GNSS Integrity and RAIM

A GNSS position can be wrong without looking wrong. A satellite with a faulty clock or corrupt orbit data goes on broadcasting a healthy-looking signal, and the FAA's AIM notes that delays of up to two hours can occur before the control segment detects and corrects an erroneous transmission. An aircraft on an approach needs to know within seconds. Navigation integrity closes that gap: confidence that the position is within the limits the operation requires, with a timely warning when it is not.

For aviation, integrity comes from augmentation. The aircraft-based augmentation system (ABAS) provides it on board, above all through receiver autonomous integrity monitoring (RAIM); satellite-based and ground-based augmentation systems broadcast integrity information from outside (see SBAS and GBAS augmentation). RAIM remains the foundation for aircraft without SBAS, and its rules are examined in EASA and FAA theory alike (see also GNSS and GNSS errors and dilution of precision).

Navigation integrity explained

Four qualities describe any navigation service:

• Accuracy: how close the computed position is to the true one, normally stated for 95% of the time.
• Integrity: the trust that can be placed in the position, including timely warnings when it should not be used.
• Availability: the proportion of time the service meets the requirements of the operation.
• Continuity: the ability to keep providing the service, once an operation has begun, without unplanned interruption.

Integrity is not accuracy. RAIM does not make a position more accurate; it tells the crew when the position may be unreliable. An accurate receiver without integrity monitoring can mislead without warning, which is why the AIM stresses that without RAIM the pilot has no assurance of the GPS position, and why VFR panel-mount and hand-held receivers, which have no RAIM alerting, are not authorised for IFR navigation.

Nor can the crew count on ATC to know. France, for example, publishes a difference from ICAO Annex 10: information on the operational status of GNSS is not provided to its aerodrome control, aerodrome flight information or approach control units.

Receiver autonomous integrity monitoring

RAIM works by redundancy. Four satellites give four equations for four unknowns, latitude, longitude, altitude and receiver clock bias, and the solution fits them exactly, leaving nothing to check. A fifth satellite over-determines the solution: the receiver can compare the positions given by different sets of four, and if one satellite is faulty they disagree. RAIM therefore needs at least five satellites, or four plus barometric altitude, to detect a fault.

Detection alone cannot say which satellite is at fault. The AIM distinguishes two kinds of RAIM message. One says there are not enough satellites, or not good enough geometry, to monitor integrity: the position may be acceptable, but it cannot be vouched for. The other says the monitor has detected an inconsistency for the current phase of flight. Either way, the position is no longer integrity-assured.

The test is scaled to the phase of flight. An IFR receiver changes its CDI sensitivity and its RAIM sensitivity together: to terminal sensitivity, ±1 NM, within 30 NM of the airport once the approach is armed, and to approach sensitivity from 2 NM before the final approach waypoint (FAWP), the CDI scale ramping down to ±0.3 NM at the waypoint. RAIM availability therefore depends on the number of satellites, their geometry and the limit to be protected, and geometry that is adequate en route may not support an approach.

In FAA terms, GPS receivers approved under TSO-C129 or TSO-C196, often called unaugmented or GPS-only equipment, depend on RAIM. SBAS receivers (TSO-C145 or TSO-C146) receive integrity information with the corrections inside SBAS coverage, and revert to GPS-only operation, with RAIM, outside it.

Fault detection and exclusion

Fault detection and exclusion (FDE) goes one step further. With six satellites, or five plus baro-aiding, the receiver can identify the faulty satellite, remove it from the solution and carry on with an integrity-assured position. Detection stops the operation; exclusion lets it continue.

FDE matters wherever there is no fallback. The FAA allows suitably approved GPS equipment to be used instead of another long-range navigation system, such as dual INS, in oceanic and remote areas, and describes SBAS equipment as capable of oceanic and remote operations once the operator has an FDE prediction program. FDE also eases alternate planning: an operator whose GPS equipment has FDE, and who makes a RAIM prediction, may plan a GPS-based approach at either the destination or the alternate, but not at both. SBAS receivers normally exclude a bad satellite using the SBAS data, or by FDE outside coverage.

Baro-aiding and other ABAS

ICAO's term ABAS covers every way in which the aircraft improves GNSS integrity with what it carries: RAIM and FDE using the satellites alone, and the integration of other sensors, notably the barometric altimeter and the inertial reference system.

Baro-aiding, or barometric aiding, feeds pressure altitude into the solution as if it were one more range measurement, so the fix and the integrity check each need one satellite fewer. It improves the availability of integrity monitoring but does nothing for propagation errors or the receiver clock. The receiver needs the current altimeter setting, entered as its operating manual describes, and the AIM warns against using GPS-derived altitude for the purpose, because GPS vertical errors are large enough to invalidate the integrity monitoring.

In airliners, GNSS is usually combined with the inertial reference system. On the A320, the GPS receivers feed the ADIRUs, each of which computes a hybrid GPS/IRS position that the FMGCs use. Integrity monitoring can then use inertial data as well. Autonomous integrity monitored extrapolation (AIME) is such a method: it uses the inertial solution to monitor the satellite measurements over time and to extrapolate an integrity-assured position through periods when satellite geometry alone would not support RAIM. Airbus states that, for RNP 1, RNP 2 and RNP 4 operations and for RNAV (GNSS) and RNAV (RNP) approaches, RAIM/AIME availability has been demonstrated 100% of the time with 24 healthy satellites. The crew sees the outcome as GPS PRIMARY on the ND and MCDU: an RNAV (GNSS) approach may be flown only with GPS PRIMARY available, and while it is available no separate navigation accuracy monitoring is required on the approach.

