Assessing avionics-based GNSS integrity augmentation performance in UAS mission- and safety-critical tasks

The integration of Global Navigation Satellite System (GNSS) integrity augmentation functionalities in Unmanned Aerial Systems (UAS) has the potential to provide an integrity-augmented Sense-and-Avoid (SAA) solution suitable for cooperative and non-cooperative scenarios. In this paper, we evaluate the opportunities offered by this integration, proposing a novel approach that maximizes the synergies between Avionics Based Integrity Augmentation (ABIA) and UAS cooperative/non-cooperative SAA architectures. When the specified collision risk thresholds are exceeded, an avoidance manoeuvre is performed by implementing a heading-based differential geometry or pseudospectral optimization to generate a set of optimal trajectory solutions free of mid-air conflicts. The optimal trajectory is selected using a cost function with minimum time constraints and fuel penalty criteria weighted for separation distance. The optimal avoidance trajectory also considers the constraints imposed by the ABIA in terms of UAS platform dynamics and GNSS satellite elevation angles (plus jamming avoidance when applicable), thus preventing degradation or loss of navigation data during the Track, Decision and Avoidance (TDA) process. The performance of this Integrity-Augmented SAA (IAS) architecture was evaluated by simulation case studies involving cooperative and non-cooperative platforms. Simulation results demonstrate that the proposed IAS architecture is capable of performing high-integrity conflict detection and resolution when GNSS is used as the primary source of navigation data.


INTRODUCTION
The integration of Unmanned Aircraft Systems (UAS) into non-segregated airspace presents a series of safety challenges [1]. One of the main challenges is the provision of a certifiable Sense-And-Avoid (SAA) capability. In addition to Space Based Augmentation Systems (SBAS) and Ground Based Augmentation Systems (GBAS), Global Navigation Satellite System (GNSS) another form of augmentation has been developed that exploits the information provided by other avionic systems. In most cases, the additional avionic systems operate via separate principles than the GNSS and, therefore, are not subject to the same sources of error or interference. A system such as this is referred to as Avionics-Based or Aircraft-Based Augmentation System (ABAS). The ABAS approach is particularly well suited to increase the levels of integrity and accuracy (as well as continuity in multi-sensor data fusion architectures) of GNSS in a variety of mission-and safety-critical aviation applications. In Unmanned Aerial System (UAS) applications, airworthiness requirements for both cooperative and non-cooperative Sense-and-Avoid (SAA) impose stringent GNSS data integrity requirements. Therefore, a properly designed and certifiable Avionics Based Integrity Augmentation (ABIA) capability would allow an extended spectrum of autonomous and safety-critical operations by continuously monitoring GNSS integrity levels and providing suitable caution and warning signals to the remote pilot or to the avionics flight control systems in order to accomplish GNSS-based mission and safety-critical tasks. This increased level of integrity could provide a pathway to support the unrestricted access of UAS to commercial airspace. Although current and likely future SBAS/GBAS augmentation systems can provide significant improvement of GNSS navigation performance, a properly designed and flight certified ABAS/ABIA system could play a key role in GNSS integrity augmentation for aviation safety-critical applications, including UAS SAA. Furthermore, using suitable data link and data processing technologies on the ground, a certified ABAS capability could be a core element of a future GNSS Space-Ground-Avionics Augmentation Network (SGAAN).

II. ABIA SYSTEM RESEARCH
Previous research on ABIA systems demonstrated the potential of this technology to enhance GNSS integrity performance in a variety of mission-and safety-critical applications including experimental flight test/flight inspection, precision approach and automatic landing [2][3][4][5]. Therefore, an advanced ABIA system was developed for UAS applications (Fig. 1). In this system, the on-board sensors provide information on the aircraft relevant flight parameters (navigation data, engine settings, etc.) to an Integrity Flag Generator (IFG), which is also connected to the GNSS system. Using the available data on GNSS and the relevant Unmanned Aircraft (UA) flight parameters, integrity signals are generated which can be sent to the UAS Ground Control Station (GCS) or used by a Flight Path Optimisation Module (FPOM). This system addresses both the predictive and reactive nature of GNSS integrity augmentation by producing suitable integrity flags (cautions and warnings) in case of predicted/ascertained GNSS data losses or unacceptable signal degradations exceeding the Required Navigation Performance (RNP) specified for each phase of flight, and providing guidance information to the remote pilot/autopilot to avoid further data losses/degradations. To achieve this, the Integrity Flag Generator (IFG) module produces the following integrity flags [2][3][4]:  Caution Integrity Flag (CIF): a predictive annunciation that the GNSS data delivered to the avionics system is going to exceed the RNP thresholds specified for the current and planned flight operational tasks (alert status).
