Let me begin with a quote worth repeating — “Do we really need to wait for a catastrophe before taking action against GNSS vulnerabilities ?” — and follow with an extension of scope beyond.

It’s encouraging to see LinkedIn discussions recognizing ADSB limitations that preclude dependable collision avoidance capability – but that recognition needs to be far more widespread. The limitations are both severe and multifaceted including, in addition to vulnerability from inadequate security,
* accuracy goals based on present position instead of the monumentally more important relative velocity — ADSB allows 10 meter/sec velocity error (!), without characterization as vectorial or relative or probabilistic.
* the glaring but near-universal flaw of sharing coordinates, thereby failing to exploit what made differential operation spectacularly successful: work with individual measurements separately.
Note that these deficiencies existed long before the emergence of unmanned vehicles. The need to correct them is as fundamental as it is urgent. I’ve communicated these concerns over and over, most recently receiving a gratifying response from my June 11 presentation to the satnav National Advisory Board, with details available from URLs at the end.
In that presentation I cited a successful flight validation achieving accuracy on the order of cm/sec, for the crucially important relative velocity between vehicles that can be on or near a collision course. That is a thousand times less error than the 10 meter/sec allowed by ADSB. Furthermore, reduction by a thousand in each of three directions translates into a billion times less volume of uncertainty — or, in just two dimensions at fixed altitude, a million times less area. To realize this crucial safety improvement no new discoveries are needed and no new equipment needs to be invented; only the content of transmitted data needs to change: measurements rather than coordinates. Yet usage of the method is not being planned. After initially proposed before 2000, a limited support program started within the past few years is the only step taken toward this direction.

No claim is made that the last word has been spoken or that introduction of the needed modifications — nor accompanying regulation — would be trivial.  The intent here is not criticism and complaints for the sake of criticism and complaints.  Emphasizing unwelcome reality always caries risk of drawing wrath.  Nevertheless, especially now with growing usage of unmanned vehicles, sounding an alarm is better than passively waiting for a calamity. So here’s an alarm: Inadequate preparation for collision avoidance is a microcosm of a much wider overall flaw in today’s decision-making process. For years substantial numbers of qualified people have spent extensive effort trying to prevent cataclysmic failures in one area or another involving PNT (position/navigation/timing).  They definitely deserve attention and action.

Anything approaching a thorough compilation of worthy advocacy would require considerable length; just a few recent examples are cited here.  Explanations tracing inaction to current shortcomings can logically include a diagnosis of dissatisfaction expressed at a pinnacle of authority within DoD. An even more current offering is only the latest expression of regret over insufficient support for satnav, describing a highly relevant chain of inaction over a multiyear period. Near the beginning of that period, a cover story for Coordinates magazine repeated a quote from the previous month’s cover story   The quote worth repeating, cited at the start of this, is a perfect expression of the frustration prevalent over a decade following the universally acclaimed 2001 Volpe report. Now, almost a decade-and-a-half after that report, partial progress toward a solution coexists with minimal progress toward collision avoidance — while unmanned vehicles are already threatening passenger flight safety. Now to extend the quote: “Do we really need to wait for a catastrophe before making better use of measurements — GNSS or otherwise — to prevent collisions in the presence of increased manned and unmanned traffic?”

In 2013 a phone presentation was arranged, for me to talk for an hour with a couple dozen engineers at Raytheon. The original plan was to scrutinize the many facets and ramifications of timing in avionics. The scope expanded about halfway through, to include topics of interest to any participant. I was gratified when others raised issues that have been of major concern to me for years (in some cases, even decades).  Receiving a reminder from another professional, that I’m not alone in these concerns, prompts me to reiterate at least some aspects of the ongoing struggle — but this time citing a recent report of flight test verification

The breadth of the struggle is breathtaking. The About panel of this site offers short summaries, all confirmed by authoritative sources cited therein, describing the impact on each of four areas (satnav + air safety + DoD + workforce preparation). Shortcomings in all four areas are made more severe by continuation of outdated methods, as unnecessary as they are fundamental, Not everyone wants to hear this but it’s self-evident: conformance to custom — using decades-old design concepts (e.g., TCAS) plus procedures (e.g., position reports) and conventions (e.g., interface standards — guarantees outmoded legacy systems. Again, while my writings on this site and elsewhere — advocating a different direction — go back decades, I’m clearly not alone (e.g., recall those authoritative sources just noted). Changing more minds, a few at a time, can eventually lead to correction of shortcomings in operation.

