledge of the aircraft attitude and position it should be possible to exclude those satellitesthat cannot be seen at the actual aircraft antenna position. These data can be compared to themeasurements, which allows to analyse the effects of creeping and masking in the vicinity of thereception antenna.

Code Minus Phase

The difference between the code range measurement and the integrated carrier phase measurementis an appropriate method to analyse dynamic effects like multipath propagation and the influences ofaccelerations. For longer observation times it is possible to validate the quality of the ionosphericcorrections under operational conditions.

Computed Position vs. Offline Position

A comparison of the receiver’s computed position with an independently computed position shouldbe performed. If a difference between both computations is encountered, this may be an indicator foreither an error in one of the computation algorithms or an error in the raw data recording.



EUROCONTROL

3.4.4 Requirements for Simulation Tools

Simulation is a powerful tool, which is likely to be used extensively in EGNOS OT&V. To ensure thatthe simulation is appropriate, it may be necessary to first independently validate the simulationbefore using simulation to validate EGNOS. Simulation will involve critical parameters, such asmultipath, ionospheric errors, integrity behaviour and other factors.

Simulation will also be used to validate assumptions made about the extrapolation of measurementresults from a limited sample set to cover the whole EGNOS area. This applies in both spatialaspects, to extrapolate results from one geographical area to the whole of the coverage area, andalso for parametric aspects to allow measurements under one set of environmental conditions to beextrapolated to cover other sets of conditions. This is an area where simulation is particularlypowerful, allowing the exact selection of appropriate sets of conditions to verify behaviour andconfirm assumptions about extrapolation of results.

An important aspect for operational validation will be the inclusion of accurate aircraft models. Tocorrectly simulate effects of masking etc it will be necessary to implement a variety of aircraft typeswith true to life physical characteristics and performance models into the simulation. This will includethe incorporation of realistic pitch, roll and yaw angles in the models.

A further advantage of simulation is the ability to inject errors into the system at will and monitorsubsequent system behaviour. This is typically not possible with tests of the actual system, whereusually the nominally good behaviour can be verified.

The actual definition of simulation activities and of the corresponding tools needs to be undertaken inthe detailed definition phase of the EOT&V Programme (see section 4.1.1.3).

3.4.5 Identification of Existing Tools

For undertaking the test & validation activities defined in the preceding sections, several tools andtest equipment will be necessary. This section identifies available test tools and test equipment isidentified that could be used for EOT&V or could be easily adapted for the purpose. SAPPHIRE andESA tools need to be considered as well as the development of additional tools.

SAPPHIRE

The overall aim of the Satellite and Aircraft Database Programme for System Integrity Research(SAPPHIRE) of EUROCONTROL is to provide European certification authorities with the dataevaluation results they require in their efforts to certify GNSS for operational use

The SAPPHIRE programme is divided into two major parts: (i) the data recording onboard commer-cial airliners and (ii) the development and operation of a Database Update & Access Unit (DUAU) inthree Phases:

• In its first phase the data evaluation is focused on investigating the capability of satellitenavigation to provide the required accuracy and to be able to perform integrity monitoring (RAIMavailability) in the operational environment. The statistical analyses are carried out as a functionof theoretical and measured satellite visibility, taking into account the geometry of the localconstellation. The SAPPHIRE Phase One DUAU was installed on schedule at theEUROCONTROL Experimental Centre during March 1997.

• The development of the DUAU in its second phase will focus on the analysis of the performanceof different RAIM & AAIM algorithms for system failure detection & identification. The databasewill be extended to handle data from additional aircraft and to interface with GLONASS andEGNOS receivers once these are available. Furthermore, a reference position determinationusing GPS Differential corrections will be included. A module will be included which can simulaterealistic GNSS and INS error scenarios for performance test purposes. Finally, the hardwareplatform will be upgraded and provisions for a distributed database system will be implemented toallow the combination of results, which may be generated by independent DUAUs.



EUROCONTROL

• For the third phase the SAPPHIRE DUAU is supposed to provide the core module forEUROCONTROL’s task within the European Tripartite Group (ETG) to test and validate EGNOS.The SAPPHIRE developments will not include tools and or functions equivalent to those to devel-oped within the ASQF (see below).

The disadvantage of SAPPHIRE with regards to EOT&V is that SAPPHIRE is a tool that has beendesigned for the data collection on-board commercial aircraft. Many validation activities withinEOT&V will require special test equipment and/or special flight manoeuvres. The only restriction forthe special flight test equipment would be that it had to be recorded in SAPPHIRE data format inorder to be processed in the DUAU.

Despite the investigations that can be covered by SAPPHIRE, additional examinations have to takeplace that need different analysis tools. Such a tool could be the ASQF or other experimental tools.

Application Specific Qualification Facility (ASQF)

The ASQF will be developed on behalf of ESA within the EGNOS AOC development. It will includeone platform dedicated to aeronautical activities, named ‘aeronautical ASQF’, and tools developed inorder to support the qualification and certification of EGNOS in other user domains (maritime andland mobile).

EUROCONTROL and ESA agreed that the ASQF will be developed to be compatible and comple-mentary with SAPPHIRE. The current aeronautical ASQF specification in [1] includes the followingfunctions. The requirement for these functions must be reviewed in the light of the over-all EGNOSvalidation programme.

• Safety assessmentThe ASQF safety assessment function will provide the means to analyse and investigate theimpact of the EGNOS system dependability performances on the safety of the aeronautical userapplications in terms of RNP parameters. The ASQF will provide the means to assess the impactof subsystems failure conditions on the RNP parameters. The ASQF safety assessment willprovide models to assess failure impacts on the RNP parameters over the ECAC area.

• Assessment and validation of MRD to SRD translationThis ASQF function will provide the means to assess and validate the translation between theMission Requirements Document (MRD) and the System Requirements Document (SRD) basedon a performance analysis at the level of RNP parameters.

• RNP performance analysisThe ASQF RNP performance analysis function will provide the means to derive statistics on theRNP parameters from real data, obtaining results on accuracy, integrity, continuity and availabil-ity, and generating reports about the qualification status. The ASQF operator shall be able tospecify the geographical area and the time span over which the RNP statistics shall be derived.The means to extrapolate the RNP parameters over the ECAC area from the measured data shallalso be provided. By this, it shall be possible to perform the EGNOS performance analysis andevaluation in terms of RNP parameters over the whole ECAC area.

• RNP performance trend analysisThis function will provide the means to perform EGNOS performance trend analysis in terms ofthe RNP parameters over the ECAC area.

• RNP prediction versus system configurationThis function shall provide the means to predict the behaviour of RNP performances over theECAC area as a function of the space segment configuration and the system configurationprofiles programmed by the ASQF operator. This shall be done over a programmable time scaleranging from a few minutes to several days.



EUROCONTROL

• Flight procedure analysisThe ASQF flight procedure analysis function will provide the means to analyse and test flightprocedures based on EGNOS by comparing recorded flight data against expected trajectoriesand RNP parameters predicted along simulated flight trajectories.

• Validation of external prediction toolsThis function will provide the means to validate the CCF prediction tool and external predictiontools, i.e. tools that external bodies develop and provide for operational use, by comparisonagainst its own prediction tools and against real data.

• Analysis of interoperability between SBASThis function will provide the means to analyse the interoperability performance of EGNOS withadjacent RAAS in terms of RNP parameters. The function shall make use of simulated data andreal data obtained in the common area of coverage between EGNOS and other RAAS.

• Analysis of interoperability with LAASThis function will provide the means to analyse the interoperability performance of EGNOS withLAAS in terms of RNP parameters.

• ArchiveThe ASQF archive function will provide the means to archive the input data used in the ASQF,the processing of intermediate results and the outputs obtained, which have not already beenarchived as part of the system archive.

All functions performed by the ASQF will consider both nominal and degraded conditions of theEGNOS system. All the real data used by the ASQF will consider both static and dynamic conditions.

Other ESA Verification Tools for EGNOS

The EGNOS AOC implementation phase will contain the development of a number of platforms andfacilities in support of the verification activities in the different phases of the EGNOS programme:

• Development and Verification Platform (DVP)The DVP represents the prime contractor tool that will be implemented as part of the systemintegration and verification activities carried out by the EGNOS prime contractor. Several devel-opment and verification tools will be implemented as part of the development, integration andverification activities carried out by industry; these tools will exist at various levels and locations,from subassemblies to the total EGNOS system. The DVP will be developed and used by theindustry throughout the EGNOS AOC implementation phase and will be a deliverable to ESA.An important part to be developed in the frame of the DVP is the EGNOS System Test Bed(ESTB).

• Performance Assessment and System Check-out Facility (PACF)The PACF will be a facility in the EGNOS AOC system for providing off-line technical support toEGNOS system operations. The PACF will become available towards the end of the EGNOSphase C/D development. Therefore, it is only of very limited interest for EOT&V. The PACF willprovide the means to perform:

- detailed analysis of the EGNOS system performance under nominal and contingency condi-tions, allowing to assess in particular all performances specified in the EGNOS system re-quirements document [2].

- trend analysis and analysis of EGNOS operational procedures

- anomaly investigations and trouble-shooting

- specifications of system modifications or upgrades

- operation support under EGNOS management control



EUROCONTROL

• EGNOS System Test Bed (ESTB)The ESTB is based on a network of eight reference stations spread over Europe, which collectsreal time data from GPS, GLONASS and the EGNOS AOR-E satellites. The data is transmitted toa central processing centre, differential corrections and integrity information is computed andcorresponding formatted messages are forwarded for transmission over the EGNOS GEO satel-lites. Several test users will then receive and process those EGNOS messages. By this, the ESTBrepresents a kind of real time mock-up of the EGNOS system. The main purpose of the ESTB isthe following [11]:

- To have a first assessment of the global performance that may be reached with EGNOS;

- To analyse in depth specific critical design issues or trade-off between several options;

- To demonstrate to the users the system operation;

- To develop and validate system test methods;

- To provide a representative tool for Civil Aviation to build up SBAS practical experience.

Within EOT&V, the ESTB will play an important since it will provide the means to develop and testvalidation procedures by applying the preliminary procedures on the GEO signals generated bythe ESTB. Additionally, it will be possible to gather first experiences with the use of the GEOsignal, allowing the user community to develop preliminary procedures for the operational use ofEGNOS. By this, the ESTB will significantly reduce the time necessary to conduct the EOT&Vprogramme since it allows many validation activities to be undertaken before the real EGNOSsignal becomes available.

• Assembly, Integration and Verification Platform (AIVP)The AIVP will be the tool for in-factory system verification based on emulators for subsystems andon test environment software.

• EGNOS System Simulation Facility (ESSF)The ESSF will be a software tool used for analysis and comprising of 3 components:

- EGNOS service volume, and EGNOS availability functions;

- End-to-end simulation, providing measurements from RIMS to user receiver;

- RAMS (Reliability, Availability, Maintainability and Safety) simulation, for determining thepropagation of errors.

Experimental Tools

A special focus within the EOT&V programme will be set on specific test scenarios that may requirespecial experimental tools that are not contained in SAPPHIRE or ASQF. An example for this mightbe an interference test scenario for which special test equipment and special procedures may benecessary in order to evaluate the influence of interference sources on the EGNOS receiverbehaviour.

Another issue for experimental tools will be special flight tests with experimental aircraft. In order toensure that the EGNOS operational requirements are met under ‘worst case’ conditions the testshave to focus on such ‘worst case’ scenarios. For example, it might be necessary to conduct manyapproaches at the edge of the EGNOS coverage under the influence of special flight manoeuvres,e.g. high bank angles and curves during the approach phase like they could occur under adverseweather conditions.

Test Equipment

The validation of EGNOS will require practical tests to be undertaken with reference user receivers.It is not clear at this time whether user equipment will be commercially available to perform thesetests.

The following receiver development activities are known to be under way:



EUROCONTROL

• The MAGNET project is funded by the European Commission with the objective of developinguser segments including WAAS/EGNOS capabilities for all modes of transport. Based on acommon core module, dedicated interfaces and environmental characteristics will be incorporatedfor each user segment. The aviation receivers are being developed with airborne certificationrequirements in mind. Prototype receivers were planned to be available by summer 1998 for firsttests onboard an aircraft.

• On behalf of ESA a multi-standard EGNOS receiver has been developed. This receiver is built toaviation standards (where they exist) but is currently a prototype. To operate such a receiveronboard a commercial airliner will require further development. Several European manufacturersare currently working on receiver products based on the ESA multi-standard module.

• US receiver manufacturers are known to be developing WAAS compatible equipment but thesereceivers are unlikely to include GLONASS, which will be included in the EGNOS design.

Currently (September 1998), there is no information on the receiver types that are being developedby several manufacturers available yet.

In addition to the test user receiver, further test equipment will be necessary. For example, thisincludes data acquisition and recording equipment, which might be similar as in the SAPPHIREproject. Additionally, some standard equipment will be necessary, e.g. spectrum analysers forinterference investigations.

3.5 Summary

This section summarises the results of the preceding sections. Table 3-1 lists all relevant parametersdetermined before and provides the basis for the consolidation of the validation strategy. The table isbased on an assumed confidence level of 95% for all tests.

Accuracy Validation

Referring to the above-presented table, the maximum correlation time to be considered for accuracyvalidation is one hour, which is necessary to handle multipath errors appropriately. On this basis, thenecessary time for an accuracy measurement campaign can be calculated as follows, assuming aconfidence level of 95%:

hours, 73hour173 =⋅=⋅= ctnT n = number of independent measurements

tc = correlation time

This means that it will be sufficient to take 73 different measurements, which are separated, fromeach other by one hour to validate the ranging accuracy of the system. Nevertheless, it makes nosense to perform these measurements by a larger number of receivers simultaneously within thecoverage area since these measurements could not be regarded as spatially decorrelated. Withregards to the ranging service of EGNOS, the influences of geometry induce a correlation ofmeasurements in longitude direction while ionospheric effects lead to a correlation in latitudedirection. Therefore, it is not possible to make parallel measurements for validation of the rangingservice. However, because of the low number of necessary test samples and due to the fact thatlocal effects on the accuracy of the ranging service can be regarded as being low, one 73 hoursmeasurement campaign would be sufficient for validation of the ranging capability.

In contrast to this, the accuracy of the differential capability has a larger spatial dependency.Therefore, the differential capability should be validated at multiple locations with a 73 hoursmeasurement campaign at each location. The grid size for the measurement locations should bedefined in relation to the RIMS network. As described in Appendix A.5 the highest probability ofdegraded accuracy, e.g. due to interference or multipath, is in the vicinity of airports. Therefore, theaccuracy test flight campaign should focus on major airports. Another reason for this is that the



EUROCONTROL

approach phase of flight is related to the most stringent accuracy requirements. The test programmeshould therefore focus on validating the accuracy performance during the approach phase of flight.

A test grid with nodes distributed all over the ECAC area should be defined. The validation of theaccuracy performance fulfilment has to be undertaken for each node of the test grid, which meansthat a 73-hour test campaign should be performed at each point. The definition of the validation gridrequires further investigation, under consideration of local effects influencing the accuracy. It has tobe noted that this grid does not replace the flight inspection activities, which will still be required forapproval of approach procedures for each individual airport.

A simulation tool needs to be developed for extrapolation of the measurement results from the testgrid to the whole ECAC area. Given the accuracy performance in certain distinct locations and basedon information from the EGNOS system this tool should provide the means to calculate the accuracyperformance for the whole ECAC area. Additionally, the definition of the test grid also should besupported by this tool. For this, the tool should be able to determine locations that are representativewith regards to their accuracy performance. In particular, such locations should be included wherethe expected accuracy performance is below the calculated average.

Additional tests should be made during all other flight phases (especially en-route) in order to verifythat the results from the extrapolation efforts are valid for all phases. However, the character of these

Accuracy(DifferentialCapability)

Accuracy(RangingCapability)

Integrity(IntegrityCapability)

Availability Continuity

Test Samples 73 73 1.38 x 109 (NPAto RNP4)1.65 x 109 (Cat I)

73 (NPA)2560 (Cat I)

1.40 x 108 (NPA-RNP4)2.87 x 107 (Cat I)

Correlation Time

General 1 s 2 min 1 s 1 s 1 s

Geometry 30 min 30 min - - -

Multipath 1 hour 1 hour 1 hour 1 hour 1 hour

Ionosphere 15 min 15 min Depends on theprobability of theoccurrence ofunpredictableionosphericeffects andinfluence on thereceiver integrity

Depends on theprobability of theoccurrence ofunpredictableionosphericeffects

Depends on theprobability of theoccurrence ofunpredictableionospheric effects

OVERALL

CORRELATION

TIME

1 hour 1 hour 1 hour (tbc) 1 hour (tbc) 1 hour (tbc)

Spatial Correlation

Geometry RIMS networkgrid size

Latitude: 15°

Longitude:Coverage Area

GBA (systemerrors only)



Ionosphere RIMS networkgrid size

Latitude:Coverage Area

Longitude: 270 km

Area ofunpredictableionosphericeffects

Area ofunpredictableionosphericeffects

Area of unpredict-able ionosphericeffects

Multipath: 20 km Latitudeand Longitude

20 km Latitude andLongitude

20 km Latitudeand Longitude

20 km Latitudeand Longitude

20 km Latitude andLongitude

OVER ALL

SPATIAL

CORRELATION

RIMS networkgrid size

Coverage Area tbd tbd tbd

Table 3-1: Summary of Correlation Parameters



EUROCONTROL

tests is more like a demonstration since the main validation will be done with regards to the highaccuracy requirements for the approach phase of flight.

Flight tests should be undertaken at different times during the day in order to consider ionosphericinfluences. Additionally, flight tests should be undertaken with different aircraft types and the resultsof all measurement campaign should be analysed with regards to possible dependencies.

Integrity Validation

As stated before in this document, it is not possible to validate integrity requirements by test ordemonstration. Modelling and analysis, if possible supported by test or demonstrations of criticalitems where possible, are the main validation tools, primary based on risk allocation trees with givenor estimated parameters. Even when concentrating on the validation of operational influences onintegrity and considering that the GIC integrity signal is validated by ESA, it is not possible to validateintegrity by practical measurements. The main reason for this is of course the large number ofnecessary test samples, although it would be possible to undertake many parallel measurements atdifferent locations, at least when only operational influences on the integrity performance areconsidered and the SIS integrity risk is taken as given by ESA. However, there still remains theproblem that the characteristics of the operational influences require long time portions between twomeasurements (1 hour), by this making a validation by test impossible.

Analyses have to be undertaken in order to assess the influence of multipath and ionospheric effectson the integrity performance of an EGNOS user. It has to be defined which particular events mayinduce integrity failures and how likely such events are to occur.

The EOT&V programme should additionally validate the receivers used in the test procedures withregards to their RAIM performance. This may be done in laboratory conditions but the influence ofdynamic effects (i.e. high accelerations) must not be neglected.

However, the integrity validation analysis should start with a risk allocation tree analysis on the basisof the ESA verification work. This, in conjunction with the analysis of the operational influences onintegrity as described above should build the backbone of the EOT&V integrity validation. Additionalneeds for validation activities might arise from the analysis.

Availability and Continuity Validation

The validation activities for availability and continuity of service are very closely related.

The necessary number of test samples for availability validation principally allows a validation by test.However, this assumption is only valid if the operational influences are regarded to follow a Gaussianerror distribution. Since this cannot be assured, the tests for availability validation should beaccompanied by analysis. This analysis should assess the probability of availability of continuity ofservice outages caused by multipath or unpredictable ionospheric effects.

Continuity of service validation requires a much higher number of test samples. Therefore, validationby test is only possible within a reasonable time schedule, if the correlation time can be reduced. Thecurrent assumptions require a correlation of 1 hour due to multipath influences. If it becomespossible to validate multipath influences (and maybe other operational influences on continuity)sufficiently by analysis, the correlation time could be reduced, thus enabling the remaining continuityrisk to be validated by test. This has to be subject to further investigations.



EUROCONTROL




EUROCONTROL

4 PROPOSED EOT&V PROGRAMME

This section provides the proposed outline of the EOT&V Programme. This proposal is based on theinvestigations that took place during the EOT&V Requirements Study and may be refined in a laterstage of the EOT&V process. First a Project Management Plan is presented, after which cost issuesare discussed and time scales are addressed.

4.1 Project Management Plan

This section describes the major tasks that have to be undertaken within the EOT&V Programme.The Work Package (WP) breakdown proposed for this project is as follows:

WP1 - Initial Reviews and AnalysisWP1.1: Reviews

- EGNOS validation framework review- Civil Aviation operational requirements- Review of ESA fault tree analysis- Review of ESA validation tools definition

WP1.2: Analysis- Fault tree analysis- Integrity risk analysis- Availability and continuity of service analysis- Multipath analysis- Analysis of Atmospheric Effects- Measurement locations

WP2 - Early TrialsWP2.1: DefinitionWP2.2: DevelopmentWP2.3: ImplementationWP2.4: Evaluation

WP3 - Detailed DefinitionWP3.1: Operational Validation PlanWP3.2: Validation ProceduresWP3.3: Data Acquisition ToolsWP3.4: Aircraft EquipmentWP3.5: Definition of Validation and Simulation ToolsWP3.6: Detailed Organisational and Financial Planning

WP4 - Development PhaseWP4.1: Simulation ToolsWP4.2: Data Acquisition ToolsWP4.3: Aircraft EquipmentWP4.4: Data Evaluation Tools (SAPPHIRE, ASQF, Others)

WP5 - Implementation PhaseWP5.1: SimulationsWP5.2: Tests and DemonstrationsWP5.3: Data Evaluation

WP6 - ManagementWP6.1: Internal Co-ordinationWP6.2: Co-ordination with CAAsWP6.3: Procurement



EUROCONTROL

WP6.4: Co-ordination with SuppliersWP6.5: Quality Assurance

Figure 4-1 shows the overall work breakdown structure. The following subsection 4.1.1 providesdescriptions of the individual tasks while section 4.1.2 describes the associated time schedule.

Proposed Programme Plan

Validation FrameworkCivil Aviation Req.ESA Fault Tree AnalysisESA Validation Tools

WP1.1Reviews

Fault Tree AnalysisIntergrity Risk AnalysisAvailability and ConituinityMultipath AnalysisAtmospheric EffectsMeasurement Locations

WP1.2Analysis

WP1Initial Reviews and Analysis

WP2.1Definition

WP2.2Development

WP2.3Implementation

WP2.4Evaluation

WP2Early Trials

WP3.1Operational

Validation Plan

WP3.2Validation Procedures

WP3.3Data Acquisition Tools

WP3.4Aircraft Equipment

WP3.5Definition of

Validation Tools

WP3.6Detailed Organisationaland Financial Planning

WP3Detailed Definition

WP4.1Simulation Tools

WP4.2Data Acquisition Tools

WP4.3Aircraft Equipment

SAPPHIREASQFOther Tools

WP4.4Data Evaluation Tools

WP4Development Phase

WP5.1Simulations

WP5.2Tests and Demonstrations

WP5.3Data Evaluation

WP5Implementation Phase

WP6.1Internal Co-ordination

WP6.2Co-ordination with CAAs

WP6.3Procurement

WP6.4Co-ordination with Suppliers

WP6.5Quality Assurance

WP6Management

EGNOS OT&VEUROCONTROL

Figure 4-1: Proposed EOT&V Work Breakdown Structure

4.1.1 Work Package Descriptions

This section provides detailed descriptions of the proposed tasks of the EOT&V programme.

4.1.1.1 WP1 - Initial Reviews and Analyses

The aim of this work package is to undertake first reviews and analyses that are necessary forrefining the EOT&V validation activities and to better plan the EOT&V programme. This task coversscientific as well as operational aspects and should be started as early as possible in order to have acompleted view of the EOT&V programme as soon as possible.

WP1.1 - Reviews

As stated earlier in this document, the EOT&V programme will assume that ESA conducts thetechnical test and validation of EGNOS to insure that the system meets the system requirements.Furthermore, it is assumed that the EGNOS SIS is true, such that an appropriate EGNOS receiverwill function in the correct manner in an ideal environment.

As it can be seen from these assumptions, EOT&V will strongly rely on the validation work that will beundertaken by ESA. Of course, it is not necessary to duplicate this work, but an independent reviewshould be undertaken. This is necessary in order to ensure that operational considerations of civilaviation have been reflected appropriately, where necessary.

The following list contains the main elements that should be subject of reviews. It is assumed thatadditional requirements for reviews will arise during the EOT&V process based on the preliminaryoutcome of the work efforts that will be undertaken.

• EGNOS validation framework review: This review shall assess the results of all completed or ongoing GNSS validation activities, as faras available. The results have to be reviewed in order to determine whether the whole frameworkfor EGNOS validation is complete. It has to be ensured that all RNP related issues, operationaland safety issues are sufficiently covered. As stated earlier in this document, the EOT&V Re-



EUROCONTROL

quirements Study focused on operational influences related to RNP. However, it is expected thatfurther investigations will become necessary with regards to the operational navigation environ-ment in European Airspace (e.g. ATC interface, controller workload etc.). The EGNOS validationframework review shall define such issues that have not been previously covered. This might leadto the definition of additional validation activities for the EOT&V process.

• Civil aviation operational requirements: As stated earlier in this document the operational requirements which EGNOS will be validatedagainst by the EOT&V programme have not been completely consolidated yet. These require-ments are based upon the ICAO RNP parameters and may also be influenced by regional opera-tional aspects such as traffic density, airspace complexity, existence of alternate navigation aids,etc. Additionally, the European CAAs do not know the exact operational usage of EGNOS yet;e.g. even new operational procedures may be defined in future for the use of EGNOS. Therefore,it is important to consolidate the actual operational (mission) requirements before the EOT&Vimplementation phase starts. However, it can be assumed that this requirement consolidation willonly change some requirement values but not the requirements itself. Therefore, the developmentof the EOT&V programme is mostly independent of the actual requirement values. The generalvalidation activities that have to be undertaken remain the same.

• Review of ESA fault tree analysis: Fault Tree Analysis is a logical top down approach to identifying the events necessary to create afailure condition. The relationship between the events are defined and their probability of occur-rence in order to establish the probability of the failure event occurring. ESA will undertake a complete fault tree analysis of the EGNOS system within the technicalvalidation programme. EOT&V will have to undertake a review of this analysis with regards tooperational aspects and may find the need for additional work due to operational issues that mighthave been left open by the ESA work.

• Review of ESA validation tools definition: The aim of this activity is to check whether the ESA tools are suitable for the use within theEOT&V process. This means to evaluate the individual ESA tool functions whether they areappropriate to fulfil the needs of EOT&V as identified in this document. This task may be under-taken by reviewing the design documents of the respective tools. In particular, the capabilities ofthe ASQF have to be analysed in order to define the additional tools and functions necessary forEOT&V. Additionally, the tools that will be selected for the use within EOT&V should be subject to a formalindependent review process verifying that the tools are reliable and built in accordance with theirspecifications. This review process could be done by review of specifications and design docu-ments etc., accompanied by audits and inspections.

WP1.2 - Analysis

There are various factors that need to be taken into consideration when the analysis phase of thetest and validation programme is to be conducted. In addition, there are also certain techniques,which can be applied to ensure the validity of the results obtained. Listed below are factors andtechniques that should be considered during the analysis phase. Some of the tasks listed below areoverlapping or strongly related to each other and thus should be performed together (by one analysisteam) or at least closely co-ordinated.

• Fault Tree Analysis: This analysis should refine the ESA work on fault tree analysis with regards to operational influ-ences on RNP. The impact of failure conditions of EGNOS on the RNP parameters has to beassessed (if not sufficiently covered by the ESA analysis). Possible failure conditions on allEGNOS levels have to be considered, i.e. on system level, subsystem level (NLES; EWAN; RIMSetc.) and component level.



EUROCONTROL

In particular, those error conditions have to be identified and regarded in detail that could haveoperational consequences for civil aviation use of EGNOS. In particular, the risk for the occur-rence of such error conditions has to be determined as well as the kind of operational conse-quence has to be analysed.

• Integrity Risk Analysis: Based on the fault tree analysis a risk allocation tree with respect to the integrity performance hasto be developed. Based on the ESA work, each individual risk parameter of the allocation tree hasto be assessed relating to the effect of operational influences. If such influences are expected, theeffect has to be assessed in terms of integrity risks (real values), either by analysis or by definingdedicated tests that allow to quantify the effect of operational influences on the integrity perform-ance (see Appendix A).

• Availability and Continuity of Service Analysis: Based on the ESA work on availability assessment, this analysis has to determine by analyticalmethods the availability of the EGNOS receiver and in particular the effect of operational influ-ences on the availability (see also Appendix A). Typically, these operational influences will resultin local and/or short-term interruptions of the EGNOS reception. It is the objective of this analysisto determine the probable duration of such interruptions and the probability that they occur. Thismight require the definition of dedicated tests to be undertaken in the implementation phase ofthe EOT&V programme. The analysis should also consider degraded performance modes of EGNOS, e.g. if one particularservice element (e.g. WAD) fails.

• Multipath Analysis: Since multipath effects are very difficult to isolate during tests, it is important to investigate theinfluence of multipath on the performance of EGNOS by analysis. This analysis should estimatethe typical multipath errors to be expected for the aircraft to be used for the EOT&V flight tests.Additionally, the probability of multipath occurrence should be estimated. Another important aspect is to analyse the influence of the antenna position on the fuselage of theaircraft (above the wings, above the cockpit, etc.) on the multipath behaviour.

• Analysis of Atmospheric Effects: The purpose of this analysis is to investigate the influence of atmospheric effects on the opera-tional performance that an aircraft user experiences. Most ionospheric influences on signal effectswill be corrected sufficiently by the correction data distributed by ESA. The focus of this analysisshould therefore be to look at long-term changes of the ionospheric effects. For this, it is expectedthat a simulation is necessary to evaluate the long-term influences on the operational perform-ance of EGNOS. This analysis task should define in detail the requirements for such a simulation. Furthermore, the analysis should investigate the influence of local ionospheric scintillation, inparticular with regards to the solar maximum around the year 2000. The probability that such localscintillations cause substantial losses of the navigation function should also be assessed. These investigations are expected to be carried out on behalf of ESA.

• Measurement Locations: The test and validation programme will undertake measurements at various locations within theEGNOS coverage area. For the selection of these locations the spatial correlation of measure-ments has to be considered (see section 3.5 and Appendix A.4), but also the expected opera-tional environment. To achieve this, locations must be sought which can be deemed to be repre-sentative of the EGNOS service across the ECAC region.



EUROCONTROL

It has to be considered that the EGNOS performance is not equal for the whole ECAC coveragearea. There are differences, e.g. because of the coverage limitations of the two GEO satellites orbecause of the RIMS locations.

4.1.1.2 WP2 - Early Trials

The implementation of EGNOS will significantly increase the role of satellite navigation in Europeancivil aviation. Although the EUROCONTROL member states already gained experience with the useof GPS in their airspace, the step to use EGNOS is expected to results in notable changes to naviga-tion operations. Therefore, it would be beneficial for the member states to make experiences with theuse of the system as soon as possible by undertaking ‘early trials’.The focus of these early trials is not the validation of EGNOS but to gather pre-operational experien-ces with the use of EGNOS. For example, these trials may help the national CAAs in the develop-ment of flight procedures for EGNOS-based navigation and to evaluate influences of the new serviceon their operational arrangements. Therefore, it is not necessary to have the full EGNOS perform-ance available during these trials. Instead, it will be sufficient to use the SIS provided by the EGNOSSystem Test Bed (ESTB).