 Warning Integrity Flag (WIF): a reactive annunciation that the GNSS data delivered to the avionics system has exceeded the RNP thresholds specified for the current flight operational task (fault status).
The following definitions of Time-to-Alert (TTA) are applicable to the ABIA system [2][3][4]:  ABIA Time-to-Caution (TTC): the minimum time allowed for the caution flag to be provided to the user before the onset of a GNSS fault resulting in an unsafe condition.
 ABIA Time-to-Warning (TTW): the maximum time allowed from the moment a GNSS fault resulting in an unsafe condition is detected to the moment that the ABIA system provides a warning flag to the user.

III. ABIA INTEGRITY FLAG GENERATOR
The main causes of GNSS data degradation or signal losses in aviation applications were deeply analysed in [2] and are listed below:  Antenna obscuration (i.e., obstructions from the wings, fuselage or empennage during maneuvers);  Adverse satellite geometry, resulting in high Position Dilution of Precision (PDOP);  Fading, resulting in reduced carrier to noise ratios (C/N 0 );  Doppler shift, impacting signal tracking and acquisition/reacquisition time;  Multipath effects, leading to a reduced C/N 0 and to range/phase errors;  Interference and jamming.
Understanding the physics of these phenomena and developing reliable mathematical models was essential in order to properly design the ABIA IFG module [2]. Fig. 2 shows the architecture of the IFG module and its interfaces. The The ABIA IFG module is designed to provide CIF and WIF alerts in real-time (i.e., in accordance with the specified TTC and TTW requirements in all relevant flight phases). IFG module inputs are from the GNSS receiver and other aircraft sensors. The GNSS and Sensors Layer (GSL) passes the aircraft Position, Velocity, Time (PVT) and attitude (Euler angles) data (from the on board Inertial Navigation Systems, Air Data Computer, etc.), GNSS data (raw measurements and PVT) and the Flight Control System (FCS) actuators data to the Data Extraction Layer (DEL). At this stage, the required Navigation and Flight Dynamics (NFD) and GNSS Constellation Data (GCD) are extracted, together with the relevant information from an aircraft Three-Dimensional Model (3DM) and from a Terrain and Objects Database (TOD). The 3DM database is a detailed geometric model of the aircraft built in a Computer Aided Three-dimensional Interactive Application (CATIA). The TOD uses a Digital Terrain Elevation Database (DTED) and additional manmade objects data to obtain a detailed map of the surfaces neighbouring the aircraft. In the Integrity Processing Layer (IPL), the Doppler Analysis Module (DAM) calculates the Doppler shift by processing the NFD and GCD inputs. The Multipath Analysis Module (MAM) processes the 3DM, TOD, GNSS Constellation Module (GCM) and A/C Navigation/Dynamics Module (ADM) inputs to determine multipath contributions from the aircraft (wings/fuselage) and from the terrain/objects close to the aircraft. The Obscuration Analysis Module (OAM) receives inputs from the 3DM, GCS and ADS, and computes the GNSS antenna obscuration matrices corresponding to the various aircraft manoeuvres. The Signal Analysis Module (SAM) calculate the link budget of the direct GNSS signals received by the aircraft in the presence of atmospheric propagation disturbances (C/N 0 ), as well as the applicable radio frequency interference and Jamming-to-Signal ratio (J/S) levels. The Integrity Flags Layer (IFL) uses a set of predefined CIF/WIF threshold parameters to trigger the generation of both caution and warning flags associated with antenna obscuration, Doppler shift, multipath, carrier, interference and satellite geometry degradations. The approach adopted to set-up thresholds for the ABIA CIF and WIF integrity flags is depicted in Fig. 3. Both Scalar Tracking Loops (STL) and Vector Tracking Loops (VTL) are considered. The masking integrity flag criteria are the following:  When the current aircraft manoeuvre will lead to less the 4 satellite in view, the CIF shall be generated.
