Vincent Benezech

Nicolas Coulombel
email: nicolas.coulombel@enpc.fr

The value of service reliability

Keywords: Public transportation, Reliability, Headway, Scheduling, Welfare

This paper studies the impact of service frequency and reliability on the choice of departure time and the travel cost of transit users. When the user has ( α , β , γ ) scheduling preferences, we show that the optimal head start decreases with service reliability, as expected. It does not necessarily decrease with service frequency, however. We derive the value of service headway (VoSH) and the value of service reliability (VoSR), which measure the marginal effect on the expected travel cost of a change in the mean and in the standard deviation of headways, respectively. The VoSH and the VoSR complete the value of time and the value of reliability for the economic appraisal of public transit projects by capturing the specific link between headways, waiting times, and congestion. An empirical illustration is provided, which considers two mass transit lines located in the Paris area.

Introduction

The unreliability of transportation systems, in the sense that these systems cannot guarantee perfectly predictable travel times, has various consequences on travelers. It may induce anxiety, cause one to miss a connection (in the case of public transport), or constitute a hindrance to the planning of activities. But the main impact is generally the potential delay at destination [START_REF] Stratec | Enquêtes qualitatives et quantitatives visant à évaluer les projets de fiabilisation des radiales ferrées en Ile-de-France, Phase 1.2[END_REF]. Travelers can cope with travel time variability through various means: they can adjust their departure time [START_REF] Coulombel | The value of reliability: an equilibrium approach[END_REF], change route [START_REF] Abdel-Aty | Investigating effect of travel time variability on route choice using repeated-measurement stated preference data[END_REF][START_REF] Liu | Uncovering the contribution of travel time reliability to dynamic route choice using real-time loop data[END_REF] or mode [START_REF] Chorus | Travel information as an instrument to change cardrivers' travel choices: a literature review[END_REF], travel somewhere else, or they can decide to report or even to cancel their trip. The preferred strategy is usually to leave with a safety margin [START_REF] Bates | The valuation of reliability for personal travel[END_REF][START_REF] Li | Willingness to pay for travel time reliability in passenger transport: A review and some new empirical evidence[END_REF], be it because other alternatives may not be available. This is especially true for transit users, who often have less alternative routes at their disposal than car users to reach their destination.

Following this train of thought, several theoretical works, in line with the seminal contributions of [START_REF] Gaver | Headstart Strategies for Combating Congestion[END_REF] and [START_REF] Knight | An approach to the evaluation of changes in travel unreliability: A "Safety margin" hypothesis[END_REF], study the impact of travel time variability on the choice of departure time and the cost of travel [START_REF] Bates | The valuation of reliability for personal travel[END_REF][START_REF] Coulombel | The variability of travel time, congestion, and the cost of travel[END_REF][START_REF] Fosgerau | The value of reliability[END_REF][START_REF] Noland | Travel-time uncertainty, departure time choice, and the cost of morning commutes[END_REF][START_REF] Siu | Equilibrium Trip Scheduling in Congested Traffic under Uncertainty[END_REF] They adapt the scheduling model popularized by [START_REF] Small | The scheduling of consumer activities: work trips[END_REF] to the context of uncertain travel times. They derive the expected travel cost and the value of reliability (VoR), the latter being usually defined as the derivative of the expected travel cost with respect to the standard deviation of travel times. Most works focus on car-users, and although some authors adapt their model to some extent to consider transit users (usually by making departure time a discrete variable), they still fail to take several aspects specific to public transport systems into account. First, they do not distinguish between waiting time and in-vehicle time, which most transit users value differently [START_REF] Wardman | Public transport values of time[END_REF]. Congestion and waiting times are strongly related to headways (and their variability), which is also not modeled in these works. Last, the VoR has two significant drawbacks when applied to public transit: total travel time variability, to which the VoR relates, is hard to measure, but also inconvenient to use for the economic appraisal of public transport projects because the transit operator does not have a direct control over this variable (unlike headway variability or in-vehicle time variability, for instance).