Therefore these early trials are not directly part of EOT&V but data gathered during these trials mightbe used later in the EOT&V process in order to increase the amount of data available for statisticalevaluation purposes. In particular, the ESTB will be useful to develop and validate test proceduresthat will be applied in the EOT&V Programme.

EUROCONTROL is expected only to undertake some co-ordination efforts for the trials and, ifpossible, to include data gathered during the trials into the SAPPHIRE database. For this, somesupport to those national CAAs undertaking early trials will be necessary. The trials are expected tobe undertaken directly on behalf of national CAAs. Nevertheless, EUROCONTROL should promotethe distribution of results and experiences gathered during the trials, in particular in order to providesupport to those EUROCONTROL member states that will not be in a position to afford such trials ontheir own.

This work package is further divided into the work packages described below:

WP2.1 - Definition

This work package shall define the trial programme in form of a project plan and to exactly define theobjectives of the trials. These objectives may differ between the different states due to differentoperational arrangements.

WP2.2 - Development

This task covers the development of procedures, tools and equipment for the trials. As far aspossible it should be made use of existing systems and equipment but some adaptations might benecessary. A particular concern is related to the availability of suitable EGNOS receivers. Today, it isquestionable whether certifiable aviation receivers will be available in time for the trials. Therefore, itmight be necessary to use prototype-like equipment or available WAAS and GPS/GLONASSreceivers.

WP2.3 - Implementation

This work package covers the execution of the trials.

WP2.4 - Evaluation

This task includes the evaluation of data gathered during the trials and to draw conclusions from thepractical experiences achieved. The evaluation might be supported by the SAPPHIRE programme.

4.1.1.3 WP3 - Detailed Definition

This work package will take the input from all previously performed work on the validation of EGNOSand will develop a detailed definition of the remaining EOT&V programme to be undertaken.



EUROCONTROL

WP3.1 - Operational Validation Plan

This work package shall define a detailed operational validation plan, based on the results fromvarious activities, such as the EOT&V Requirements Study and the EUROCONTROL safety work onGNSS. By this, the plan to be developed should cover all three categories of EOT&V related work asdefined earlier in this document: RNP related issues, operational issues and safety issues.

This plan will provide the baseline for EUROCONTROL to co-ordinate the EOT&V activities. Forinstance, the plan could then be used to determine the validation activities that can be carried outmaking use of States’ experimental infrastructures, thus allowing for possible cost-savings.

WP3.2 - Validation Procedures

The basis for the development of validation procedures is the theoretical concept developed in thisdocument. The outcome of the initial reviews and analyses (WP1) will also provide additionalnecessary input to this task.

On this basis, the objective of this work package is to define in detail all activities and procedures forthe operational validation of EGNOS. All aspects assessed in this document as well as those aspectsthat will be derived from WP1 have to be covered by an appropriate comprehensive set of validationprocedures.

An appropriate separation between the various possible validation methods (such as tests andsimulation) will be defined, exact definitions for ground and flight tests have to be made and differenttest scenarios will be developed.

Some validation procedures will be built on existing tools and techniques while others may requirethe definition of additional necessary developments, such as add-ons to existing simulation tools.

WP3.3 - Data Acquisition Tools

Based on the data requirements for the measurements to be undertaken within the EOT&Vprogramme, this work package will define the requirements for appropriate data acquisition tools. Itcan be expected that the scope of this task is very limited since based on the experiences from theSAPPHIRE programme, the EOT&V data acquisition tools will probably only require some minormodifications to those used for SAPPHIRE.

However, it might be necessary to include additional requirements towards the tools due to thecharacteristics of EGNOS compared to GPS (e.g. the much higher amount of data to be expected)or due to constraints resulting from the concerned aircraft that have to be equipped.

WP3.4 - Aircraft Equipment

This work package is closely related to the data acquisition tool definition (WP3.3) and will define indetail the necessary on-board equipment for flight trials.

The requirements for equipment will differ significantly with regards to the type of aircraft used for thetrials. For experimental aircraft, a complete certification of the equipment is not as important as forcommercial airliners since a temporary experimental installation of the equipment would be sufficient.A usual certification procedure for such experimental installation usually only covers the assurancethat the equipment does not interfere with the safety critical avionics.

The situation for commercially operated aircraft for passenger services is completely different. Here,a full certification of the equipment is required. An additional difficulty that might occur is the fact, thatmost modern aircraft will be already equipped with certified GPS equipment. An upgrade ofequipment to EGNOS is not possible without losing this certification, e.g. due to the fact that adifferent antenna (for GPS and GLONASS reception) has to be installed. This will probably not beacceptable for the airlines. Therefore, it can be expected that the EGNOS equipment would have tobe installed in addition to the existing GPS equipment but this is associated with high costs and isalso depending on the acceptance by the airlines.



EUROCONTROL

WP3.5 - Definition of Validation and Simulation Tools

There will be two important tools for data evaluation within the EOT&V programme, which areSAPPHIRE and the ASQF. Nevertheless, it has to be noticed that the ASQF has additional features(e.g. with regards to simulation and prediction) that go beyond evaluation of real data.

Although SAPPHIRE has been developed especially for the data collection on-board commercialaircraft, it will be of significant use for EOT&V. Many analysis and simulation tools that have beendeveloped within the SAPPHIRE programme will be very useful for EOT&V. However, there will bethe need to extend some of the SAPPHIRE functions in order to include EGNOS capabilities. Theseextensions will be developed in the third phase of the SAPPHIRE DUAU development. The EOT&Vrequirements phase will produce contributions to the specification of these extensions.

Some of the analysis tools that will be necessary for EOT&V will be implemented in the ASQF.EUROCONTROL and ESA agreed that the ASQF will be developed to be compatible and comple-mentary with SAPPHIRE, thus ensuring that future SAPPHIRE developments will not duplicate toolsand functions of the ASQF.

Additionally, also the capabilities of other ESA tools (e.g. the ESTB) will be useful for evaluation andsimulation activities within EOT&V.

This work package will define in detail the adaptations that have to be applied to the existing tools inorder to become suitable for of the purposes of EOT&V. Currently, it is not expected that completelynew tools will be necessary but this will need to be confirmed.

WP3.6 - Detailed Organisational and Financial Planning

The objective of this work package is to update and refine the organisational and financial planningfor the EOT&V programme outlined in this document.

As stated before in this document, many EOT&V activities still need to be defined. Therefore, adetailed planning of the activities and an estimation of the associated costs is not possible yet (seealso section 4.2 on cost estimates). Necessary input to this task has to be provided by the initialanalyses (WP1) and the detailed definition activities undertaken in the parallel work packages3.1-3.5.

4.1.1.4 WP4 - Development Phase

Based on the definitions and specification developed in WP3, this work package will develop thesimulation, data acquisition and evaluation tools as well the aircraft equipment for the EOT&Vprogramme.

WP4.1 - Simulation Tools

A number of requirements for the operational use of EGNOS can not be validated by practicalmeasurements alone. This is mainly due to the fact that the number of necessary independent testsamples would be too high so that the practical validation would take many years. A reasonablecombination of analysis, simulation and practical tests is the solution for this problem. Whereverpossible, the results of simulations should be verified by practical measurements.

The exact requirements for simulation within EOT&V will be developed in WP3.5 during the detailedprogramme definition. On this basis, this work package will further define the necessary tools.

SAPPHIRE offers a number of powerful data simulation tools. A tool that is of special interest forEOT&V is the XDOP simulation tool. The XDOP algorithms are designed to determine the satelliteconstellation performance for a specific user aircraft. It allows the consideration of GPS, GLONASSand INMARSAT (EGNOS) satellites by using either almanac or ephemeris data of the respectivesystem. Furthermore different scenarios allow the calculation of the satellite constellation perform-ance under different constraints and in different co-ordinate systems.



EUROCONTROL


Based on WP3.3 the objective of this work package is to develop the data acquisition tools for themeasurements to be made during EOT&V.


Based on WP3.4 this task develops and/or procures the necessary aircraft equipment for flight trials.This work package is closely related to the development of data acquisition tools.

WP4.4 - Data Evaluation Tools

The objective of this work package is to develop the data evaluation tools identified in WP3.5. Thiswill consist of adaptations of existing tools as outlined in the description of WP3.5.

4.1.1.5 WP5 - Implementation Phase

WP5.1 - Simulation

Simulation is a powerful tool that is likely to be used extensively in EGNOS OT&V. To ensure that thesimulation is appropriate, it may be necessary to first independently validate the simulation beforeusing simulation to validate EGNOS. Simulation will involve critical parameters, such as multipath,coverage, interference, ionospheric, tropospheric and other factors.

Simulation will also be used to validate assumptions made about the extrapolation of measurementresults from a limited sample set to cover the whole EGNOS area. This applies in both spatialaspects, to extrapolate results from one geographical area to the whole of the coverage area, andalso for parametric aspects to allow measurements under one set of environmental conditions to beextrapolated to cover other sets of conditions. This is an area where simulation is particularlypowerful, allowing the exact selection of appropriate sets of conditions to verify behaviour andconfirm assumptions about extrapolation of results.

Unlike with conventional navigation aids where the signal reception hardly depends on the aircraft’sattitude, the reception of satellite signals is based on the line of sight. Therefore, it is an importantaspect for operational validation to include accurate aircraft models. To correctly simulate effects thatinfluence the satellite visibility (masking etc.) it will be necessary to implement models of a variety ofaircraft types with true to life physical characteristics and performance models into the simulation.This will include the incorporation of realistic pitch, roll and yaw angles in the models. In addition, itwill be necessary to simulate the satellite geometry that will be visible to a user at a specific locationwithin ECAC. Together with the analysis of recorded data, this will enable the extrapolation ofmeasurement to other geographical regions, other aircraft manoeuvres or other aircraft types.

A further advantage of simulation is the ability to inject errors into the system at will and monitorsubsequent system behaviour. This is typically not possible with tests of the actual system, whereusually the nominally good behaviour can be verified.

Examples for simulations within the EOT&V programme are listed below. The exact requirements forsimulation will be developed in WP3:

• simulation of multipath at aircraft• investigation of the influence of ionospheric effects on the operational performance of EGNOS• simulation of dynamic effects on the EGNOS receiver behaviour using an EGNOS signal

generator

WP5.2 - Tests and Demonstrations

The very nature of operational test and validation dictates that real life tests and measurements willprovide the backbone of EGNOS OT&V. Although other methods provide good support and theability to extrapolate the results of actual measurements, EGNOS OT&V would not be possiblewithout making real measurements under operational conditions. It is important that the requirements



EUROCONTROL

for these operational tests are well considered, since a good choice of operational tests will minimisethe number of tests required whilst ensuring that sufficient data is collected to allow validation of theentire EGNOS operation. The tests selected must be representative of system operation in bestcase, typical and worst case conditions. Further demonstrations can be used to verify that simulationand analysis results are valid and a true representation of operational conditions.

Tests will be both operational and experimental, the latter employing special equipment to enablespecific parameters or conditions to be examined in detail. These could include, for example,integrity tests using error injection to monitor system behaviour under fault conditions.

According to the current EGNOS time schedule, a complete EGNOS signal for validation purposeswill not be available before mid 2002. Therefore, the main tests and demonstrations cannot beundertaken before that date. However, those activities that do not require the EGNOS signal tocompletely fulfil its requirements (in particular demonstrations) can be initiated earlier in the EOT&Vprocess by making use of the ESTB. The ESTB will generate a signal, broadcast by GEO satellite(s),which is similar to the final EGNOS AOC signal (with identical data format), although not fulfilling thestringent AOC requirements. The ESTB may also be used for the initial assessment of testprocedures, thus allowing to refine the procedures before applying them to the real EGNOS signals.After EOT&V has successfully validated EGNOS, it will be necessary to approve the system forspecific flight procedures. This process of operational approval will be the responsibility of themember states and may require dedicated measurements, comparable to flight inspection forconventional navigation aids. However, it has to be recognised that some states do not have theresources to undertake major validation and approval activities on their own. In this respect, the roleof EUROCONTROL should be to initiate as much effort as possible on a European wide level.

Ground Tests

Ground tests provide an efficient method to undertake EGNOS measurements without the high costsassociated with flight tests. The ground tests to be undertaken will be defined in detail in WP3. Forexample, ground tests may cover measurements dedicated to multipath validation at locations wheremultipath is expected to be high, i.e. during approach and departure. Additional ground tests shouldbe undertaken in order to intentionally look for quasi-static multipath at airports. Such initial measure-ments for multipath validation may be undertaken by using the ESTB signals since the multipathbehaviour should be identical to that of the EGNOS AOC signal. If multipath events occur, the risk ofthis occurrence might have to be validated by additional analysis efforts.

Before conducting flight trials at airports (approaches, departures), measurements with a spectrumanalyser should ensure that no interference sources exist in the vicinity of the airport.

Flight Tests

After ground tests have demonstrated the system performance in the static environment a series offlight tests must be carried out in order to verify the system performance in the real operationalenvironment. Flight tests should establish the validity of the signal-in-space as it is presented to anaircraft including the effects of representative aircraft manoeuvres. Initial flight tests will be carriedout using test aircraft where the test team has control over the trajectory and manoeuvres of theaircraft. After successful test flights, data gathering can be extended to include commercial flights asit is currently done for the EUROCONTROL SAPPHIRE programme. An additional possibility for theflight test phase would be to use special use aircraft (e.g. flight inspection aircraft) which wouldenable an easier installation and certification of the on-board equipment.

All flight tests should cover the aircraft dynamics described in Appendix A.4 in order to ensure thatthe validation is valid for all flight manoeuvres that may occur in usual flight operations. Tests willhave to be undertaken onboard various aircraft types in order to investigate the influence of theaircraft on the measurement results. Especially, the position of the antenna installation at the aircrafthas to be regarded. It also might be useful to investigate systems with two receiving antennas withone being installed under the aircraft. Such a constellation would probably be useful for aircraft flyingat high bank angles where a second antenna would help to prevent interruptions of the signalreception from the geostationary satellites.



EUROCONTROL

The methodology and differences between operational and experimental tests are illustrated by thefollowing Figure 4-2 and explained in the following paragraphs.

Tests can be either performed to identify sets of parameters which can be used in simulations oranalyses to find results which are as close to the reality as possible or they are used to deliver directresults for any validation activity. In the latter case the test must be performed with a representativenumber of samples under consideration of the spatial and time correlation. These tests can beperformed using experimental and operational equipment. If the validation of a specific requirementis mainly undertaken by analysis and/or simulation, it might be useful to conduct an additionaldemonstration of the fulfilment of this requirement in the operational environment in order to gainconfidence in the validation results and to verify assumptions made for the analysis and/or thesimulation.

Tests using experimental equipment are referred to as experimental tests. The general advantage ofexperimental tests is the flexibility of the test equipment, which allows fast iteration loops if modifica-tions are needed. Consequently, experimental test may be the appropriate means for a qualificationof the test equipment. They can be performed by stationary ground test, on board of ground basedmobile users or on board of experimental aircraft. In the context of the EGNOS OT&V programmethey will play a less important role for the system validation. Since it cannot be expected that thewhole EGNOS coverage area will be over-flown by operational test carriers it may be appropriate toperform flight trials over critical regions by using test aircraft. Nevertheless, special care has to betaken for the interpretation of the results.

Tests using operational aircraft under operational conditions are referred to as operational tests.These tests are important to identify sets of parameters, which can be used in simulations oranalyses, or they are used to deliver direct results for any validation activity.

Demonstrations

In addition to the test campaigns for the operational RNP validation, a number of additional aspectscan be sufficiently validated by demonstrations. Examples for demonstrations to be undertaken arelisted below:

• Demonstration of time to alarm by measurement on ground as well as in-flight during differentflight phases and aircraft manoeuvres.

• Intentionally move the aircraft attitude in order to look for masking effects of the GEO(s) duringthe flight.

• Flights at the edge of the coverage area.• Flights into or out of the coverage area.• Investigate test receiver behaviour under influence of interference (in laboratory conditions). The

results of these tests can be very helpful in order to identify interference influences during theflight test campaigns.

• Interoperability with WAAS:Principally, WAAS and EGNOS are compatible systems and users should be able to operate with

Data Analysis Tools

Demonstration Test

Operational Experimental

Flight Tests Ground Tests

Figure 4-2: Methodology for Tests



EUROCONTROL

both systems. In areas where the reception of more than one SBAS signal is possible, usersshould be able to use the ranging signals of all satellites in view. With regards to integrity anddifferential correction data, a user within the EGNOS coverage area should preferably only usethe EGNOS SIS and not WAAS.

With regards to operational approval, it might be a critical issue that WAAS does not incorporateintegrity and differential correction data for GLONASS. Therefore, it should be expected thattypical WAAS receivers will not be capable of receiving GLONASS signals, although they willprincipally be compatible to EGNOS. Therefore, it does not seem to be reasonable to excludeWAAS receivers from operational use in ECAC. But it might be necessary to limit the use ofWAAS receivers in ECAC to certain operations.

WP5.3 - Data Evaluation

This work package will complete the operational validation process of EGNOS by providing acomprehensive evaluation of all EOT&V activities previously undertaken. In particular, the datagathered during the various tests and demonstrations have to be analysed.

The stated EGNOS performance levels identified earlier in this document must be evaluated againstthe actual values measured across the EGNOS service area. Additionally, this should also include atrend analysis, ensuring the long-term validity of the results. Based on the experiences gatheredduring the EOT&V programme the possible impact of expected phenomena on the RNP performanceshould be estimated.

Finally, the data evaluation will conclude in defining those flight operations (e.g. in terms of flightphases or RNP categories) for which the EGNOS system provides a sufficient performance. Theremaining step before EGNOS may be operationally used by European civil aviation for the identifiedoperations is the operational approval with is within the responsibility of the national CAAs.

4.1.1.6 WP6 - Management

This work package covers the usual project management activities. This task is divided into thefollowing sub work packages:

• WP6.1 - Internal Co-ordination• WP6.2 - Co-ordination with CAAs• WP6.3 - Procurement• WP6.4 - Co-ordination with Suppliers• WP6.5 - Quality Assurance (see also section 4.3.3)

4.1.2 Time Scale

A first brief time schedule for the EOT&V programme is shown in Figure 4-3. The EOT&V schedulewill be refined on the basis of the outcome of the detailed definitions to be undertaken in the nextphases of the EOT&V process. The schedule is shown in relation to the time schedule of the EGNOSAOC development.

4.2 Cost Estimates

This section gives a first overview on aspects that have to be regarded for the estimation of thecosts for the EOT&V programme. It is important to note that cost assessment within the scope of thisstudy shall provide cost trends for getting an impression of the expected cost frame, and not precisecost data for financial planning.

The following principle cost categories have to be regarded:

• development costs• procurement costs• integration and installation costs



EUROCONTROL

• costs for testing and validation• training costs• maintenance costs• project management and overhead costs

Due to the high costs associated with practical flight tests, the extent of the flight test programme willbe the major cost driver for EOT&V. As stated before, it will be necessary to conduct flight tests withdifferent aircraft types. For each aircraft it will be necessary to procure and install the required testequipment. When commercial aircraft (with passengers on-board) will be used, the certification of theon-board equipment will also be an important cost driver, while the installation (and certification)

1998 1999 2000 2001 2002 2003 2004

EGNOS AOC

Development


Initial Operation

Operational AOC

WP1 - Initial Reviews and Analysis

WP1.1 - Reviews

WP1.2 - Analysis

WP2 - Early Trials

WP2.1 - Definition

WP2.2 - Development

WP2.3 - Implementation

WP2.4 - Evaluation

WP3 - Detailed Definition

WP3.1 - Operational Validation Plan

WP3.2 - Validation Procedures



WP3.5 - Definition of Validation Tools

WP3.6 - Organis./Finan. Planning

WP4 - Development Phase

WP4.1 - Simulation Tools



WP4.4 - Data Evaluation Tools

WP5 - Implementation Phase

WP5.1 - Simulations

WP5.2 - Tests and Demonstrations

WP5.3 - Data Evaluation

WP6 - Management

WP6.1 - Internal Co-ordination

WP6.2 - Co-ordination with CAAs

WP6.3 - Procurement

WP6.4 - Co-ordination with Suppliers

WP6.5 - Quality Assurance

Milestones ORRPDR Operational Approval

Figure 4-3: Proposed EOT&V Time Schedule



EUROCONTROL

costs would be much lower for experimental aircraft. The second major cost driver for the flight testprogramme is, of course, the number of tests that have to be undertaken, i.e. the number ofindependent test samples that are necessary for the validation of certain operational requirements.

The extent of the flight test programme stands in a direct relationship to the extent of the analysisand simulation efforts, because these may significantly reduce the number of necessary practicalmeasurements. In this case, the main objective of the flight tests would only be to verify thesimulation and analysis results. Typically, the use of analysis and simulation tools is less expensivethan undertaking flight tests. However, this might be different, if very special and complicated toolswould have to be developed. Therefore, a reasonably weighted validation programme has to bedeveloped.Additionally, the effort for data evaluation also depends on the number of flight hours during whichEGNOS data will be recorded.

4.2.1 Assumptions

In order to provide a comprehensive cost assessment and to allow cost determination in conjunctionwith the proposed time scales, cost data is defined on the basis of the above presented projectmanagement plan (see section 4.1). The following assumptions concerning estimated effort andcosts have to be considered as the basis for the more detailed cost assessment presented in thenext section:• Effort and costs are regarded separately for each sub-task. This means that possible inter-

dependencies between similar tasks that could lead to co-ordinated, reduced effort are notconsidered.

• Generally, project management and overhead costs are included in the estimated values givenbelow.

• If an effort of 1 man-year has been estimated, an average availability of 220 days per year and 8hours per day is considered.

• One man-year is estimated to cost approximately 150 KECU. This value includes an overheadfor travel and subsistence as well as costs for a standard computer.

• One workstation for analysis or development is required per man-year. This workstation costs,including maintenance, standard software and spare parts, approximately 5 KECU per year.Specialised software is not included.

• One licence for a special software for highly sophisticated analyses (e.g. complex risk allocationtrees) or development costs approximately 8 KECU per year. This includes acquisition, stafftraining, maintenance and upgrades.

• One EGNOS (or WAAS) receiver for validation purposes costs approximately 20 KECU peraircraft. Antenna installation, rewiring, installation, test and certification are estimated to cost 80KECU in average per aircraft. This value covers ground time costs for aircraft and staff costs aswell. With this, the overall equipment of one aircraft with an EGNOS or WAAS receiver costsapproximately 100 KECU. It has to be noted that this is an average value that could be lower forexperimental aircraft but also higher for commercial aircraft equipping.

Again, the necessity to provide the above equipment depends essentially on the outfit of theorganisation which is responsible for the performance of the respective task. The following costassessment is based on the assumption that all specific equipment for undertaking a task has to beprocured. If some equipment is already available, its acquisition costs have to be removed from thelists below.

4.2.2 Effort and Cost Assessment

This section comprises an overview on expected efforts and costs for the EOT&V programmeperformance. It is obvious that no precise cost values can be provided at this stage of the EOT&Vprocess. A more detailed cost assessment will have to be undertaken after the initial analyses andreviews have been undertaken and the actual scope of the EOT&V activities is better known.



EUROCONTROL

WP 1 - Initial Review and Analysis

This workpackage consists of two sub-tasks that are "Review" and "Analysis". "Review" meansreviewing of already existing documents, whilst "Analysis" covers the accomplishment of newanalytical processes. Therefore, this WP does not require any additional test equipment with theexception of PC hard- and software. Again, it has to be noted that "Engineer" includes standardcomputer equipment. Even if more complex calculations with highly sophisticated software applica-tions are required, additional workstation and software equipping has to be taken into consideration.Generally, it is obvious that for reviews no additional tools are required, whereas analyses are basedon the use of powerful hard- and software tools.Considering that WP1 costs are only related to the EUROCONTROL agency, it is assumed that thefollowing effort is necessary:

WP Task Effort/Equipment

Unit Costs[KECU]

Sub-Total[KECU]

TOTAL[KECU]

1.1 EGNOS validationframework review

Staff [MY] 0.2 30 30 (EA) ≈ 650 (T)

Civil Aviation operationalrequirements

Staff [MY] 0.2 30 30 (EA) ≈ 650 (EA)

Review of ESA fault treeanalysis

Staff [MY] 0.3 45 45 (EA)

Review of ESA validationtool definition

Staff [MY] 0.2 30 30 (EA)

1.2 Fault tree analysis Staff [MY]Workstation [Y]Software [Y]

1.01.01.0

15058

163 (EA)

Integrity Risk Analysis Staff [MY]Workstation [Y]Software [Y]

0.50.50.5

7534

82 (EA)

Availability and continuityof service analysis

Staff [MY]Workstation [Y]Software [Y]

0.50.50.5

7534

82 (EA)

Multipath analysis Staff [MY]Workstation [Y]Software [Y]

0.50.50.5

7534

82 (EA)

Analysis of atmosphericeffects


0.30.30.3

4522

49 (EA)

Measurement Locations Staff [MY] 0.3 45 45 (EA)

MY: Man Year; Y: Year; EA: EUROCONTROL; NC: National CAA

Table 4-1: WP 1 - Effort and Cost Assessment

WP 2 - Early Trials

Early Trials is the headline for pre-validation flight-tests. The major aim of these trials is to obtainsome practical experience with the use of EGNOS rather than precise, reliable data for validationpurposes.

The assumed scenario for early trials is the following:

• Early trails will be performed under responsibility of the individual ECAC States.• It is assumed that only a few ECAC States will undertake such trials. Based on the current

number of member States actively participating in EGNOS-related EUROCONTROL activities, itis reasonable to assume that 6 States will perform early trail programmes.



EUROCONTROL

• Furthermore, it is estimated that each State operates in average 2 aircraft for early trials. One ofthese aircraft is a commercial air carrier that collects data during standard, commercial flightswithin the scope of SAPPHIRE data collection. It is assumed that these flight hours do not pro-duce costs for the national CAAs. The other aircraft will especially equipped for flight trial pur-poses and has to undertake approximately 60 hours for the assessment of non-standard situa-tions.

• It is estimated that each flight hour for validation purposes costs approximately 3 KECU. Thisincludes all related costs like fuel, maintenance, depreciation, staff costs etc.

• It seems to be realistic that EGNOS receivers are not available for early trails. Therefore, WAASor GPS/GLONASS receivers have to be used for early trial performance. Nevertheless, it isassumed that acquisition, installation and test, antenna installation and certification costs forWAAS and EGNOS devices are approximately the same (see section 4.2.1)

• EUROCONTROL will co-ordinate and, more important, collect and analyse the gathered data.Nevertheless, since the responsibility for early trials is at the respective State, it seems to bereasonable to assume that this State will do a data analysis by itself as well. This has to bereflected in the cost assessment table below.

• Since SAPPHIRE has been already developed yet, R&D costs for this software are sunk costsand thus, are not considered in this study.

Distinguishing between the two expenditure groups "EUROCONTROL" and "National CAA", theassumed effort and costs are as shown in the table below:


Unit Costs[KECU]

Sub-Total[KECU]

TOTAL[KECU]

2.1 Definition(EUROCONTROL)

Staff [MY] 0.2 30 30 (EA) ≈ 4.040 (T)

Definition(6 CAAs)

Staff [MY] 0.3 45 270 (NC) 140 (EA) +

2.2 Development(EUROCONTROL)

Staff [MY] 0.2 30 30 (EA) 3.900 (NC)

Development(6 CAAs)

Staff [MY] 0.5 75 450 (NC)

2.3 Implementation(6 CAAs)

Staff [MY]Aircraft Equipping[No. per State]Flight Hours

1.0

260

150

200180

2.220 (NC)

2.4 Evaluation w. SAPPHIRE(EUROCONTROL)

Staff [MY]Workstation [Y]

0.50.5

753

78 (EA)

Evaluation(6 CAAs)


1.01.01.0

15058

978 (NC)

MY: Man Year; Y: Year; EA: EUROCONTROL; NC: National CAA; T: Total


WP 3 - Detailed Definition

This work package includes the detailed definition of all tools and planning which are necessary forall further steps of the EOT&V programme. It is assumed that all activities will be under theresponsibility of EUROCONTROL from this stage of the programme.

The following assumptions form the basis of the cost and effort assessment below:



EUROCONTROL

• Detailed definition of validation procedures relies on former developed, initial validation conceptsin conjunction with the results obtained during the early trial programme. This includes the devel-opment of test procedures for practical tests or simulation activities.

• Data acquisition tools are, beside computer hard- and software, mainly EGNOS receivers. It isassumed that commercial receiver will be available from industry. Therefore, additional costs forreceiver development do not occur.

The assumed effort and costs are as shown in the table below:


Unit Costs[KECU]

Sub-Total[KECU]

TOTAL[KECU]

3.1 Operational Validation Plan(EUROCONTROL)

Staff [MY] 0.5 75 75 (EA) ≈ 320 (T)

3.2 Validation Procedures(EUROCONTROL)

Staff [MY] 0.5 75 75 (EA) ≈ 320 (EA)

3.3 Data Acquisition Tools(EUROCONTROL)

Staff [MY] 0.2 30 30 (EA)

3.4 Aircraft Equipment(EUROCONTROL)

Staff [MY] 0.2 30 30 (EA)

3.5 Definition of ValidationTools(EUROCONTROL)

Staff [MY] 0.2 30 30 (EA)

3.6 Detailed Organisationaland Financial Planning(EUROCONTROL)

Staff [MY]Software [Y]

0.50.5

754

79 (EA)

MY: Man Year; Y: Year; EA: EUROCONTROL; NC: National CAA T: Total


WP 4 - Development Phase

This section is about the costs that are estimated to be necessary for the development of EOT&Vvalidation tools as defined in the previous work package.

The following assumptions have to be taken into consideration when assessing the costs for WP 4:

• Regarding simulation hardware, it is assumed that the required hardware (multipath measure-ment, etc.) has already been developed, but needs slight modifications. The main efforts will befor software extensions. The cost/effort for this is estimated to be 0.5 man-year for staff and 300KECU for other expenses like material, documentation etc.

• It is assumed that commercial EGNOS receivers will be available from industry for the EOT&Vprocess. Therefore, development costs for EGNOS receivers are not to be considered. For on-board data acquisition and data storage it is assumed that similar equipment as for SAPPHIREwill be used. Therefore, no major new developments will be necessary but only an adaptation ofexisting designs and concepts. This effort is assumed to be financed by EUROCONTROL and isestimated to be approximately 0.5 man-year.

• The main data evaluation tool will be SAPPHIRE that is already available. Nevertheless, it isreasonable to assume that additional efforts will be required in order to add additional functionsor to adapt existing components of SAPPHIRE to the specific requirements of EOT&V. It isassumed that this will take approximately 1.5 man-years.