 When less than 4 satellites are in view, the WIF shall be generated.
Additionally, when only four satellites are in view:  When one (or more) satellite(s) elevation angle (antenna frame) is less than 10 degrees, the caution integrity flag shall be generated.
 When one (or more) satellite(s) elevation angle is less than 5 degrees, the warning integrity flag shall be generated.
From the definition of Dilution of Precision (DOP) factors, GNSS accuracy can be expressed by [6]: where σ is the standard deviation of the positioning accuracy and σ ୖ is the standard deviation of the satellite pseudorange measurement error. For the C/A-code σ ୖ is in the order of 33.3m. Therefore, the 1-sigma Estimated Position, Horizontal and Vertical Errors of a GNSS receiver can be calculated using the PDOP (EPE in 3D), the HDOP (EHE in 2D) or the VDOP (EVE). In order to generate CIFs and WIFs that are consistent with current GNSS RNP, we need to introduce the Horizontal and Vertical Accuracy (HA/VA) requirements in the various flight phases. The Horizontal Alert Limit (HAL) is the radius of a circle in the horizontal plane, with its centre being at the true position, which describes the region which is required to contain the indicated horizontal position with the required probability for a particular navigation mode. Similarly, the Vertical Alert Limit (VAL) is half the length of a segment on the vertical axis, with its centre being at the true position, which describes the region which is required to contain the indicated vertical position with the required probability for a particular navigation mode. As a result of our discussion, the DOP integrity flags criteria are the following:  When the EHE exceeds the HA 95% or the VA 95% alert requirements, the CIF shall be generated.
 When the EHE exceeds the HAL or the EVE exceeds the VAL, the WIF shall be generated.
During the landing phase, a GNSS Landing System (GLS) is augmented by GBAS in order to achieve RNP levels, as well as Lateral and Vertical Protection Levels (LPL and VPL). LPL/VPL is defined as the statistical error value that bounds the Lateral/Vertical Navigation System Error (NSE) with a specified level of confidence. In particular, Local Area Augmentation System (LAAS) allows for multiple Differential Global Positioning System (DGPS) reference receivers (up to four) to be implemented. The lateral and vertical accuracy (NSE 95%) and alert limits required by a GLS in the presence of LAAS, considering the continuously varying position of the aircraft with respect to the Landing Threshold Point (LTP) are given in [7]. Additionally, [7] provides the so-called Continuity of Protection Levels in terms of Predicted Lateral and Vertical Protection Levels (PLPL and PVPL).
Although the definition in [7] is quite comprehensive, a generic statement is made that the PVPL and PLPL computations shall be based on the ranging sources expected to be available for the duration of the approach. In other terms, it is implied that the airborne subsystem shall determine which ranging sources are expected to be available, including the ground subsystem's declaration of satellite differential correction availability (satellite setting information). Unfortunately, this generic definition does not address the various conditions for satellite signal losses associated to specific aircraft manoeuvres (including curved GLS precision approaches). Therefore, it is suggested that an extended definition of PLPL and PVPL is developed taking into account the continuously varying aircraft-satellite relative geometry (masking envelope). In particular, when the current aircraft manoeuvre will lead to less than 4 satellites in view or unacceptable accuracy degradations, the CIF shall be generated. Under these assumptions, the criteria for producing SBAS/GBAS CIFs and WIFs are:  When the PLPL GBAS/SBAS exceeds LPL or PVPL GBAS/SBAS exceeds the VPL, the CIF shall be generated.
 When the LPL GBAS/SBAS exceeds the LPL or the VPL GBAS/SBAS exceeds the VPL, the WIF shall be generated.
Multipath integrity flags were defined using the Early-Late Phase (ELP) observable and the range error [8]. As described in [3], the multipath integrity flags criteria are the following:  When the ELP exceeds 0.1 radians, the caution integrity flag shall be generated.
 When the multipath range error exceeds 1 meter, the warning integrity flag shall be generated.