This paper intends to address these issues by adapting the standard scheduling model to the case of public transport. The scope is limited to headway-based services (as opposed to schedule-based ones), for which frequency is high. We study the impact of service headway and reliability on the choice of departure time and the travel cost. Two indicators capture the effect of changes in service characteristics on the expected trip cost: the value of service headway (VoSH) measures the effect of a change in the mean headway, and the value of service reliability (VoSR) that of a change in the standard deviation of headways. The VoSH and VoSR complete the value of time and the VoR in the case of public transit. The former couple relates to headways and their impact on waiting times and in-vehicle congestion, while the latter couple, which originally related to the total travel time in the context of car users, more naturally relates to in-vehicle time for transit users.

The layout of this paper is as follows. Sections 2 and 3 review the theoretical framework, then the main results of renewal theory regarding the link between transit service headways, user-perceived headways, and waiting times. Section 4 presents the model and several findings in the general case. Section 5 elaborates on the case of exponentially distributed headways then provides an empirical illustration, which considers two heavy rail lines located in the Paris area. Section 6 extends the model by introducing in-vehicle congestion, and Section 7 concludes.

Theoretical framework

There are currently three main modeling frameworks which address the value of travel time variability [START_REF] Carrion | Value of travel time reliability: A review of current evidence[END_REF][START_REF] Li | Willingness to pay for travel time reliability in passenger transport: A review and some new empirical evidence[END_REF]: the mean-variance model, the mean lateness model, and the scheduling model. The first two are based on a descriptive approach: they assume that individuals distaste travel time variability, but do not purport to explain why. These modeling frameworks intend to provide the most efficient specification to estimate the value of reliability.

Scheduling models, on the other hand, provide a micro-economic foundation to the value of reliability. They represent the choice of departure time when individuals face time constraints (e.g. work start time). A first strand of the literature has focused on departure strategies when travel times are uncertain. [START_REF] Gaver | Headstart Strategies for Combating Congestion[END_REF] and [START_REF] Knight | An approach to the evaluation of changes in travel unreliability: A "Safety margin" hypothesis[END_REF], who developed the notions of "head start" and "safety margin", respectively, represent two pioneering contributions in this regard. In parallel, another strand of the literature has aimed to model and estimate scheduling preferences when travel times are certain. Building on the works of [START_REF] Gaver | Headstart Strategies for Combating Congestion[END_REF] and [START_REF] Vickrey | Congestion Theory and Transport Investment[END_REF], [START_REF] Small | The scheduling of consumer activities: work trips[END_REF] specified and estimated a scheduling model which has later been widely used in theoretical works. The model is based on the assumption that the traveler's cost C is a linear function of travel time and schedule delay costs:

        * * * C t T t t T t T t t T t                1 (1)
where (x) + = x if x is positive, 0 otherwise, and 1(x) is the Heaviside step function (equal to 1 if x is positive, 0 otherwise). C(t) is the travel disutility when leaving at time t, T the travel time, and * t t T  the schedule delay. The schedule delay is said to be early if it is positive, late if it is negative. It is measured relatively to a preferred arrival time t*, which usually represents the work starting time. The cost of one minute of travel time is α; the cost of being one minute early at one's destination is β and the cost of being one minute late is γ. Being late also entails a fixed penalty equal to δ. These parameters are positive (as C is a disutility function); they set the terms of the trade-off between travel time and schedule delay when choosing the departure time. We will refer to (1) as (α , β , γ , δ ) preferences, or more simply (α , β , γ ) when the late dummy is not included (δ = 0).

