Integrity Lessons from the WAAS Integrity Performance Panel (WIPP)

The Wide Area Augmentation System (WAAS) is unlike any previous navigation system fielded by the FAA. Historically the FAA has implemented relatively simple and distributed systems. Each only affects a small portion of the airspace and each is maintained independently of the others. WAAS, in contrast, is a complex and centralized, system that provides guidance to the whole airspace. Consequently, the certification for WAAS must proceed very cautiously. WAAS is being pursued because its potential benefits are significant. It will provide guidance throughout the national airspace. It will enable approaches with vertical guidance to every runway end in the United States without requiring local navigational aids. It will enable advanced procedures such as curved approaches and departures. Eventually it will allow greater capacity through smaller separation standards. These and other benefits motivate the effort to create and certify this new type of system. Although the analysis becomes much more difficult, the system must maintain the same or higher level of safety than the existing infrastructure. Another difference with WAAS is that it is inherently a non-stationary system. It relies on satellites that are constantly in motion and that may change their characteristics. Additionally, the propagation of the satellite signals varies with local conditions. Thus, the system has differing properties over time and space. However, the system requirements apply to each individual approach. In particular, the integrity requirement, that the confidence bound fails to contain the true error in fewer than one in ten million approaches, must apply to all users under all foreseeable operational conditions. To ensure that the integrity requirement would be met, the FAA formed the WAAS Integrity Performance Panel (WIPP). The role of the WIPP is to independently assess the safety of WAAS and to recommend system improvements. To accomplish these tasks, the WIPP had to determine how to interpret the integrity requirement for WAAS, develop algorithms to meet this requirement, and ultimately validate them. INTRODUCTION The Wide Area Augmentation System (WAAS) monitors the Global Positioning System (GPS) and provides both differential corrections to improve the accuracy and associated confidence bounds to ensure the integrity. WAAS utilizes a network of precisely surveyed reference receivers, located throughout the United States. The information gathered from these WAAS reference Stations (WRSs) monitors GPS and its propagation environment in real-time. However, WAAS designers must be aware of the limitations of its monitoring. The observables are corrupted by noise and biases causing certain fault modes to be difficult to detect. Because it is a safety-of-life system, WAAS must place rigorous bounds on the probability that it is in error, even under faulted conditions. In late 1999, concerns arose over the WAAS design and the process by which WAAS was to be proven safe. In response, the FAA created the WAAS Integrity Performance Panel (WIPP). The WIPP is a body of GPS and system safety experts chartered to assess the system engineering and safety design of WAAS and recommend any required changes. The WIPP consists of members from government (FAA, JPL), industry (Raytheon, Zeta, MITRE), and academia (Stanford University). They first convened in early 2000 to address the integrity and certification of WAAS. Primarily the WIPP quantified the degree to which WAAS mitigated the system vulnerabilities. Over the next two years, the WIPP changed the design of several system components where the system could not satisfactorily demonstrate the required level of integrity. As each threat was addressed, the WIPP built upon what it had learned. Some of the main lessons that emerged from the WIPP are: ß The aviation integrity requirement of 10 per approach applies in principle to each and every approach. It is not an ensemble average over all conditions. ß For events where fault modes or rare events are not known, validated threat models are essential both to describe what the system protects against and to quantitatively assess how effectively it provides such