The assumed effort and costs are as shown in Table 4-4.

WP 5 - Implementation Phase

This section provides effort and cost estimates for WP 5. This comprises the performance ofsimulation, test and demonstration activities as well as data evaluation calculations.



EUROCONTROL


• Simulation costs consist, beside staff costs, of operating costs for test beds and specificsimulation software. It is critical to estimate reliable data for this without having a very precisevalidation and simulation concept. However, as a first rough estimate it is assumed that 2 man-years and 200 KECU are necessary for the performance of simulation activities. The amount of200 KECU covers test bed operations, maintenance and operating activities for simulation tools.

• In compliance with the statements made concerning simulation tools, it is obvious that it is ratherdifficult to estimate reliable effort and cost values for test and demonstration performance. Mostof test and demonstration data will and has to be gathered under operational conditions whichmeans that operational, commercial air carrier have to be equipped.Beside this data acquisition under operational conditions, it will be necessary to undertake flighttrials with especially equipped aircraft. The following rough assumptions are necessary for esti-mating the overall effort for test and demonstration:

Õ One flight hour with an experimental aircraft, including all expenses like staff, fuel, mainte-nance, etc., costs approximately 3 KECU.

Õ It can be assumed that the previously discussed validation grid for performance validationconsists of 25 points (see also section 3.5 and Appendix A.4).

Õ Referring to the calculations of the test sample numbers in Appendix A.4, it can be estimatedthat 75 flight hours per grid location and with this about 1.900 flight hours in total would benecessary in order to validate the measurable performance parameter. However, it is as-sumed that most of these measurements will be collected by commercial air carrier duringtheir usual operational flights. These flights do not have to be financed by EUROCONTROLor the national CAAs.

Õ It is assumed that approximately 10% of the above estimated flight hours have to be flownby experimental aircraft due to technical or environmental reasons. Adding additional 100hours for the validation of other additional, critical points within the ECAC area, this leads toa total of 300 flight hours for EOT&V flight validation which have to be financed byEUROCONTROL.

Õ From this, a total of 300 flight hours (= 900 KECU) results.Total staff effort for performing test and trial activities is estimated to be 2 man-years in total.

• The estimation of the effort necessary for data evaluation is also difficult to calculate. Dataanalysis is a process that will run in parallel to all other activities. On the other hand, if the soft-ware for data analysis will once be implemented successfully, the effort for data analysis willmainly be limited to computer hardware and software usage.Nevertheless, it is assumed that 2 man-years are required for data analysis, supplemented by anadequate computer soft- and hardware processing effort.


Unit Costs[KECU]

Sub-Total[KECU]

TOTAL[KECU]

4.1 Simulation Tools(EUROCONTROL)

Staff [MY]Hardware

0.5-

75300

375 (EA) ≈ 690 (T)

4.2 Data Acquisition Tools(EUROCONTROL)

Staff [MY] 0.5 75 75 (EA) ≈ 690 (EA)

4.3 Aircraft Equipment(EUROCONTROL)

Staff [MY]Aircraft Equipping[No. per State]

- - -

4.4 Data Evaluation Tools(EUROCONTROL)


1.51.01.0

22568

239 (EA)





EUROCONTROL

The assumed effort and costs are as shown in the table below:


Unit Costs[KECU]

Sub-Total[KECU]

TOTAL[KECU]

5.1 Simulations(EUROCONTROL)

Staff [MY]Hardware

2.0-

300200

500 (EA) ≈ 2.000 (T)

5.2 Tests and Demonstrations(EUROCONTROL)

Staff [MY]Flight Trials [Hrs]

2.0300

300900

1.200 (EA) ≈ 2.000(EA)

5.3 Data Evaluation(EUROCONTROL)


2.02.02.0

3001016

326 (EA)



WP 6 - Management

This section provides effort and cost estimates for WP 6. This comprises the EOT&V projectmanagement internal and external activities.


• It is assumed that 2 persons are necessary for the whole project time frame of 4 years in order toprovide all required management and quality related services (7.5 man years in total are ex-pected to be necessary). This covers internal co-ordination and quality management as well asexternal co-ordination with the national CAAs and suppliers.

• It has to be taken into consideration that the project and quality management team will belocated at existing EUROCONTROL premises and with this, that project and quality manage-ment tools will be already available.

• It is assumed that 0.5 man-years of effort at national level are necessary for each CAA (as anaverage over all CAAs) during the development and implementation phase in order to provideproject management service and co-ordination with EUROCONTROL.

The assumed effort and costs are as shown in the following Table 4-6.


Unit Costs[KECU]

Sub-Total[KECU]

TOTAL[KECU]

6.1 Internal Co-ordination(EUROCONTROL)

Staff [MY] 1.5 225 225 (EA) ≈ 3.600 (T)

6.2 Co-ordination with CAAs(EUROCONTROL)

Staff [MY] 1.5 225 225 (EA) 1.000 (EA)+

6.3 Quality Management(EUROCONTROL)

Staff [MY] 0.5 75 75 (EA) 2.600 (NC)

6.4 Procurement(EUROCONTROL)

Staff [MY] 1.5 225 225 (EA)

6.5 Co-ordination Suppliers(EUROCONTROL)

Staff [MY] 1.5 225 225 (EA)

6.6 Co-ordination withEUROCONTROL(35 CAAs)

Staff [MY] 0.5 4.500 2.600 (NC)





EUROCONTROL

4.2.3 Cost Summary

This section provides a cost summary on the basis of the work package effort and cost assessmentspresented in the tables of the above sections.

Again, it is important to note that this calculation is only a very rough assessment of the overallEOT&V programme costs. At this stage of the project, it is not possible to provide more detailed andprecise cost estimates. Detailed financial planning is part of the EOT&V programme itself (in workpackage WP3), since detailed definitions of validation procedures, manpower and tools will beavailable at this stage of the project.

Regarding the results presented in Table 4-7, the following aspects have to be considered:

• The costs below are rough estimates and do not represent detailed, reliable cost data. Costassessment within the scope of this study shall provide cost trends for getting an impression ofthe expected cost frame, and not precise cost data for financial planning.

• The NC (National CAAs) share of the overall estimated costs has to be split between the partici-pating CAAs.

• Flight inspection of local flight procedures is not included in this cost and effort assessment sincethey are outside the scope of this study. Costs for development of EGNOS-based flight proce-dures and costs related to the final operational approval of EGNOS are also excluded. Thesecosts are expected to be covered by the national CAAs.

4.3 Quality Assurance

The EOT&V programme shall ensure that the EGNOS system fulfils the safety critical requirementsof civil aviation applications. Therefore, it is necessary to undertake not only the EGNOS develop-ment but also the EOT&V programme in accordance with very high quality standards.

The quality assurance measures to be undertaken in the course of the EOT&V programme shall bedefined in a quality management plan. This plan has to be established before the development of theEOT&V programme (Phase B) and its implementation (Phase C) start. Generally, the qualitymanagement plan has to cover the following aspects:

• Definition of the EOT&V quality objectives• Definition of verification measures and references• Definition of the responsibility for the verification measures

This section presents a first overview on EOT&V quality assurance issues.

4.3.1 Objectives

The objective of quality assurance activities within the EOT&V project is the establishment of aquality management plan. This plan contains measures to be taken in order to guarantee a high levelof quality and aims at reaching the following targets:

• Reliable results:EOT&V will be the basis for national European aviation administrations to accept EGNOS foroperational use in their airspace. The reliability of the EOT&V results is therefore a safety-of-lifeissue; i.e. this quality objective of ‘reliability’ should have the highest priority. The results gainedwithin the EOT&V project shall meet the real figures as closely as possible with minimum devia-tions.

• Complete and comprehensive results:The results of the EOT&V project shall provide a complete picture of the performance and limita-tions of EGNOS. Therefore, no important aspect of EGNOS must be omitted in the course of thetest and validation efforts of the EOT&V project.



EUROCONTROL

WP Task Sub-Totals[KECU]

TOTAL WPs[KECU]

TOTALEOT&V[KECU]

1.1 EGNOS validation framework 30 (EA) ≈ 650 (T) ≈ 11.300 (T) ≈Civil Aviation operational requirements 30 (EA) ≈ 650 (EA) 4.800 (EA) +

Review of ESA fault tree analysis 45 (EA) 6.500 (NC)Review of ESA validation tool definition 30 (EA)

1.2 Fault tree analysis 163 (EA)

Integrity Risk Analysis 82 (EA)

Availability and continuity of service analysis 82 (EA)

Multipath analysis 82 (EA)

Analysis of atmospheric effects 49 (EA)

Measurement Locations 45 (EA)

2.1 Definition (EUROCONTROL) 30 (EA) ≈ 4.040 (T)Definition (6 CAAs) 270 (NC) 140 (EA) +

2.2 Development (EUROCONTROL) 30 (EA) 3.900 (NC)Development (6 CAAs) 450 (NC)

2.3 Implementation (5 CAAs) 2.220 (NC)

2.4 Evaluation w. SAPPHIRE (EUROCONTROL) 78 (EA)

Evaluation (5 CAAs) 978 (NC)

3.1 Operational Validation Plan 75 (EA) ≈ 320 (T)3.2 Validation Procedures (EUROCONTROL) 75 (EA) ≈ 320 (EA)3.3 Data Acquisition Tools (EUROCONTROL) 30 (EA)

3.4 Aircraft Equipment (EUROCONTROL) 30 (EA)

3.5 Definition of Validation Tools(EUROCONTROL)

30 (EA)

3.6 Detailed Organisational and FinancialPlanning (EUROCONTROL)

79 (EA)

4.1 Simulation Tools (EUROCONTROL) 375 (EA) ≈ 690 (T)4.2 Data Acquisition Tools (EUROCONTROL) 75 (EA) ≈ 690 (EA)4.3 Aircraft Equipment (EUROCONTROL) -

4.4 Data Evaluation Tools (EUROCONTROL) 239 (EA)

5.1 Simulations (EUROCONTROL) 500 (EA) ≈ 2.000 (T)5.2 Tests and Demonstrations

(EUROCONTROL)1.200 (EA) ≈ 2.000 (EA)

5.3 Data Evaluation (EUROCONTROL) 326 (EA)

6.1 Internal Co-ordination (EUROCONTROL) 225 (EA) ≈ 3.600 (T)6.2 Co-ordination with CAAs (EUROCONTROL) 225 (EA) 1.000 (EA)+6.3 Quality Management (EUROCONTROL) 75 (EA) 2.600 (NC)6.4 Procurement (EUROCONTROL) 225 (EA)

6.5 Co-ordination Suppliers (EUROCONTROL) 225 (EA)

6.6 Co-ordination with EUROCONTROL(35 CAAs)

2.600 (NC)


Table 4-7: Cost Assessment Summary



EUROCONTROL

• Relevant results:The results of the individual tests shall make sense for the EOT&V project. Tests shall not ad-dress irrelevant parameters but provide information that significantly adds to an extensive valida-tion of EGNOS.

• Accurate results:Depending on the system feature to be investigated, accuracy and resolution of the gathered datahave to be high enough in order to provide useful data for the EGNOS test and validation effort.

These objectives can be achieved through a number of measures, which address the selection oftest and validation methods, as well as the quality assurance procedures that are applied to theproject.

Both method selection and quality assurance measures are described in more detail in the nextsubsections.

4.3.2 Verification Measures

The approach taken in order to provide a high quality standard within the EOT&V project comprisesseveral activities. Three important measures are given below:

• Application of proven standards methods: The application of recognised standard methods ofquality assurance adds to the overall reduction of potential sources of error. In addition to that,an assessment of the individual method’s efficiency is possible. The standard methods maycome from EUROCONTROL, the IEEE, ISO, etc.

• Use of proven design: Wherever possible, the tools and procedures to be developed shall bebased on proven design in order to minimise the number of possible error sources.

• Relying on a variety of procedures: The verification of the quality standard within the EOT&Vproject should be based on a wide spectrum of procedures. This way, possible deficiencies ofone particular method can be avoided. The range of procedures, which may be applied, is de-scribed in section 4.3.3.

The use of a multitude of proven elements and methods should ensure the achievement of theobjectives listed in the subsection before. In addition to that, techniques like the independence ofreviewers from developers should be used.

4.3.3 Quality Assurance Procedures

The principal measures that may be undertaken within the EOT&V quality assurance process are:

• Review:Assessment of existing (technical) paperwork for its correctness during a meeting with relevantparties that may also include the customer. This task shall be performed by a group that is inde-pendent from the authors of the paperwork.

• Analysis:Analysis and verification of the technical parameters and functions using various techniquesincluding simulation.

• Inspection:An inspection is considered to be a particular type of review that focuses on a relatively smallarea. The inspection is performed in a very methodical way, in-depth and it exceeds the durationof one meeting.

• Audit:An audit is a formal quality assurance procedure following a catalogue of relevant questions. The



EUROCONTROL

auditor may not have been involved in the project. She/he verifies the compliance of the actualstate within the project with the quality management plan and its internal consistence.

• Tests:Tests can be performed on actual existing hardware and software components. Verification ofquality targets can be achieved through running dedicated tests on these components whichshall confirm their proper functioning under various conditions.

• Demonstration:A demonstration is very similar to a test with the main difference of a more passive observationof the proper functioning in contrast to actually operating equipment for test purposes.

The responsibility for these quality measures has to be with an organisation that is independent fromthe developer teams. For example, if an EOT&V tool would be developed by an industry team,EUROCONTROL could undertake the necessary quality assurance measures (e.g. audits, inspec-tions) at the developing industry team.

4.3.4 References

The following documents and standards are relevant with regards to the EOT&V quality assuranceprocess. In addition to these specific documents, the EN ISO 9000 standard also needs to beconsidered.

• EEC/SEU/ST/0004: Formal Inspections of Software and Documentation [12]This standard of the EUROCONTROL Experimental Centre describes how formal inspections ofsoftware and documentation projects are carried out. The composition of the inspection team isdescribed as well as the individual tasks of the team members. There also is a guideline on theconduction of an inspection and on possible follow-up actions.

• IEEE Std 730-1989: Software Quality Assurance Plan [13]The IEEE standard covering Software Quality Assurance Plans (SQAP) includes the structure ofa SQAP, its management and documentation as well as the description of reviews and audits,problem reporting and control measures. IEEE Std 730-1989 applies to the development ofcritical software.

• IEEE Std 828-1990: Software Configuration Management Plans [14]The planning of software configuration management (SCM) is covered by this standard. Thedocument describes the contents of a SCM plan, necessary activities, schedules, resources andplan maintenance.

• IEEE Std 829-1983: Software Test Documentation [15]This standard describes the planning and specification of tests as well as reporting on tests ofsoftware components. It establishes guidelines for the structure of software test plans and docu-mentation with detailed descriptions of specifications for test design, test cases, test proceduresas well as logging, and reporting on test incidents and results.

• IEEE Std 1058.1-1987: Software project management plans [16]The establishment of management plans for software projects is the subject of this standard.The format and the content of software project management plans (SPMP) are described in thisdocument together with explanations of the individual items that are required in the plan.

A number of issues addressed in the above mentioned standards can be transferred to the EGNOSOperational Test and Validation programme for application in the project’s quality assuranceprocess. Inspections and reviews, for example, could be conducted in a very similar manner to theprocedure described in EEC/SEU/ST/004. This includes the creation of inspection teams comprisingthe author(s) of the test and validation action to be inspected, a moderator, two inspectors whichcould be involved in subsequent and/or previous actions and a so-called “Standards-Bearer” who isresponsible for the compliance of the action with relevant quality standards and guidelines.



EUROCONTROL

5 CONCLUSIONS

To allow the implementation of satellite navigation in European airspace, the European TripartiteGroup (ETG) is currently developing the EGNOS system, which is planned to reach operationalstatus by the year 2002. Prior to that a large-scale test and validation activity will be necessary toestablish that the system meets the technical and operational requirements. Within the ETG, theEuropean Space Agency (ESA) is responsible for the technical validation of the system, whereasEUROCONTROL is responsible for its operational validation for civil aviation.

The technical validation of EGNOS will be performed by ESA and industry and needs to establishthat the system provides the desired Signal-in-Space. For this, an extensive measurement campaignwill be set-up in the EGNOS service area.

However, this alone will not be sufficient for civil aviation, and so additional, aviation-specific,validation activities will have to be undertaken. These activities need to prove that the operationalperformance of aircraft using GPS and GLONASS with EGNOS complies with the RNP requirementsin terms of accuracy, integrity, availability and continuity.

The differences between traditional navigation aids and EGNOS are substantial and make thevalidation efforts a challenging exercise. The main differences are:

• The international character of EGNOS, which will provide a service over the entire ECAC area.

• The distributed character of the ground infrastructure, where the navigation services in any Statewill rely on ground infrastructure in several other States.

• Institutional concerns such as regional control of EGNOS, but no influence on GPS andGLONASS

• Complexity of the EGNOS system architecture

• Time and geographical dependency of the EGNOS system performance.

New validation methods and safety regulatory approaches will be necessary to deal with theseissues.This document defined the outline of the EOT&V programme that EUROCONTROL intends toundertake. Based on an assessment of the operations that EGNOS is expected to support, and therequirements upon the EGNOS system in terms of RNP to allow these operations, the boundaries ofthe operational use of EGNOS were defined. Thereafter, the main influences that may hinder fulfillingthe requirements were investigated. The operational issues related to RNP with the highest potentialinfluences are:

• Receiver and Aircraft DynamicsGenerally, high velocity and accelerations as they may occur on-board aircraft are difficult forGNSS receivers to handle. Eventually, the positioning accuracy might be reduced or even loss oflock to certain satellites may occur.

• Masking and GeometryThe availability of the EGNOS service is strongly dependent on the ability of the user receiverantenna to receive the signals in space. The operational validation of EGNOS must, therefore,consider possible masking effects, which would prevent the EGNOS signals being received.Masking reduces the potential number of visible satellites. The effect is caused by an objectblocking the line of sight between the EGNOS antenna and a satellite, and preventing the satel-lite’s signal from being received at the user antenna. It could be caused by local effects, such asthe masking of the antenna by the surface of the aircraft, or by external factors, such as terrain.The satellite is therefore not available for use in the navigation solution.

• MultipathMultipath is the effect where a signal arrives at a receiver via two or more different paths. Thereceived signals will each have a different path length, and these differences in the path lengths



EUROCONTROL

cause the signals to interfere which each other. This interference causes an error to the calcu-lated satellite ranges, and hence to the accuracy of the position solution.

• InterferenceInterference is caused by other radio frequency transmissions, on similar frequencies than thoseused by EGNOS. The effect is that the signal the user is attempting to acquire is becomingcorrupted due to the other signal interference in the same frequency band. This may reduce thepositioning accuracy or even completely hinder the reception of EGNOS signals.

• Atmospheric EffectsThe ionosphere is perhaps the most important issue for the final performance of EGNOS andrequires careful consideration. During the propagation of the EGNOS signals through the atmos-phere, especially the ionosphere causes fluctuations in the propagation speed. This reduces thepositioning accuracy that may be achieved with EGNOS. An important item to investigate is theinfluence of the imminent peak in ionospheric activity expected around the year 2000, which willoccur during the implementation phase of EGNOS.

In section 3 EOT&V validation activities were proposed that should be undertaken in order to validatethe performance of EGNOS with regards to RNP and to assess the influences of operational issueson RNP. The applicable validation methods are review, analysis, inspection, demonstration and test.For each RNP parameter a validation strategy was defined. Additionally, a strategy for the validationof operational influences on the RNP parameters was outlined. This approach lead to validationrequirements that form the baseline for the definition of the actual validation activities.

The very nature of operational test and validation dictates that real life tests and measurements willprovide the backbone of EOT&V. Nevertheless, other methods such as analysis and simulation haveto be undertaken in order to support the tests and to provide the ability to extrapolate the results ofactual measurements. Some parameters, for example integrity, are very demanding due to their highpercentile requirements, which makes it impossible to validated by tests. Here, a careful strategycombining different validation methods is needed.

It is important that the requirements for operational tests are well considered, since a good choice ofoperational tests will minimise the number of tests required whilst ensuring that sufficient data iscollected to allow validation of the entire EGNOS operation. Further demonstrations can be used toverify that simulation and analysis results are valid and a true representation of operationalconditions.Finally, this document provided the outline of the proposed EOT&V programme by defining a projectmanagement plan with work package definitions for the tasks to be undertaken during the EOT&Vprocess. A time schedule was provided as well as a description of quality assurance aspects to beconsidered. Finally, a brief cost estimation for the EOT&V programme was made, although at thisearly stage of the EOT&V process, this estimation can only provide a first rough idea of the actualcosts to be expected.

The EOT&V process is of very high importance in order to make the benefits of EGNOS available tothe aviation users soon, thus contributing to increase efficiency and safety in European civil aviation.

Essais et validation opérationnels d'EGNOS pour l'aviation civile –Grandes lignes du Programme

Rapport CEE No. 342 67

EUROCONTROL

Traduction en Français du préface, du résumé, de l’introduction, des objectives et desconclusions

PRÉFACE À L'ÉTUDE RELATIVE AUX ESSAIS ET A LA VALIDATIONOPÉRATIONNELS D'EGNOS

Le système EGNOS est mis au point par l'Agence spatiale européenne (ASE) dans le cadre del'Accord tripartite européen signé avec la Communauté européenne et EUROCONTROL. Aux termesde cet accord, EUROCONTROL est chargée, entre autres, des essais et de la validationopérationnels du GNSS1 pour l'aviation civile, centrés, dans un premier temps, sur EGNOS.

A l'ASE, le programme EGNOS est entré dans la phase de conception détaillée et de réalisation, ditePhase C/D. Selon les plans actuels de l'ASE, le système EGNOS pourra être remis à l'entité degestion et d'exploitation d'EGNOS d'ici février 2003, date fixée pour la Revue d'aptitudeopérationnelle (ORR).

En collaboration avec des représentants de ses États membres, EUROCONTROL a défini lesexigences de la mission GNSS pour l'aviation civile, qui ont servi de base à la définition desexigences de mission "multimodales" pour le GNSS1, dont ont été dérivées les exigences pourEGNOS. Les exigences de mission pour l'aviation civile constitueront le fondement d'un programmede validation visant à démontrer que l'utilisation d'EGNOS dans l'espace aérien de la CEAC répondaux impératifs de l'aviation civile.

On trouvera dans le présent rapport les résultats d'une étude menée, à la demande des États quienvisagent de fournir des services fondés sur ce système, aux fins de définir la portée des essais etde la validation opérationnels d'EGNOS. C'est l'Équipe spéciale "Recherche-développement sur lesystème" (SRD) du Groupe "Applications de la navigation par satellite" (SNA) d'EATCHIP qui s'estchargée de la spécification des travaux et en a également suivi l'avancement.

La réunion de lancement du projet s'est tenue en janvier 1998. Un premier atelier a été organisé enmars 1998 en vue de recueillir l'avis des différents partenaires : les États membres etEUROCONTROL représentant les prestataires de services, l'ASE en sa qualité de concepteur dusystème et les compagnies aériennes pour les usagers, quoique l'intérêt de ces derniers soit restélimité. L'atelier a connu un franc succès, et ses conclusions principales ont fait l'objet d'un rapportqui, associé à l'étude susvisée, a servi à la rédaction du Rapport CEE n° 340, dont le présentdocument constitue la synthèse. Il est prévu de soumettre au nouveau Conseil directeur duProgramme GNSS de l'EATMP, en juillet 1999, la première version d'un Plan de validation intégraled'EGNOS.

Les travaux faisant l'objet du présent rapport ont été effectués par l'Avionik Zentrum Braunschweig,avec l'appui de l'Université technique de Brunswick et de Roke Manor Research.

Les gestionnaires du Programme GNSS, sous la responsabilité desquels est publié le présentrapport, tiennent à remercier les États membres d'EUROCONTROL et l'Agence spatiale européennepour leur aide et leurs contributions précieuses.

Richard FarnworthEdward Breeuwer

Chefs de projet pour EUROCONTROL


68 Rapport CEE No. 342

EUROCONTROL

(Page intentionellement blanche)



EUROCONTROL

RESUME

L'Europe œuvre actuellement à la mise au point du Complément géostationnaire européen denavigation (EGNOS), qui constitue l'apport européen à l'actuelle constellation de systèmes denavigation par satellite. La conception préliminaire d'EGNOS a été achevée courant 1998, et l'onescompte que le système atteindra la Capacité opérationnelle avancée (AOC) d'ici 2003. EGNOSest un système multimodal qui améliorera les performances de navigation des utilisateurs dans tousles secteurs des transports ainsi que dans d'autres domaines d'application. S'agissant de l'aviationcivile, non seulement la mise en œuvre d'EGNOS aura une incidence sur les opérations actuelles,mais elle pourrait également permettre la définition d'opérations nouvelles.

Au sein du Groupe tripartite européen (ETG), composé de la Commission européenne, de l'Agencespatiale européenne (ASE) et d'EUROCONTROL, cette dernière est chargée de tester et de validerEGNOS en conditions opérationnelles, par rapport aux impératifs des utilisateurs aéronautiquescivils. Le présent document constitue la synthèse d'un rapport élaboré par une équipe dirigée parAvionik Zentrum Braunschweig (Allemagne), qui propose un programme d'Essais et de validationopérationnels d'EGNOS (EOT&V).

L'ASE et le titulaire du marché EGNOS mettront en œuvre un programme de vérification techniquevisant à établir la conformité du service assuré par EGNOS au cahier des charges. En particulier, leprogramme de vérification de l'ASE s'assurera que le signal électromagnétique d'EGNOS répondaux critères de performance requis dans l'ensemble de la zone qu'il doit couvrir. Pour compléter cestravaux, EUROCONTROL coordonnera les Essais et la validation opérationnels d'EGNOS parrapport aux critères de performance de l'aviation civile. Le programme EOT&V est indispensablepour faciliter l'acceptation (par les administrations nationales de l'aviation et les prestataires deservices de la circulation aérienne des États membres de la CEAC) de l'utilisation d'EGNOS dans lesopérations aériennes.

Le processus EOT&V doit porter sur tous les aspects opérationnels qui ne seront pas couverts parles activités de vérification technique. Au sens strict, EGNOS n'est qu'un service complémentaire duGPS et du GLONASS. La validation opérationnelle doit donc prendre en compte trois éléments : leGPS et le GLONASS, le service de complément de couverture pour le GPS et le GLONASS, et lerécepteur. On peut classer en trois grandes catégories les activités à entreprendre dans le cadre duprocessus EOT&V, à savoir les questions liées à la RNP (Qualité de navigation requise), les aspectsopérationnels et la sécurité. Le présent rapport est plus particulièrement centré sur la premièrecatégorie, c'est-à-dire les essais et la validation d'EGNOS par rapport aux paramètres RNPjusqu'aux approches de Catégorie 1, dans l'environnement opérationnel.

Une stratégie de validation a été élaborée pour chacun des paramètres RNP, sur la base desimpératifs RNP. Des activités de validation appropriées sont dérivées de cette stratégie, comptetenu des influences opérationnelles potentielles. Le processus se fonde sur une approche statistique,nécessaire pour définir le nombre d'échantillons d'essais requis (pour autant que l'essai constitueune méthode de validation appropriée pour le paramètre considéré). Une analyse des influencesopérationnelles permet de fixer, pour les mesures, des intervalles raisonnables en temps et endistance, utilisables pour la validation statistique, qui permet à son tour la définition des activités devalidation et du programme EOT&V envisagé.

La qualité de navigation dont bénéficiera l'utilisateur dépend dans une large mesure des influencesopérationnelles suivantes sur la RNP, qui sont examinées dans le rapport:

• la dépendance par rapport au GPS et au GLONASS ;• les manœuvres et la dynamique des vols ;• les types d'aéronefs ;



EUROCONTROL

• l’effet de masque ;• la zone de couverture ;• les trajets multiples ;• les interférences ;• les effets atmosphériques.

Dans l'ensemble, même si, prises isolément, les influences opérationnelles sur la RNP ne perturbentpas de manière décisive les performances de navigation, la conjugaison de plusieurs d'entre ellespourrait engendrer des problèmes.On trouve dans le programme EOT&V envisagé un organigramme technique des tâches assorti dedescriptions détaillées, ainsi qu'un calendrier et une première estimation des coûts.

Il est recommandé d'engager le programme EOT&V le plus rapidement possible afin qu'EGNOSpuisse être mis en exploitation dans les meilleurs délais. Parmi les activités à entreprendre enpremier lieu figurent une série initiale d'analyses critiques dont les résultats permettront d'affiner lesactivités de validation et de mieux planifier le programme EOT&V. Cette tâche porte sur des aspectstant scientifiques qu'opérationnels.

Il est en outre recommandé de procéder à des expérimentations dites "anticipées". Bien que lesÉtats membres d'EUROCONTROL aient déjà acquis une certaine expérience de l'utilisation du GPSdans leur espace aérien, le passage à l'utilisation d'EGNOS devrait modifier sensiblement lesopérations de navigation. Les États membres ont donc tout intérêt à acquérir le plus tôt possible uneexpérience de l'utilisation du système en engageant rapidement des expérimentations. De tellesexpérimentations sont particulièrement importantes pour EUROCONTROL, car elles viendront àl'appui de l'élaboration de méthodes de validation appropriées qui seront appliquées dans le cadred'étapes ultérieures du programme EOT&V.

Le reste du programme EOT&V pourra être défini de manière détaillée au vu des résultats de cespremières activités. On passera ensuite à la phase de développement, puis enfin à la phase de miseen œuvre, au cours de laquelle seront effectués les essais et la validation proprement dits. Lesessais et mesures en conditions réelles constitueront l'ossature de la phase de mise en œuvre. Il estimportant de bien étudier les exigences à fixer pour ces essais opérationnels, car une sélectionjudicieuse de ces derniers (onéreux) permettra d'en réduire le nombre au minimum tout en assurantla collecte d'une quantité suffisante de données pour permettre la validation de l'exploitation globaled'EGNOS. Des activités supplémentaires seront nécessaires pour extrapoler les mesures effectuéesau cours des essais opérationnels.

Le programme EOT&V s'achèvera avec l'approbation, par les États membres, de l'utilisation deprocédures de vol faisant appel à EGNOS dans leur espace aérien.



EUROCONTROL

1 INTRODUCTION

EUROCONTROL est chargée, dans le cadre de son engagement au sein du Groupe tripartiteeuropéen (ETG), des essais et de la validation opérationnels d'EGNOS (Complémentgéostationnaire européen de navigation) par rapport aux besoins des utilisateurs aéronautiquescivils. Ces essais et cette validation opérationnels (EOT&V) permettront de vérifier si EGNOSrépond aux besoins des utilisateurs aéronautiques civils dans l'environnement opérationnel.

Le présent document a pour objet de proposer les grandes lignes du programme EOT&V. Il constituele dernier élément de l'Analyse des exigences des essais et de la validation opérationnels d'EGNOSet a été préparé, pour le compte d'EUROCONTROL, par une équipe menée par Avionik ZentrumBraunschweig (Allemagne), à laquelle ont participé Roke Manor Research (R-U), l'Administration del'aviation civile du Royaume-Uni et l'Université technique de Brunswick (Allemagne).