Integrity limits and time to alert

Integrity is expressed as limits. For each fix the receiver computes a protection level, a radius around the indicated position that contains the true position with the very high probability integrity requires. GPS receivers output the horizontal value as the horizontal integrity limit (HIL). On the A320, the HIL is among the GPS data transmitted by ADS-B Out, where it underlies the containment radius reported to ground systems (see ADS-B). The receiver compares the protection level with the alert limit of the operation: while the HIL is within it, integrity is assured; when it exceeds the limit, or the RAIM test detects a fault, the receiver must alert.

Alert limits tighten as operations become more demanding. The AIM gives the lateral limit as 0.3 NM (556 m) for GPS approaches to LNAV and LNAV/VNAV minima and 40 m for LPV, which also brings a vertical limit: 50 m for LNAV/VNAV and for LPV with minima of 250 ft or more, and 35 m for LPV with minima below 250 ft. Limits that tight are beyond RAIM, which is why LPV needs SBAS.

The time to alert is the longest the system may take between the moment the position error exceeds the alert limit and the moment the crew is warned. It too shortens with the phase of flight: approach operations allow a time measured in seconds. An integrity requirement therefore combines an alert limit, a time to alert and a very small acceptable probability of misleading information going unannounced.

Flight management systems show a related figure, the estimated position uncertainty (EPU), called actual navigation performance (ANP) on Boeing aircraft, and alert when it exceeds the required RNP value (see performance-based navigation).

Loss of integrity

A loss of integrity (LOI) annunciation, or a RAIM alert under whatever name the receiver uses, means the position can no longer be relied on for the current phase of flight. The receiver may keep navigating, but its information is advisory only. The response depends on where it happens:

• En route and in the terminal area, with unaugmented GPS: the alternate means of navigation that such installations must carry, such as VOR or DME/DME/IRU, must now be actively monitored; while RAIM was available it need not have been.
• Before the FAWP: do not start the final descent. The receiver checks RAIM by 2 NM before the FAWP as a condition for entering approach mode. If it does not change to approach mode, or a RAIM alert appears, proceed to the missed approach waypoint via the FAWP, fly the missed approach and contact ATC as soon as practical.
• After the FAWP: climb and fly the missed approach.

SBAS approaches add a subtlety. Once an approach is active, the receiver does not fall back by itself to a lower level of service. If only the vertical flag appears on an LPV or LNAV/VNAV approach, the pilot may continue to LNAV minima where the operating rules allow a change of approach type after starting; if the lateral integrity limit is exceeded on an LP approach, a missed approach is necessary.

On the A320 the corresponding event is GPS PRIMARY LOST: RNP operations may continue if the RNP value is checked on the MCDU and HIGH accuracy is displayed, but an RNAV (GNSS) approach requires GPS PRIMARY.

RAIM availability prediction

Because satellite geometry is predictable, so is RAIM availability at a given place and time. The AIM stresses that previous experience at an airport proves nothing, because the constellation keeps changing. For unaugmented GPS the prediction is required: before an IFR flight the pilot confirms that RAIM will be available at the destination around the ETA, and a prediction answers only that question, whether the warning capability will exist, not whether the database is current or the fix accurate.

In the United States the prediction can come from:

• the receiver's own prediction function or a manufacturer's program;
• the FAA's Service Availability Prediction Tool (SAPT), on its en route and terminal RAIM prediction website;
• a flight service briefing, normally covering one hour either side of the ETA;
• M-series NOTAMs for military airfields, available up to 24 hours ahead.

European practice is similar. At Toulouse Blagnac, for example, the AIP requires aircraft using GPS on the RNAV arrivals to confirm the predicted availability of RAIM for the planned flight path and its duration before take-off. On long flights the AIM suggests rechecking the destination prediction en route, since an unscheduled satellite outage may have occurred since departure.

If an outage is predicted, the plan changes: another navigation and approach system, another route or destination, or a delay. Training material adds that when the destination offers only GNSS approaches, the alternate should have one that does not depend on GNSS. The FAA states the rule outright: a required alternate must have an approach that does not need GPS, unless the FDE conditions above are met. SBAS users may plan a GPS-based approach at an alternate, but on its LNAV or circling minima.

Sole-means and supplemental use

The terms describe how far a navigation system may be relied on alone. A supplemental means of navigation meets the accuracy and integrity requirements of an operation but must be used alongside another approved system carried on board. A sole-means system, for a given operation, meets all the requirements, including availability and continuity, and needs no other navigation equipment for that operation.

Basic GPS was certified as a supplement: the AIM describes TSO-C129 avionics as certified as a supplement to other means of navigation. An aircraft using unaugmented GPS under IFR must therefore carry an alternate approved and operational means of navigation suitable for the route, such as VOR or DME/DME/IRU, and the ground facilities needed for the route to the destination and any alternate must be operational. SBAS equipment is evaluated without reliance on other navigation systems, so it does not require other equipment appropriate to the route, although an alternate means of navigation remains advisable.

Commercial operations add a layer. The FAA requires two independent navigation systems suitable for the route, or one system plus an independent backup. More than 50 NM offshore, dual GPS-based systems may count as independent; on all other flights, the second system must be independent of GPS. In Europe, GNSS operations are defined by performance-based navigation specifications, such as RNP APCH, which set the required accuracy, integrity monitoring and crew procedures; EASA certifies the aircraft for them under CS-ACNS, which in 2019 took over the earlier AMC 20-27A (see RNP approaches).

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.