A: While GPS satellite faults have always been infrequent, they have become rarer in the past decade due to the maturity of the GPS constellation and its Operational Control Segment (OCS). Lessons learned from past GPS satellite failures have also aided the development of newer GNSS constellations such as the European Galileo.
Rebecca Wang, Todd Walter, Sam Pullen, Stanford University
The resulting improvements in GNSS performance and reliability mostly go unnoticed by the majority of GNSS users but are real and important.
The civil community that supports GNSS users with demanding integrity requirements (meaning tight limits on the probability of unbounded and undetected errors) needs to understand both the probability and dynamics of different classes of satellite failures to certify that augmentation systems such as SBAS and GBAS and algorithms for unaugmented users adequately protect all user classes and levels of service. Automated methods have been developed to analyze GNSS satellite measurements and navigation data recorded over time by global reference station networks such as the International GNSS Service (IGS) at igs.org. The results of these studies have been used to both better understand rare-event GNSS satellite behavior and confirm that performance standards relied on by civil users, such as those in the GPS Standard Positioning Service Performance Specification (GPS SPS PS) [1], have been and continue to be met with margin (for more on this, see the “GNSS Solutions” article in the May/June 2022 issue of Inside GNSS).
This article summarizes recent results published in [2] showing examples of GPS and Galileo satellite faults and “near faults” over the past six years (2017 to 2022) and into 2023. The focus here is on “integrity faults,” meaning the subset of satellite faults that are not immediately obvious to users and thus could lead to loss of user integrity if not detected and alerted by augmentation system or user monitoring. These are distinct from more-common satellite outages triggered by loss of signal tracking or health parameter flags in navigation data. In this article, integrity faults are often just called “faults” for simplicity.
GNSS Satellite “Integrity Faults” and “Near Faults”
The definition of a satellite integrity fault for both GPS and Galileo is a range error that exceeds KF σURA, where σURA represents a one-sigma bound on satellite User Range Accuracy provided by the constellation, and KF is a unitless multiplier. σURA is a bound that allows use of the standard Normal (Gaussian) distribution with zero mean and the given standard deviation, thus KF is based on the standard Normal deviation at the specified integrity probability. For example, the probability of an individual GPS satellite being in an integrity-faulted state should not exceed 10-5 according to [1]. The standard Normal deviation that exceeds this probability, considering both positive and negative errors, is 4.42, thus KF_GPS = 4.42. The value of this probability for Galileo is 3×10-5 from [3], thus KF_Galileo= 4.17.
GPS and Galileo are different in that σURA for GPS is included within the broadcast navigation data and, for Legacy navigation (LNAV) data, is usually 2.4 meters but occasionally rises to 3.2 meters or higher. Galileo, on the other hand, specifies a fixed value of 6 meters for σURA when two frequencies (E1 and E5a) are used to estimate and remove ionospheric delay from the measured pseudoranges [3]. While this may change in the future, the current range error threshold for Galileo integrity faults (6 meters × 4.17 ≅ 25.0 meters) is much looser than the most common GPS value (2.4 meters × 4.42 ≅ 10.6 meters).
In this article, the maximum range error among user locations that can view and track the satellite is evaluated and compared to the fault criteria. The normalized maximum projected error (MPE) is this error divided by the corresponding σURA. This normalization (MPE/σURA) reduces the fault definition to the comparison between MPE and KF, and is shown in Figure 1. In addition, because integrity faults are rare, recent GPS “near faults” are also examined. Near faults are defined by normalized MPE exceeding KNF = 2.5 [2], which is much smaller than KF but still represents a significant error that should be unlikely (with a probability of no greater than 0.0124 based on the standard Normal distribution).
Recent GPS Service History
Figure 1 shows an overview of the normalized MPE for all GPS satellites reporting healthy status from the beginning of 2017 to the end of 2021 (at 300-second intervals). Because the value of σURA in the GPS LNAV message is conservative, it is not surprising that the vast majority of the normalized MPE points in this plot are within –1 and 1. Some points exist between 1 and 2 (on either side of zero), but only four events exceed 2.5 and represent “near faults.” They are highlighted by red boxes in Figure 1 and are listed in Table 1. However, no actual fault events were observed. Three of the four near-fault events occurred in the last year of this period (2021), which might be due to chance but suggests that near faults might be becoming more frequent. Of greater importance is the fact that, since the end of 2021, two faults (not just near faults) have occurred. These are shown in Table 2. The first of these, on October 2, 2022, was the first integrity fault observed on GPS in more than 10 years (since June 17, 2012), while the second integrity fault followed it by less than four months.