We’re not pondering minor improvements, but dramatic ones. To realize them, don’t communicate with massaged data; put raw data on the interface. Communicate in terms of measurements, not coordinates — that’s how DGPS became stunningly successful. Even while using all the best available protection against interference, (including anti-spoof capability), follow through and maximize your design for robustness;  expect occurrences of poor GDOP &/or less than a full set of SVs instantaneously visible. Often that occurrence doesn’t really constitute loss of satnav; when it’s accompanied by history of 1-sec changes in carrier phase, those high-accuracy measurements prevent buildup of position error. With 1-sec carrier phase changes coming in, the dynamics don’t veer toward any one consistent direction; only location veers during position data deficiencies (poor GDOP &/or incomplete fixes) and, even then, only within limits allowed by that continued accurate dynamic updating. Integrity checks also continue throughout.

So then, take into account the crucial importance of precise dynamic information when a full position fix isn’t instantaneously available. Take what’s there and stop discarding it. Redefine requirements to enable what ancient mariners did suboptimally for many centuries — and we’ve done optimally for over a half-century.  Covariances combined with monitored residuals can indicate quality in real time. Aircraft separation means maintaining a stipulated relative distance between them, irrespective of their absolute positions and errors in their absolute positions. None of this is either mysterious or proprietary, and none of this imposes demands for huge budgets or scientific breakthroughs — not even corrections from ground stations.

A compelling case arises from cumulative weight of all these considerations. Parts of the industry have begun to address it. Ohio University has done flight testing (mentioned in the opening paragraph here) that validates the concepts just summarized. Other investigations are likely to result from recent testing of ADSB. No claim is intended that all questions have been answered, but — clearly — enough has been raised to warrant a dialogue with those making decisions affecting the long term.

Avionics Commonality

A LinkedIn discussion centered on the Future Airborne Capability Environment (FACE) standard contained an important observation concerning certification.  Granted — requirements for validation, with acceptance by governing agencies, definitely are essential for safety. What follows here is advocacy for a proposed way to realize the common avionics benefits offered by FACE while retaining (and in fact, improving) the process of certification. Reasoning is based on three major items:

* CHANGE. In many respects this has necessitated improved standards. 

* HISTORY. Spectacular failures in what we have now are widely documented.

* COST. The status quo is (and, for a long time, has been) unaffordable.

In regard to the first item: the pace of change in so many areas (hardware, software, operating systems, data communication, etc., etc., etc.) — and the effects on procurement cycles — are well known. How can certification remain unchanged when nothing else does? That argument would be undercut if the process had a rock solid track record — but that theme would not be supported by the second item — history:

Myriad shortcomings of existing operational systems are so pervasive that no one is considered a “loose cannon” for openly discussing them. Any of my horror stories — too strange and too numerous to be revisited here — would be trumped anyway by a document from the government itself. GAO-08-467SP, in 2008, described outlandish cost overruns, schedule delays, and deficient technical performance in the defense industry. That 3-way combination speaks for itself. Now a significant addition: the certification process has not been at all immune to serious flaws. The first-ever certified GPS receiver is now well known to have failed spectacularly in multiple facets of integrity testing by another manufacturer. It is readily acknowledged that correction of those early problems is quite credible, but one issue is inescapable: Historical proof of flightworthiness improperly bestowed — with proprietary rights accepted for algorithms and tests –- happened,  and that was not widely known until much later.

There is still more, including integrity failure probability limits missed by orders-of-magnitude in certified GPS receivers, severe limitations of GO/NO-GO testing, and failed attempts to gain approval to set requirements for correcting those plus other deficiencies. For brevity here, those issues are covered by citing the fifth page from another related reference.