1.1 Généralités

EGNOS est la contribution européenne à l'actuelle constellation de systèmes de navigation parsatellite. Ce système, dont la conception préliminaire a été mise au point en 1998, devrait atteindrela capacité opérationnelle avancée (AOC) d'ici 2003.

La coordination des travaux européens relatifs aux futurs services de navigation par satellite (ycompris EGNOS) est assurée par le Groupe tripartite européen (ETG), qui réunit l'Organisationeuropéenne pour la sécurité de la navigation aérienne (EUROCONTROL), l'Agence spatialeeuropéenne (ASE) et la Commission européenne (représentant l'Union européenne). Chaqueorganisation apporte son expérience et ses connaissances spécialisées, et contribue au financementdu Programme EGNOS. Le mandat de l'ETG est étayé par des décisions gouvernementales auniveau national et à celui de l'Union européenne. En particulier, cette dernière s'attache à élaborerun Programme d'action, avec l'appui des membres de l'ETG, des États membres de l'UE etd'organisations internationales, en vue d'établir un cadre institutionnel et technique pour la mise aupoint du GNSS à des fins civiles. Au sein de l'ETG, les responsabilités sont réparties comme suit :

• la Commission européenne est responsable des questions institutionnelles et des grandesorientations, et veille à ce que les avis de tous les utilisateurs potentiels soient pris en comptedans le cadre du programme global. En outre, la Commission européenne traite des questionsliées à l'utilisation multimodale d'EGNOS ;

• EUROCONTROL se charge de la définition des exigences de mission pour l'aviation civile etsera responsable des essais et de la validation opérationnels d'EGNOS au regard des besoinsdes utilisateurs aéronautiques. Les travaux confiés à EUROCONTROL seront effectués encoopération avec les autorités aéronautiques compétentes au niveau national et supranational ;

• l'Agence spatiale européenne (ASE) prend en charge la gestion de toutes les activités de miseau point, de déploiement et de validation technique. Sa contribution s'effectuera via sonProgramme de recherche de pointe sur les systèmes de télécommunications (ARTES).

Le système EGNOS

Les systèmes de navigation par satellite actuels – GPS et GLONASS – ne peuvent, seuls, répondreà certains besoins des utilisateurs, notamment dans le cas d'utilisations à facteur "sécurité" vitaltelles que l'aviation. Des systèmes dits de renforcement ont été mis au point pour combler au moinsquelques-unes de ces lacunes. Trois Systèmes de renforcement orbital (SBAS) sont actuellement encours de développement : le Système de renforcement à couverture étendue (WAAS) aux États-Unis, le Complément géostationnaire européen de navigation (EGNOS) en Europe et le Systèmesatellitaire multifonctionnel de renforcement (MSAS) au Japon. Ces systèmes diffuseront desdonnées via des charges utiles de navigation embarquées sur des satellites géostationnaires, etdevraient répondre aux exigences de l'aviation civile pour un système primaire, voire exclusif, denavigation pour toutes les phases de vol jusqu'à l'approche de précision de Catégorie I.Contrairement au WAAS et au MSAS, l'EGNOS comprend également un renforcement duGLONASS russe.



EUROCONTROL

Tous les systèmes de renforcement orbital assureront trois fonctions essentielles :

• la mesure de distance : des signaux de mesure de distance de type GPS seront diffusés etrenforceront le nombre de satellites de navigation à la disposition des utilisateurs du GPS,augmentant ainsi la disponibilité de services de navigation fondés sur le GPS qui utilisent leContrôle d'intégrité autonome par le récepteur (RAIM) ;

• un canal d'intégrité : cette fonction consistera en la diffusion de données d'intégrité GPS etaugmentera, de ce fait, la disponibilité et la sécurité des services de navigation GPS ;

• la correction différentielle à couverture étendue (WAD) : cette fonction assurera la diffusionde données de correction différentielle valables pour les satellites GPS (et GLONASS).

Les trois systèmes SBAS assureront, ensemble, une couverture de diffusion quasiment mondiale.Des réseaux au sol dédiés seront toutefois nécessaires pour certains éléments des fonctions dusystème, ce qui restreint les zones de service actuellement prévues.

Le développement du système EGNOS se déroulera en deux phases : une phase de Capacitéopérationnelle avancée (AOC) faisant appel aux transpondeurs de navigation embarqués sur deuxsatellites INMARSAT-III (AOR-E et IOR) et à un transpondeur à bord du satellite ARTEMIS, suivied'une phase de Capacité opérationnelle totale (FOC) mettant en œuvre le déploiement du systèmeen vraie grandeur afin de répondre aux exigences de l'aviation civile visant un moyen primaire ouexclusif de navigation pour toutes les phases de vol jusqu'aux approches de précision de Catégorie1.

Calendrier EGNOS

La durée de vie du système EGNOS est de 15 ans et couvre les phases AOC (Capacitéopérationnelle avancée) et FOC (Capacité d'exploitation finale). La Figure 1-1 présente le calendrierde développement du système EGNOS pour la phase AOC, dont les principaux jalons sont lessuivants :

• PDR – Revue préliminaire de conceptionLa PDR est le jalon final avant le démarrage du développement du GIC/WAD.

1996 1997 1998 1999 2000 2001 2002

Phase Initiale

Conception du base du système

Essais Préliminaires

Extension – Phase B

Etape 1: Mesure de distance GEO

Développement

Installation & Vérification

Exploitation (AOR-E + IOR)

Etape 2: Système d’Essais GIC/WAD

Développement & Intégration

Vérification

Exploitation

Etape 3: AOC Opérationnel

Développement GIC/WAD

Installation & Vérification

Première Exploitation

Jalons ORRFQRCDRPDR

Figure 1-1 Calendrier AOC EGNOS (ASE- Bureau du Programme GNSS1, 12 mars 1998)



EUROCONTROL

• CDR – Revue critique de définitionLa CDR doit déboucher sur l'acceptation par l'ASE de la conception de système proposée par leconsortium industriel ; elle a pour but de vérifier que cette conception est conforme au cahierdes charges et qu'il n'y a pas de divergence.

• FQR – Revue de qualification en usineAprès acceptation de la conception du système, on passera à la fabrication et à l'intégration dumatériel en usine. Ce jalon intervient après achèvement de toutes les activités dedéveloppement. Cette revue a pour objet de vérifier que tous les composants du système ontété développés conformément au cahier des charges.

• ORR – Revue d'aptitude opérationnelle Le déploiement sur site commence ; il est suivi de l'intégration et de la validation technique dusystème qui, si les résultats sont positifs, conduisent au présent jalon. A l'issue de l'ORR, lavalidation technique d'EGNOS est considérée comme acquise, ce qui signifie que l'ASE acceptele système développé par le consortium industriel.

1.2 Le cycle de vie d’EGNOS

Le cycle de vie du système EGNOS couvre toutes les phases, depuis la définition des exigences demission jusqu'à l'homologation du service, en passant par la conception, le développement,l'intégration et la validation du système. La Figure 1-2 présente le cycle de vie du système EGNOSsous la forme d'un diagramme en "V", qui donne un aperçu graphique du processus global menant àl'exploitation d'EGNOS. Le diagramme en "V" commence par la traduction des exigences de missionen un cahier des charges. Le processus de développement se déroule comme suit :

• Approche descendante :établissement du cahier des charges, conception du système, spécification & conception dessous-systèmes, développement ;

• Approche ascendante : développement, intégration & validation des sous-systèmes, intégration du système, validationdu système.

La Revue Préliminaire de Conception (PDR) clôture la conception préliminaire et mène à laconception finale. Elle est suivie de la Revue Critique de Définition (CDR), engagée avant ledémarrage du développement. Avant l'intégration du système, il est procédé à la Revue deQualification en Usine (FQR), et la dernière étape de la vérification technique coordonnée par l'ASEest la Revue d'Aptitude Opérationnelle (ORR). L'ORR est suivie de l'homologation du service en vuede l'utilisation multimodale d'EGNOS. Le présent document est consacré aux essais et à la validationopérationnels au regard des besoins du secteur de l'aviation civile.

1.3 Dissociation de la vérification technique et de la validation opérationnelle

L'ASE et le titulaire du marché EGNOS exécuteront un programme de vérification technique en vued'établir la conformité du service assuré par EGNOS au cahier des charges, suite à quoi l'ASEpourra procéder à la réception du système. Parmi ces activités de vérification figurent des mesurespratiques de la performance du système au moyen d'un prototype de récepteur utilisateur conçuspécialement à cet effet.

Pour compléter ces travaux, EUROCONTROL coordonnera les essais et la validation opérationnelsd'EGNOS par rapport aux critères de performance de l'aviation civile. Ce processus doit prendre enconsidération tous les éléments qui ne seront pas couverts par la vérification technique. Aux fins del'EOT&V, le processus de validation technique sera réputé avoir validé le SIS (signalélectromagnétique) d'EGNOS conformément aux critères de performance du système.

A l'issue de l'ORR commencera la phase d'exploitation initiale d'EGNOS. Le programme EOT&Vsera engagé dans les meilleurs délais, les principales campagnes d'essais étant entreprises dèsqu'un SIS complet sera disponible. De premières mesures pourront cependant être effectuées avecun SIS préliminaire (généré par exemple par la station d'essai EGNOS - ESTB). L'essentiel du



EUROCONTROL

programme EOT&V s'achèvera avec la réception opérationnelle d'EGNOS, qui viendra conclure laphase préopérationnelle du système.

En raison des caractéristiques du processus de vérification technique et de l'EOT&V, certainesactivités de validation se recouperont. Il convient en outre de noter que le cahier des charges(System Requirements Document – SRD) d'EGNOS se fonde essentiellement sur les exigences demission de l'aviation civile, ce qui accroît le risque de doubles emplois. Le programme EOT&Vd'EUROCONTROL est toutefois défini de manière à restreindre au maximum ces doubles emplois. Acette fin, une coopération étroite doit être établie entre les deux équipes chargées des essais et dela validation techniques et opérationnels.

1.4 Objectifs de la vérification technique

L'objectif des activités de vérification technique coordonnées par l'ASE est de s'assurer que lesystème répond aux besoins et est à même de maintenir ses performances pendant tout son cyclede vie. La validation sera un processus spécialisé, indépendant, dans toute la mesure possible, desactivités de conception du système.

La vérification de la performance se fera de bout en bout, y compris le segment utilisateur, dans desconditions représentatives de l'environnement opérationnel, au moyen des signaux diffusés par lesGEO GPS, GLONASS et EGNOS. Les scénarios les plus défavorables seront également examinésen détail. L'ASE prévoit d'effectuer des essais pratiques dans les trois principaux domainesd'utilisation (aviation, transport maritime et service mobile terrestre).

Une série d'outils de vérification sera mise au point dans le cadre du programme ARTES-9 pour lesbesoins du processus de vérification technique. Il est recommandé de réutiliser ces outils dans lecadre du programme EOT&V, mais les possibilités réelles de réutilisation doivent faire l'objet d'uneétude plus poussée.

1.5 Essais et validation opérationnels multimodaux

Les essais et la validation opérationnels multimodaux d'EGNOS ont pour objet de vérifier que lesystème répond aux divers critères de performance des utilisateurs (aviation civile, transport

Intégrat.& Validat.des Sous-syst.

Spécif. et Concept.des Sous-syst.

Développement

Conception duSystème

Intégration duSystème

Validation duSystème

Cahier desCharges

Homologation du Servicedu Transport Aerien,Maritime, Terrestre

Exigences de Mission du Transport Aerien,Maritime, Terrestre

Communauté desUtilisateurs

Mission

Système

EOT&VMulti-modal

VérificationTechnique

CDR

FQR

ORR

ASE

PDR

ConceptionPréliminaire

ConceptionPréliminaire

DetailedDesign

Conceptiondétaillée

Figure 1-2 Cycle de vie du système EGNOS



EUROCONTROL

maritime, service mobile terrestre, etc.). Le présent rapport est consacré aux aspects de cesactivités multimodales se rapportant à l'aviation civile. Bien que le programme EOT&Vd'EUROCONTROL n'envisage que les applications d'EGNOS intéressant la communautéaéronautique, une grande partie des résultats et conclusions pourra être extrapolée aux utilisateursterrestres et maritimes, principalement du fait que le secteur aéronautique est le plus exigeant, sur leplan des performances, de tous les groupes d'utilisateurs potentiels d'EGNOS (à l'exception peut-être de certaines applications ferroviaires à facteur sécurité critique).

Le programme EOT&V d'EUROCONTROL pourrait donner des résultats importants pour denombreuses applications non aéronautiques qui requièrent des essais et une validation complets. Enrègle générale, toutes les utilisations à facteur "sécurité" vital (notamment dans les secteurs maritimeet ferroviaire) nécessitent des procédures de validation spécialisées pour vérifier que le systèmeEGNOS répond bien à leurs besoins spécifiques. Il se peut que d'autres applications qui ne sont pasà facteur "sécurité" vital (notamment dans le secteur du transport routier) requièrent des procéduresde validation strictes pour d'autres raisons, notamment les risques financiers potentiels, d'un niveauélevé.

Au sein du Groupe tripartite européen, la Commission européenne est chargée, entre autres,d'analyser les besoins des utilisateurs, tous modes confondus. C'est pourquoi elle a lancé, en janvier1998, une étude consacrée au système orbital multimodal de sécurité pour les transports ("Multi-modal Safety Satellite System for Transport" - MUSSST), dont l'un des objectifs est la spécificationet la réalisation d'un banc d'essai multimodal pour les systèmes de navigation par satellite. Cestravaux devront prendre soigneusement en considération les résultats des études de validation et decertification menées sur EGNOS.

1.6 Champ d'application des essais et de la validation opérationnels d'EGNOS pourl'aviation civile

Le programme d'essais et de validation opérationnels d'EGNOS (EOT&V) vise à valider laperformance d'EGNOS au regard des besoins de l'aviation civile. EUROCONTROL a commencé paranalyser les besoins EOT&V, afin de définir précisément les exigences et paramètres à valider et deproposer un plan approprié des activités à mener dans le cadre de l'EOT&V.

Au début de l'analyse des besoins EOT&V, EUROCONTROL a défini comme suit les principalesétapes des essais et de la validation opérationnels d'EGNOS :• récapitulation des besoins opérationnels de l'aviation pour EGNOS ;• recensement des activités d'essai et de validation nécessaires et des outils requis ;• achat/mise au point des outils d'analyse des données ainsi que du matériel, des procédures et

des outils nécessaires à l'exécution des essais ;• exécution des campagnes d'essais.

Les activités à entreprendre dans le cadre du processus EOT&V se répartissent en trois grandescatégories : RNP, sécurité et mise en œuvre dans l'espace aérien. Le présent rapport met l'accentsur la première catégorie, à savoir les essais et la validation opérationnels d'EGNOS au regard desparamètres RNP, jusqu'au niveau de système exclusif de navigation pour les approches deCatégorie 1 dans l'environnement opérationnel. Les activités envisagées pour la validation de laRNP dans l'environnement opérationnel réel portent sur des aspects tels que les manœuvres desaéronefs et la dynamique des vols, les éléments influant sur la réception du signal tels que l'effet demasque, les trajets multiples, les interférences, etc. La catégorie "Mise en œuvre dans l'espaceaérien" porte sur des éléments tels que l'inspection en vol, les modèles de risque de collision,certains aspects liés à l'exploitation et à la maintenance du système EGNOS ainsi que les interfacesavec l'ATC. En ce qui concerne l'environnement opérationnel, la validation inclut des aspects liés à lagestion de la circulation et à la charge de travail des contrôleurs. La plupart de ces aspects ne sontpas traités dans le présent document, bien qu'il soit apparu, en cours d'analyse, que ces questionssont d'une grande importance et devraient, à ce titre, faire l'objet d'un examen plus détaillé à unstade ultérieur du processus EOT&V. Enfin, la catégorie "sécurité" relève essentiellement de lacompétence de l'Équipe ETG d'évaluation de la sécurité.



EUROCONTROL

Le processus EOT&V n'est qu'un élément de la validation en vraie grandeur du GNSS et nes'applique donc pas à tous les aspects nécessaires à la validation du GNSS. A titre d'exemple, unprocessus EOT&V complet du GNSS porterait sur des éléments tels que la validation des SARP,l'analyse des TLS par rapport à la configuration GNSS, la traduction des SARP en exigences demission, etc.

2 OBJECTIFS

Le processus EOT&V vise à démontrer qu'EGNOS répond aux besoins opérationnels de l'aviationcivile à tous les niveaux requis.

Il doit faciliter l'acceptation (par les administrations nationales de l'aviation civile et les prestataires deservices de la circulation aérienne (ATS) des États membres de la CEAC) de l'utilisation d'EGNOSdans les opérations de vol. Plus précisément, EGNOS doit être validé au regard des critères deperformance de l'aviation civile en termes de disponibilité, d'intégrité, de précision et de continuité deservice.

Le présent document propose, dans les grandes lignes, le programme d'essai et de validationopérationnels d'EGNOS qu'EUROCONTROL entend mener en étroite coopération avec ses Étatsmembres. L'Analyse des besoins EOT&V avait pour but de définir les objectifs du programmeEOT&V global, compte tenu des exigences des États qui ont l'intention d'offrir des servicesopérationnels utilisant EGNOS. Il s'agissait de récapituler les impératifs opérationnels imposés ausystème, d'établir la limite entre validation technique et validation opérationnelle et de proposer lesactivités d'essai et de validation nécessaires pour la validation opérationnelle d'EGNOS en termesde RNP. L'analyse a également porté sur le recensement du matériel d'essai et des outils d'analysede données requis. En outre, un plan de gestion de projet a été proposé pour les phases ultérieuresdu programme EOT&V.

3 CONCLUSIONS

Pour que la navigation par satellite puisse être mise en œuvre dans l'espace aérien de l'Europe, leGroupe tripartite européen (ETG) s'attache actuellement à développer le système EGNOS, quidevrait être opérationnel d'ici 2003. Au sein de l'ETG, EUROCONTROL est responsable de lavalidation opérationnelle du système pour l'aviation civile tandis que l'Agence spatiale européenne(ASE), assistée par le secteur industriel, se charge de sa validation technique, aux fins de prouverque le système fournit le signal électromagnétique souhaité. A cet effet, une vaste campagne demesures sera mise sur pied dans la zone de couverture d'EGNOS. Ces travaux ne seront toutefoispas suffisants pour prouver que le système répond aux besoins de l'aviation civile ; d'autres activitésde validation spécifiques devront donc être menées pour démontrer que la performanceopérationnelle des aéronefs utilisant le GPS et le GLONASS, complétés au moyen d'EGNOS, répondaux critères RNP en termes de précision, d'intégrité, de disponibilité et de continuité.

Les aides à la navigation classiques diffèrent fondamentalement d'EGNOS, ce qui fait de lavalidation un exercice particulièrement exigeant, appelant de nouvelles méthodes de validation et denouvelles approches en matière de réglementation de la sécurité. Les principales différences sontles suivantes:

• le caractère international d'EGNOS, qui assurera un service dans l'ensemble de la zone CEAC ;• la répartition géographique de l'infrastructure au sol, les services de navigation d'un État étant

tributaires de l'infrastructure mise en place dans plusieurs autres pays ;• les questions institutionnelles telles que le contrôle régional d'EGNOS, mais l'absence d'influence

sur le GPS et le GLONASS ;• la complexité de l'architecture du système EGNOS ;• la subordination de la performance du système EGNOS au temps et à la géographie.



EUROCONTROL

Le présent document définit, dans les grandes lignes, le programme qu'EUROCONTROL entendmener. Les limites de l'utilisation opérationnelle d'EGNOS sont déterminées en fonction d'uneévaluation des opérations qu'EGNOS est appelé à appuyer, et des critères auxquels le systèmedevra satisfaire en termes de RNP pour que ces opérations soient possibles.

Les éléments spécifiques dont l'influence risque de contrarier le respect des impératifs ont étéexaminés. Les éléments RNP ci-après sont les plus critiques à cet égard :

• Incidence de la dynamique de vol sur le récepteurD'une façon générale, les récepteurs GNSS ont du mal à gérer la vitesse élevée et lesaccélérations qui interviennent à bord d'un aéronef. A terme, la précision de positionnementrisque de s'en trouver réduite et il se peut même que le récepteur "décroche" de certainssatellites.

• Effet de masque et géométrieLa disponibilité du service EGNOS est fortement tributaire de l'aptitude de l'antenne du récepteurà capter les signaux électromagnétiques. La validation opérationnelle d'EGNOS doit, de ce fait,prendre en compte les éventuels effets de masque empêchant la réception des signaux EGNOS.L'effet de masque réduit le nombre potentiel de satellites visibles. Ce type d'effet se produitlorsqu'un objet bouche la portée optique entre l'antenne EGNOS et un satellite, empêchant ainsila réception du signal du satellite par l'antenne de l'utilisateur. Il pourrait être provoqué par deséléments locaux, tels que le masquage de l'antenne par la surface de l'aéronef, ou par deséléments extérieurs, tels que la topographie. Dans de telles conditions, le satellite n'est plusdisponible pour les besoins de la navigation.

• Trajets multiplesLes trajets multiples se produisent lorsque le signal arrive au récepteur via deux ou plusieurstrajets différents. Chacun des signaux reçus a une longueur de trajet différente, d'où desinterférences entre les signaux. Les interférences dues aux trajets multiples faussent les calculsde distance du satellite et, partant, le calcul de la position.

• BrouillageLe brouillage est causé par d'autres transmissions par radiofréquences ou sur des fréquencessimilaires à celles qu'utilise EGNOS. Le signal que l'utilisateur tente de capter est alors corrompupar l'interférence d'autres signaux dans la même bande de fréquence. Ce brouillage peut réduirela précision de positionnement, voire empêcher complètement la réception des signaux EGNOS.

• Effets atmosphériquesL'ionosphère est sans doute l'élément le plus déterminant en matière de performance finaled'EGNOS, et requiert une attention particulière. L'ionosphère cause, davantage que les autrescouches atmosphériques, des fluctuations de la vitesse de propagation des signaux d'EGNOS,réduisant ainsi la précision de positionnement potentielle d'EGNOS. Un élément important àétudier est l'influence du pic imminent d'activité ionosphérique prévu aux alentours de l'an 2000,pendant la phase de mise en œuvre d'EGNOS.

Le rapport propose les activités de validation EOT&V qu'il convient d'engager en vue de valider laperformance d'EGNOS en termes de RNP et d'évaluer les incidences des problèmes opérationnelssur la RNP. Les méthodes de validation applicables sont l'examen, l'analyse, l'inspection, ladémonstration et l'essai. Une stratégie de validation a été définie pour chaque paramètre RNP. Enoutre, une stratégie de validation des incidences opérationnelles sur les paramètres RNP a étéélaborée dans ses grandes lignes. Cette méthode permet de déterminer les impératifs de validationqui servent de référence pour la définition des activités de validation proprement dites.

La nature même des essais et de la validation opérationnels commande que le processus EOT&Vsoit constitué essentiellement d'essais et de mesures en conditions réelles. D'autres méthodes,notamment l'analyse et la simulation, devront également être utilisées pour appuyer les essais etpermettre l'extrapolation des résultats des mesures. Certains paramètres, tels que l'intégrité, sonttrès exigeants en raison des percentiles élevés qu'ils requièrent, ce qui rend impossible leurvalidation par des essais. Il faudra, dans ce cas-ci, élaborer avec minutie une stratégie combinantdifférentes méthodes de validation.

Il importe d'examiner soigneusement les impératifs des essais opérationnels, car un choix judicieuxpermettra de minimiser le nombre d'essais requis tout en recueillant suffisamment de données pour



EUROCONTROL

la validation de l'exploitation globale d'EGNOS. D'autres démonstrations pourront servir à vérifierque les résultats des simulations et des analyses sont valables et constituent une représentationfidèle des conditions opérationnelles.

Enfin, le rapport présente les grandes lignes du programme EOT&V proposé et définit un plan degestion de projet et des ensembles de travaux pour les tâches à entreprendre dans le cadre duprocessus EOT&V. On y trouve un calendrier, de même qu'une description des aspects d'assurancequalité à prendre en considération. Enfin, les coûts ont fait l'objet d'une estimation sommaire, étantentendu qu'à ce stade précoce du processus EOT&V, il ne peut s'agir que d'une premièreapproximation des coûts réels à escompter.

Le processus EOT&V est d'une très grande importance pour que les utilisateurs aéronautiquespuissent bénéficier rapidement des avantages offerts par EGNOS, ce qui contribuera à accroîtrel'efficacité et la sécurité de l'aviation civile en Europe.



EUROCONTROL

Appendix A



EUROCONTROL



EUROCONTROL

APPENDIX A: TECHNICAL ANNEX

A.1 EGNOS System Description

The EGNOS system will be developed in two phases, an Advanced Operational Capability (AOC)using the navigation transponders on-board INMARSAT-III AOR-E and IOR satellites, followed by aFull Operational Capability (FOC) implementing full-scale system deployment in order to meetprimary or sole means5 civil aviation requirements for all phases of flight down to Cat I landing.

A.1.1 EGNOS AOC System

The EGNOS AOC system architecture consists of the space, ground and user segment:

• The EGNOS space segment is composed of geostationary transponders on-board INMARSAT IIIAOR-E and IOR satellites.

• The EGNOS ground segment consists of GNSS (GPS, GLONASS and GEO) Ranging andIntegrity Monitoring Stations (RIMS) which are connected to the Mission Control Centres (MCC)where the EGNOS navigation messages are configured before being sent to the NavigationLand Earth Stations (NLES). These ground segment components are interconnected by theEGNOS Wide Area Network (EWAN).

• The EGNOS user segment consists of an EGNOS standard receiver to verify the Signal-In-Space (SIS) performance and of prototype user equipment in order to verify the system perform-ance for civil aviation, maritime and land applications. The overall EGNOS AOC architecturestructure is shown in the following figure A.1-1.

GPSSatellites

GLONASSSatellites

GEOSatellites

User Segment NLES RIMS

MCC

EWAN

Figure A.1-1: EGNOS AOC Architecture

A.1.1.1 Space Segment

The EGNOS space segment has two main functions: improving the geometry (i.e. the availability) ofthe GPS constellation through its GPS-like GEO ranging function and broadcast of the GIC andWAD message. The nominal EGNOS AOC space segment is composed of navigation transponders




EUROCONTROL

on-board INMARSAT III, AOR-E and IOR satellites. A third navigation transponder will be providedby the ARTEMIS satellite.

A.1.1.2 Ground Segment

The EGNOS AOC ground segment will comprise the following major components:

• 4 Mission Control Centres (MCC)• 4 Navigation Land Earth Stations (NLES) - two for each satellite• 22 (tbc) Ranging and Integrity Monitoring Stations (RIMS)• EGNOS Wide Area Network (EWAN)

Due to safety requirements, some critical software and hardware elements of the ground segmentare diversified; i.e. there will be two separate developments and implementations of the samefunctional specification.

Mission Control Centre (MCC):

The EGNOS AOC ground segment will comprise four identical MCCs which will be located in Madrid(Spain), Gatwick (UK), Langen (Germany) and Ciampino (Italy).

The MCC performs two main functions that are:

• Computation, distribution, validation and transmission of GEO ranging, integrity and WAD correc-tion data

• Control of EGNOS system

On the basis of data collected by RIMS the MCC computes WAD corrections, in particular ephemerisand clocks corrections regarding satellites (GPS, GLONASS and GEO) and ionospheric delay on agrid over ECAC. All these results will be formatted in messages and then transmitted to all NLES forbroadcast to EGNOS users through the GEO satellites. An independent chain of computation, withdata from RIMS not used in the first chain will assess the integrity of the first chain’s results. Allprocessing functions will be fully automatic and will not require continuous active control byoperators.

The MCC Control function will receive all status information from the different EGNOS facilities andwill have the capability to perform actions needed to maintain the EGNOS service. This function willbe in charge of external communications to and from the EGNOS system, e.g. with ATC, INMARSATetc.The processing functions are grouped in the so-called Central Processing Facility (CPF) and thecontrol functions in the Central Control Facility (CCF). The MCC is the combination of these twofacilities.

Navigation Land Earth Station (NLES):

Two NLES per geostationary satellite are deployed as part of the EGNOS AOC ground segment. TheNLES are used to uplink data to the GEO satellites. Additionally, the NLES are also in charge of theaccurate synchronisation of GEO message transmission relative to GPS time.

Only one NLES is actively transmitting to a GEO satellite at any one time, a second one being in hotbackup mode and kept in synchronisation with the primary one. Since the NLES is a safety criticalcomponent of the EGNOS system, primary and secondary NLESs are diversified in design in orderto avoid common modes of failure.

Ranging and Integrity Monitoring Station (RIMS):

RIMS are remote stations acting as data collection points. For this purpose, RIMS are equipped withGNSS receivers, atomic clocks and meteorological sensors. They transmit the collected data to allMCCs of the EGNOS system.



EUROCONTROL

The number of RIMS to be deployed has not finally been determined by now. In order to meetEGNOS service level 3B performance, the system will comprise 22 RIMS. However, EGNOS servicelevel 3A will require additional RIMS to allow proper ionospheric modelling in the absence ofGLONASS signals. The total number of RIMS required is estimated to be around 33 in order to coverthe whole ECAC region.

EGNOS Wide Area Network (EWAN):

The main functionality of the EWAN is the transfer of data between the different EGNOS sites, inparticular the continuous data flows from RIMS to the MCCs and from MCCs to NLES.

The AOC EWAN is conceived as a private intranet with centralised network management usingframe relay carrier network service with the required throughput, guaranteed service availability andlow latency.

A.1.1.3 User Segment

The EGNOS AOC user segment development activities will address the aeronautical, maritime andland-mobile fields of application, as well as the project requirements to verify the system perform-ance.

The EGNOS user segment developments will consist in an EGNOS test receiver to verify the signal-in-space performance, and of prototype user equipment in order to validate the system for differentialapplications. This equipment will be developed according to internationally agreed standards (RTCAand EUROCAE). It will implement all functions necessary to validate the system under differentoperational environments.

The activities under the ARTES programme of the European Space Agency (ESA) concerning userequipment do not include the development of commercial products. Therefore, the EuropeanCommission supports the development of EGNOS user equipment by an industrial team within theTransport Telematics Programme.

A.1.2 Transition to FOC

The transition from AOC to FOC will consist of the deployment of additional system components tospace and ground segments in order to increase the availability and continuity performance ofEGNOS.

• Space Segment:The space segment will consist of 3 active GEO satellites located in such way that double cover-age is ensured over the ECAC region. Current plans foresee the launch of a third GEO navigationpayload by the end of 1999 on-board the ARTEMIS satellite.

An additional spare satellite will be in orbit with an activation time of less than one month. Inaddition to this, a consistent satellite replacement strategy over the system lifetime will be imple-mented in order to ensure the availability of spare satellites.

• Ground Segment:According to the principle established for the AOC ground segment, two NLES per additionalsatellite would be required. With regards to the EWAN, a second overlay network, that is fullyindependent of the EGNOS AOC EWAN, will be necessary to achieve the required availabilityand continuity of service requirements. Additional RIMS would be required in order to provide fullredundancy and coverage in the ECAC area, and, if required, in order to implement expansion ofservice to other regions within the broadcast area of the geostationary satellites.