Figures 2 and 3 show details of the satellite error behavior on GPS PRN 12 (SVN 58) that led to the fault event on October 2, 2022 [2]. In Figure 2, the definition of a fault based on 4.42 times the broadcast σURA is shown by the thick blue lines. A slow clock error ramp (the purple curve in Figure 2 and the second plot in Figure 3) began around 10:20 (UT) and increased over five hours before finally crossing the fault definition at about 15:10. Afterward, the satellite remained in a faulted state for about 45 minutes before the satellite transmits updated navigation data (indicated by an IODC change in the bottom plot of Figure 3) that corrects the error. Note the satellite was never flagged as unhealthy and instead returns to nominal performance when new navigation data is uploaded by the OCS and begins being transmitted. This behavior is not typical, but it was also observed in the two previous GPS satellite faults on April 25, 2010 and June 17, 2012 as reported in [4]. It also appears that an earlier navigation data update tried to correct the problem with limited success: the update at around 11:00 reduced the clock error but did not remove the ramp-wise error growth.
Figures 4 and 5 show details of the satellite error behavior on GPS PRN 1 (SVN 63) that led to the most recent observed fault event on January 25, 2023 [2]. Here, the fault was caused by an obvious (in retrospect) clock error jump occurring at roughly 16:10. The fault lasted for about 185 minutes until roughly 19:15, when the satellite is set unhealthy by an OCS navigation upload with a new IODC. The maximum clock error of about 27 meters significantly exceeded the 10.6-meter fault definition, and the duration of the fault was significantly longer than any of the previous fault durations observed since 2008. Once the satellite was flagged as unhealthy, it remained that way until approximately 15:45 on the following day (January 26, 2023), when another upload returned the satellite to a healthy state.
These two recent GPS satellite faults have similar characteristics to those observed from 2008 to 2012 [4], but like the recent uptick in near-fault events, the occurrence of two faults in relatively rapid succession is concerning. The PRN 12 clock fault on October 2, 2022, had less effect on users because the 4.42×σURA fault definition was only slightly exceeded after several hours of slow error growth. However, because it appears that several unscheduled navigation data uploads were made, presumably to attempt to correct the error, it is unclear why the GPS OCS did not flag the satellite as unhealthy sooner before correcting the error. One possibility is that, because the error remained small and well below the fault threshold for some time, there was no immediate perceived need to take decisive action. The most recent fault on January 25, 2023, was likely due to anomalous behavior of the clock on the satellite and could not be foreseen or prevented by OCS action, but the delay of more than 3 hours before flagging the satellite unhealthy seems odd, given the resulting MPE suddenly grew to over 2.5 times the fault definition. Section 3.5.1 of the GPS SPS PS [1] cites a maximum fault state duration of 6 hours, which to our knowledge has never been exceeded. The mean fault state duration is specified as 1 hour, which is still met when averaging across all faults observed since 2008.
Recent Galileo Service History
Because the Galileo satellite constellation is much younger than GPS and only achieved Early Operational Capability (EOC) in late 2016, it would not be surprising if it suffered integrity faults more often than GPS, particularly because GPS itself had a higher rate of faults prior to 2008. While large errors did occur on multiple Galileo satellites in July 2019 due to a ground-system problem, this was not an integrity fault because safety-critical users following the guidance in the Galileo OS SDD [3] would not have used the erroneous signals and data [5].
Figure 6 gives a graphic overview of Galileo satellite behavior from January 2018 to the end of June 2022 [2]. It shows periods of known “unhealthy periods” with blue lines and includes the July 2019 event in which many satellites were simultaneously unusable. Four integrity faults are also shown in Figure 6 and are highlighted by pink boxes. Table 3
indicates the affected satellites and the duration of these fault events. The first two of these faults were on the earlier generation of IOV satellites, while the latter two were on the same FOC satellite (SVN 210). All four of these events had short fault state durations of about 40 minutes or less before the satellites were flagged as (potentially) unhealthy based on the broadcast signal-in-space accuracy (SISA) parameter, which changed from indicating finite values to “No Accuracy Prediction Available” or “NAPA.” Satellites with SISA messages of NAPA are either unhealthy or of “marginal” health according to [3] and should not be used in safety critical applications.
Two of the four Galileo satellite faults in Table 3 are illustrated in detail. Figures 7 and 8 show the fault on October 29, 2019 on PRN 11 [2]. As shown in Figure 7
and the second plot in Figure 8, at 17:55, the clock error began to quickly “ramp off” in an unbounded manner. At roughly 18:05, the MPE exceeded the 25-meter Galileo fault definition, and roughly 40 minutes later, at 18:45, the broadcast SISA changed from 3.12 meters to NAPA. The clock error grew to be about 500 meters at the end of the fault duration (when NAPA was broadcast), after which it grew to be greater than 5,000 meters. Meanwhile, the top plot of Figure 8 shows the along-track and cross-track dimensions of satellite ephemeris error also grew in a ramp-like fashion but stayed at nominal values below ± 2 meters during the interval shown. However, the marginal/unhealthy status persisted for more than one day, and during this period, the radial, along-track, and cross-track errors continued to grow and became significant as well. The satellite was not fully restored to healthy and usable status until almost one month later, on November 28, 2019.