The final item is, after years of fruitless talk about cost reduction, being acknowledged — we can’t do what we’ve been doing any more.  With dollars being the ultimate driver of so many decisions, we might finally see the necessary break from ingrained habits. FACE already addresses the issues and the requisite justifications. To make it all happen, two essential ingredients are

* raw-data-across-the-board, and

* nonproprietary software, with standardization under government control.
Flight-validated algorithms already in existence can be converted (e.g., from proof-of-concept to in-flight real-time form) according to government specification, by small groups more interested in engineering than in dollars (yes, that does exist). The payoff in cost savings can be huge.

Significant momentum is evolving toward a role for Open System Architecture (OSA) applied to radar. My observations in connection with that, voiced in a short LinkedIn discussion, seem worth repeating here.

One step could add major impact to this development: Rather than position (or relative position) outputs, provide measured range, azimuth, elevation (doppler could optionally be added if applicable) on the output interface. That simple step would vastly improve effectiveness of track file maintenance. Before attempting to describe all reasons for improved performance, two obvious benefits can be identified first:
* ability to use partial information (e.g., range-only or, for passive operation, angle-only)
* proper weighting of data for updating track state estimates.
The first item is self-evident. The second arises from common-sense attachment of greater value to the most accurate information. An explanation:

One-sigma error ellipsoids for individual radar fixes are not spherical (not a beachball shape but more like a flattened beachball), even at close range. At longer distances the shape progresses from a frisbee to a pancake to a DVD. Kalman filtering has enabled us to capitalize on that feature for over a half-century. Without exploiting it, we effectively treat separate radar-derived “coordinates” by intersecting volumes in space that are common to overlapping spheres. Resulting uncertainty volume is enormously larger than it should be.

The feature just noted shows up dramatically when mixing data among multiple platforms. Consider cooperative engagement whereby participants, all tracking each other via network-transmitted GPS observations, share radar observations from an unknown non-participant. Share measurements or coordinates? No contest; multiple lines crossing from different directions can offer best (i.e., along-range) accuracies applicable in 3-D.

That fact (i.e., combining data from different sensors and different platforms further dramatizes available improvements) doesn’t diminish the basic issue; even with a time history of data from only one radar, a designer with direct measurements available — instead of, not in addition to, coordinates — can provide incomparably superior performance.

“Send Measurements not Coordinates” (1999; #66 from the “Published Articles” panel, opening with eight rock-solid reasons) was aimed at GPS rather than radar. Many of the principles are the same when mixing data with information from other platforms — and from other sensors such as GPS. There is no reason, in fact, why data from satellite navigation and radar can’t be combined in the same estimation algorithm. That practice hasn’t evolved but the historical separation of operations (e.g., navigation and surveillance), arising from old equipment limitations, should no longer be a constraint. Moreover, with focus shifted from tracking to navigation, integration with additional (e.g., inertial) data offers still more reasons for using direct measurements. Rather than loose integration, superior benefits are widely known to result as the sophistication progresses forward (tight. ultratight, and deep integration).

Further elaborations on “casting off our old habits” appear from different perspectives in various blogs, one-pagers, and a few manuscripts available at this site. If your library has a copy of GNSS Aided Navigation & Tracking  pages 203-4 show a way to implement the cooperative sharing of radar data obtained from a non-participant, among participants tracking each other via the mutual surveillance and tracking approach defined earlier in that same chapter.

Because so many operational systems (in fact, a vast majority) use reports in the form of coordinates, reiteration is warranted. The central issue is the content, not the amount, of data. Rather than coordinates, provide accurately time-stamped direct measurements with links connected to whichever platform observed the data (e.g., for satnav — pseudoranges; for radar — range, azimuth, elevation). Those links are automatically attached when Mode-S extended squiter (e.g., chosen for ADSB) is the means for conveying the data.  For message content, strictly disallow “massaging the data beyond the light of day” (e.g., by unknown processes, with uncertain timing, … ) which invariably results in enormous loss of performance in common occurrence today.