A.2 Phases of Flight

To determine the aviation operational requirements of EGNOS it is necessary to determine the flightphases for which the system will be used. The flight profile of an aircraft must be considered fromdeparture to arrival at a destination airfield. With regards to RNP, three terms are used to identify the



EUROCONTROL

flight phases of an aircraft: En-route, Non Precision Approach and Precision Approach. This sectiondefines these phases of flight and the associated RNPs allocated to them. In some cases severalRNPs have been defined for a given phase of flight.

En-route (RNP20, RNP12.6, RNP4/5 and RNP1)

The En-route phase of flight covers operations between the departure and terminal phases of anaircraft’s flight. The category is further sub-divided into En-route Continental and En-route Oceanicphases. For Oceanic flight phases, RNP12.6 is currently the mandatory requirement, however, inview of the increases of air traffic, the need for RNP4 is being considered. Over continental Europe,RNP5 is adequate however, by 2005 it is under consideration whether RNP1 performance may berequired.

The En-route phase of flight is considered to cover the portion of the flight where the aircraft isbetween the Terminal Manoeuvring Areas (TMA) of the departure and arrival airports. TMA providesthe transition from the En-route phase to the approach phase, and from the departure phase to theEn-route phase. There is Terminal Control Area airspace around most large airfields, which allow AirTraffic Control at the airport to sequence the aircraft approaching or departing the airfield appropri-ately. In the TMA performance requirements will vary between RNP 1 and possibly RNP 0.3.

Non Precision Approach (RNP 0.3)

A Non Precision Approach (NPA) will be taken to be commenced from 4 nautical miles out from thethreshold of the approach runway, to the point where the aircraft has come to a complete stop on therunway surface.

For NPA navigation aids are used to bring the aircraft sufficiently close to the airfield that allows thepilot to have a view of the runway to enable a visual landing. The approach phase of a flight isgenerally regarded as commencing 20 nautical miles from the arrival runway threshold. Theprocedures used for NPAs are based upon VOR/DME or NDB navigation aids and do therefore notassume vertical guidance. The procedures implemented for NPAs vary depending upon the localenvironment and the performance of the navigation aids in the vicinity of the airfield. The landing isperformed manually, with no automatic guidance provided by a navigation aid.

Precision Approach (RNP 0.03/50 and RNP 0.02/40)

A Precision Approach will be taken to be commenced from 4 nautical miles out from the threshold ofthe approach runway, to the point where the aircraft has come to a complete stop on the runwaysurface.

A Precision Approach is a type of approach made to a runway using horizontal and vertical guidanceprovided by a precision approach landing aid. Currently, there are two approved types of landingaids: the Instrument Landing System (ILS) and the Microwave Landing System (MLS). Both aids arelocated at the airfield. Precision approach landing aids provide both vertical and lateral guidance, andguide the aircraft along the approach path up to a Decision Height (DH). The Decision Height for anygiven approach procedure is dependent upon the Category of approach for which the ILS is intendedand the obstacle clearance environment. For ILS, the categories are defined as Cat I, Cat II, Cat IIIA,Cat IIIB, and Cat IIIC. The ILS Cat I is the least stringent of these with a minimum Decision Height of200 feet, and ILS Cat IIIB installations providing auto-land facility. When the aircraft reaches thedecision height and if the pilot has visual contact with the runway, and it is safe to continue theapproach, the landing will be attempted. If the pilot does not have visual contact with the runway, theapproach will be aborted. Obviously, for those categories of approach that provide an auto-landcapability, the landing will be completed regardless of whether the pilot has visual contact with therunway.

Two sets of RNP parameter values have been defined to support Precision Approach operations.RNP 0.03/50 assumes a Decision Height of 350 feet, while RNP 0.02/40 assumes a similar decisionheight as the ILS Cat I.



EUROCONTROL

A.3 Man Machine Interface

In the consideration of the operational use of EGNOS, the interface between the users and the on-board equipment must be addressed. It is important to consider the change in workload due to theintroduction of an additional navigation system such as EGNOS. The ways in which the workload forthe operators of the system may change is dependent upon system knowledge and user interface.Therefore, the impact of EGNOS on flight-deck operations should be included as part of any airlinetraining programme. This aspect is especially important, since the principles upon which the systemoperates are unlike any currently used navigation aid. Additionally, attention should be paid to theinterfacing between the crew and the navigation function provided by EGNOS. Once again, theinformation provided to the crew must be considered since EGNOS, unlike current ground basednavigation aids, will be able to provide in far greater detail the current state of the system and theintegrity of the navigation solution generated.

A further impact of EGNOS will be upon the Flight Management System (FMS). At present, the FMSgenerates a performance indication of the position generated by determining whether any of thereceived navigation signals appear to be spurious. Consideration therefore needs to be given to theway in which the EGNOS derived position solution and the integrity information shall be handled bythe FMS (e.g. whether a discrete decision is made, or whether a ‘graceful’ degradation of theposition is allowed, determined by the integrity data provided by EGNOS).

Take-off /Initial Climb

Cruise Climb

Cruise

Stack Hold

Approach

Descent

Figure A.4-1: Example Flight in EGNOS Service Area



EUROCONTROL

EGNOS is not expected to have an impact on the way in which a crew performs current operations,and its introduction onto the flight-deck as a navigation service should be transparent to the crew.However, it is important to understand the interaction the crew will have with the system, and showthat the presence of a new navigation source does not detract from the safe operation of the aircraft.

A.4 Operational Influences on RNP Validation

A.4.1 Aircraft Manoeuvres and Dynamics

The manoeuvres of an aircraft have a strong influence on the navigation performance of the on-board EGNOS receiver. For example, the attitude of the aircraft has an influence on the potentialmasking of satellites. Another aspect is for example, that the aircraft speed may be used todetermine the typical spatial distance between two measurement points (if the measurement rate isgiven). Additionally, it has to be considered that during some aircraft manoeuvres (especially duringapproaches and departures) strong vertical accelerations may occur.To determine the flight operations which an aircraft would encounter, an arbitrary flight between twoairports within the EGNOS Service Area was considered (see Figure A.4-1).

A.4.1.1 Flight Operations

During the aircraft’s flight from the departure airport, through the en-route phase, and arrival at thedestination airport, there are several different flight operations that it will experience. These areillustrated at the foot of Figure A.4-1, and have been defined as:

• Initial Climb and Departure• Cruise Climb• Cruise• Descent• Stack Hold• Approach

Initial Climb and Departure

The Initial Climb and Departure phase covers the aircraft flight from take-off point on the departureairport runway surface, to the boundary of the TMA of the departure airport. During this phase, theaircraft will exhibit and initial climb out of the airport ATZ following take-off, before levelling off for theduration of the flight to the TMA boundary.This operation will occur in both RNP1 and RNP4/5 airspace.

Cruise Climb

The Cruise Climb phase covers the aircraft flight from the boundary of the departure airport TMA, tothe point at which the aircraft reaches it’s desired altitude for the Cruise phase. During this phase theaircraft will experience a steady climb up to the desired cruise altitude. The dynamic characteristicsof the Cruise Climb phase will also be relevant to altitude changes made during the Cruise phase,should the aircraft require a change in altitude.This operation will occur in both RNP5 and RNP12.6 airspace.

Cruise

The Cruise phase covers the aircraft flight from the point at which it reaches its initial cruise altitude,to the point where the aircraft commences it’s initial descent towards the destination airfield.This operation will occur in both RNP12.6 and RNP20 airspace and potentially RNP 5 airspaceshould implementation plans increase the navigation performance to this level.

Descent

The Descent phase covers the aircraft flight from the point at which it commences it’s initial descenttowards the destination airfield, to the approach to the runway at the destination airport. This phase



EUROCONTROL

may additionally include a Holding phase, where the aircraft is queued in a ‘Stack’ before it isreleased for onward navigation towards the runway.This operation will occur in both RNP12.6 and RNP20 airspace and potentially RNP 5 airspaceshould implementation plans increase the navigation performance to this level.

Stack Hold

The Stack Hold phase covers the aircraft flight from the point at which it enters a holding pattern tothe point at which it departs the holding pattern for onward navigation. During this phase, the aircraftwill typically maintain a ‘racetrack’ holding pattern, in either a clockwise or anti-clockwise direction.The ‘racetrack’ pattern is typically defined as two 5 nmi straight and level flight profiles, connected bytwo 180° rate one turns (180° per minute), as shown in the figure below.

~5 nmi

Figure A.4-2: Racetrack Holding Pattern

This operation will occur in both RNP12.6 and RNP20 airspace and potentially RNP 5 airspaceshould implementation plans increase the navigation performance to this level.

Approach

The Approach phase covers the aircraft flight from the point at which it commences it’s finalapproach to the airfield. Final approach is defined as commencing at a distance of 4 nmi out from thethreshold of the arrival runway.This operation will occur in both RNP1 and RNP4/5 airspace.

A.4.1.2 Aircraft Dynamics

During each of the flight operations identified above, the aircraft will undergo a varied number ofdifferent manoeuvres depending upon the desired operation. To determine which aircraft dynamicsare relevant, the axes of motion of an aircraft were considered, as illustrated in Figure A.4-3.

Y

X

Z

Figure A.4-3: Aircraft Axes of Motion



EUROCONTROL

In each of the axes of motion (X, Y and Z) the aircraft will have velocity, acceleration, roll, and rollrate.

Of these, the following are of relevance:

X- Axis

• Ground Speed• Roll (degrees)

Y- Axis

• Pitch (degrees)

Z- Axis

• Turn Rate (degrees/minute)• Altitude

Acceleration parameters have not been included, since the accelerations present in a commercialaircraft will be significantly small as to not impact upon the navigation performance of the EGNOSreceivers. The accelerations on the X-axis will be due primarily to changes in the engine throttlesettings. The maximum acceleration, which can be achieved by this mechanism, is not expected toexceed 1g. In the Y-axis, side gusts could cause possible accelerations, but these are not expectedto exceed 1g. Finally, in the Z-axis, turbulence may cause the aircraft to suddenly loose altitude;however, the accelerations expected due to this effect are also not expected to exceed 1g.Nevertheless, possible effects of such accelerations on the receiver behaviour are investigated insection 0 of this document.

In addition, the absolute position is relevant to the user performance obtained from EGNOS. Whilethe position in the horizontal plane has been previously identified (as being within the EGNOSService Area), the altitude also could be significant. Therefore, approximate altitude figures are alsoprovided in the following paragraphs.

Initial Climb and Departure

Typical and potential worst case manoeuvring characteristics for an aircraft in this operation phaseare:

Ground Speed Roll Pitch Turn Rate Altitude

250 kts 20o 30o 180o/min 5000 ft

300 kts 30o 40o 270o/min 5000 ft

Table A.4-1: Climb & Departure Dynamics

Cruise Climb



400 kts 10o 30o 180o/min 41000 ft

500 kts 20o 40o 270o/min 41000 ft

Table A.4-2: Cruise Climb Dynamics



EUROCONTROL

Cruise



400 kts 10o ±10o 180o/min 41000 ft

500 kts 20o ±20o 270o/min 41000 ft

Table A.4-3: Cruise Dynamics

Descent



400 kts 10o -20o 180o/min 41000 ft

500 kts 20o -30o 270o/min 41000 ft

Table A.4-4: Descent Dynamics

Stack Hold



250 kts 30o 0o 180o/min 10000 ft

300 kts 45o ±10o 360o/min 20000 ft

Table A.4-5: Stack Hold Dynamics

Approach



150 kts 30o -20o 180o/min <3000 ft

250 kts 40o -30o 360o/min <3000 ft

Table A.4-6: Approach Dynamics

A.4.2 Aircraft Types

The platform upon which the user receiver is installed is important to consider for the validation ofthe operational use of EGNOS. With regards to aircraft types a number of possible configurationsexist.

These include:

• High (e.g. BAe 146) and Low (e.g. B737) wing installations;• Single and multi-engine types.• Engine types (propeller, or jet).• Engine position (at front, under wing, fuselage mounted).• High and low tail plane installations.• Aircraft size (e.g. B747, Gulfstream V).• EGNOS antenna location.



EUROCONTROL

The potential effects, which these parameters may have upon the navigation performance obtained,will mostly be due to either masking or multipath.

In theory, it would be sufficient to consider masking issues by simulation since the nominal antennapattern (including limits to this pattern due to the frame of the aircraft) is known. This would enablethe extrapolation of measurement data from tests with one specific aircraft type to other aircraft typesby simply simulating the satellite visibility assuming a different antenna pattern.

However, in contrast to this theoretical approach, a number of effects have to be considered. Forexample, the ‘creeping’ of satellite signals which normally are outside of the antenna diagram andtherefore should not be received. Also, changes of the antenna diagram by the aircraft structurehave been observed where satellites could not be received although they were in the nominalantenna diagram and not being masked by the aircraft structure.

Therefore a correlation between simulations and practical tests should be made. The focus should beput on simulation but recorded data of different aircraft types should be compared with the simulationresults in order to ensure that the simulation results are correct.

To analyse effects of multipath in the vicinity of an aircraft, the position of the antenna plays animportant role. Normally, GNSS antennas are placed on the top of the fuselage of an aircraft.Investigations of the German research project CESAR [10] have shown, that there are two mainreflectors for such a constellation: the wings and the horizontal stabiliser. If a satellite signal isreflected by one of these areas, it can reach the antenna and influence the range measurementaccuracy of the GNSS receiver.

Possible Antenna Positions

Figure A.4-4: Possible Positions for Antenna Installation

In the above mentioned report two different positions of the GNSS antenna were investigated: onone hand, a position on top of the body directly above the wings, and on the other hand a positiondirectly over the cockpit (see Figure A.4-4). As a result it can be stated, that the probability ofmultipath is about ten times greater for the antenna position above the wings than for that one overthe cockpit. In this case, due to the reflection geometry, all multipath signals are sent out by satelliteswith high elevation angles. The delay of the reflected signal in comparison to the direct signal ismaximised which in turn results in a large ranging error of the receiver. With the same argumentationit can be concluded that in the second scenario only satellites with low elevation angles are reflected.The range errors caused by these multipath signals are smaller.

But there is another aspect that must be considered. Normally, only line-of-sight signals can reach aGNSS antenna. Because of the antenna position flat on the body of the aircraft and the rounding ofthe body, no signal reflected by the wing can directly reach the antenna. But there is another effectthat makes it possible: the signal creeps around the body. There are some indicators, that signalswith elevation angles of –20° can reach the antenna (reflection law: elevation angle = reflectionangle). So it can be said, that multipath signals from satellites with high elevation angles influencethe quality of range measurement less than those with low elevation angles since the damping of thefuselage is for the latter type of reflections significantly smaller. This result is opposing to that fromthe preceding paragraph.

So further investigations considering these results must show, which antenna position is the best forprotection against multipath in the vicinity of the aircraft.



EUROCONTROL

A.4.3 Masking and Geometry

The availability of the EGNOS service is strongly dependent on the ability of the user receiverantenna to receive the signals in space. The operational validation of EGNOS must, therefore,consider possible masking effects, which would prevent the EGNOS signals being received.

Masking reduces the potential number of visible satellites. The effect is caused by an object blockingthe line of sight between the EGNOS antenna and a satellite, and preventing the satellite’s signalfrom being received at the user antenna. It could be caused by local effects, such as the masking ofthe antenna by the surface of the aircraft, or by external factors, such as terrain. The satellite istherefore not available for use in the navigation solution.

Intentional masking can, however, sometimes be necessary. It has been recognised that lowelevation satellites provide less accurate navigation signals compared to those at higher elevations.In order to prevent the degradation of the position solution, it is possible to set the receiver to onlynavigate using satellites above a predetermined elevation.However, masking in the context of the Operational Test and Validation of EGNOS considers onlyunintentional masking, whereby the potential number of satellites which could be used for navigationis reduced due to external effects.

During high roll or pitch manoeuvres there exists the highest potential for the masking of satellitesfrom the EGNOS receiver due to the aircraft surfaces. Either a wing can mask out satellites if itbreaks the EGNOS receiver’s elevation mask angle, or fuselage can mask out satellites during highclimb or descent profiles. If the aircraft has a ‘T’ tail configuration, this will further increase thepotential for masking effects. In this case, the tail plane could mask satellites from the EGNOSantenna regardless of the aircraft dynamics. Of particular concern is the masking of the EGNOSGEO signals. This is most likely to occur at the extremes of the EGNOS Service Area when theaircraft is tracking away for the GEOs.

The impact of either roll or pitch perturbations upon the performance of the EGNOS receiver dependupon the aircraft type, the position of the antenna, and the mask angle employed. Masking mayoccur if any structure of the aircraft breaches the surface created by the elevation mask angle.

In the roll axis of the aircraft, this is dependent upon the size and length of the wings on the hostaircraft, and the amount of pitch or roll. In the pitch axis of the aircraft, it depends upon the location

36o

72o

Figure A.4-5: Good Satellite Geometry (Illustrative)



EUROCONTROL

of the antenna, and the length of the aircraft. If, for example, in pitch the antenna is set a relativelylong distance back from the nose of the aircraft, it would not take a large amount of pitch for thefuselage to breach the elevation mask angle surface.The geometry of the ranging satellites will also affect the performance of the EGNOS receiver. If a 2-dimensional example is considered, a more accurate position fix will be achieved when the tworanging sources are orthogonal and equidistant from the user. Figure A.4-5 shows a probable goodsatellite constellation geometry. Here, eight visible satellites have been considered, and areorganised into two different elevations, with four satellites at each elevation. The satellites at bothelevations are orthogonal with respect to the user, with the four satellites at each elevation offset by90° from each other.

If the geometry is poor when considering the same number of satellites in view, the navigationperformance of the receiver will be degraded. Poor geometry is likely to occur when a number ofsatellites have similar azimuth angles from the user, or when there is insufficient spread in thevertical plane. In these cases, the position measurement provided by the satellites will not have asgood accuracy as compared to an optimum constellation. This will be reflected in the Dilution ofPrecision (DOP) figure of merit values generated by the user receiver.

Correlation Time and Spatial Correlation

The correlation time with regards to the satellite geometry is assumed to be 30 minutes. This timewould allow a sufficient change of the geometry due to the satellite movements in order to assumeindependent measurements.

Concerning the spatial correlation, it is important to have a look at the DOP values, which varydepending on the horizontal position of the measurement (see figure A.4-6). The typical geometricalcorrelation for the HDOP is plotted vs. the difference of the latitudes of two different measurementpositions. It can be shown that these locations should be separated by at least 15 degrees of latitude(approximately 1600 km) to obtain nearly independent measurements. This means that as far as theinfluence of the dilution of precision is involved in the error budget it makes no sense to perform a lotof measurements simultaneously over Europe.

-50 -40 -30 -20 -10 0 10 20 30 40 500

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

Latitude [deg]

Cor

rela

tion

Coe

ffici

ent

Typical Geometrical Correlation for HDOP

Figure A.4-6: Typical Spatial Correlation for HDOP vs. Latitude Difference



EUROCONTROL

A.4.4 Coverage Area

The availability of the EGNOS service assumes that the signal can be received at all locations in thespecified service area. The validation is required to demonstrate that the EGNOS signal is withinspecification at the extremes of the service area. In addition, it should consider the performanceoutside the specified coverage area and the users’ transition across the coverage boundary.

The performance of EGNOS will vary over the service area. This is due to the footprints of thegeostationary satellites, which will be used to transmit ranging, differential corrections, and integritydata. Over some regions of the service area, both geostationary INMARSAT satellites (for AOC) willbe visible, however, over other regions (especially towards to the Poles) only a single INMARSATsatellite shall be visible. These effects are visible in the EGNOS Service Area diagram, shown inFigure 2-2.

The dashed line starting at approximately 10° W / 20° N represents the limit of coverage of theINMARSAT IOR satellite. Therefore, regions to the West of this line will only be able to receive theINMARSAT AOR-E satellite. Although the same differential and integrity information will betransmitted by both satellites, in the regions where only a single INMARSAT satellite is visible, theuser will only be able to receive one INMARSAT ranging signal. Therefore, under some circum-stances, the lack of the second INMARSAT ranging signal may be critical to some flight phaseapplications. Additionally, signal reception outages, either caused by a satellite failure or by maskingare more critical when only one GEO is received.

Transitional effects may also be present. These include the effects of transitions into and out of theEGNOS Service Area, from single to double INMARSAT coverage, and from double to singleINMARSAT coverage. In the latter case, where either an INMARSAT ranging signal is lost or addedto the service, this can be regarded as loss or gain in the number of pseudoranges available, sincethe other EGNOS function availability will not alter. In the other case where the navigation systemeither loses or gains the availability to navigate using EGNOS this represents a gain or loss of theintegrity and correctional data provided by EGNOS.

Additionally, at higher latitudes there exists a greater possibility that masking of the geostationarysignals will occur. This will also require investigation when considering the operational scenarios forEOT&V.

A.4.5 Multipath

Multipath is the effect where a signal arrives at a receiver via two or more different paths. Thereceived signals will each have a different path length, and these differences in the path lengthscause the signals to interfere which each other. This interference causes an error to the calculatedsatellite ranges, and hence to the accuracy of the position solution.

The interference that is caused by the delay D is directly dependent on the reflection angle α (seealso Figure A.4-7).

αh

Figure A.4-7: Basic Reflection Model

It can be shown that the delay D between the direct and the reflected signal is:

αsin2 ⋅⋅= hD



EUROCONTROL

Figure A.4-8 details the observed error budget for GPS and shows an estimation of multipath to thetotal error.In general one can distinct between multipath propagation generated by reflections at the groundsurface and multipath caused by reflections at the airframe itself. For a given receiver architectureboth kinds of multipath effects only depend on two parameters:

1. the delay between the direct and the reflected signal;2. the multipath to signal ratio (MCR).

If the range error generated by a particular receiver is plotted against the delay for a given MCR itcan be shown that the error significantly depends on the receiver architecture:

-80

-60

-40

-20

0

20

40

60

80

0 100 200 300 400 500 600Delay [m]

Ran

ge E

rror

[m]

-80

-60

-40

-20

0

20

40

60

80

0 100 200 300 400 500 600Delay [m]

Ran

ge E

rror

[m]

Figure A.4-8: Range Error vs. Delay for a Given MCR (-3dB) for Both a Standard (left) andNarrow Correlator Receiver

In case of a standard correlator receiver the maximum range error due to multipath (Mmax) for anMCR of -3dB is in the order of 80m whereas the narrow correlator receiver shows an Mmax of 20munder the same conditions.

Figure A.4-9 shows the maximum multipath error for different multipath to signal ratios for both astandard and a narrow correlator receiver. It should be stated that in case of an MCR of 0dB whichmeans that the reflected signal has the same strength as the direct one the resulting error is notlimited.

0.1

1

10

100

-40-35-30-25-20-15-10-50M/C [dB]

Mm

ax [m

]

Low-Cost Receiver

High-End Receiver

Figure A.4-9: Maximum Multipath Error depending on the MCR



EUROCONTROL


The necessary correlation time for multipath validation is difficult to estimate and is currently notknown. However, because of the aircraft movement, the correlation time is very much related to thespatial correlation. This has been estimated by means of a simulation tool, which exclusively takesinto consideration the possible multipath propagation at the aircraft itself. With respect to the notnormally distributed error characteristics of multipath errors it is suggested to perform additionalmeasurements with high sampling rates to get an estimation for the type of error distribution ofmultipath.

Since multipath significantly depends on the local environment of the aircraft it changes by thevariation of the aircraft’s position and attitude as well as by the variation of the space segmentsgeometry. Both aspects were covered by a simulation:

Within this simulation a standard approach of a commercial aircraft is reproduced from leaving theair-route up to the touch down. This flight segment is divided into 3640 waypoints. The distancebetween them is 10 meters. For each of these points a multipath investigation is done over 12 hoursin steps of 5 minutes. For the reflection-investigation a satellite is chosen, which rises and goesdown during this time period. So a local and temporal statement concerning multipath can be given.Also in the case of multipath it must be guaranteed, that simultaneously performed measurementsare independent from each other.

At first it should be checked which time interval is necessary to perform independent measurements.For this case, a reflection-function for one point and a whole satellite orbit is defined as follows:

( )

= reflection of casein 1

reflection no of casein 0, tXf

r

with X as investigated position

On this function, an auto-correlation function is applied. This investigation is done for all 3640 points.The results are shown in figure A.4-10 and A.4-11 as a three dimensional plot. Both figures show thesame plot from different points of view. The axes are chosen as follows: The x-axis displays the timeover which the auto-correlation function is computed. The y-axis displays the counter of thewaypoints. On the z-axis finally, the result of the auto-correlation is shown. The view of the secondplot is chosen to identify the maximum width of the main peak. In this case it is less than one hour.So it can be said that measurements taken in intervals greater than one hour are statisticallyindependent.

Figure A.4-10: Correlation Results for Timely Variation



EUROCONTROL

Figure A.4-11: Correlation Results for Timely Variation in x-z-Plane

In the next case, the local variation is in the focus of interest. The approach is the same as before: areflection-function is defined. But now the time is fix and the position is varied. The calculation ofauto-correlation is the same as above. The results are shown in figure A.4-12 and A.4-13:

Figure A.4-12: Correlation Results for Local Variation

Figure A.4-13: Correlation Results for Local Variation in x-z-Plane

Now the x-axis represents the distance in metres, the y-axis the counter of time-slices and the z-axisthe correlation coefficient again. It can be seen that for a local separation of 20 km independentmeasurements can be expected.

A.4.6 Atmospheric Effects

The ionosphere is perhaps the most important issue for the final performance of EGNOS andrequires careful consideration. The main effects are scintillation, i.e. amplitude and phase fluctua-tions, and rapid spatial and temporal gradients. Important items to investigate are the influence of theimminent peak in ionospheric activity expected around the year 2000, which will occur during theimplementation phase of EGNOS.



EUROCONTROL

Since an EGNOS navigation solution shall determine the user position by calculating the ranges toeach of the visible satellites, the propagation speed of the navigation signals is critical. The ranges toeach of the satellites are calculated by multiplying the measured propagation time of the navigationsignals (from transmission to reception at the receiver) with this propagation speed. Obviously, theuser receiver needs to determine what the propagation speed is in order to accurately calculate thesatellite ranges, and hence a navigation solution.

In vacuum, the navigation signals (and indeed all frequencies) will propagate at the speed of light.However, in the operational environment, with a user receiver near the Earth’s surface, thesenavigation signals must pass through the Earth’s atmosphere. It is due to the propagation of theEGNOS navigation signals through the atmosphere that causes fluctuations in the propagationspeed, and therefore errors in the calculated position.

The atmosphere can be considered to be made up of two regions. The lower region is called thetroposphere and varies from a maximum height of 9km (over the poles) to 16km (over the equator).The upper region is called the ionosphere, and begins at a height of approximately 50km above thesurface of the Earth, and continues up to 1,000km or more. It has been suggested that the upperlimit of the ionosphere is around 2,000km, however, this depends upon what particular plasmadensity is used in the definition of the ionosphere. Further regions of the atmosphere are defined, butdo not need to be considered here.

Ionospheric Effects vary both temporally and spatially. The most dominant variability is diurnal,however, there are also solar and seasonal cycles, together with short-term variations, which have,been observed to have periods of 20 minutes to more than 100 minutes. Additionally, the attributethat causes the errors in the ranging signal (the Total Electron Content, TEC) is approximately anorder of magnitude less during night-time than during daylight. The effect of solar or geomagneticstorms can effect the mean propagation delay by up to 100%, which would double the pseudorangeerrors expected.

The ionospheric delay is also a function of the elevation angle of the satellites. As the elevation angleof the satellites reduces the signal must pass through more of the Earth’s atmosphere, and so theionospheric delay is degraded further.

Therefore, it is potentially difficult to mitigate against these effects. However, GPS does attempt todo this and transmits in the navigation message the parameters for an empirical model, whichpredicts the bias due to ionospheric effects. This can reduce up to 50% (rms.) of the ionosphere’seffect, which for a civilian receiver equates to 24 metres maximum line-of-sight error.

The maximum vertical component of the ionosphere’s effects, in terms of TEC Units (TECU) isapproximately 100 TECU, which corresponds to a propagation delay of about 16 meters on the GPSL1 frequency. However, as the elevation angle of the satellites reduces, this figure can be factoredby as much as 3 times, giving an error of 48 meters. A maximum error of 100 meters had beenreported to be worst-case for GPS L1 pseudoranges.

Where a multiple-frequency receiver is employed, it is possible to resolve the ionospheric errorcontribution. With the proposed implementation of further GPS frequencies available to civilianusers, it may be possible for future receivers to remove these errors.

These errors can also be reduced by using differential techniques, which the EGNOS service willprovide. Additionally, some of the errors introduced by the employment of Selective Availability (SA)on the GPS signals will also be reduced by the differential corrections provided by EGNOS. Of theatmospheric effects however, the major contributor to the total error remains the ionospheric inducederrors.


For ionospheric effects, a correlation time of 15 minutes can be assumed. This value can betransferred to a correlation length in the direction of earth rotation, because the major part of the



EUROCONTROL

variation of the TEC value is represented by the oscillation due to earth rotation. Thus the correlationlength in direction of the longitude at any place at 50° latitude can be determined by:

km

hh

kml 270

min60

min15

24

50cos63712 ≈×°⋅⋅= π

This value can be taken for the spatial correlation for ionospheric effects.

A.5 Impact of Operational Issues

This section addresses the impact of the operational influences identified upon the ability of EGNOSto meet the RNP requirements, and the flight operations. The impact of these parameters uponthese requirements has been considered such that appropriate test scenarios may be developed.The method used was to identify which parameters impact upon the ability to perform the variousflight operations, and then to determine which of the RNP parameters would therefore be prone tonot being met.

This bottom-up approach is described in Figure A.5-1. Essentially, the flight operations element actsas a filter. Initially, all of the operational parameters are under consideration, however, only a sub-setis relevant to each flight operation. There now exists a number of parameters for each flightoperation. Since flight operation exist in specific airspaces, the RNP values which are effected by theoperational influences can be determined. For example, if the masking parameter were considered tobe relevant in the cruise flight operation, then the RNP parameters in which the cruise flightoperation was conducted would be determined to be effected by masking.

A.5.1 Impact on Flight Operations

This section investigates the effects of the operational influences upon the flight operationsidentified. Only those influences have been considered for which the effect depends on the flightoperation. For example, atmospheric effects and satellite geometry are not considered since theseinfluences are equal for all flight operations.

Departure and Initial Climb

During the departure and initial climb phase, the EGNOS navigation performance will be affected by:

Operational Parameters

RNP

Accuracy Integrity

Availability Continuity

Flight Operations

Figure A.5-1: Impact of Critical Parameters



EUROCONTROL

• Multipath:Due to the potentially high multipath environment in the locality of the departure airport becauseof the large number of reflective surfaces caused by the airport infrastructure (hangars, terminalbuildings, etc…), the navigation performance may be compromised. Additionally, the multipatheffects caused by the aircraft structure may also reduce the navigation performance.Quasi-static multipath may also exist in the airport environment, which may further reduce thenavigation performance of the system.