In line with [START_REF] Gaver | Headstart Strategies for Combating Congestion[END_REF] and [START_REF] Polak | Travel time variability and departure time choice[END_REF], [START_REF] Noland | Travel-time uncertainty, departure time choice, and the cost of morning commutes[END_REF] combine the two above approaches and study the influence of travel time variability on the choice of departure time and the cost of travel under ( α,β, γ,δ ) preferences. Travel time is the sum of a deterministic component and of a random delay, the distribution of which does not vary with the departure time. A key result is the derivation of the minimum expected trip cost when the delay follows a uniform or exponential law. While it is not done in their work, one can use their results to derive the value of reliability (VoR), usually defined as follows [START_REF] Carrion | Value of travel time reliability: A review of current evidence[END_REF]:

VoR C C m       (2)
where m is the trip monetary cost and σ the standard deviation of travel times. For ( α,β,γ,δ ) preferences, the parameters are usually expressed in monetary terms and the VoR is simply C   

. [START_REF] Fosgerau | The value of reliability[END_REF] generalize Noland and Small's work by formally deriving the VoR under less strict assumptions regarding the distribution of the delay. They consider ( α,β,γ) preferences instead of ( α,β,γ,δ ) , and assume that the expected travel time is constant. Under these assumptions, the VoR is:

    1 1 VoR Φ        s ds (3)
where Φ is the cumulative distribution function of the standardized travel time.

Most theoretical works on the VoR focus on car users (e.g. [START_REF] Coulombel | The variability of travel time, congestion, and the cost of travel[END_REF][START_REF] Fosgerau | The value of reliability[END_REF][START_REF] Noland | Travel-time uncertainty, departure time choice, and the cost of morning commutes[END_REF]. In the case of transit riders, one cannot use the exact same analytical framework for at least two reasons. First, transit services do not run continuously. When choosing their departure time, individuals usually consider the schedule or the frequency of the transit lines that they plan to use [START_REF] Bowman | Service frequency, schedule reliability and passenger wait times at transit stops[END_REF][START_REF] Furth | Service reliability and hidden waiting time: insights from automatic vehicle location data[END_REF]. Schedule or headways should thus be explicitly modeled. This point is especially salient as most studies find that individuals have a higher value of waiting time than of in-vehicle time (e.g. [START_REF] Algers | Role of waiting time, comfort, and convenience in modal choice for work trip[END_REF][START_REF] Beesley | The value of time spent in travelling: some new evidence[END_REF][START_REF] Wardman | Public transport values of time[END_REF]. Second, congestion in public transportation is linked to the service headway. It can strongly vary between two consecutive vehicles when headways are irregular [START_REF] Chen | Assessing the influence of public transit headway irregularity on passenger's distribution[END_REF]. This differs from road congestion which is a more continuous phenomenon, traffic incidents put aside. [START_REF] Bates | The valuation of reliability for personal travel[END_REF] study the choice of departure time and the cost of unreliability in the case of transit users. Their analysis focuses on scheduled services, which leads them to model departure time as a discrete variable. 1 The same choice is operated in [START_REF] Batley | Marginal valuations of travel time and scheduling, and the reliability premium[END_REF], [START_REF] Fosgerau | The value of reliability[END_REF], and [START_REF] Fosgerau | The value of travel time variance[END_REF], among others. The underlying assumption is that headways are perfectly reliable, and that the variability of travel time entirely derives from in-vehicle time variability. 2 This assumption is strong, especially if one considers mass transit lines with high levels of ridership, for which headway regularity is often a significant issue (subsection 5.2 providing an illustrative example). Moreover, these works consider neither the distinction between waiting time and in-vehicle travel time, nor the issue of in-vehicle congestion.

The main purpose of this paper is to study the influence of service reliability (limited here to the dimension of headway regularity3 ) on the choice of departure time and the cost of travel. In particular, we show that service reliability impacts the generalized travel cost through three channels: waiting time, schedule delay, and congestion.

Route headways, user-perceived headways and waiting times

This section reviews the main results of renewal theory regarding the link between the headways of a transit route, the headways perceived by users, and waiting times. We consider first the general case, then the case when the standardized distribution of headways follows a centered exponential law. The reader can refer to [START_REF] Osuna | Control Strategies for an Idealized Public Transportation System[END_REF] or Kleinrock (1975, p. 169) for a proof of these results.