CONING in STRAPDOWN SYSTEMS

Free-inertial navigation uses accelerometers and gyros alone, unaided. For that purpose pioneers of yesteryear developed a variety of techniques, ranging from a 2-sample approach (NASA TND-5384, 1969) by Jordan to his and various others’ higher-order algorithms to reduce errors from noncommutativity of finite rotations in the presence of coning (and/or pseudoconing). The methods showed considerable insight and produced successful operation. Since it’s always good to have “another tool in the toolbox” I’ll mention here an alternative. What I describe here isn’t being used but, with today’s processing capabilities, could finally become practical. The explanation will require some background information; I’ll try to be brief.

a

A very old investigation (“Performance of Strapdown Inertial Attitude Reference Systems,” AIAA Journal of Spacecraft and Rockets, Sept 1966, pp 1340-1347) used the usual small-angle representation for attitude error expressed in the vehicle frame. With that frame rotating at a rate omega the derivative of that vector therefore contains a cross product of itself crossed with omega.  One contributor to that product is a lag effect from omega premultiplied by a diagonal matrix consisting of delays (e.g., transport lags equated to reciprocals of gyro bandwidths). Mismatch among those diagonal elements produces drift components with nonzero average, e.g., the x-component of the cross product is easily seen to be
aaaaaaaaaaa    (difference between y and z lags) times (omega_y) times (omega_z)
Even with zero-average (e.g., oscillatory) angular rates, that product has nonzero average due to rectification.  I then characterized the lags as delays from computation rather than from the gyros, with the lag differences now proportional to nonuniformities among RMS angular rate components along vehicle axes, and average products proportional to cross-correlation coefficients of the angular rate components. That was easy; I had a simple model enabling me to calculate the error due to finite gyro sampling rates producing finite rotation increments that don’t commute.

a

A theoretical model is only that until it is validated. I had to come up with a validation method with mid-1960s computational limitations. Solution came from a basic realization: performance doesn’t degrade from what’s happening but from belief in occurrences that aren’t happening. The first-ever report of coning (Goodman and Robinson, ASME Trans, June 1958) came from a gimballed platform that was believed to be stable while it was actually coning. If the true coning motion they described had been known and taken into account, then their high drift rates never would have occurred. The reason they weren’t taken into account then was narrow gimbal servo bandwidth; the gyros responded to the coning frequency but the platform servos didn’t. Now consider strapdown with the inverse problem: pseudoconing — a vehicle believed to experience coning when it isn’t. That will fall victim to the same departure of perception from reality. If you gave the same Goodman and Robinson coning motion to their strapdown gyro triad and sampled them every nanosecond, the effect from noncommutativity wouldn’t be noticeable.

a

Armed with that insight I then chose rotational dynamics with a closed form solution. Although rotations about fixed vehicle axes produced no coning, the pseudoconing was severe, with the apparent (reported-from-gyros) rotation axis changing radically within fractions of a millisecond; too fast for the 10 kHz data rate used in that computation.  The cross product formulation was then validated by making extensive sets of runs, always comparing two time histories:

* a closed form solution for a true direction cosine matrix corresponding to a vehicle experiencing a sinusoidal omega
* an apparent direction cosine matrix, obtained by brute-force but meticulous formation from processing gyro outputs at finite rates with quantization, time lags, and a wide variety of error sources.

That “bull-by-the-horns” computation allowed extended runs (up to a million attitude iterations) to be made for a wide range of angular rate frequencies, axis directions, and combinations of gyro input errors (steady, random, motion-sensitive, etc.). Deviation of apparent attitude from closed-form truth was consistently in close conformance to the analytical model, for a host of error sources. I have to admit that this “bull-by-the-horns” approach gave me an advantage of finding out answers before I understood the reasons for them. The cross-product analytical model didn’t come from my vision; it came after much head-scratching with answers computed from dozens of runs. A breakthrough came from the sensitivity, completely unanticipated, to angular acceleration about gyro output axes — clear in retrospect but not initially. After these experiences it occurred to me: if cross-axis covariances were known, the dominant contributor to errors — including noncommutativity — could be counteracted. I noted that on page 1342 of that old AIAA paper.