• Masking:Due to the potentially high masking environment in the locality of the departure airport because ofsurfaces caused by the airport infrastructure (hangars, terminal buildings, etc…), the navigationperformance may be compromised. Additionally, the masking effects caused by the aircraftstructure may also reduce the navigation performance.As previously identified in this document, masking can occur due to potentially either the terrainor by an aircraft surface (tail fin, wing etc.).

• Interference:Due to the potentially interference rich environment in the locality of the departure airport, thenavigation performance may be compromised.

• Flight Dynamics:During the departure and initial climb phase of flight there exists a possibility that the aircraft willundergo relatively high dynamic loading.

Cruise Climb

During the cruise climb phase, the EGNOS navigation performance will be affected by:

• Multipath:As with all phases of flight, the multipath effects caused by the aircraft structure may reduce thenavigation performance. However, due to the less stringent accuracy requirements during thecruise climb phase, the multipath effect is expected to be small.

• Masking:As with all phases of flight, the masking effects caused by the aircraft structure may reduce thenavigation performance. Masking effects may become an important issue during very high climbrates when the potential of masking through the aircraft body increases.

Cruise

During the cruise phase, the EGNOS navigation performance will be affected by:

• Multipath:As with all phases of flight, the multipath effects caused by the aircraft structure may reduce thenavigation performance. However, due to the less stringent accuracy requirements during thecruise phase, the multipath effect is expected to be small.

• Masking:As with all phases of flight, the masking effects caused by the aircraft structure may reduce thenavigation performance.

Descent

During the descent phase, the EGNOS navigation performance will be affected by:• Multipath:

As with all phases of flight, the multipath effects caused by the aircraft structure may reduce thenavigation performance.



EUROCONTROL

• Masking:As with all phases of flight, the masking effects caused by the aircraft structure may reduce thenavigation performance.

Stack Hold

During the stack hold phase, the EGNOS navigation performance will be affected by:

• Multipath:As with all phases of flight, the multipath effects caused by the aircraft structure may reduce thenavigation performance

• Masking:As with all phases of flight, the masking effects caused by the aircraft structure may reduce thenavigation performance. Masking effects in this flight phase may experience perturbations due tothe nature of flight making continuous turns.

• Flight Dynamics:During the stack hold phase of flight there exists a possibility that the aircraft will undergo rela-tively high dynamic loading.

Approach

During the Approach phase, the EGNOS navigation performance will be affected by:

• Multipath:Due to the potentially high multipath environment in the locality of the arrival airport because ofthe large number of reflective surfaces caused by the airport infrastructure (hangars, terminalbuildings, etc.), the navigation performance may be compromised. Additionally, the multipatheffects caused by the aircraft structure may also reduce the navigation performance.Quasi-static multipath may also exist in the airport environment, which may further reduce thenavigation performance of the system.

• Masking:Due to the potentially high masking environment in the locality of the arrival airport because ofsurfaces caused by the airport infrastructure (hangars, terminal buildings, etc…), the navigationperformance may be compromised. Additionally, the masking effects caused by the aircraftstructure may also reduce the navigation performance.As previously identified in this document, masking can occur due to potentially either the terrainor by an aircraft surface (tail fin, wing etc..).

• Interference:Due to the potentially interference rich environment in the locality of the departure airport, thenavigation performance may be compromised.

• Flight Dynamics:During the approach phase of flight there exists the highest probability of all the flight phases thatthe aircraft will undergo relatively high dynamic loading.

A.5.1.1 Criticality Assignment

The impact upon the navigation performance due to the operational influences described aboveduring each of the flight phases will differ, and assumptions have been made as to how critical theeffect upon the navigation performance these parameters are.

Three levels have been assigned to gauge the level of the effect of the operational influences uponthe navigation performance in any given flight phase. These levels are: HIGH, MEDIUM, and LOW.No quantitative values have been assigned to these criticality levels, and exist only to hi-light theperceived impact of the operational influence upon the navigation performance. The levels assigned



EUROCONTROL

should be taken as being relative to a particular operational influence only, and should not becompared to other operational influence criticality level assignments. For example, the sameassignment in the multipath and masking influences cannot be compared against each other.

Of the operational influences identified, three have not been classified a criticality level by flightphase. These are EGNOS dependency upon GPS and GLONASS, EGNOS coverage areaperformance, and aircraft types.

The ‘EGNOS Dependency upon GPS and GLONASS’ parameter serves more as a statement of fact,rather than a measurable parameter.

The ‘EGNOS Coverage Area Performance’ parameter does not change with flight operation. Thisparameter is dependent upon the location at which the aircraft is flying. For example, the higher thelatitude at which the aircraft is flying, the higher the risk that geostationary satellites will be maskedfrom view. For this case, the effects of this critical parameter can be divided into the followingcategories:

• 2+ GEOs in View• 1 GEO in View• No GEOs in View

Although the loss of a single EGNOS GEO would not impact that greatly upon the navigationperformance (since only one ranging signal will have been lost), it would still yield a lower navigationperformance than that of the 2 or more EGNOS GEOs in view. If no EGNOS GEOs are visible,obviously EGNOS navigation would be degraded to GPS/GLONASS only.

The ‘Aircraft Types’ parameter is also not dependent upon the flight operation, but upon the hostaircraft configuration. Additionally, this critical parameter is a contributor to the multipath andmasking parameters, which the aircraft type will affect. As previously stated, there are numerousconfigurations of engine number and location, wing placement, tailplane location etc.. The followingcategories were identified:

• Engine Type (Propeller/Jet)• Tailplane Installation (Low/High)• Aircraft Size (Small/Large)• Antenna Location (Forward/Central/Aft)

The other parameters identified were considered as not being important, such that any contributionto the degradation of the navigation performance was deemed negligible. The EGNOS antennalocation will be taken as being placed on top of the fuselage at a reasonable location, in order toreceive the GPS, GLONASS, and EGNOS signals.

The type and number of engines is considered to not degrade the navigation performance. Theeffects of multipath and masking between a two and four engine aircraft, for example, is notexpected to be sufficiently different to warrant consideration. The multipath from the tailplane was notconsidered to be overly detrimental to the performance of the user receiver, although a high tailplaneconfiguration may have a greater effect.

When considering masking effects, masking due to the tailplane was considered to provide thehighest masking potential. A high tailplane could potentially totally block a signal for a long duration(dependant upon the direction and location of the flight). If this is an EGNOS signal, and the aircraftis in a region where only a maximum of one EGNOS GEO is visible, EGNOS navigation could becompletely lost. The masking due to the size of the aircraft was also considered. As in the multipathcase, as the size of the aircraft increases, so too will the potential for masking. The larger theaircraft, the larger the aircraft surfaces will be, which therefore increase the masking potential.

As previously stated, the atmospheric effects and constellation geometry critical parameters are notdependent upon the flight operation under consideration. Therefore, these two parameters willremain constant across all the flight operations identified.



EUROCONTROL

The remaining operational influences mainly depend on the flight operations, and are listed togetherin Table A.5-1.

Departure,InitialClimb

CruiseClimb

Cruise Descent StackHold

Approach

Multipath HIGH LOW LOW LOW MEDIUM HIGH

Masking HIGH MEDIUM LOW LOW MEDIUM HIGH

Interference HIGH MEDIUM LOW MEDIUM MEDIUM HIGH

Atmospheric MEDIUM MEDIUM MEDIUM MEDIUM MEDIUM MEDIUM

Geometry MEDIUM MEDIUM MEDIUM MEDIUM MEDIUM MEDIUM

Dynamics MEDIUM LOW LOW LOW MEDIUM HIGH

Table A.5-1: Effects of Operational Influences

When assessing the multipath and masking critical parameters, the effects of aircraft type (asdiscussed above) were not taken into account. The criticality levels assigned to the multipath andmasking parameters have been considered as if the aircraft did not impose additional effects, whichmay impair the navigation performance of the EGNOS receiver.

The multipath was considered to be at it’s greatest at operations near airports (i.e. departure andarrival), with other flight operations remaining low. The exception to this is the holding flightoperation, where the multipath may fluctuate more due to the dynamic flight manoeuvres made (overthose of the climb, cruise, and descent operations). The same arguments were applied to theassignment of the criticality levels of the masking critical parameter.

Once again, as with the multipath and masking critical parameters, the interference was foreseen tobe greatest in the locality of the airport. At altitude, during the cruise flight phase, interference levelswere considered to be at a minimum, with the remaining operations taking an intermediate criticalitylevel due to their greater proximity to sources of interference from the ground.Finally, the aircraft dynamics were taken in account. Generally, the aircraft dynamics should be quitelimited since the comfort of the passengers is important to airline operators. The most stable flightoperations where only small aircraft perturbations will be expected will be during the climb, cruise anddescent flight operations, and so dynamic effects upon the user receiver will be negligible. During thedeparture and the holding flight operations, the dynamic motion of the aircraft will be more severewith steeper climb/turn rates, but whilst still remaining a smooth flight. The flight operation with thehighest probability for high dynamic loading is considered to be the approach phase. In this flightphase, the aircraft will be attempting to land on the runway, and as such, the crew may have to makemore dramatic attitude/heading changes. For this reason, the approach phase operation has beenassigned the highest criticality level for the dynamics critical parameter.

A.5.2 Impact on RNP Parameters

This section investigates the effects of the critical parameters upon the RNP parameters byaccuracy, availability, continuity and integrity.

A.5.2.1 Accuracy

The accuracy of EGNOS has been identified to be affected by the following:

Multipath

The accuracy of the navigation solution will be affected by the presence of multipath. Multipath willgive the appearance that the same signal has reached the antenna more than once, and at differenttimes. Therefore, the manner by which these signals are combined or selected, will affect the



EUROCONTROL

performance of the receiver. As an example, consider a signal, which has undergone severalreflections before being detected at the antenna. If the multipath signal is used by the receiver, thepropagation delay shall be longer than ‘true’ signal, and thus induce a ranging error.

Flight Dynamics

The accuracy of the navigation solution might be affected by flight dynamic effects. If the aircraft isput under high dynamic loading, the receiver will also experience the effects of this. Under highdynamic loading, some receivers may not be able to function correctly. This may lead to increasedpseudorange errors. Additionally, the receiver may loose ‘lock’ with the satellite(s) being tracked. Ifthis happens, the receiver will no longer have the ability to navigate using all the satellites available,and the accuracy achieved is degraded.

Interference

The accuracy of the navigation solution will be affected by the presence of interference. Interferencewill degrade the quality of the signals received, corrupt the data being transmitted, or swamp thedesired signal such that it cannot be detected at the antenna. Any of these effects may cause theloss of a satellite(s) from the navigation solution, and therefore degrade the accuracy obtained.

Interference may also degrade the overall receiver performance, which may cause higher error of thereceiver’s pseudorange measurements.

Geometry

The accuracy of the navigation solution will be affected by the geometry of the satellites relative tothe user receiver. The geometry of the satellites has an influence upon the navigation performanceachieved. If the geometry is poor, a degraded accuracy will be achieved.

Atmospheric Effects

The accuracy of the navigation solution will be affected by atmospheric effects. As discussed in anearlier chapter, the signals are delayed as they pass through the Earth’s atmosphere. This delay inthe propagation of the EGNOS signals will result in errors in the pseudoranges calculated. If thepseudoranges used in the navigation solution have errors, then the accuracy of the derived positionwill be degraded.

Further influences are evaluated in the integrity section since inconsistencies in the correction andintegrity data have a direct impact on the system integrity and can only be obtained by decodingerrors of the receiver since the signal in space is assumed to be fault free.

A.5.2.2 Availability and Continuity

The availability and continuity of EGNOS has been identified to be affected by the following:

Multipath

The availability and continuity of the navigation solution will be affected by the presence of multipath.If the presence of multipath causes the use of a potential satellite, which could be used for navigationto be removed from the navigation solution, the availability of the system will fall as a result or acontinuity failure may occur.

Flight Dynamics

The availability and continuity of the navigation solution will be affected by flight dynamic effects. Ifthe aircraft is put under high dynamic loading, the receiver will also experience the effects of this.Under high dynamic loading, some receivers may not be able to function correctly. The most likelycause of this is to loose ‘lock’ with the satellite(s) being tracked which will reduce the availability ofthe navigation service or my lead to continuity failures.



EUROCONTROL

Interference

The availability and continuity of the navigation solution will be affected by the presence of interfer-ence. Interference may cause the loss of a satellite(s) from the navigation solution, and if this occurs,the availability of the system will fall as a result or a continuity failure may occur.

Masking

The availability and continuity of the navigation solution will be affected by satellite masking. Maskingof the satellite signals will remove a potential satellite, which could be used in the navigation solution.As a result, the availability of the system will fall or continuity failures may occur.

Atmospheric Effects

Although a secondary effect, the availability and continuity of the navigation solution will beinfluenced by atmospheric effects. As discussed in an earlier chapter, the signals are delayed as theypass through the Earth’s atmosphere. This delay in the propagation of the EGNOS signals will resultin errors in the pseudoranges calculated. If the pseudoranges used in the navigation solution haveerrors, then the accuracy of the derived position will be degraded. Should the accuracy achieved beinsufficient for a given operation such that the EGNOS derived position cannot be used, then theavailability of the system will fall or a continuity failure will occur.

A.5.2.3 Integrity

The integrity of EGNOS has been identified to be affected by the following:

Multipath

The integrity of the navigation solution will be affected by the presence of multipath. If the presenceof multipath causes a potential satellite, which could be used for RAIM to be removed from thenavigation solution, the integrity of the system will fall as a result.

An integrity error could also occur as a result of degraded accuracy due to multipath, which is difficultto detect by the receiver.

Flight Dynamics

The integrity of the navigation solution will be affected by flight dynamic effects. If the aircraft is putunder high dynamic loading, some receivers may not be able to function correctly. The most likelycause of this is to loose ‘lock’ with the satellite(s) being tracked. If this happens, the receiver will nolonger have the ability to navigate using all the satellites available and the RAIM performance isdegraded. Additionally, also the accuracy may be degraded due to satellite(s) removed from thenavigation solution caused by dynamics. Should the accuracy achieved be insufficient for a givenoperation, then an integrity failure may occur, which is difficult for a receiver to detect.Another possible effect of high receiver dynamics is a potential increase in the pseudorange errors,which also are difficult to detect by the receiver. An increase in the pseudorange errors will obviouslydegrade the accuracy performance, and therefore the potential for degraded integrity occurs shouldthe receiver not detect this.

Interference

The integrity of the navigation solution will be affected by the presence of interference. Interferencemay cause the loss of a satellite(s) from the navigation solution, and if this occurs, the integrity of thesystem will fall as a result.

Interference can additionally reduce the accuracy performance of the system, and therefore, if this isnot detected provides the potential for an integrity error.

Atmospheric Effects

The integrity of the navigation solution will be affected by atmospheric effects. As discussed in anearlier chapter, the signals are delayed as they pass through the Earth’s atmosphere. This delay inthe propagation of the EGNOS signals will result in errors in the pseudoranges calculated. If the



EUROCONTROL

pseudoranges used in the navigation solution have errors, then the accuracy of the derived positionwill be degraded. If this effect is not detected, there is the potential for an integrity error.

A.6 RNP Parameter Validation

A.6.1 Statistical Theory

In order to present the test theory more understandable and to determine the effort that could benecessary for testing requirements with high RNP parameters, the following example has beencreated:Principally, there are a lot of different normal probability distributions each characterised by its ownmean and standard deviation. However, the random variables of these distributions can betransformed to the so-called Z-score. The Z-score is the random variable of a standard normaldistribution. With this, the respective probabilities can be calculated by using the Z-score inconjunction with the probability tables for the standard normal distribution. Assuming that theobserved element is following a Gaussian (normal) distribution and defining that the event shall betested with a confidence level of 95% (which is rather low), the number of independent test samplescan be calculated on the basis of the following formula for the Z-score, conforming to the normal law:

( )( )

−

−=

n

pp

ppz

ff

f

1

with p: standard achievement of performancepf: frequency of the observed eventn: number of observed samples

Within the context of this study an event can be for example:

• the RNP value is reached or not;• the alarm limit is exceeded or not;etc.

The observed distribution is compared with the ideal standard of p=100% (=1.0) for achievement ofthe performance, i.e. the situation that actually occurred during the measurements is compared withthe ideal case where the performance is always achieved. With this, the above presented formulacan be simplified as follows:

( )f

f

p

pnz

−=

1

Resolving this formula to obtain the number of necessary test samples:

f

f

p

pzn

−=

12

The z-score, conforming to a normal law, is known or can be calculated from mathematical tables.The corresponding z-score for a confidence level of 95% is:

96.1=z

In our example (integrity risk for Cat I approaches), this results in:



EUROCONTROL

( ) 99999965.0105.31 7 =⋅−= −fp

Calculating the number of necessary samples:

( )72 1010.1

99999965.01

99999965.096.1 ⋅≈

−=n

This means that approximately 1.1 x 107 independent operations would have to be performed forvalidating whether the RNP integrity requirement has been fulfilled or not.

If the correlation time is also taken into consideration it is very likely that a corresponding testprogramme cannot be performed in an acceptable time. Some of the error sources, which areresponsible for the overall error budget, will be of a systematic type. Therefore it might be notappropriate to analyse these errors by means of a stochastical theory. The theory above is based onthe assumption of a Gaussian error distribution. To extend it to not normally distributed errors twodifferent approaches may be feasible:

1. If the error can be measured independently it is a common approach to find the smallestGaussian distribution that completely covers the real error distribution. All following calculationsare performed with the Gaussian envelope.If this option is chosen it is suggested to proceed in two consecutive steps.

1a. In a first approach the data acquisition rate should be as high as possible to find a Gaussianapproximation for the real error distribution.

1b. In a second step the data have to be collected timely independent from each other with a lowerdata acquisition rate.

2. The theory above can be extended to a non Gaussian error distribution. Since the errorcharacteristics are unclear at this phase of the project this topic may be an appropriate meansafter the analysis of some preliminary results of the test and validation programme.

A.6.1.1 Confidence Level

The confidence level defines the probability that the result of a measurement campaign (test) reflectsthe real situation. Taking a confidence level of 95% as an example and assuming that a testcampaign delivers the result that the requirements have been fulfilled, the risk that this statement isfalse may not be higher than 5%. From another point of view, this relationship between theconfidence level and the reliability of the test result means that the higher the required confidencelevel is the higher the necessary number of test samples for the test campaign. This is reflected inthe formula for the test sample calculation as described above in section A.6.1.Generally, there is an interrelationship between the risk associated with a parameter under testconsideration and the recommended compliance technique. The final draft version of the MASPS ofthe LAAS System proposes the following relations:

Risk Probability Recommended Compliance Technique

0.05 to 0.01 validate using flight tests, bench tests, simulations, and analysis

10-2 to 10-5 validate using bench tests, simulations and analysis

10-5 to 10-9 validate using simulations and analysis, or a combination there of

Table A.6-1: Risk Probabilities

This approach is in line with the general rules from JAR 25.1309 where an inverse relationshipbetween the severity of a generic failure mode and its probability of occurrence is described andwhere some acceptable means of showing compliance with the JAR requirements are given. Theseacceptable assessment tools are related to the risk probability, accordingly.



EUROCONTROL

In the case of a practical test, regardless whether it is a bench test or flight test, it has to be decided,how many trials of that test have to be conducted. As one can not conduct an infinite (or evensufficient) number of trials in order to derive a statistically justified result, the number of trials willhave to be limited to an appropriate level. Doing this the following question arises:

How many trials have to be conducted in order to assure that these trials are statisticallyrepresentative for the system under consideration?

To answer such a question a confidence level has to be specified which relates the level ofconfidence between the conducted test with a limited number of trials and the real system. Hence,the key parameter will be the confidence level of the test.

Looking at the literature, one can find quite different suggestions for such confidence levels:

• JAR AWO 231: Flight tests concerning CAT II auto-pilot systems:Flight Path Control. ... Since it is not economically possible to make a large number of approachesto show compliance with AWO 231 it is necessary to impose a confidence level on the results ofthe programme. A confidence level of 90% has been selected to allow a reasonable number ofapproaches. ...

• RTCA DO 229: MOPS WAAS, Appendix M.3: Bench tests concerning CAT I accuracy require-ments:... Given a required confidence of α = 0.99 and 100 data points ...

At first sight, this distinctive difference between these two confidence levels is troubling. But it has tobe considered that the 90% confidence level is applied to a flight test, whereas the 99% confidencelevel concerns a bench test. The difference reflects the compromise between economical aspectsand the desire for a statistically representative test due to the complexity of the conducted test: Abench test will be a burden, but it will not be as constraining as a flight test. Additionally, a flight testwill be only the last verification step on the complex system level after a detailed validation of thesubsystems and can hence be considered to assess the correctness of the foregoing analysis andsimulations.Since the 90% confidence level seems to be too low, it has been assumed that a confidence level of95% is an acceptable compromise between the two above values. Additionally, all calculations havebeen performed with a confidence level of 99.9% due to the fact that this value has been used withinthe GNSS Validation Study, which is currently undertaken on behalf of EUROCONTROL.

A.6.1.2 Correlation Time and Spatial Correlation

The preceding sections presented the way to calculate the necessary number of independent testsamples, which are necessary to validate the fulfilment of the respective performance. However, inorder to estimate the absolute effort, which is necessary for the validation campaigns, additionalparameters and influences have to be considered. The major parameters to be taken into considera-tion for test effort estimation are the correlation time and the spatial correlation.The correlation time is the minimum time between two measurements which is necessary to ensurethat they are independent. The spatial correlation defines the minimal distance between twomeasurement locations that has to be assured in order to guarantee that different measurements arespatially independent. This factor may be important for the test programme, which has to be definedlater. It may be a possible solution to shorten the data collection time which is needed for the testprogramme and which can be derived from the necessary number of independent test samples aswell as from the correlation time by means of different simultaneous measurements. In this case ithas to be guaranteed that all the different simultaneously performed measurements are independentfrom each other. This may be ensured by a large distance between the different measurements.

Both parameters, correlation time and spatial correlation, are different for the individual RNPparameters as well as for the various operational influences. Therefore, these two parameters areinvestigated in the following sections separately for each RNP parameter and operational influence.A summary of the determined values and derived proposed validation activities are provided insection 3.5.



EUROCONTROL

A.6.2 Accuracy Validation

The accuracy parameter of RNP is defined in terms of total system error TSE, which is a measure ofthe true aircraft position relative to a required flight path defined for each phase of flight. The error inthe estimation of the aircraft’s position is referred to as navigation system error NSE, which is thedifference between the (by the navigation system) indicated flight path and the true flight path of theaircraft (see figure A.6-1). The difference between the commanded flight path and the indicated flightpath of the aircraft is referred to as the flight technical error. It includes deviations of the aircraft’sflight paths due to turbulence and the guidance behaviour of the aircraft responding to the com-mands generated by the navigation system. The vector sum of the NSE and the FTE is the totalsystem error TSE:

FTENSETSE +=

From the Gaussian error propagation principle, the following relationship results for the mean errorvalues (assuming a Gaussian error distribution of the position measurements):

222FTENSETSE +=

CommandedFlight Path

Flight Path Indicatedby Navigation System

Actual FlightPath

TSEBoundary

Figure A.6-1: TSE, NSE and FTE

TSE as well as NSE accuracy can be determined by the use of an appropriate position referencesystem (see section 3.4.3.2.2). An important question to be answered with regards to accuracyvalidation is whether to validate TSE or NSE. The ICAO RNP requirements are given as TSE valueswhile the GNSS SARPs ([6], see above) define NSE requirements. Additionally, ICAO also definedFTE values to be expected. Principally, both TSE and NSE may be assessed during flight tests withinEOT&V, although the determination of TSE might be difficult, especially during the en-route flightphase, where it might be hard to assess the commanded flight path of the aircraft.

Principally, the validation of FTE is not an issue specifically related to EGNOS. However, the FTEassumptions made by ICAO need to be validated before operational approval can be given.Therefore, EUROCONTROL should consider the validation of FTE in their overall GNSS activities.From the current point of view, it is recommended for EOT&V to focus on NSE measurements whileTSE might be determined on the basis of the FTE validation.

Furthermore, the following SARPS definitions have to be taken into consideration, concerningaccuracy requirements and validation [6]:



EUROCONTROL

"C.5.2.2: To ensure that the position error is acceptable, an alert limit is defined that representsthe largest position error, which results in a safe operation. The position error shall not exceedthis alert limit without annunciation. This is analogous to ILS, in that the system can degrade sothat the error is larger than the 95th percentile but within the monitor limit.C.5.2.3: The 95% accuracy requirement is defined to ensure pilot acceptance, since it repre-sents the errors that will typically be experienced. The GNSS accuracy requirement will be metfor the worst-case geometry under which the system is declared to be available. Statistical orprobabilistic credit is not taken for the underlying probability of particular ranging signal ge-ometry. For example, if the system is to be used when the HDOP is less than 6, then the accu-racy requirement must be met when the HDOP equals 6.C.5.2.4: Therefore, GNSS accuracy is specified as a probability for each and every sample,rather than as a percentage of samples in a particular measurement interval. For a large set ofindependent samples, at least 95% of the samples should be within the accuracy requirementsin A.2.5-1. The accuracy requirement must be satisfied for the worst-case geometry. Data isscaled to the worst-case geometry in order to eliminate the variability in system accuracy thatis caused by the geometry of the orbiting satellites. This can be accomplished using the basicconcept of Dilution of Precision (DOP), which is one means of describing the expected accu-racy.C.5.2.5: An example of how this concept can be applied is the use of GPS to support non-precision approach performance. Assume that the system is intended to support non-precisionapproaches when the HDOP is less than or equal to 6. To demonstrate this performance,samples should be taken over a long period of time (e.g., 24 hours). The measured positionerror for each sample, i, is denoted εi. This error is scaled to the worst case geometry as6 x εi / HDOP. Ninety-five percent of the scaled errors must be less than 220 meters for thesystem to comply with the non-precision accuracy requirement under worst-case geometryconditions. The total number of samples collected must be sufficient for the result to be statisti-cally representative, taking into account the decorrelation time of the errors."

Theory

ICAO RNP parameters for accuracy are defined as the maximum offset from the desired track. Thegeneral confidence level is defined as 95% TSE (with a corresponding z-score of 1.96). Assumingadditionally that the necessary probability for not exceeding the allowed deviation is 95%, the numberof necessary test samples can be calculated as follows:

7395.01

95.096.1 2 ≈

−=n , with z = 1.96 as the induced value for a 95% confidence level.

With this, the necessary number of independent test samples to validate the ICAO RNP performancerequirements is 73. Obviously, it is theoretically possible to validate these requirements by perform-ing flight measurements, assuming an environment, which is free from errors like multipath effects,interference etc.

Assuming a confidence level of 99.9% TSE, the result is as follows:

20695.01

95.029.3 2 ≈

−=n , with z = 3.29 as the induced value for a 99,9% confidence level.

As expected, the number of necessary test samples is much higher in comparison to the 95%confidence-level scenario. Nevertheless, 206 necessary test samples is an acceptable value whichallows validation by testing, too.

The correlation time for accuracy measurements depends on several parameters. Of major interestare those parameters, which have the longest associated correlation time:

• Selective Availability with a correlation time of approximately 2 minutes• Satellite Geometry (DOP, Dilution of Precision)• Atmospheric Effects, see section 3.2.7



EUROCONTROL

The spatial correlation only depends on operational influences such as geometry and atmosphericeffects, which is investigated in the associated sections of this document (see section 3.2 andAppendix A.4).

Validation Issues

The principle approach for validating accuracy performance requirements is to perform measurementcampaigns with suitable receivers and comparing the assessed position measurements with aposition reference.

In addition to the number of necessary test samples, the main critical aspect is to guarantee thecoverage area of the RNP values. This can not be validated with test measurements alone,independently whether such measurements are theoretically sufficient to verify the RNP or not.

If the accuracy performance of the system would be the same all over the ECAC area, eachmeasurement could be rated as an independent test sample, independently from its location.However, due to the fact that this assumption is not realistic and accuracy is not the same atdifferent locations, accuracy performance theoretically has to be validated separately for eachlocation of interest.

A.6.3 Integrity Validation

Integrity is a measure of the trust, which can be placed in the correctness of the information suppliedby the total system. Integrity includes the ability of a system to provide timely and valid warnings tothe user (alerts) when the system must not be used for the intended operation (or phase of flight).Therefore it has to be determined whether or not the system will inform the user in case of a failurethat was induced by the operational environment.

The integrity of the EGNOS ranging signal can be determined by evaluation of the signal to noisevalue, by measuring the TSE as described in the accuracy section, and the pseudoranges to thesatellites in order to determine the pseudorange residuals. With this information the functionality ofthe integrity monitoring algorithms can be checked.

The integrity performance of the correction and integrity data can be determined by examining the bitand word error rate of the transmitted data in respect of the operational environment. Therefore,analytical investigations will have to be undertaken which allow the evaluation of realistic parametersthat can be used during intensive simulations, which will be necessary. These simulations have toinclude models of the influencing parameters that are mentioned in the next paragraph. Realisticparameters for the simulations can be obtained by analysing the results of flight trials. Within theseflight trials several different data like signal to noise ratio, dynamic conditions and attitude informationshould be recorded. Nevertheless, a close co-operation with the receiver manufacturers is essentialfor this task.

Theory

The validation of integrity is much more critical than accuracy validation due to the fact that very lowprobabilities for failure appearance are required. Concerning ICAO RNP, the given integrity risk is10-5 per hour for NPA to RNP4 and 3.5 x 10-7 per operation for Cat I.

For the purpose of test sample calculation it is necessary to recalculate the probability which is givenper hour or per operation to a more reasonable time base. Within this context, it has been assumedthat the correlation time for integrity measurements is 1 second, i.e. a minimum test sampling rate of1 second has to be maintained to guarantee independent measurements. The necessary number oftest samples for NPA to RNP 4 requirements validation has been calculated as follows:

95

1078,23600

10 −−

⋅≈s

/second



EUROCONTROL

Therefore, the risk that an integrity failure occurs must not exceed 2.78 x 10-9 per second. Since1 second is our basis time period, the integrity risk is used without its dimension in the followingcalculation:

99

92 1038.1

)1078.21(1

)1078.21(96.1 ⋅≈

⋅−−⋅−= −

−

n , with z = 1.96 as the induced value for a 95%

confidence level.

Concerning Cat I integrity performance, the calculation of the number of test samples is similar to thecalculation presented above. The maximum allowed integrity risk for Cat I approaches is 3.5 x 10-7

per operation. Assuming that "operation" is in this case equivalent with "approach" and that thecorresponding time for one approach is 150 seconds, the given integrity risk has to be fulfilled per150 seconds. Thus, the necessary number of test samples can be calculated in the usual way.