In order to define the integrity thresholds associated with Doppler and fading effects, a dedicated analysis of the GNSS receiver tracking performance was required. When the GNSS measurement errors exceed certain thresholds, the receiver loses lock to the satellites. Since both the code and carrier tracking loops are nonlinear, especially near the threshold regions, only Monte Carlo simulations of the GNSS receiver in different dynamics and Signal-to-Noise Ratio (SNR) conditions can determine the receiver tracking performance [6,9,10]. Nevertheless, some conservative rule of thumbs that approximate the measurement errors of the GNSS tracking loops can be used. Numerous sources of measurement errors affect the Phase Lock Loop (PLL) and the Frequency Lock Loop (FLL). However, for our purposes, it is sufficient to analyze the dominant error sources in each type of tracking loop. Considering a typical GNSS receivers employing a two-quadrant arctangent discriminator, the PLL threshold is given by [6]: where: σ ୨ = 1-sigma phase jitter from all sources except dynamic stress error; θ ୣ = dynamic stress error in the PLL tracking loop.
Frequency jitter due to thermal noise and dynamic stress error are the main errors in a GNSS receiver FLL. The receiver tracking threshold is such that the 3-sigma jitter must not exceed one-fourth of the frequency pull-in range of the FLL discriminator. Therefore, the FLL threshold is [6]: where: 3σ = 3-sigma thermal noise frequency jitter; σ ୲ = dynamic stress error in the FLL tracking loop.
Regarding the code tracking loop, a conservative rule-ofthumb for the Delay Lock Loop (DLL) tracking threshold is that the 3-sigma value of the jitter due to all sources of loop stress must not exceed the correlator spacing (d), expressed in chips. Therefore [6]: where: σ ୲ୈ = 1-sigma thermal noise code tracking jitter; R e = dynamic stress error in the DLL.
The Phase Lock Loop (PLL), FLL and DLL error models described in [2] allow determining the C/N corresponding to the receiver tracking thresholds. The integrity flag criterion applicable to the ABIA system is: where: (C/N ) = Minimum C/N for PLL tracking; (C/N ) = Minimum C/N for FLL tracking; (C/N ) ୈ = Minimum C/N for DLL tracking.
Numerical solutions of Eqs. (3), (4) and (5) show that the weak link in unaided avionics GNSS receivers is the carrier tracking loop threshold (greater sensitivity to dynamics stress). Therefore, the (C/N ) threshold can be adopted in these cases. In general, when the PLL loop order is made higher, there is an improvement in dynamic stress performance. Therefore, third order PLL are widely adopted in avionics GNSS receivers. Assuming 15 to 18 Hz noise bandwidth and 5 to 20 msec predetection integration time (typical values for avionics receivers), the rule-of-thumb tracking threshold for the PLL gives 25 to 28 dB-Hz. Additionally, in aided avionics receiver applications, the PLL tracking threshold can be significantly reduced by using external velocity aiding in the carrier tracking loop. With this provision, a tracking threshold of approximately 15 to 18 dB-Hz can be achieved. Using these theoretical and experimental threshold values, we can also calculate the receiver Jamming-to-Signal (J/S) performance for the various cases of practical interest, as described in [3]. When available, flight test data collected in representative portions of the aircraft operational flight envelope (or the results of Monte Carlo simulation) shall be used. Taking an additional 5% margin on the 3-sigma tracking thresholds for the CIF, the following additional criteria are introduced for the ABIA integrity thresholds:  When either 3σ > 45°or 3σ > 1/4T or 3σ ୈ > d the WIF shall be generated.