a

Finally I can describe the alternative means of compensating the dominant computational error. Description begins with the reason why it would be useful. Earlier I mentioned that many authors developed very good algorithms to reduce errors from noncommutativity of finite rotations in the presence of coning and/or pseudoconing. All that history, plus more detailed presentation of everything discussed here, can be found in Chapters 3 and 4 of my 1976 book plus Addendum 7.A of my 2007 book. A supreme irony upstages much of the work from those brilliant authors: without accounting for gyro frequency response characteristics, the intended benefit can be lost — or the “compensation” can even become counterproductive (Mark and Tazartes, AIAA Journal of Guidance, Control, & Dynamics, Jul-Aug 2006, pp 641-647). As if those burdens weren’t enough, the adjustment’s complexity — as shown in that paper — can be extensive. So :  that motivates usage of a simpler procedure.

 a

By now I’ve put so much explanation into preparing its description that not much more is needed to define the method. Today’s signal-processing boards enable the requisite covariances to be repetitively computed. Then just form the vector cross product already described and subtract the result from the gyro increments ahead of attitude updating. So much for coning and pseudoconing — but I’m not quite finished yet. The paper just cited leads to another consideration: even if we successfully removed all of the error theoretically arising from inexact computation, significant improvement in free-inertial performance would require more. Operation in the presence of vibrations would necessitate reduction of other motion-sensitive errors. Gyro degradations from rotations, for example, would have to be compensated — and that includes a multitude of components. For that topic you can begin with the discussion of gyro mounting misalignment following that up with the tables in Chapter 4 of my 1976 book and Addendum 4.B of my 2007 book.

LORAN REVISITED

Now that a few years have passed since the LORAN-C budget was killed, it might be a good time to revisit that decision. Unlike other decisions, this one might conceivably be undone; there hasn’t been the widespread demolition of resources (e.g., towers, transmitters) followed by restoration of sites. Something else, though, did occur: recent success achieved by cooperative effort between the Coast Guard and UrsaNav Inc.

For brevity here it suffices to make a few surface-scratching notes. The vast majority of us in the navigation community recognized the potential benefit of LORAN (and an extended form eLORAN) as a crucial backup — at extremely low cost — to be used when GPS is unavailable.  Many of us, furthermore, anxiously pressed for sanity (e.g., my “2-cents worth” written, to no avail, in 2009).

What’s different now, conceivably, is a combined effect of multiple factors:
* The USCG/UrsaNav success surpassed goals that had been stated earlier.
* Awareness of GPS vulnerability (therefore need for backup) has increased.
* Delay in follow-through (site restoration) offers the chance for a remedy.

An utterance appearing in Coordinates Magazine’s March 2012 cover story was reached from a different context, but its importance prompted me to cite it in the April 2012 cover story — and to repeat it here: “Do we really need to wait for a catastrophe before taking action against GNSS vulnerabilities?”

Once again I’m adding my voice to the chorus of those speaking out before it’s too late.

RUNWAY INCURSIONS

The number of runway incursions, as shown on an FAA URL  was nearly a thousand in FY 2011 and 1150 for FY 2012.  A subsequent article shows renewed interest in their prevention.

A hundredfold reduction in velocity error (from meters/sec to cm/sec) was shown in flight for squitter message transmission — but with measurement-based message content, as discussed in an accompanying blog.  A publication describing highly favorable results in air (3-D) could readily extend to 2-D (surface).

A 1996 crash that killed U.S. Commerce Secretary Ron Brown drew attention to a problem that has caused thousands of airline fatalities.  Controlled flight into terrain (CFIT) results from an autopilot driven by erroneous information regarding aircraft‘s flight path relative to its surroundings.  This writer narrowly escaped death in early January 1981 when an errant foreign airliner very nearly collided with the World Trade Center (that time it would have been accidental); an alert air traffic controller issued a turn directive just in time.  A highly informative IEEE-AES Systems Journal article by Swihart et.al. —
…. “Automatic Ground Collision Avoidance System Design, Integration, and Test” (May 2011, pp.-4-11)
addresses CFIT while envisioning, near the end, future extension to unmanned aircraft.  The authors correctly describe the effort as the beginning of a long-awaited development with a huge payoff in lives to be saved and, secondarily, in vehicles not destroyed.  As proof of my full concurrence — both with the intent and with the “long-awaited” characterization — I cite the following:

* a “GPS for Collision Avoidance” seminar I prepared in 2000 (hardly anyone attended — no funding, no interest — but safety shouldn’t take a back seat to economics).
* two coauthored papers (ICNS 2009 and ION-GNSS-2011) resulting from recent low-level support to Ohio Univ. by NASA.