General case

Consider a direct transit line connecting two points A and B, which we will refer to as a railway line with no loss of generality. Headways at A are given by a sequence of positive random variables (Hi)iℤ. They are identically and independently distributed, with probability distribution function (p.d.f.) φH and cumulative distribution function (c.d.f.) ΦH. Headways being positive, φH and ΦH are both null on ℝ -* . We will assume throughout the text that the distribution of headways has finite moments of all orders. We denote μH and σH the mean and the standard deviation of headways; they provide inverse measures of service frequency and reliability, respectively. 4A traveler arrives at the train platform in A at time t. Given the assumptions, the user-perceived headway, which is defined as the headway that the traveler experiences when arriving at time t, is a random variable HU with the following p.d.f.:

        H U H xx x (4)
The distribution of headways perceived by users differs from the objective distribution. Indeed, when a traveler arrives on the platform in a "random manner" (meaning that he has no dynamic information regarding headways), the longer the headway, the more likely it is for that traveler to arrive in the corresponding time interval.5

The waiting time is a stochastic variable Tw with p.d.f.:

    1 Φ for , 0 otherwise H w H x x x       R (5)
The mean and the standard deviation of waiting times are (using integration by parts):

2 2 2 2 3 4 2 1 2 12 2 3 4 H H w H H H H H H w H H                                    (6)
where ηH is the skewness of (Hi)iℤ. These results call for two comments. First, a change in service reliability (i.e. in σH) impacts the mean waiting time, even when service headway remains constant. Second, (5) linking the p.d.f. of Hi and Tw, these two variables cannot be standardized simultaneously. Considering our focus on service reliability, we choose to standardize the (Hi)iℤ:6

  i H H H h ( 7
)
where h is a random variable with mean 0 and variance 1. For reminder, the following relationships link the p.d.f. and c.d.f of h and H:

    and Φ Φ                        H h H H H H h H H x x x x (8)

Exponentially distributed headways

We will give special attention to the case of a centered exponential distribution. 7 It leads to closed form solutions and fits the data well to boot (see section 5).

When h follows a centered exponential distribution, we have:

        1 1 for 1 Φ1            x h x h xe x xe (9)
In the exponential case, the condition that headways must be positive is, according to (7), equivalent to constraining σH μH . Service unreliability as measured by σH cannot exceed μH for the standardization of headways to be consistent, the case σH= μH corresponding to the standard exponential distribution.

The distribution of headways perceived by users is:

    for Φ 1 H H H H H H x U HH H H x H U H x x e x x x e                                       (10)
Lastly, the p.d.f. of waiting times is:

    1 for 0 1 for H H H w H H H x w H H H x x x e x                                 (11)
Figure 1 illustrates φw for various values of σH. When σH tends toward 0, φw converges pointwise to the uniform distribution, which corresponds to the case of perfect headway regularity.

A scheduling model for headway-based transit services

Model set-up

An individual wishes to go from point A to point B. As previously, a direct transit line connects the two points. The service is headway-based: there is no schedule, or alternatively service frequency is high enough for the user to ignore the schedule and only consider headways when planning his trip. The service is not perfectly reliable, headway variability being modeled by ( 7). The transit line operator sets the levels of service frequency and reliability, in other words μH and σH, which are taken as exogenous.

As is common in the literature, we assume that the individual has ( α,β,γ) preferences. The relevancy of ( α,β,γ) preferences for modeling the departure time choice is actually controversial. While [START_REF] Noland | Simulating travel reliability[END_REF] find that ( α,β,γ) preferences well fit the behavior of individuals in their survey, [START_REF] Tseng | Value of time by time of day: A stated-preference study[END_REF] raise the objection that the assumption of time-invariant shadow prices is unrealistic, a point corroborated by their empirical analysis. In addition, [START_REF] Börjesson | Valuations of travel time variability in scheduling versus mean-variance models[END_REF] find that ( α,β,γ) preferences do not well capture the aversion of individuals to travel time variability. While acknowledging these limitations, ( α,β,γ) preferences are widely used in this research field, simple to handle from a mathematical standpoint, and yield closed-form solutions in our application in section 5. These various points led us to keep this functional form. 8The individual has standard ( α,β,γ) preferences except that he values in-vehicle time and waiting time differently. The generalized cost of travel (or travel disutility) is:

      ** w w v v w v w v C t T T t t T T t T T t                (12)
where Tw is the platform waiting time and Tv the in-vehicle time. The real parameters ( αw,αv ,β,γ) are positive. A common result of the empirical literature on the value of time is α w > αv [START_REF] Wardman | Public transport values of time[END_REF]): waiting yields less utility than being in a vehicle. The model remains valid when α w  αv . Most empirical studies on scheduling preferences also find that ( α,β,γ) are ordered as follows: β < α < γ [START_REF] Bates | The valuation of reliability for personal travel[END_REF][START_REF] Carrion | Value of travel time reliability: A review of current evidence[END_REF]. Added to the fact β > α that leads to counterintuitive behaviors (such as preferring to wait on the platform or to spend more time in the vehicle rather than to get early at one's destination), we assume: 0 < β < α = min ( α w ,α v ) and γ > 0.

Waiting time Tw is a random variable, its distribution being given by (5). Onboard travel time Tv is on the other hand deterministic and constant. This assumption is made for the sake of simplicity, as computations are quite complex and hard to follow when both in-vehicle times and waiting times vary. Our results can easily be extended to the case with variable in-vehicle time, as long as Tv and Tw are not correlated.9

Waiting time variability has a twofold source in our model, as brought to light by ( 5) and ( 6). First, the user only knows the headway distribution of the railway line (i.e. φh), not the exact schedule. Even in the case of perfectly regular headways, he will still arrive at a random time between two trains. Second, headways are not perfectly reliable, which increases further waiting time variability. Indeed, (5) shows that waiting times follow a distribution which is uniform when headway reliability is perfect (σH= 0), but progressively changes as reliability declines.

We denote m = t*t -Tv the head start. It is the time allocated to waiting, which can be positive or negative. Travel cost becomes:

                 w w v v w w C m T T m T T m (13)
If Tw < m, the traveler arrives early at his destination, if Tw > m he is late. Because Tw is positive, choosing a strictly negative head start implies arriving late with certainty.

Optimal head start

The traveler chooses the head start which minimizes his expected travel disutility:

          0 m w w v v w w m C m T m x x dx x m x dx                 (14)
The first order condition is

      Φ * 1 Φ * 0 w w m m      .
The optimal head start is:

  1 * Φ w m    (15)
where

    
is the relative shadow price of being late.

We find an equation identical to [START_REF] Fosgerau | The value of reliability[END_REF] except that it involves the c.d.f. of waiting time instead of travel time. In our set-up, the choice of the head start m only impacts the expected scheduling cost within the total expected cost of travel. It bears no influence on the travel time cost component αwμw + αvTv, which is independent of m. This explains why m* only depends on the scheduling parameters β and γ and not on the values of time αw and αv. The safety margin increases with γ and decreases with β. The more important it is to be on time, the more extra time one plans for his trip.

When γ tends towards +∞, the optimal margin tends towards

  1 Φ 1 w 
, the maximum waiting time, also equal to the maximum headway. Individuals who must be on time at all costs consider the worst case scenario and take the necessary head start.

When service reliability is perfect (σH= 0), the optimal safety margin is * The effects of marginal changes in service headway and reliability on the optimal head start are given by (see Appendix):

        * * * * * * * Φ 1 Φ Φ 1 1 Φ H H H H H H H H m dm d m m dm m d m                                   (16)
The shape of the headway distribution largely determines the impact of μH and of σH on the optimal head start. Nevertheless, we show three main results in the general case (see Appendix for proof). First, the optimal head start m* is always greater than m*det. As expected, headway variability causes individuals to take a bigger margin than when headways are perfectly regular. , which indeed is usually the case, the opposite can occur for fat-tailed distributions. An increase in the service headway causes then travelers to reduce their head start. This counterintuitive result stems from the disjunction between the objective and subjective distributions of headways.10