In avionics receivers, lock detectors are used to assess if the satellite signals are being tracked or not tracked. Code lock detection is very similar to estimating the received C/N , inferring that the receiver is operating on or near the correlation peak. Knowledge of code lock is obviously parallel to the knowledge of received signal power. The receiver's code-correlation process has to raise the signal out of the noise. The spread spectrum processing gain (G ୮ ) is defined as the ratio of the spread bandwidth to the unspread (baseband) bandwidth and is expressed in dB. The postcorrelation signal-to-noise ratio can be calculated by: When the receiver code is aligned with the transmitted code, the signal power at the band pass output is crushed into approximately 100 Hz of bandwidth. The processing gain can be calculated from: where C R is the chipping rate and T D is the data period. For the C/A-code this works out to be about 43 dB. The TORNADO-IDS receiver has a cut off value at 10 dB, which means that if the value is less than this the satellite signal level is too low to be used in the positioning computations [11]. Therefore, an additional threshold to be accounted for is: During experimental flight test activities performed with unaided L1 C/A code avionics receivers, it was also found that, in a variety of dynamics conditions, a C/N of 25 dB-Hz was sufficient to keep tracking of the satellites [12]. Consequently, taking a 2 dB margin for the CIF, the following additional criteria are adopted for the TORNADO S/N integrity flags:  When the C/N is less than 27dB-Hz or the difference between the S/N and the processing gain is less than 12 dB, the CIF shall be generated.
 When the C/N is less than 25dB-Hz or the difference between the S/N and the processing gain is less than 10 dB, the WIF shall be generated.
Interference detection in a GNSS receiver is typically performed based on a number of parameters including output power, variance and standard deviation of the output power (correlated), carrier phase uncertainty and Automatic Gain Control (AGC) values. The key component to detect interference in the received signal is the Automatic Gain Control (AGC). In order to minimize the signal loss, the amplitude of the received GNSS signal is tuned to the ADC range. The gain in AGC drops significantly when there is an increased power in the GNSS bandwidth. The chirp signals are predominantly used for jamming in the recent times. Chirp signals are typically sinusoidal or cosine signals with sweeping of frequency within in-band GNSS frequency ranges. The chirp signals are modelled using a periodic Frequency Modulated (FM) signal and can be expressed as [12,13]: where f ଵ (t ᇱ − h. T ୱ,ଵ ) is the 1 st saw tooth function, f ୬ (t ᇱ − h. T ୱ,୬ ) is the n th saw tooth function, T ୱ,୬ is the sweep time. A number of algorithms have been proposed for jamming detection, localisation and characterisation of interfering signals. Considering a GNSS jammer transmitting chirp signals (with zero mean) from a random position, the received signal can be expressed as [14]: where s ୲ (t) is the transmitted jammer signal, f ୡ is the carrier signal, d is the distance between the jammer and the receiver, α is the path loss and c is the speed of light. In order to improve the hostile effects of GNSS in electronic warfare and terrorist attacks, new generation signals are being introduced. These signals inherently possess higher precision of orientation and anti-jamming performance, and are also compatible existing GNSS signals. Binary Offset Carrier (BOC) modulation is introduced to increase the ERP for antijamming performance without affecting the existing GNSS signals. In these cases, Costas loop is used as carrier tracking loop to receive BOC modulated signals. When a jamming signal interferes with the GNSS signal, phase measurement error increases beyond a specified threshold value and as a consequence the tracking loop loses lock. The design of the GNSS antenna generally provides a superior polarization signal reception and poor low elevation angle gain. As a result of superior polarisation, cross polarisation reception is less than -10dBic and thus effectively reduces unwanted signal reflections. In order to design GNSS receivers against interference, bandwidth, sampling and hardware considerations are taken into account. In order to increase the accuracy of the signal, narrow correlator spacing is employed by sharpening up the auto correlation function. Therefore, it is ensured that the correlators are still operating in a linear range. Noise increases due to the increase in precorrelation bandwidth but it can effectively tackled by employing superior digital signal processing algorithms. Generally, the signal processor adopted has the capability of performing code correlation in two different modes: an early minus-late power mode and a dot-product mode. The signal processor has two correlators in each channel and can operate one of the correlators as an early or an early-minuslate correlator. The normalised dot-product discriminator is given by [14]: where I and Q values are summed over the Prediction Integration Interval (PDI). I ୣି୍ and Q ୣି୍ represent the I and Q values when the hardware in implemented in the dotproduct mode. P stands for I and Q and are similar to the ones used in carrier loop discriminators. For an