First, the given integrity risk has to be standardised to the time basis of one second:

97

1033.2150

105.3 −−

⋅≈×s

/second

The risk that an integrity failure occurs must not exceed 2,3 x 10-9 per second. Since 1 second is ourbasis time period, the integrity risk is used without its dimension in the following calculation:

99

92 1065.1

)1033.21(1

)1033.21(96.1 ⋅≈

⋅−−⋅−= −

−

n , with z = 1.96 as the induced value for a 95%

confidence level.

Summarising both calculations, it can be stated that, based on a 95% confidence level,

• approximately 1.38 x 109 independent test samples are necessary to validate NPA to RNP4integrity requirements;

• approximately 1.65 x 109 independent test samples are necessary to validate Cat I requirements.

Assuming a 99.9% confidence level, the necessary numbers of test samples would increaserespectively. Considering the induced z-score of 3.29 for a 99.9% confidence level,

• approximately 3.89 x 109 independent test samples are necessary to validate NPA to RNP4integrity requirements;

• approximately 4.65 x 109 independent test samples are necessary to validate Cat I requirements.

The correlation time for integrity validation is mainly associated with the system’s capability to updateintegrity information in case of a failure occurrence. EGNOS is able to provide integrity messagesevery second if necessary. Additionally, the length of each message is one second at the most. Thisresults in a minimum correlation time of 1 second in order to avoid the measurement the depend-ency of two test samples.

The spatial correlation depends on the source of the integrity alarm. Most integrity alarms will besubject to the whole EGNOS coverage area, e.g. in case of a GPS or GLONASS satellite failure.Therefore, it has to be assumed that two integrity measurements taken at the same time are alwayscorrelated with each other, independent from the distance between the two measurement locations.

Validation Issues

It is obvious that validation of integrity performance is the most critical issue of EGNOS performancevalidation. Due to high probabilities, it is not possible to validate integrity requirements by test ordemonstration. Modelling and analysis, if possible supported by test or demonstrations of criticalitems where possible, are the main validation tools, primary based on risk allocation trees with givenor estimated parameters.



EUROCONTROL

Integrity risk at end user level can not be validated by performing test trials, regarding the abovedetermined numbers of necessary test samples. Assuming a correlation time of 1 second for integritytesting, the NPA to RNP4 requirements for a 95% confidence level would result in a test duration ofapproximately 45 years. Therefore, validation by analysis will be necessary, wherever possiblesupported by tests and demonstrations.

Validation of the integrity risk at end user level is mainly influenced by the integrity risk of the EGNOSSIS (Signal in Space) and of the RAIM functionality of the user receiver. The integrity risk allocated tothe SIS of the EGNOS service will be determined by ESA and therefore be validated during theEGNOS system validation. Thus, within the context of this study, SIS integrity risk can be regardedas a given and validated parameter.

The major components, which have influence on the overall integrity risk at end user level, areillustrated in the following figure A.6-2.

GPS/GLONASS

User Receiver

RAIM

GPS/GLONASSRanging Signal

EGNOS

- Ranging Signal- GIC

- WADEGNOS

Ground Segment

EGNOS

Space Segment

Figure A.6-2: EGNOS Signal Distribution Architecture

The figure indicates the influences on the overall integrity risk. Integrity risk for EGNOS SIS has beendefined. The major aspect for integrity risk validation at end user level is to assess the behaviour ofthe user receiver’s RAIM algorithm. It has to be noted that the following discussions are based on theassumption that there is an error free environment, i.e. influences of operational activities, multipathetc. are excluded. They will be discussed in more detail later in this section.

Concerning integrity risk at user level, it has to be noted that several possible cases may occur(again, operational effects are not considered):

1. Both integrity functions are available2. EGNOS-GIC is available, RAIM is not available (due to insufficient satellite visibility, insufficient

satellite geometry for the particular application or receiver malfunction)3. EGNOS-GIC is not available, but RAIM is4. No integrity function is available



EUROCONTROL

Since these parameters will be determined by ESA and/or the receiver manufacturer(s), the majortask within EOT&V of integrity performance will be to assess whether these provided values are validunder operational conditions as well.

Based on the system design shown above, both the EGNOS GIC and the RAIM algorithm areparallel systems since the integrity functions operate independently from each other. With this, theoverall end user integrity risk is the probability that EGNOS and RAIM do not detect a failure at thesame time. Since both integrity services are working in parallel regarding “global“ integrity threats,the overall integrity risk can be calculated by multiplying both probabilities in the following way:

IntRAIM

IntEGNOS

Inttotal ppp ⋅=

This formula is only valid for “global“ integrity threats, i.e., those failures are concerned that theo-retically can be detected by both the EGNOS GIC and RAIM. Furthermore, it is assumed that bothintegrity mechanisms work independently from each other.

The second possible type of integrity threats is based on local effects like multipath, interference etc.The “local“ integrity failures can only be detected by RAIM. The associated risk of an undetectedlocal integrity failure equals therefore the RAIM integrity risk, i.e.:

IntRAIM

Intlocal pp =

The overall integrity risk allocation for the whole system is illustrated in the following figure:

GlobalIntegrity Threat

EGNOS GIC(PEGNOS)

LocalIntegrity Threat

Raim(PRaim)

Raim(PRaim)

Overall Integrity Risk(PTotal)

IntRAIM

IntEGNOS

Intglobal ppp ⋅= Int

RAIMIntlocal pp =

),max( Intlocal

Intglobal

Inttotal ppp =

Figure A.6-3: Overall Integrity Risk

In order to assess the total integrity risk, it is assumed that local and global integrity threats areindependent from each other. Based on this assumption, it is obvious that the overall integrity riskcannot be calculated by using the addition law for probabilities since local and global integrity threatsare based on two different sets of failure sources. Because of this, the higher integrity risk is decisivefor the total integrity risk:



EUROCONTROL

),max( Intlocal

Intglobal

Inttotal ppp =

Again, due to the fact that different sources of errors have been assumed for local and globalintegrity threats, the total integrity risk has to be determined by identifying the largest possible riskvalue, i.e., either the global or the local integrity risk.

In order to calculate the total integrity risk, the following values have to be identified:

• As stated previously, the EGNOS GIC integrity risk can be regarded as given, although it has yetnot been validated. Therefore, it is assumed that the EGNOS SIS will meet the required integrityrisk.

• The risks associated with the RAIM algorithm are generally well known. RAIM integrity risk isconsidered to be 10-3 at the minimum. This can be tested by provoking different types of errorsand comparing it with the system output (accelerated testing). Nevertheless, it can be assumedthat this performance will be guaranteed by the manufacturer of the user receiver, but should bedemonstrated again for EGNOS validation purposes. Additionally, it has to be noted that theabove risk for RAIM algorithms is dimensionless, this means e.g. that in maximum one of 1000cases a failure can not be detected by the receiver. In order to estimate the integrity risk on atime basis, it is necessary to assess how many integrity cases are assumed to take place in aspecific time period. With this, it becomes possible to calculate the receiver integrity risk on atime basis.

• The probability of the events that are called the “global integrity threat” is mainly driven by theerror rate of the GNSS satellites. It can be assumed that the respective data can be provided bythe satellite operators or the data can reasonably be estimated, e.g. by analysing the GNSSsatellite status reports over a long period.

• The most critical value to determine is the probability of an integrity failure caused by localthreats. Local integrity threats are based on multipath, interference or other effects. It is ratherdifficult to estimate the probability of such local influences. Nevertheless, one solution could be along-term monitoring of the whole system integrity failure rate. Based on the above mentionedresults of the global integrity probability assessment, the theoretical integrity rate for local integrityevents can be calculated. Further refinement of risk assessment and validation methods have toshow whether this procedure is suitable for local threat probability identification or not. In anycase, the probability for local integrity events is a critical aspect of integrity risk validation.

As a result of the previous conclusions, a risk allocation tree analysis in conjunction with testcampaigns where possible is needed in order to assess the overall integrity performance. Therespective risk allocation trees have been developed by ESA and can be used for operational testand validation. This analysis has to be performed in two major steps:

1. Each individual risk parameter of the allocation tree has to be assessed relating to the effect ofoperational influences. If such an influence is expected, the next step has to be performed:

2. The changed integrity risk of the individual parameter has to be calculated by estimating theoperational influence either through performing test campaigns or through assuming a new value.

After these two steps will have been completed for all elements of the respective risk allocation trees,the overall integrity risk can be recalculated. Finally, the comparison between this value and therequired ICAO integrity risk answers the question after the fulfilment of the required performances.

Another important parameter that has to be considered with regards to integrity validation is the timeto alarm between the occurrence of a failure and the notification of the user. It can be assumed thatthe major validation work on this subject will be undertaken by ESA. Therefore, EOT&V shouldvalidate the time to alarm by demonstration only. This should be done by determining a number of“representative“ sources for integrity alarms and demonstrating the system’s reaction afterintentional injection of such errors that should lead to an integrity alarm.

Operational influences will have a major effect on the overall integrity performance. Such issuesresulting in influences on the performance include:



EUROCONTROL

• Atmospheric effects;• Surface/terrain (mountains, buildings etc.), e.g. inducing multipath;• Aircraft flight parameters (accelerations, heading, attitude etc.);• Aircraft design (wing span, EGNOS antenna location etc.).

All these items may cause disturbances or interruptions (e.g. multipath, interference, shadowing etc.)of the EGNOS signals and/or services and therefore, have an influence on the overall integrity risk(see figure A.6-4). Since it is one of the major assumptions of this study that the signal in space iswithin its specification, only those dependencies need to be tested which are typical for theoperational use. The integrity of the ranging function will be checked by the EGNOS system itself.Hence, an additional analysis is not necessary.

Operational and Local Influences

EGNOS:GIC SIS WAD SIS

User Receiver:GPS/GLONASS SIS RAIM Availability

Figure A.6-4: Operational Influences on Integrity Service

The operational influences can be characterised as follows:

• EGNOS GICThe signal of the EGNOS integrity channel may be disturbed or completely interrupted. In the firstcase, the receiver internal signal will check and detect the inconsistent signal and exclude this signalfrom further processing. The very improbable case that a GIC signal which indicates an error ischanged by operational influences in a way that the received signal indicates an error free function ofthe system seems to be negligible, although this assumptions has to be validated by analysis duringthe EOT&V process.

Therefore, only the probability has to be assessed that the signal will be interrupted or "destroyed".This could be done by estimating the influence of operational and local effects on signal behaviour,supplemented by test trials and demonstrations. Such local effects could be excessive accelerationsof the aircraft or multipath reflections at the aircraft structure. These effects may lead to an increasedbit error rate of the integrity channel.

Additionally, it has to be noted that in case of a GIC service interruption the only remaining integrityfunction is RAIM. Since the integrity risk allocated to the RAIM algorithm is comparatively high, itcould be possible that the receiver without EGNOS GIC service is not able to fulfil the ICAO RNP.This has to be confirmed during the validation phase.

• EGNOS WADEGNOS WAD service might be influenced by operational influences in the same way as describedfor the GIC service. If the WAD service is interrupted it has to be ensured that the resulting degra-dation of the accuracy performance is communicated to the user in an appropriate manner. It isassumed that no bit errors will be induced by operational influences in such a way that a pseudo-range error results which is not detected by the receiver. However, this assumption has to bevalidated during EOT&V by analysis.



EUROCONTROL

• User RAIMOperational influences have a significant influence on RAIM processing since GPS and GLONASSsignals are very susceptible against disturbances. This concerns mainly shadowing, multipath andinterference. However, it is assumed that the influence of these effects on the overall integrity risk isconsidered in the integrity risk allocated to the RAIM algorithm. An exception to this is the case thatRAIM is not possible due to a lack of visible satellites or due to insufficient satellite geometry for theparticular application. These aspects will be assessed in the following paragraph on RAIM availability.• RAIM Availability:A minimum of 5 satellites is necessary to detect that one signal is wrong, 6 satellites are necessaryto identify the wrong signal/satellite. This is based on the assumption that a 3-dimensional navigationsolution is required. But even if a sufficient number of satellite signals is available it is still dependenton their geometric arrangement and the particular application whether or not RAIM will be available.Therefore, it might be possible that a constellation will be sufficient for RAIM in an En-Route phasebut insufficient in an approach phase of flight.

RAIM availability is not considered in the integrity risk allocated to the RAIM algorithm. The EGNOSRAIM availability is dependent on the satellite constellation and can be assessed through simulation.The respective simulator has to be able to calculate GPS and GLONASS visibility over the area ofinterest.

The next step is the assessment of operational local influences. Within this context, shadowingthrough aircraft geometry, antenna location and the surrounding terrain play a major role. Theseeffects have to be modelled and calculated individually for each location and each type of aircraft.The result of this analysis can be used to calculate the overall integrity performance.

A.6.4 Availability Validation

Availability is an indication of the ability of the system to provide usable service within the specifiedcoverage area and is defined as the portion of time during which the system is to be used fornavigation during which reliable navigation information is presented to the crew, auto-pilot or othersystem managing the flight of the aircraft.

The measurement that will give a representative indication of the availability of the satellite signal, isthe Signal to Noise Ratio (SNR). The measured SNR value can be compared to a predefinedthreshold. This will allow an absolute comparison of the availability, because all receiver specificparameters can be eliminated.

With regards to validation, the main problem is that availability has to be determined on the basis ofa very long time period, also with regards to the fact that most EGNOS system aspects that influenceavailability do not follow a Gaussian error distribution. In practice, availability of navigation solutionsdepends on the GPS and GLONASS signals as well as on the EGNOS signals, independent from thecause for a signal outage. Furthermore, it has to be considered that a failure or breakdown of theuser’s receiver also causes a loss of service.

The following paragraph is an extract from the SARPS, which have been identified to be relevant inthis study since it explains the core aspect of availability validation very well:

"Unlike a ground navigational aid infrastructure, the availability of GNSS is complicated by themovement of satellites relative to a coverage area and the potentially long time to restore asatellite in the event of a failure.

The measurement period should be as long as practical when evaluating the availability. How-ever, GNSS has degraded configurations such as the loss of multiple satellites, which are veryrare and may only happen once in twenty years. Accurately measuring the availability of such asystem would take many years, to allow the measurement period to be longer than the MTBFand repair times. The availability of GNSS should be determined through design and analysis,rather than measurement. Using the failure characteristics of the components of the system, amodel of all of the degraded configurations can be constructed.“



EUROCONTROL

To conclude, it is obvious that EGNOS availability cannot be validated only by performing test cam-paigns within an acceptable short time period. This could lead to a misinterpretation in case of anunexpected user receiver breakdown or EGNOS signal outage. It is rather necessary to consider thatavailability essentially depends on time and location and therefore availability has to be tested over along period and over the whole area of interest to avoid an over-interpretation of local and short-termeffects.

The availability depends on the following key parameters:

• EGNOS SIS availability performance• GPS/GLONASS SIS availability• user receiver availability considering MTBF (Mean Time Between Failures) and MTTR (Mean

Time to Repair)• operational issues (e.g. multipath, masking etc.)

EGNOS SIS availability performance will be determined by ESA and EOT&V will assume that thesevalues are appropriately validated. Thus, these values can be used by EOT&V without furthervalidation. A similar approach has to be taken for GPS/GLONASS signal availability. The availabilityvalues for GPS are quite well known based on observations and measurements over a long timeperiod. These values are referenced in the EGNOS documentation [2]. With regards to GLONASSthe situation is different since no availability performance values are commonly known for thissystem. However, the EGNOS system requirements document [2] assumes that the GLONASSavailability performance equals that of GPS, which seems to be questionable. Although thisassumption seems to be questionable, EOT&V will assume that ESA will determine correctavailability figures for the SIS.

The remaining key parameters (user receiver and operational issues) are then subject to validationthrough EOT&V. The MTBF of the user receiver is usually determined (estimated) by the receivermanufacturer. If it should be necessary to validate this performance, the receiver would have to betested on a test bench through performing an accelerated test campaign. In this case, the receiverwould be stressed more heavily than under nominal conditions while monitoring its ability to maintainservice. With this, the MTBF can be estimated. Concerning MTTR, it is obvious that no repairactivities are possible under flight operation conditions. MTTR in this case has to be understood asthe ability of the aircraft crew to re-activate the receiver by changing modes or settings. The time forperforming such activities and the probability that they will lead to success have to be considered inthe receiver’s availability calculations. There also might be cases when the user receiver recoversfrom failures without external input. Again, it is assumed that MTTR values will be provided by thereceiver manufacturer.

The only key parameters remaining for practical availability validation are the operational influences.For EOT&V, it will be assumed that the operational influences on availability follow a Gaussian errordistributing if the number of test samples is high enough. Therefore, availability validation withinEOT&V should be undertaken by tests supported by theoretical analysis (modelling and calculation)to investigate under which operational influences the number of EGNOS and/or GPS/GLONASS SISare not sufficient to provide a navigation solution.

Theory

The ICAO RNP values for availability are given as dimensionless probability parameters. This allowsa relatively easy calculation of the required test samples for RNP validation. The required probabilityfor NPA is 0.95 and for Cat I approaches 0.9975. Currently, no parameters are given for RNP 1 andupward categories (see Table 2-1).

As discussed above, EOT&V will assume that the SIS (EGNOS, GPS and GLONASS) availability willbe determined by ESA. According to Table 2-4 the required AOC system performance for availabilityis 0.999 for NPA and 0.99 for precision approaches, based on the navigation system performanceassuming a fault free receiver. For EGNOS FOC (see Table 2-5), the system requirements demandan availability of 0.9999 for NPA and 0.999 for precision approaches. The main reason for thisdifference between EGNOS AOC and FOC availability is the number of GEOs that will be usable.Only with FOC the user will have the possibility to access two EGNOS GEOs anywhere within ECAC.



EUROCONTROL

With AOC, EGNOS is intended to be used only as primary means of navigation. As mentionedbefore in this document, this does not require validation of availability and continuity. Therefore, thefollowing theoretical “delta approach“ is only applicable to EGNOS FOC.

The “delta approach“ assumes that it is sufficient to validate the difference between the ICAOrequirements and the EGNOS/GPS/GLONASS SIS availability as to be determined by ESA. Fromthe current perspective6 on the basis of the preliminary values mentioned above this assumptionwould result in the following delta availability requirements that would have to be validated byEOT&V:for NPA: ( ) ( ) 9501.095.09999.011 ,,, =−−=−−=∆ NPARNPNPASISNPA AAA

for precision approaches: ( ) ( ) 9985.09975.0999.011 ,,, =−−=−−=∆ PARNPPASISPA AAA

The calculation of necessary test samples is similar to that presented for accuracy requirements. ForNPA with the probability of 0.9501 the result is:

739501.01

9501.096.1 2 ≈

−=n , with z = 1.96 as the resulting value for a 95% confidence level.

Concerning the 0.9985 probability for Cat I approaches, the necessary number of test samples hasto be higher:

25609985.01

9985.096.1 2 ≈

−=n , with z = 1.96 as the resulting value for a 95% confidence level.

With this, the number of independent measurements for a test campaign at a 95% confidence levelhas to be

• approximately 73 for validation of the NPA availability requirement and• approximately 2560 for validation of the Cat I availability requirement.

Assuming a confidence level of 99.9%, the results can be calculated with the above formulas, butconsidering a z-score of 3.29 for the 99.9% level. This results in:

• approximately 206 for validation of the NPA availability requirement and• approximately 7210 for validation of the Cat I availability requirement.

The correlation time for availability measurements is rather difficult to estimate. Complete EGNOSservice interruptions due to technical reasons like component or sub-component failures, data linkinterrupts, failed switch-over activities etc. normally occur randomly and affect the whole GBA of therespective GEO satellite. In order to determine the correlation time for such errors it would benecessary to know the typical duration of the service interruptions. Also, it has to be noticed that withregards to such errors all timely parallel measurements are correlated with each other. However,since EOT&V assumes that such system related error sources are covered sufficiently by the ESAverification efforts. EOT&V therefore can focus on operational influences at the aircraft that may leadto interruptions of the EGNOS navigation. The investigation of these operational influences withregards to correlation time is contained in section 3.5 and Appendix A.4.

Validation Issues

As mentioned above, availability validation within EOT&V should be undertaken by tests supportedby theoretical analysis.

6 It has to be noted that these results will have to be recalculated later within the EOT&V processwhen the exact EGNOS SIS availability performance has been determined by ESA.



EUROCONTROL

It has to be noted, that the above statements assume that all services (ranging, GIC and WAD) arerequired to provide the navigation service. Nevertheless, in a next step it should be considered thatnot all services are necessary for calculating a sufficient navigation solution. For example, WAD isnot necessarily needed for fulfilling the accuracy requirements in certain flight phases. This aspectshould also be subject to the availability analysis.

Concerning flight tests, special attention should be directed towards flights in northern latitudes, andalong the border of the EGNOS Service Area.

A.6.5 Continuity of Service Validation

The continuity of a system is the capability of the total system (comprising all elements necessary tomaintain the aircraft position within the defined airspace) to perform a function without non-scheduled interruptions during the intended operation.Additionally, the SARPs describe that "the occurrence of navigation system alerts, either due to rarefault free performance or to failures, constitute continuity failures. Since the duration of theseoperations is variable, the continuity requirement is specified as a probability on a per hour basis."

The measurement that will give a representative indication of the continuity of the satellite signal, isthe Signal to Noise Ratio (SNR). The measured SNR value can be compared to a predefinedthreshold. This will allow an absolute comparison of the continuity, because all receiver specificparameters can be eliminated.

Similar as for availability, possible continuity failures may result from:

• SIS failures (EGNOS/GPS/GLONASS)• user receiver malfunctions• operational influences (e.g. due to operational influences such as masking, interference, etc.)• integrity alarms (correct and false alarms)

As for the availability validation, EOT&V will assume that the SIS (EGNOS/GPS/GLONASS)continuity performance will be determined and appropriately validated by ESA. Thus, these valuescan be used by EOT&V without further validation. The continuity performance of the user receiver(based on MTBF values) is expected to be determined by the receiver manufacturer.

With this, the remaining key parameters for validation within EOT&V are the operational influences. Itwill be assumed that the operational influences on availability follow a Gaussian error distributing ifthe number of test samples is high enough. Therefore, continuity validation within EOT&V should beundertaken by tests supported by theoretical analysis (modelling and calculation) to investigate underwhich operational influences the number of EGNOS and/or GPS/GLONASS SIS are not sufficient toprovide a navigation solution.

Theory

The RNP values defined for EGNOS continuity service are 10-4 per hour for NPA up to RNP4 and 10-

5 per 15 seconds for Cat I approaches. Although availability and continuity-of-service are linkedtogether very closely, ICAO RNP requirements for continuity performances are higher thanavailability requirements. This is mainly based on the fact that the loss of service is much morecritical if the service is in use, because this might mean that the respective operation would have tobe interrupted.

As discussed above, EOT&V will assume that the SIS (EGNOS, GPS and GLONASS) continuity willbe determined by ESA. According to Table 2-4 the required AOC system performance for continuityrisk is 10-5/h for NPA and 8x10-5/approach for precision approaches. For EGNOS FOC (see Table 2-5), the system requirements demand a continuity risk performance of 10-6/h for NPA and8x10-5/approach for precision approaches.



EUROCONTROL

As mentioned before, EGNOS AOC is intended to be used only as primary means of navigation. Thisdoes not require validation of availability and continuity. Therefore, the following theoretical “deltaapproach“ is only applicable to EGNOS FOC.

The “delta approach“ assumes that it is sufficient to validate the difference between the ICAOrequirements and the EGNOS/GPS/GLONASS SIS continuity performance as to be determined byESA. Before this difference can be determined, it is necessary to recalculate the probability, which isgiven per hour, per 15 seconds or per approach (150s) to a common time base of 1 second:

for NPA to RNP4:ss

C NPARNP

11078.2

3600

10 84

,−

−

⋅≈=

ssC NPASIS

11078.2

3600

10 106

,−

−

⋅≈=

for precision approaches:ss

C PARNP

11067.6

15

10 75

,−

−

⋅≈=

ssC PASIS

11033.5

150

108 75

,−

−

⋅≈⋅=

From the current perspective7 on the basis of the preliminary values mentioned above the “deltaapproach“ would result in the following delta continuity risk requirements that would have to bevalidated by EOT&V. Since 1 second is our basis time period, the continuity risk will be used withoutits dimension in the following calculations.

for NPA to RNP4: 8108,,, 1075.21078.21078.2 −−−

∆ ⋅≈⋅−⋅=−= NPASISNPARNPNPA CCC

for precision approaches: 777,,, 1034.11033.51067.6 −−−

∆ ⋅=⋅−⋅=−= PASISPARNPPA CCC

The calculation of necessary test samples for NPA to RNP4 is as follows:

88

82 1040.1

)1075.21(1

)1075.21(96.1 ⋅≈

⋅−−⋅−= −

−

n , with z = 1.96 as the resulting value for a 95%

confidence level.

The calculation of the number of test samples for precision approach continuity performance resultsin:

77

72 1087.2

)1034.11(1

)1034.11(96,1 ×≈

×−−×−= −

−

n , with z = 1,96 as the induced value for a 95%

confidence level.

Summarising both calculations on the basis of a 95% confidence level, it can be stated that:

• approximately 1.40 x 108 independent test samples are necessary to validate NPA to RNP 4integrity requirements;

• approximately 2.87 x 107 independent test samples are necessary to validate precision approachrequirements.

Assuming a 99.9% confidence level with a corresponding z-score of 3.29, it can be stated that• approximately 3.94 x 108 independent test samples are necessary to validate NPA to RNP 4

integrity requirements;• approximately 8.08 x 107 independent test samples are necessary to validate precision approach

requirements.

7 It has to be noted that these results will have to be recalculated later within the EOT&V processwhen the exact EGNOS SIS continuity performance has been determined by ESA.



EUROCONTROL

Similar as for availability, the correlation time for continuity of service measurements is difficult toestimate. Complete EGNOS service interruptions due to reasons from the EGNOS system itselfnormally occur randomly and affect the whole GBA of the respective GEO satellite. In order todetermine the correlation time for such errors it would be necessary to know the typical duration ofthe service interruptions. Also, it has to be noticed that with regards to such errors all timely parallelmeasurements are correlated with each other. However, since EOT&V assumes that such systemrelated error sources are covered sufficiently by the ESA verification efforts. EOT&V therefore canfocus on operational influences at the aircraft that may lead to interruptions of the EGNOS naviga-tion. The investigation of these operational influences with regards to correlation time and spatialcorrelation is contained in section 3.5 and Appendix A.4.

Validation Issues

Due to the high number of necessary test samples, continuity can not be validated by tests alone.Therefore, an appropriate split between tests and analysis/simulation techniques is necessary. Withregards to flight tests special attention should be directed towards flights in northern latitudes, andalong the border of the EGNOS Service Area.

It has to be noted, that the above calculations assume that all services (ranging, GIC and WAD) arerequired to provide the navigation service. Nevertheless, in a next step it should be considered thatnot all services are necessary for calculating a sufficient navigation solution. For example, WAD isnot necessarily needed for fulfilling the accuracy requirements in certain flight phases. This aspectshould also be subject to the continuity of service analysis.

In contrary to availability validation, continuity requires a much higher number of test samples tovalidate the respective performances. On the other hand, it is clear that continuity validation is veryclosely related to availability validation. This means that the analysis techniques as well as the testcharacteristics to be applied are basically the same. Practically, this would mean that, since forcontinuity there are more demanding requirements, the results from the continuity validation can bedirectly used to validate availability, mainly just by changing the time basis for the calculations fromthe duration of a specific operation to a longer time period.



EUROCONTROL




EUROCONTROL

Appendix B



EUROCONTROL



EUROCONTROL

APPENDIX B: EGNOS OT&V AS AN INPUT TO SAFETY REGULATION

This section attempts to place the planned EGNOS OT&V activity in the context of the likely safetyregulatory mechanisms that may be associated with the use of EGNOS.

Several previous papers, from EUROCONTROL and individual states, have proposed variouspossible regulatory models and processes to manage and regulate the unique aspects of multi-national systems such as EGNOS. It has yet to be agreed what the final model to be used will be. Inorder to move the debate forward, this paper has made various assumptions.

This paper does not cover the legal and institutional issues that surround the use of Space basedelements not under the direct control of the service provider.

B.1 Assumptions

In developing this paper the following assumptions have been made:• EGNOS will be used to support the provision of an Air Traffic Service in several European States.• The new Safety Regulatory Commission (SRC, see section B.4) will develop high-level safety

regulatory requirements for European ATS service providers.• Safety Regulatory "approval" of EGNOS based Air Traffic Services will initially be a national

responsibility.• Such SRC Safety Regulatory requirements are likely to require European ATS providers to have

some form of Safety Management System (SMS) in place to effectively manage the safety of theservice(s) they provide.

• These SMS will have to follow agreed basic principles, which will include the ATS providersseeking safety assurance from third party service providers.

• In this context EGNOS could be considered a "brought in" service, as it is unlikely to be operatedby the ATS providers.

• Regulatory "approval" of EGNOS will be through ATS service provider regulation. This will likelybe via a review of the effectiveness of the ATS provider’s SMS, i.e. that it follows the regulatorySMS principles, in part seeking assurance that all "brought in" services are subject to the samerobustness of process. It is therefore likely that the EGNOS operator will be required to have aform of Safety Management System, following the agreed SMS principles.

B.2 ATS Safety Management System

B.2.1 Policies and Principles

Safety Management is that part of the overall management function which determines and imple-ments an organisation’s safety policy.

The implementation of a safety management system by an organisation should follow a top downprogramme, which ensures that:

• Safety policy statements are defined: these statements should define the organisation’sfundamental approach to the management of safety and should commit the organisation at thehighest level to the fulfilment of its stated safety policy.

• From the policy statements the organisation should define its safety management principles: theprinciples should specify the safety objectives with which the organisation intends to comply toimplement its policy statements.

• Having defined the policy statements and principles, the organisation should produce proceduresthat define the tasks to be performed to meet the stated safety objectives contained in the policyand principles. Accountability should be assigned for carrying out these tasks.

One of these policy statements should address the use of "brought in" services. Typically this wouldbe Externally Supplied Products and Services: The organisation should make a safety policystatement committing it to ensuring that the safety assurance processes used by its externalsuppliers satisfy its own safety management standards and safety requirements.



EUROCONTROL

Rationale: A safety assessment requires input from all phases of a product or service development. Forexternally supplied products or services the external supplier must understand and comply with theorganisation’s safety and safety management system requirements, i.e. EGNOS.

B.2.2 ATS Safety Management Principles

ATS Safety Management Principles provide a framework for the establishment of processes toidentify safety shortcomings, so that remedial action can be taken, and provide assurance that safetylevels are being met or improved.

The safety management principles address three main issues:

• Safety Achievement specifying the means by which high safety performance is achieved.• Safety Assurance specifying the means for providing assurance that risks are being managed

properly and effectively.• Safety Promotion specifying the means by which safety issues are communicated within an

organisation to eliminate unnecessary risks and avoid repeat errors or risks.

The following sections consider these principles in more detail, and their particular relevance toEGNOS OT&V.

B.2.2.1 Principle: Safety Achievement

a. Safety Levels

Whenever practicable, quantitative safety level should be derived maintained and improved for allaviation products and services.

Rationale: If the safety performance of a service or product is to be assessed and monitored it isnecessary to define the safety objectives that need to be met.