Values of service headway and reliability

Using the first order condition, we obtain the minimum expected travel cost:

        * ** v v w w w m C C m T x x dx                (17)
or equivalently :

      * 0 * m v v w w w C T x x dx              (18)
When headways are perfectly reliable, the travel cost is:

* 22 H H det v v w CT        (19)
The first two terms are the time cost. The last term is the scheduling cost; unlike in the standard model (e.g. Fosgerau and Karsltröm, 2010), it is not null because waiting times exhibit variability even when headways are perfectly reliable.11

To study the impact of service characteristics on the travel cost, we introduce two indicators. The value of service headway (VoSH) and the value of service reliability (VoSR) are the derivatives of the minimum expected travel cost with respect to the mean and the standard deviation of headways, respectively:

12 * * VoSH VoSR H H C C                (20)
The VoSH and the VoSR are closely related to the VoT and the VoR. Actually, the model of [START_REF] Fosgerau | The value of reliability[END_REF] can easily be adapted to derive the value of waiting time (VoWT) and the value of waiting time variability (VoWR). 13 The couple (VoWT, VoWR) would be formally equivalent to the couple (VoSH, VoSR), except that it would use the waiting time metrics instead of the headway metrics. For headway-based transit services, the headway metrics is the most relevant one, however. Headways are easier to measure than waiting times. Transit operators control headways, not waiting times. 14 And congestion is easier to introduce with headways than with waiting times (see section 6).

Differentiating (18) yields the VoSH and the VoSR:

            2 * 2 0 * 0 VoSH 1 Φ Φ 2 * * VoSR 2 Φ m w H H w H H m H H w w H H H H x x dx m m x dx                                                 (21)
In the general case, the relationship between the VoSH and the various model parameters is complex. Similarly, comparative statics for the VoSR are not straightforward. We turn to the exponential case: this allows us to analytically derive the VoSH and the VoSR while providing a good approximation of realcase data, as we will see for two mass transit lines of the Paris area.

Application: the exponential case

From this point on, we assume that headways follow a centered exponential distribution:

i H H H h   ( 22
)
where h is a random variable with centered exponential law (which has -1 as a minimum). As underlined in subsection 3.1, the condition that headways must be positive implies that this specification only makes sense for σH μH.

Analytical derivation

Two regimes arise in the exponential case (see Appendix and Figure 1 for an intuitive interpretation). In the first mode, headway variability is low (in relative terms): σH/ μH  1 -κ. The optimal head start and the minimum cost are:

    * 2 * * * 2 2 H det H H v v w w det w H m m C T C                         (23)
In this regime, service reliability is good enough so that individuals do not change their departure time compared to the deterministic case. The expected travel cost does increase, however, as a result of two concurring phenomena. Headway variability increases the mean waiting time, which is captured by the term α w σ H 2 /(2μ H ) . It also leads to greater waiting time variability, hence a greater scheduling cost. The term γ σ H 2 /(2μ H ) reflects this second mechanism. When service reliability is poor (σH/ μH  1 -κ), the system tips over the exponential regime. The optimal head start and the expected trip cost are: variability, and the various results would still apply using the waiting time distribution instead of the travel time distribution. 14 To be precise, operators can control waiting times, but indirectly (through headways) and not perfectly. For instance, even if headway regularity is perfect, waiting times remain variable. It is also likely that users have a good knowledge of the frequency of the lines they use but not of the distribution of waiting times.