infinite precorrelation bandwidth, the normalised Early-minus-Late (EL) discriminator has an output at high values of SNR and the estimation is given by: where τ is the tracking error and d is the EL discriminator spacing in chips. The standard deviation of the pseudorange observations (σ த ) is estimated from the discriminator output standard deviation (σ ୢ ) and is given by: where G ୢ is the gain of the discriminator and B is the bandwidth. For example, for a loop bandwidth of 1/30 Hz, the resulting σ த is approximately 0.3 cycles. In avionics receivers, lock detectors are used to assess if the satellite signals are being tracked or not tracked. Code lock detection is adopted, which is very similar to estimating the received C/N , inferring that the receiver is operating on or near the correlation peak. The code-correlation process of the receiver is designed to increase the signal strength when compared to that of inherent and added noise. The spread spectrum processing gain (G ୮ ) is defined as the ratio of the spread bandwidth to the unspread (baseband) bandwidth and is expressed in dB. The post-correlation S/N is given as: When the receiver code is aligned with the transmitted code, the signal power at the band pass output is crushed into approximately 100 Hz of bandwidth. The processing gain can be calculated from: where C ୖ is the chipping rate and T ୈ is the data period. For the C/A code this works out to be about 43 dB. Typical avionics receivers have a cut off value at 10 dB, which means that if the value is less than this the satellite signal level is too low to be used in the positioning computations [14]. An additional threshold criterion to be accounted for in the ABIA system is given as: When G ୮ is more than 11 dB (margin of 1 dB), the CIF shall be generated.
 When G ୮ is less than 9 dB (margin of 1 dB), the WIF shall be generated.

IV. ABIA FLIGHT PATH OPTIMISATION MODULE
Optimising a trajectory for integrity based navigation is a standard optimisation problem that can be solve like all optimal control problem using a variety of direct or indirect derived methods. The optimisation problem is depicted in Fig. 4. All the standard components of an optimization problem are used. A flight dynamic model of the aircraft gives the dynamic constraints and allows creating a trajectory that will be flyable by the aircraft. The integrity degradations and the current GNSS parameters define a certain number of path constraints. They ensure that integrity degradations will be avoided on the whole trajectory. Then boundary conditions include minimal, maximal, initial and final values for the entire state and command variable. They are given by the aircraft sensors, which relate the current flight parameters, and by the Flight Management System (FMS), which gives the information from the flight plan. The cost function is the performance criterion to minimize. All the necessary constraint for the integrity degradations are already included in the path constraint, therefore the time is minimized. This choice is made for simplicity and because only the integrity navigation optimization is considered in this research, but more complex criterion could be set based on aircraft performances. The Aircraft Dynamics Model (ADM) used is a three dimensional symmetric flight, unsteady model. A 3-Degree of Freedom (3-DoF) model with variable mass is adopted. The majority of the GNSS integrity degradations depend on the relative position of the GNSS receiver antenna and each satellite. The relative movement between the GNSS receiver antenna and the satellite is also crucial. Therefore degradations related to one satellite do not affect the system with the same manner or intensity as the others. A loss of integrity occurs if a combination of several degradations from different satellites takes place at the same instance. The CIF/WIF thresholds defined for the antenna obscuration, Doppler shift, multipath, carrier, interference and satellite geometry degradations are precisely capable of detecting combination of such degradations. A potential CIF or WIF is produced based on the current values of the aircraft flight parameters (position, Euler angles, and velocity), the satellite parameters (position and velocity), and the given thresholds [3]. An individual CIF or WIF is produced with respect to each satellite of the constellation. An overall CIF is triggered if there are less than 5 satellites remaining without an individual CIF and an overall WIF is triggered if less than 4 satellites are remaining without an individual WIF. The flight path optimisation algorithm is initiated when degradation in integrity is predicted or detected by the IFG. The logical steps involved are listed below: -If the flag is not due to Doppler shift, the minimum elevation limit is set with the current selected satellite's elevation angle. -If the flag is due to Doppler shift, the sign of the azimuth angle is compared to the sign of the bank angle. If the satellite is located in the same direction of the track, the minimum elevation limit is set with the current satellite's elevation value. If the satellite is located in the opposite direction of the track, the maximum elevation limit is set with the current satellite's elevation value.  Step 3: After the satellite elevation limits are set, the parameters are used in the trajectory optimization suite.