 

It remains true to this day: much more needs to be done.  Without significant increase in development, life will be increasingly hazardous.  Both heavier traffic and unmanned aircraft will contribute to the increased danger.

BOOK on TRACKING

Tracking acceleration dynamics by GNSS, radar, imaging

My 2007 book on GPS and GNSS (GNSS Aided Navigation & Tracking), as its title implies, involves both navigation and tracking. This discussion describes the latter, covered in the longest chapter of the book (Chapter 9).  In addition to the flight-validated algorithms for navigation (processing of inertial sensor data, integration with GPS/GNSS, integrity, etc.), this text offers extensive coverage of tracking. Formulations are given for a variety of modes, in 2-D (e.g., for runway incursion prevention or ships) and 3-D (in-air), using GPS/GNSS and/or other sensors (e.g., radar, optical).  Position and velocity vectors are formed, in some operations joined by some or all components of acceleration.

This author was fortunate to be “at-the-right-places at-the-right-times” when a need arose to address each of the topics covered.  As a result, the words of one reviewer — that the book is

…………….. “teeming with insights that are hard to find or unavailable elsewhere.”

applies to tracking as well as to navigation.  The book identifies subtleties that arise in specific applications (aircraft, ships, land vehicles, satellites, long-range or short-range projectiles, reentry vehicles, missiles, … ). In combination with a variety of possible conditions affecting sensor suite and location (air-to-air; air-to-ground; air-to-sea surface; surface-to-air, etc. — with measurements associated with distance or direction or both; shared or not shared among participants who may communicate from different positions), it is not surprising that striking contrasts can arise, influencing the characterization and approaches used.  The array of formulations offered, while fully accounting for marked differences among operations, nevertheless exploits an underlying commonality to the maximum possible extent.

Tracking dynamics of aircraft, missiles, ships, satellites, projectiles, …

Formulations described in Chapter 9 were used for tracking of both aircraft and missiles, concurrently, through usage of an agile beam radar.  For another example, air-to-surface operations subdivide into air-to-ground and vessel tracking from the air.  That latter case constrains tracked objects’ altitudes to mean sea level — a substantial benefit since it obviates the need for elevation measurements, which are subject to large errors from refraction (bearing and range measurements, much less severely degraded, suffice). Air-to-ground tracking, by contrast, further subdivides into stationary and moving targets; the former potentially involves imaging possibilities (by real or synthetic aperture) while the latter — if not being imaged by inverse SAR — separates its signature from clutter via doppler.

Reentry vehicles, quite different from other track operations, present a unique set of “do’s” and “don’ts” owing to high-precision range measurements combined with much larger cross-range errors (because of proportionality to extreme distances involved).  Pitfalls from uncertain axial direction of “pancake” shaped one-sigma error ellipsoids must be avoided.  A counterexample, having angle observations only (without distance measurements), is also addressed.  Orbit determination is unique in still another way, often permitting “patched-conic” modeling for its dynamics.  A program based on Lambert’s theorem provides initial trajectories from two position vectors with the time interval separating them.

Those operations and more are addressed with most observations from radar or other (e.g., infrared imaging) sensors rather than satellite measurements.  That of course applies to tracked objects carrying no squitters. Friendlies tracking one another, however, open the door for using GNSS data.  Those subjects plus numerous supporting functions are discussed at some length in Chapter 9.  Despite very different dynamics applicable to various operations, the underlying commonality (Chapter 2) connects the error propagation traits in their estimation algorithms and also — though widely unrecognized — short-term INS error propagation under cruise conditions (Chapters 2 and 5).  Support operations such as synthetic aperture radar (SAR) and transfer alignment are described in the chapter Addendum.