Finally, Figures 9 and 10 show the most recent observed Galileo fault on PRN 1 on April 29, 2022 [2]. This fault also was a rapid ramp-like clock error increase and was similar to the October 2019 fault as well as the September 2021 fault on the same satellite. In this case, the ramp started around 00:58 and exceeded the fault definition at around 01:00. The MPE of this fault settled at about 250 m, which is smaller than the 2019 and 2021 faults but is still very large. The fault duration lasted about 12 minutes until a SISA value of NAPA was broadcast at 01:12. After almost one month, on May 25, 2022, the satellite became healthy and usable again.
GPS and Galileo Satellite Integrity Fault Comparison
Three things stand out from this review of GPS and Galileo satellite faults. The first is the dominant cause of these faults is clock error ramps in which the atomic clock driving the satellite signal grows quickly and unpredictably. This is not new—it has been the most common cause of GPS satellite faults since observations began around 2000. Ephemeris error growth sufficient to exceed the definition of a fault has also occurred but is much less common.
Second, while both GPS and Galileo respond to satellite faults quickly, the mechanism of curing the fault condition differs. Both systems indicate faulty conditions by uploading updated navigation data, but GPS sometimes attempts to correct the errors with updated clock and ephemeris navigation data rather than proceeding immediately to “unhealthy” status, particularly when the error growth is relatively slow and straightforward to correct. Galileo instead appears to almost always respond first by updating the SISA parameter to NAPA and attempting correction and repair later. The fact the Galileo faults described here have rapid clock-driven error growth leading to large MPE values is one reason the first Galileo response is to alert loss of health through NAPA. Fortunately, this response is rapid, as the maximum fault duration observed since 2018 is 40 minutes.
Third, integrity faults on both GPS and Galileo remain quite rare and appear to satisfy the promised state probabilities of below 10-5 for GPS and 3×10-5 for Galileo with margin. Estimates of these probabilities based on the years of observations reported here and in [4] are given in [2]. GPS has had two integrity faults in the past six months, which is surprising considering the lack of any such faults between 2012 and 2022 (at least as observed by the methods used here).
Summary
This article provides an overview of recent GNSS satellite integrity faults and shows examples of such faults in both GPS and Galileo. While the specifics differ, the nature of these faults and the means by which GPS and Galileo responds to them are broadly similar. The probabilities of these faults remain below the standards issued by both systems. However, the recent occurrence of two GPS faults after many years without any demonstrates that offline monitoring of GPS, Galileo and other GNSS constellations must continue without pause to provide confidence that these standards remain met in the future.
Acknowledgments
The authors thank the FAA Satellite Navigation Team for funding this work under Memorandum of Agreement 693KA8-22-N-00015 and for their continuous support over many years.
References
(1) GPS Standard Positioning Service (SPS) Performance Standard (GPS SPS PS), Washington DC, U.S. Dept. of Defense, 5th Edition, April 2020. https://www.gps.gov/technical/ps/2020-SPS-performance-standard.pdf
(2) R. Wang and T. Walter, “Characterization and Comparison of Galileo and GPS Anomalies,” Proceedings of ION 2023 International Technical Meeting (ITM). Long Beach, CA, Jan. 2023. http://web.stanford.edu/group/scpnt/gpslab/pubs/papers/Wang_ION_ITM_2023_GNSS_Faults.pdf
(3) Galileo–Open Service–Service Definition Document (Galileo OS SDD), European Union Agency for the Space Programme (EUSPA), Issue 1.2, Nov. 2021. https://www.gsc-europa.eu/sites/default/files/sites/all/files/Galileo-OS-SDD_v1.2.pdf
(4) T. Walter and J. Blanch, “Characterization of GNSS Clock and Ephemeris Errors to Support ARAIM,” Proceedings of 2015 ION Pacific PNT Meeting, Honolulu, HI, April 2015. http://web.stanford.edu/group/scpnt/gpslab/pubs/papers/Walter_IONPNT_2015_ARAIM_characterization.pdf
(5) E. Chatre and J. Benedicto, “2019–Galileo Programme Update,” Proceedings of ION GNSS+ 2019. Miami, FL, Sept. 2019. https://doi.org/10.33012/2019.1690
Authors
Rebecca Wang is a graduate student in the GPS Research Laboratory working under the guidance of Professor Todd Walter in the Department of Aeronautics and Astronautics at Stanford University. Prior to joining the lab, Rebecca received her B.S. in Aerospace Engineering at the University of Texas at Austin. Her research interests include multi-GNSS integrity for aviation and high-accuracy navigation.
Todd Walter is a Research Professor in the Department of Aeronautics and Astronautics at Stanford University. He is also a member of the National Space-Based Positioning, Navigation, and Timing (PNT) Advisory Board. His research focuses on implementing satellite navigation systems for safety-of-life applications. He has received the Institute of Navigation (ION) Thurlow and Kepler awards. He is also a fellow of ION and has served as its president.