V. ABIA/SAA SYSTEMS INTEGRATION
Both cooperative and non-cooperative SAA systems are being developed to address UAS safe integration into the non-segregated airspace [1]. The SAA capability can be defined as the automatic detection of possible conflicts (i.e., collision threats) by the UA platform and the implementation of avoidance manoeuvres to prevent the identified collision threats. An analysis of the available SAA candidate technologies and the associated sensors was presented in [15]. An approach to the definition of encounter models and their applications on the SAA strategies is presented in [15,16] considering both cooperative and non-cooperative scenarios. As part of our research, the possible synergies attainable with the adoption of different detection, tracking and trajectory generation algorithms were studied. Additionally, the error propagation from different sources and the impacts of host and intruders dynamics on the ultimate SAA solution were investigated [15]. SAA system requirements can be derived from the current regulations applicable for the human pilot see-and-avoid capability [17][18][19][20][21][22]. The proposed ABIA/SAA integrated architecture is illustrated in Fig. 5. The Position, Velocity and Attitude (PVA) measurements are typically obtained by adopting multi-sensor data fusion techniques [23 -25]. An initial flight path is generated using the aircraft dynamics model. The IFG module run is performed on that trajectory. Based on a Boolean decision logic that sorts sensors' data based on estimated performance parameters, the C-SAA or noncooperative SAA sensors are used for safe separation. If both the safe separation thresholds are violated and a mid-air collision threat is detected the WIF is generated. To prevent any WIF, the flight path optimization process starts when the first CIF is generated. Pseudo-Spectral Optimisation (PSO) and Differential Geometry Optimization (DGO) techniques are used to generate a new optimised trajectory free of any integrity degradations. Depending on the relationship between the available time-to-collision and the computation time PSO and DGO trajectory solutions, the optimised trajectory data are sent to the AFCS (and/or to the ground pilot) for execution of the avoidance manoeuvres. In the trajectory optimisation process time is used as the cost functional and the aircraft dynamics model/satellite elevations are used as path constraints. The selection of the optimal trajectory from the generated set of safe trajectories is performed, which is then fed to the aircraft guidance subsystems. The implemented decision logic is based on minimisation of the following cost function [26,27]: where:  D(t) is the estimated distance of the generated avoidance trajectory points from the avoidance volume associated with the obstacle.  D ୫ ୧ ୬ = min[D(t)] is the estimated minimum distance of the avoidance trajectory from the avoidance volume.  t ୗ = t| ୈ ౣ is the time at which the safe avoidance condition is successfully attained.
• s] is the specific fuel consumption.
 T(t) is the thrust profile.  w ୲ , w , w ୢ , w ୧ ୢ are the weightings attributed to time, fuel, distance and integral distance respectively. reference frame and to obtain satellite visibility data. The satellite position and velocity are calculated from the Kepler's laws of orbital motion using either the YUMA or SEM almanac data [28,29]. Various geometric parameters were extracted from the literature to draw a detailed CATIA model of the AEROSONDE UA [30][31][32][33][34]. The ABIA integration into an existing UAS SAA architecture was studied in cooperative and non-cooperative SAA scenarios. The ABIA host platform used in the simulation was the AEROSONDE UA and the intruders platforms included AIRBUS 320 (A320) and AEROSONDE UAs. The AMMs in pitch and roll are generated calculating all possible intersections of the aircraft body (all triangular surfaces) with the LOS antenna-satellites (Fig. 6). In all the simulated scenarios, an avoidance volume (sum of navigation and tracking errors) was generated by the SAA system [15]. Pseudospectral (PSO) or constrained differential geometric optimization (DGO) techniques were used to generate the new trajectory based on the available time to conflict (host entering the avoidance volume). The avoidance trajectory was initiated by the SAA system when the probability of collision exceeded the required threshold value. Time and fuel were used in the cost functional, the dynamic model as dynamic constraint, and the elevation criteria as path constraints for both PSO and DGO techniques. Boundary conditions were set from the value of the flight parameters at CIF time step. Fig. 7 illustrates the cooperative SAA test scenario wherein AEROSONDE (ABIA host platform) UA and two intruders (AEROSONDE UAs) are on the same FL. One intruder UA is 90°off track and the other