In EGNOS terms, from the ATS functional requirements and the associated functional hazardanalysis, a series of high-level ATS safety requirements will be developed. Some of these require-ments will be apportioned to the EGNOS element of the system.

b. System Safety Assessment

All new or existing products or services, and changes to them, should be assessed for their safetysignificance. Safety assessment should be conducted and documented to ensure that full considera-tion is given to all aspects of safety prior to introduction into use.

Rationale: The analysis process is conducted during development of the system, service or productto establish safety requirements. The safety assessment process is used to demonstrate that theserequirements are met.

Therefore an assessment of EGNOS will have to take place to confirm that any high-level safetyrequirements apportioned to the EGNOS system, have been met. If they cannot be met by design,then what mitigation is in place. The EOT&V activity will include confirmation that the EGNOS SafetyRequirements have been met.

B.2.2.2 Principle: Safety Assurance

System Safety Assessment Records

An organisation should identify and record the safety requirements for a service or product, theresults of the safety assessment process and evidence that the safety requirements have been met.These records need to be maintained throughout the life of the service or product.



EUROCONTROL

Rationale: The safety assessment documentation should provide the evidence to the organisationupon which it will base its decision whether it is safe to use the service, or product. Maintenance ofthese records throughout the life of the service or product provides ongoing assurance that itcontinues to meet its original safety requirements and that remaining risks are adequately controlled.With EGNOS, this could be an EGNOS system safety case. This would be one manifestation of theEGNOS system operator Safety Management System and would form a key document for the useby ATS providers and subsequent safety regulatory assessment.

The System Safety Case is produced to demonstrate that the following process is followed:

• Safety assessment and requirement definition (including identification of regulatory require-ments).

• Production of evidence that the system design meets the requirements specified. (EOT&V is akey element of this step)

• Assessment of the risks due to transition from design into service and provision of assurance thatthese risks are tolerable.

• Demonstration that operating and maintenance procedures are acceptable for initial operation.

B.3 EGNOS Safety Assessment

One can conclude from the preceding paragraphs that the safety assessment satisfies only a portion,albeit an essential portion, of the information required by safety regulatory organisations. This has tobe followed by assurances that the safety management will preserve this “snap-shot” assurance offunctional safety over the life-cycle of EGNOS. The latter is beyond the scope of this study.

The objective of the safety assessment is to provide assurance that the threat to human life in civilaviation is acceptably low. Therefore the basis of the safety assessment is the establishment of cleardefinitions of how EGNOS can pose a threat to human life. All subsequent tests must be traceable tothese definitions which should be both qualitative (e.g. integrity lost with no alarm) and quantitative(e.g. probability of hull loss = 1 x 10-8)

Establishment of the safety threats attributable to EGNOS is a complex task, but nevertheless, anunavoidable task. EGNOS could potentially be used in a number of Air Traffic Services, discussed inthis document, in number of different architectures, which all affect the residual amount of safety riskthat can be allocated to EGNOS. These must all be defined and recorded in a manner so that theyare clearly traceable to every test and validation used to give assurance of the safety of EGNOS.

The test and validation study must therefore be very closely linked to operational studies throughoutthe programme to ensure complete continuity of safety between EGNOS implementation and appli-cation. This is especially important in the present developmental stages of EGNOS where efficienttrade-offs in performance can be made between the operational/ATS domain and EGNOS. Further-more, the study may reveal limitations in EGNOS performance, which could be compensated for inthe operational/ATS domain for a specific ATS. In terms of safety though, the acceptance by Statesof EGNOS, which was validated in relation to a different architecture from which it will be applied,could lead to potentially catastrophic consequences. Hence the need to closely liase the EGNOS testand validation study to the operational and ATS domains is of paramount importance to safety.

The number of variants and also the proprietary nature of components which would typicallycomprise an EGNOS based ATS adds to complication when establishing an ATS architecture. Thisis perhaps most notable in the aircraft receiver domain where different manufacturers techniquescould result in significantly different performances. Clearly the model used to derive EGNOS test andvalidation factors would need to make assumptions on such performances. As the certifying authorityof airborne and other ATS components, safety regulatory authorities need to be aware of anyassumptions made over the performances of these components.

In theory, to maintain complete traceability of safety for safety regulatory purposes, every test usedto validate EGNOS must be traceable to a specific air traffic service, its architecture and operationalrequirements. In practice EGNOS can be regarded as component which interfaces with an air trafficmanagement system through a finite number of variable parameters. The various air traffic services



EUROCONTROL

and architectures would then demand different performances from these EGNOS parameters. Thevalidation task can then be simplified by seeking to identify the most demanding performance fromthe set of EGNOS interface parameters. If EGNOS can achieve these performances, it should bebaselined against together with clear cross references to the applicable air traffic services andarchitectures. Care should be taken when determining the most demanding performances, forexample, precision landing services do not demand the same level of continuity performance as enroute services. It is unlikely that a State’s regulatory authority will accept the use of EGNOS for allpurposes on the basis that it has been validated as safe only against precision landing phases offlight.

It is essential to note that State’s Safety Regulatory Authorities are responsible for accepting the totalAir Traffic Service in respect of safety. One-off, global approval, which guarantees the safety ofEGNOS can not be made in isolation of the total ATS architecture, indeed, such approval couldfalsely lead to assumptions that EGNOS is safe in the absence of an ATS infrastructure. At present,no legal infrastructure exists to support single acceptance of a single European ATS component.Under the present regime the primary customer for the EGNOS safety validation material will be thenational providers who are directly responsible for the air traffic services in the respective EuropeanStates. These providers must accept the burden of safety and hence they are responsible forintegrating the EGNOS test and validation material into their safety assurance process for the totalair traffic service. This may well require the application of the developed test and validation tools, byproviders, to accept EGNOS as a part of their air traffic service. It is only at this stage that State’ssafety regulatory authorities are involved, and hence EGNOS is regarded as a part of the totalservice safety argument. Despite this, it is regarded that for reasons of efficiency, State’s safetyregulatory authorities should be involved at this stage to ensure that the EGNOS safety assurance,as a common denominator, will be compatible, in principle, with all of the difference forms of nationalsafety regulation.

B.4 The new role of EUROCONTROL’s SRU and SRC

At a meeting of ECAC Transport Ministers in February 1997 the following objective was defined:

“To establish a formal mechanism in Europe, separate from service provision, for the multilateraldevelopment and harmonisation of an ATM Safety Regulatory regime within a total aviation safetysystem approach”

This objective was met by the establishment of the Safety Regulatory Commission (SRC) which wasenacted by a revision to the EUROCONTROL Convention. The Safety Regulatory Unit (SRU) wasalso established to perform a supporting role for the SRC.

B.4.1 Safety Regulatory Commission (SRC)

The SRC is a commission established by the Council to ensure through co-operation between Stateson safety regulation, consistent high levels of safety in ATM within the ECAC area. The SRC willadvise the Council on all matters related to the safety regulation of ATM, including recommendationsfor improvement of the safety of these services.

The SRC is responsible for the development of harmonised safety regulatory objectives, approachesand requirements for the ATM System, which will be implemented and enforced by the MemberStates. The SRC should address not only the technical issues associated with the development ofobjectives, but also the strategic issues of safety harmonisation; for example, common standards forcontroller licensing, common standards for risk tolerability etc. Perhaps most importantly, the SRCshould spread best practice for safety regulation and safety management throughout member states.The SRC should function in such a way that would not inhibit the expected later transfer of EuropeanATM Safety Regulation into the JAA or its successor organisation.



EUROCONTROL

The functions of the SRC are as follows:

a) agree a co-ordinated approach for ATM safety regulation for adoption by the Council;b) propose objectives for the safety regulation of ATM for approval by the Council;c) in accordance with those objectives, establish safety regulatory requirements and asso-

ciated safety standards, as required, for approval by the Council;d) define target levels of safety, standards of safety performance, certificates of conformity

and/or full certification for ATM systems as appropriate (ATM safety regulation will growin importance as more safety critical systems are used on the ground and as data-linking results in a more closely coupled air/ground system);

e) establish procedures, where necessary, for the uniform national application of EuropeanATM safety regulatory requirements for adoption by the Council;

f) ensure that industry, service providers and other interested parties are adequately con-sulted in the preparation of the requirements;

g) ensure proper co-ordination of ATM safety regulation with other safety regulatory disci-plines within a total aviation safety system approach;

h) assess the overall safety performance of the ATM system and provide feedback of ex-perience in order to promote safety improvement;

i) ensure co-ordination with other national, regional or global safety regulatory bodies;j) approve the work programme and budget of the SRU for adoption by the Council;k) undertake such other functions within the sphere of ATM safety regulation as the Coun-

cil may specify.

B.4.2 Safety Regulatory Unit (SRU)

The role of the SRU is to provide full time, expert support to the SRC. In order to carry out itsfunctions the SRU will develop and maintain working arrangements with national aviation authorities,service providers, industry, representative organisations of airspace users and airports, other safetyregulatory and standards organisations, the JAA and other interested parties. These arrangementswill be submitted by the SRC to the Council for approval. Some of these working arrangements willneed to be formal in nature; for example, to ensure that ATM safety regulation is addressed from atotal system perspective, a Memorandum of Understanding with the JAA may be appropriate.

The functions of the SRU are as follows:

a) develop objectives for the safety regulation of ATM as tasked by the SRC;b) promote the adoption and maintenance of a harmonised approach to safety regulation

of ATM;c) promote the adoption and maintenance of best practices in safety regulation and safety

management;d) prepare harmonised safety regulatory requirements and safety standards for approval

as tasked by the SRC;e) as tasked by the SRC, develop harmonised processes for States’ regulatory approval

mechanisms and consider joint regulatory activities between States and joint certifica-tion mechanisms for common ATM systems;

f) prepare and monitor the implementation of procedures for ensuring the uniform applica-tion, by States, of safety regulatory requirements;

g) facilitate and support any ad-hoc working bodies that may be formed.

B.5 Time Scales

Safety must be integral part of the design of EGNOS and it’s management. Safety is not a featurethat can be added on completion of a system without some penalty on performance. Hence thefollowing milestones should lie appropriately within the EGNOS development phases.

Completion of the following milestones should coincide with completion of the EGNOS missionrequirements phase:



EUROCONTROL

• Establish the air traffic services in which EGNOS will be used and validated for.• Establish the architectures in which EGNOS will be placed to form an air traffic service.• Identify the ATS operational requirements.• Establish the risk to human life that can be caused by EGNOS in qualitative terms and quantita-

tive terms.• Establish any assumptions, models etc., used to represent the total ATS architecture.

Completion of the following milestones should coincide with completion of the EGNOS systemrequirements phase:

• Establish those parameters of EGNOS, which interface with the ATS architecture.• Establish the most demanding criteria for the EGNOS interface parameters and baseline it at this

level.

Completion of the following milestone should be divided into two. The first part completion shouldcoincide with the EGNOS system design phase, and the second part coincident with the EGNOSsystem validation phase. This gives the opportunity to revise the system requirements or the systemdesign as a result of findings on the integrated system:

• Establish any unacceptable risks caused by EGNOS, which will either require re-design ofEGNOS or mitigation elsewhere in the ATS architecture.

Completion of the following milestone should coincide with the EGNOS mission service qualificationphase:

• Submission of the test and validation results in a structured format which gives ATS providersand regulators traceability to the operational domain and the identified risks (and also includes allassumption made for the test and validation process).



EUROCONTROL

Appendix C



EUROCONTROL



EUROCONTROL

APPENDIX C: ABBREVIATIONS

AAIM Aircraft Autonomous Integrity Monitoring

ADS Automatic Dependent Surveillance

AENA Aeropuertos Espanoles y Navegacion Aerea

AIVP Assembly, Integration and Verification Platform

AOC Advanced Operational Capability

AOR-E Atlantic Ocean Region - East

ARTEMIS Advanced Relay and Technology Mission Satellite

ARTES Advanced Research in Telecommunication Systems

ASQF Application Specific Qualification Facility

ATC Air Traffic Control

ATS Air Traffic Services

ATZ Airport Traffic Zone

AWO All Weather Operations

AZB Avionik Zentrum Braunschweig

B-RNAV Basic RNAV

CA Civil Aviation

CAT Clear Air Turbulence

CCF Central Control Facility

CD Compact Disc

CDR Critical Design Review

CNES Centre National d’Études Spatiales

CoS Continuity of Service

CPF Central Processing Facility

DGAC Délégation Générale à l’Aviation Civile

DGNSS Differential GNSS

DGPS Differential GPS

DH Decision Height

DME Distance Measuring Equipment

DOP Dilution of Precision

DUAU Database Update and Access Unit

DVP Development and Verification Platform

ECAC European Civil Aviation Conference

EEC EUROCONTROL Experimental Centre

EGNOS European Geostationary Navigation Overlay Service

EOG EGNOS Operations Group

EOT&V EGNOS Operational Test & Validation

ESA European Space Agency

ESSF EGNOS System Simulation Facility

ESTB EGNOS System Test Bed

EU European Union

EURIDIS European Ranging and Integrity Differential System

EWAN EGNOS Wide Area Network



EUROCONTROL

FA False Alarm

FAA Federal Aviation Administration

FD Failure Detection

FDE Failure Detection and Exclusion

FIR Flight Information Region

FOC Full Operational Capability

FQR Factory Qualification Review

FTE Flight Technical Error

GBA Geostationary Broadcast Area

GDOP Geometric Dilution of Precision

GIC Ground Integrity Channel

GLONASS Global Navigation Satellite System

GNSS Global Navigation Satellite System

GNSSP GNSS Panel

GPS Global Positioning System

HDOP Horizontal Dilution of Precision

ICAO International Civil Aviation Organization

IEEE Institute of Electrical and Electronics Engineering

INS Inertial Reference System

IOR Indian Ocean Region

IPV Instrument Procedure with Vertical Guidance

kts knots

LAAS Local Area Augmentation System

LADGPS Local Area DGPS

MAGNET Multi-modal Approach for GNSS1 in European Transport

MCC Master Control Centre

MCR Multipath to Signal Ratio

MD Missed Detection

MOPS Minimum Operational Performance Standard

MRD Mission Requirements Document

MTBF Mean Time Between Failures

MTTR Mean Time To Repair

MUSSST Multi-modal Safety Satellite System for Transport

n/a not applicable

NAVSTAR Navigation System with Time and Ranging

NC National CAAs

NDB Non Directional Beacon

NLES Navigation Land Earth Station

nmi nautical miles

NPA Non Precision Approach

NSE Navigation System Error

ORR Operational Readiness Review

OT&V Operational Test & Validation

P-RNAV Precision RNAV



EUROCONTROL

PA Precision Approach

PACF Performance Assessment and System Check-out Facility

PDR Preliminary Design Review

RAIM Receiver Autonomous Integrity Monitoring

RAMS Reliability, Availability, Maintainability and Safety

RIMS Ranging and Integrity Monitoring Station

RNAV Area Navigation

RNP Required Navigation Performance

SAPPHIRE Satellite and Aircraft Database Programme for System IntegrityResearch

SARPs Standards and Recommended Practices

SBAS Space-based Augmentation System

SCC Sirius Cybernetics Corporation

SCM Software Configuration Management

SID Standard Instrument Departure

SIS Signal in Space

SMS Safety Management System

SNR Signal to Noise Ratio

SPMP Software Project Management Plan

SQAP Software Quality Assurance Plan

SRC Safety Regulatory Commission

SRD (1) System Research and Development(2) System Requirements Document

SRU Safety Regulatory Unit

STAR Standard Terminal Arrival Route

STNA Service Technique de la Navigation Aérienne

TDOP Time Dilution of Precision

TEC Total Electron Content

TECU TEC Unit

TLS Target Level of Safety

TMA Terminal Manoeuvring Area

TSE Total System Error

tbc to be checked

tbd to be determined

VDOP Vertical Dilution of Precision

VHF Very High Frequency

VOR VHF Omnidirectional Radio Range

WAAS Wide Area Augmentation System

WAD Wide Area Differential



EUROCONTROL




EUROCONTROL

Appendix D



EUROCONTROL



EUROCONTROL

APPENDIX D: DEFINITIONS

Accuracy The degree of conformance between the estimated or measured positionor velocity of a platform at a given time and its true position or velocity.

Remarks:GNSS position error is the difference between the estimated position andthe actual position. For any estimated position at a specific location, theprobability that the position error is within the accuracy requirement shouldbe at least 95 percent.

GNSS errors change over time. The orbiting of satellites and the errorcharacteristics of GNSS result in position errors which can change over aperiod of hours. In addition, the accuracy itself (the error bound with 95%probability) changes due to different satellite geometries. Since it is notpossible to continually measure system accuracy, the implementation ofGNSS demands increased reliance on analysis and characterisation oferrors.

The error for many GNSS architectures varies slowly over time, due tofiltering in the augmentation systems and in the user receiver. This resultsin a small number of independent samples in periods of several minutes.This issue is very important for precision approach applications, becauseit implies that there can be a 5% probability that the position error exceedsthe required accuracy for an entire approach.

The 95% accuracy requirement is defined to ensure pilot acceptance,since it represents the errors that will typically be experienced. The GNSSaccuracy requirement will be met for the worst-case geometry under whichthe system is declared to be available. Statistical or probabilistic credit isnot taken for the underlying probability of particular ranging signalgeometry.

Therefore, GNSS accuracy is specified as a probability for each and everysample, rather than as a percentage of samples in a particular measure-ment interval. For a large set of independent samples, at least 95% of thesamples should be within the accuracy requirements. The accuracyrequirement must be satisfied for the worst-case geometry.

Alert Limit An alert must be raised within a given time when accuracy with therequired integrity can no longer be guaranteed. When the Alert Limit isexceeded, the system should respond with an appropriate alert mecha-nism. The alert limit specified for the En-route phase of flight is the outerperformance boundary, which is twice the RNP value. For the approachenvironment, an alert limit has been set which is within the outerperformance boundary. Therefore, an alert will be raised before the outerperformance boundary is exceeded. An alert limit has been proposed atthe 5σ value for the approach phase.

Analysis Analysis is the determination of the essential qualities, performances andlimitations of an item by cognitive or computational methods. This includesthe comparison of hardware and software design with known scientific andtechnical principles, technical data, or procedures and practices to validatethat the proposed design will meet the specified functional or performancerequirements.

Another possible analysis technique is simulation, i.e. subjecting systemelements to different standard and non-standard inputs and verifying



EUROCONTROL

whether their behaviour is as expected. When using simulations thesimulators themselves must also be validated to confirm that its functionsare accurate representations of the real world.

Availability The availability of GNSS is the portion of time during which the system isto be used for navigation during which reliable navigation information ispresented to the crew, autopilot, or other system managing the flight of theaircraft.

Remarks:Availability is computed separately for each point within the servicevolume and averaged over a long period of time (e.g. 1 year). Availabilitytherefore, specifies the long term system usability. All possible systemoutages, both planned and unplanned, and including predicted outages,must be considered in the calculation of availability.

Any given outage can either have local or global consequences, and it isimportant to differentiate between the two. A local outage is considered asone that affects an individual operation, and a global outage as one thataffects multiple users.

In the En-route flight phase, any outage is considered to be globalbecause it will affect all users. For the approach phase of flight, a localoutage would be one that affects only a single airfield, and not thealternate destination (except during an approach to that airfield). However,with EGNOS, it is likely that an outage may simultaneously affect anumber of airfields within a given area. It has been proposed that todetermine whether an outage is local or global by defining limits given bythe radius of a circle. Outages that affect an area greater than a particularlimit would then be considered as global. A figure of 50 kilometres hasbeen suggested, but requires further assessment to verify that this isrealistic.

A further definition of a local outage could be determined by the durationof the outage. If an outage were relatively short, for example less thanfifteen minutes, then the alternate destination would be available by thetime the aircraft had arrived after diverting. Alternatively, it may bepossible for the aircraft to hold for the duration of the outage. It is for thesereasons that short duration outages have been considered to beequivalent to local outages.

Continuity (ofService)

The Continuity of Service of a system is a measure of its ability to performthe required function without interruption during the period of the intendedoperation. A loss of continuity occurs when the required accuracy is nolonger provided with the required integrity.

Due to the nature of the EGNOS system, a total loss of the navigationfunction is very unlikely, although partial losses will inevitably occur. It ismore likely that a degradation in the performance of the system isobserved, rather than a total loss in navigation ability due to a satelliteoutage, for example. The degradation may make operations morehazardous, such as only achieving RNP4 in RNP1 designated airspace,but it would not be as significant as a total loss. Therefore, due to thepossibility of partial and total loss of the navigation function, two differentcontinuity requirements have been proposed. The first corresponds to thereduction in the RNP from one value to another, and the secondcorresponds to the total loss of the navigation function. It has beenacknowledged that the concept of performance degradation will need to be



EUROCONTROL

further investigated to ensure that the approach is reasonable. It has beendetermined, however, that for the approach phase of flight the concept ofdegraded performance is not applicable. This is because performancedegradation on the approach would result in the approach being aborted,and can therefore be regarded as a total loss of the navigation function.

The Continuity of Service figures can be improved by taking intoconsideration predicted outages. If users (e.g. airline operators) can benotified of potential outages in advance, it may be possible to adjustoperations to avoid them, thereby excluding the predicted outages fromthe calculation of continuity.

The Continuity Risk is the probability that the system will be interruptedand not provide guidance information for the intended operation.

Coverage Surface Area of space volume in which the signals are adequate to permitthe user to determine position to a specified level of performance.

Demonstration Demonstration is the qualitative validation of operational characteristics onthe operating item. Demonstration is mainly applicable to functionalrequirements.

En-route The En-route phase of flight covers operations between the departure andterminal phases of an aircraft’s flight. The category is further sub-dividedinto En-route Continental and En-route Oceanic phases.

Flight Technical Error The Flight Technical Error comprises of the pilot and auto-pilot errorsassociated with the navigation performance of the aircraft.

Geostationary An equatorial satellite orbit that results in a constant fixed position of thesatellite over a particular earth surface reference point on the equator.

Inspection Inspection is a method of validation to determine compliance withspecification requirements which consists primarily of visual observationor mechanical measurements of equipment. The examination does notrequire stimuli.

Integrity The integrity of a system is a measure of the trust that can be placed inthe correctness of the information supplied. The measure of integrity alsoincludes the ability of the system to provide timely and valid warnings tothe user when the system should not be used for the intended operation.

Integrity is specified in terms of risk and the time to alert the pilot that therequired navigation performance parameters are not met.

Integrity Risk The probability during the period of operation that a failure might result ina computed position error exceeding a maximum allowed value, called (Å)alert limit, and the user being not informed within the specific (Å) time toalert.

Mask Angle The elevation angle measured from the horizontal plane tangent to theearth at the antenna to the minimum angle where the satellite data will bereceived and processed.



EUROCONTROL

Maximum Unpre-dicted OutageDuration

The maximum outage duration that is not predicted at least twenty-fourhours in advance, specified with a probability of 10-9 per hour. Thisrequirement is associated with a total outage affecting large numbers ofusers which is considered as a catastrophic event. The duration is limitedby the ability of Air Traffic Control to continue to safely manage traffic.

Navigation The means by which an aircraft is given guidance to travel from oneknown position to another known position. The process involvesreferencing the actual aircraft position to a desired course.

Navigation SystemError

The Navigation System Error is the error contribution of the navigationsystem to the (Å) Total System Error.

Non PrecisionApproach (NPA)

A Non Precision Approach (NPA) uses navigation aids to bring the aircraftsufficiently close to the airfield that allows the pilot to have a view of therunway to enable a visual landing.

Precision Approach A Precision Approach is an approach made to a runway using theguidance provided by a precision approach landing aid. Precisionapproach landing aids provide both vertical and lateral guidance, andguide the aircraft along the approach path up to a Decision Height (DH).

Primary Means AirNavigation System

A navigation system approved for a given operation or phase of flight thatmust meet accuracy and integrity requirements, but need not meet fullavailability and continuity requirements. Safety is achieved by limitingflights to specific time periods and through appropriate proceduralrestrictions.

Note: There is no requirement to have a sole-means navigation system onboard to support a primary-means system.

Qualification The process of determining that the product, as designed, is capable ofmeeting its specified performance requirements in its operationalenvironment, with margins appropriate for the technologies used and theintended application. [Source: ISO]

Receiver Autono-mous IntegrityMonitoring (RAIM)

A technique whereby a GNSS receiver determines the integrity of theGNSS navigation signals without reference to sensors or integrity systemsother than the receiver itself. This determination is achieved by aconsistency check among redundant pseudorange measurements.

Review Review is the systematic examination of items for the purpose ofassessing the results obtained at a given time, by persons not themselvesbeing responsible for the project. Usually Review is understood as reviewof the design documentation. Reviews may be used to prove obviousimplementation of certain design requirements or used to consolidateother verification methods (e.g. tests) by detailed examination of thedesign documentation.

Supplemental MeansAir NavigationSystem

A navigation system that may only be used in conjunction with a primary-or sole-means navigation system. Approval for supplemental means for agiven phase of flight requires that a primary-means navigation system forthat phase of flight must also be on board. Amongst the navigation system



EUROCONTROL

performance requirements for a given operation or phase of flight, asupplemental-means navigation system must meet the accuracy andintegrity requirements for that operation or phase of flight; there is norequirement to meet availability and continuity requirements.Note: Operationally, while accuracy and integrity requirements are beingmet, a supplemental-means system can be used without any cross-checkwith the primary-means system.

Sole Means AirNavigation System

A sole-means navigation system approved for a given operation or phaseof flight must allow the aircraft to meet, for that operation or phase of flight,all four navigation system performance requirements: accuracy, integrity,availability, and continuity of service. Note: This definition does notexclude the carriage of other navigation systems.

Remark:During the preliminary stages of GNSS development in the field ofaviation, the terms supplemental, primary and sole means of navigationwere defined to distinguish the degree of reliance that is placed on theGPS position solution. These definitions have continually been a source ofconfusion as the variety of different GNSS architectures and applicationscan lead to ambiguous and potentially incorrect interpretation of thedefinitions. In particular the UK CAA recognises two distinct safetyconcerns that can arise through the incorrect interpretation of thesedefinitions, especially sole means.

The first is that in some applications, where GPS could be the onlynavigation sensor, there may still be the requirement for inertial referencesystems, FMS, compass, maps, VFR etc. to be used for the purposes ofnavigation. Hence, the term sole means hence may incorrectly infer tousers that conventional means should be ignored or removed, which is notthe case, especially in the near term future of GNSS. For this reason theUK CAA Safety Regulation Group uses the term “primary means” as analternative in some circumstances.

Secondly, the approval of GNSS in a “sole means” capacity dependsentirely on the system design and configuration and the purpose to whichis put (i.e. the operational requirement) including the mitigating factors thatcan be applied in those circumstances. The very same GNSS installationmay be completely unsatisfactory for other purposes in a “sole means”capacity as it may not be possible to build in essential factors to preserveacceptable levels of safety. Therefore the use of the definition “solemeans” when used to describe a system can mislead industry that systemtype is acceptable for one or more purpose for which it was not intendedwhich could result with serious safety hazards. For this reason the UKCAA Safety Regulation Group avoid the term sole means in preference toapproved means of navigation and in some cases primary means asexplained above.

Test Test is the method of quantitative validation by measuring the perform-ance of a system, if required after the controlled application of knownstimuli. Quantitative values are measured, compared against previousacceptance criteria and then evaluated to determine the degree ofcompliance.Tests may also be used to confirm assumptions used in simulations andmodels

Time to Alert Time-to-alert is the maximum period of time between the occurrence of afailure and notification to user that a failure has occurred.



EUROCONTROL

Tolerable OutageDuration

Tolerable Outage Duration is defined as the duration of a service outagethat is transparent to the operational system. It does, therefore, not impactupon the system availability and continuity. A navigation outage is notconsidered an operational outage if the outage is shorter than theTolerable Outage Duration. If this is the case, the outage is not included inthe calculations of availability and continuity. The Tolerable OutageDuration is taken to be the total time that a navigation outage exists, andtherefore, must include any restart time associated with the airbornesystem.

Total System Error The term ‘Total System Error’ refers to the total system employed todetermine and control the aircraft’s position relative to the desiredtrajectory or position.

Validation The confirmation by examination and provision of objective evidence thatparticular requirements for a specific intended use are fulfilled. [Source:ISO]

Validation concerns the process of examining a product to determineconformity with user needs. Validation (in contrast to verification) isnormally performed on the final product (here: EGNOS) under normaloperating conditions.

Verification The confirmation by examination and provision of objective evidence thatspecified requirements have been fulfilled. [Source: ISO]



EUROCONTROL

Appendix E



EUROCONTROL



EUROCONTROL

APPENDIX E: REFERENCE DOCUMENTS

No. Title Code

[1] EGNOS AOC Verification Requirements Document E-RD-VAV-E-001-ESA,Issue 2, Rev. 0

[2] EGNOS AOC System Requirements Document E-RD-SYS-E-001-ESA,Issue 1, Rev. 1

[3] Provisional Navigation System Performance Requirementsfor GNSS (Draft)

OCR/DP/085, Issue 3.0,07.01.1997

[4] EGNOS Addendum to the EUROCONTROL OCR Task ForceDP085 Document, ESA GNSS-1 Project Office

97/TG/487/JPD, Issue 0,Draft 4, 11.03.1997

[5] Civil Aviation Performance Requirements for EGNOS overECAC (Draft) J.P. Dupont, ESA GNSS-1 Project Office

March 27, 1998

[6] Draft ICAO GNSS SARPs Version 7, August 1998

[7] Technical Note on EGNOS Operational Test & Validation AENA, OPE/006.98/JRM,Draft Issue, 10.02.1998SRD/DP/108

[8] The Role of the ASQF in the EGNOS Operational Test andValidation

AENA, OPE/016098/JR,Issue 1.0, 08.05.1998

[9] The Natural Measurements of a GPS Receiver, N. Ward ION-GPS ‘95

[10] Certification Policies, Procedures and Requirements forSatellite based Navigation and Landing Systems andcorresponding Research Activities (CESAR), CESARIndustrial Team on behalf of BMV/BMBF (Germany)

CESAR 2. Report

[11] EGNOS System Test Bed architecture, design and develop-ment, P. Raizonville, R. Hanssen, P. Gouni, J.M. Gaubert, N.Zarraoa

ION GPS ’98, Nashville,USA

[12] Formal Inspections of Software and Documentation,EUROCONTROL

EEC/SEU/ST/0004

[13] Software Quality Assurance Plan, IEEE IEEE Std. 730-1989

[14] Software Configuration Management Plans, IEEE IEEE Std. 828-1990

[15] Software Test Documentation, IEEE IEEE Std. 829-1983

[16] Software Project Management Plans, IEEE IEEE Std. 1068.1-1987

[17] Manual on the Required Navigation Performance (RNP) ICAO Doc. 9613, 1994

PROGRAMME OUTLINE EEC Report No. 342 - Eurocontrol...Braunschweig TU Braunschweig Roke Manor...

Documents

Transcript of PROGRAMME OUTLINE EEC Report No. 342 - Eurocontrol...Braunschweig TU Braunschweig Roke Manor...