is on a head-on collision with the host UA. The horizontal and vertical separation obtained with respect to intruder 1 and 2 are illustrated in Fig. 8 and 9 respectively. Three different points are shown on the ABIA/SAA host platform trajectory in Fig. 7:  The simulation results demonstrate that the ABIA IFG module is capable of generating integrity flags to provide both caution and warning signals when GNSS signals are degraded or lost. After the integrity caution flag is generated, the time available for the pilot/autopilot to react (before the integrity event is detected and the warning flag is generated), is at least 2 seconds. This TTC can support safety-critical tasks including GLS curved/segmented precision approach and automatic landing applications. Data analysis showed that the ABIA system can provide useful integrity signals for CAT-III precision approach and automatic landing. In the C-SAA and N-SAA scenarios investigated and in the dynamic conditions explored, all near mid-air collision threats were successfully avoided by implementing adequate trajectory optimisation algorithms. Both PSO and DGO algorithms proved successful in C-SAA and N-SAA scenarios depending on the available time for the optimisation loops (distance host-intruders and relative dynamics). Simulation case studies to evaluate the performance of the proposed GNSS ABIA integrity augmentation strategy were performed in a number of test platforms (3-DoF and 6-DoF aircraft dynamics models) including AIRBUS 320 (A320), TORNADO-IDS and AEROSONDE UA. In all scenarios including multipath environments [15], an overall avoidance volume is generated based on the SAA Unified Method (SUM) proposed in [15]. Time and fuel are used in the cost functional, the aircraft dynamics model produces the dynamics constraints, and the satellite elevation criteria are used to set path constraints for both PSO and DGO techniques [5]. Based on the obtained position uncertainty about the host manned aircraft or UA trajectory, an optimised avoidance trajectory without any GNSS data losses is constructed around the overall avoidance volume obtained by combining the jamming signal radiation pattern and navigation error of the host platform. The optimised avoidance trajectory is constructed tangential to the radiation pattern of the jammer (main lobe in the case of directional jammer). The optimised avoidance trajectory obtained in the presence of a directional jammer is illustrated in Fig. 10. The results of a simulation performed in MATLAB/Simulink for the directional jammer case are illustrated in Fig. 11. The AEROSONDE 6-DoF dynamics model is used for this case study. After jamming detection and generation of a CIF, an optimised avoidance trajectory is generated. This is based on the cost function approach defined earlier and the constraints imposed by ABIA in terms of UA platform dynamics and GNSS satellite elevation angles. The avoidance trajectory guarantees jamming avoidance while preventing degradation or losses of GNSS navigation data.

VII. SIMULATION ACTIVITIES
The synergies between a GNSS Avionics Based Integrity Augmentation (ABIA) system and a novel Unmanned Aerial System (UAS) Sense-and-Avoid (SAA) architecture for cooperative and non-cooperative scenarios were explored. The integration of ABIA with SAA leads to an Integrity Augmented SAA (IAS) solution supporting the efforts towards a safe and unrestricted access of UAS to commercial airspace. The ABIA and SAA research activities were presented and a detailed ABIA/SAA integrated architecture was established. Simulation case studies were performed for IFG, IFG/FPM and ABIA/SAA modules. According to the simulation results, after the integrity caution flag is generated, the time available for the pilot/autopilot to react (before the integrity warning flag is generated), is sufficient for safety-critical tasks including GLS curved/segmented precision approach and automatic landing applications. The ABIA integration into an existing UAS SAA architecture proved that all near mid-air collision threats were successfully avoided by implementing trajectory optimisation algorithms. The proposed ABIA/SAA integration architecture can achieve adequate performance by avoiding critical satellite signal losses while fulfilling the separation requirements for SAA. Current research is extending the ABAS/ABIA concepts to the Aeronautical Data Link (ADL) application domain, also investigating ABIA LOS and BLOS communications interfaces for UAS applications. Additionally, ABIA evolutions for Next Generation Flight Management Systems (NG-FMS) and ground-based Four-Dimensional Trajectory (4DT) Air Traffic Management (ATM) systems are being addressed [35][36][37][38][39]. Finally, possible extensions of the ABIA concept to aviation mission planning and forensic (accident investigation) applications are being investigated.