2 1 * ln 1 1 ln 2 1 * H H H H H H H H v v w W H H H m C T                                                      (24)
Individuals respond to the poorer service reliability by adjusting their safety margin. As expected, the margin increases with the service headway and the service unreliability:

*/ 1 / 0       H H H dm d and     * / ln / . / 0          H H H dm d .
Figure 2 compares the optimal head start in the deterministic case and for three values of σH. In the former case, the optimal head start increases linearly in κ (measuring the relative cost of being late). For low values of κ, the head start does not depend on σH. When κ exceeds a certain threshold (itself decreasing with σH), individuals shift to the exponential regime. As κ increases, they increase more and more their margin to insure themselves against the risk of being late caused by service unreliability. When κ tends toward 1, the head start tends toward +∞. Since headways are unbounded for exponential distributions, insuring oneself against the worst case scenario implies taking an infinite safety margin. We can use ( 23) and ( 24) to derive the value of service headway (VoSH) for the two regimes:

2 2 2 2 2 2 2 VoSH 1 1 if 1 2 2 VoSH 1 1 if 1 2 2 w H H H H H H w H H H H H H                                                                        (25)
As expected, the VoSH increases with α w , β, and γ. 15 The more the user values not waiting or being on time, the more he enjoys better transit service frequency. Furthermore, the VoSH decreases with σH/μH. Improving service frequency is more beneficial when headway variability is low (in relative terms). 16Similarly, we can derive the value of service reliability (VoSR):

  VoSR if 1 1 VoSR 1 ln if 1 1 H H w H H H H H H w H H H H                                                  (26)
Similarly, the VoSR increases with α w , β, and γ. Headway variability increases the mean waiting time, which explains that the higher α w , the more a degradation in service reliability would cost. In addition, headway irregularity increases waiting time variability. This increases the scheduling disutility, hence the increase with β and γ.17 Unlike the VoSH, the VoSR increases with σH/μH instead of decreasing. Thus, there exists a cut-off level above which it is more beneficial to improve service reliability than service frequency (Figure 3).

Empirical illustration

We use data on observed headways during the morning peak hour to estimate the headway distribution of two mass transit lines of the Paris area, the RER A and the RER E. Data were provided by the railway operator, Transilien, in the case of the RER E, and were collected using real-time data available on the web in the case of the RER A. Both databases provide records for a time period of 3 months in 2011. For the RER A, headways are measured at the station named Nation, which is located on the eastern frontier of Paris, and for westbound trains. For the RER E, headways are measured at Bondy, which is outside of Paris, again for westbound trains.

The RER A is one of the most used transit lines in the world, with more than one million riders a day. At the morning peak hour, headways are short but the high congestion level hampers operations, leading to irregular headways. Parametric estimation of the headway distribution yields μH = 2.4 and σH = 0.9, the exponential distribution fitting the data remarkably well (Figure 4a).

The RER E is a newer and less central line than the RER A, with about 300,000 travelers per day. Frequency is lower than for the RER A (μH = 7.8), for a similar service reliability (σH= 1.0). Again, the exponential distribution fits the data well, although less so than for the RER A (Figure 4b).

To illustrate our findings, we consider a traveler who has the following preference parameters: α v = 1, α w = 2, β = 0.8, γ = 3. 18 His journey on the RER (A or E) is 10 minutes long. Under these assumptions, the VoSH is equal to 1.02 and the VoSR to 1.71 for the RER A. For the RER E, the values are 1.27 and 0.64, respectively. Judging from the values of the VoSH and the VoSR, it will likely be more beneficial to improve reliability on the RER A and frequency on the RER E. To confirm this point, we simulate in Table 1 the impact of an increase in either frequency or reliability on the expected travel cost, which is broken down into three components, in-vehicle time, waiting time and schedule delay, as apparent in equation ( 14). As expected, the best scenario is "Reliability improvement" for the RER A and "Frequency improvement" for the RER E . This basic simulation hints that future investments should focus on improving service reliability on the RER A and increasing frequency of the RER E. 19 Table 1: Simulation of 2 improvement scenarios for the RER A and the RER E 18 Regarding the triplet ( α , β,γ) , [START_REF] Bates | The valuation of reliability for personal travel[END_REF] indicate the ratios 1:0.8:3 as typical from the literature. A ratio of 2 for α w / α v is also standard [START_REF] Wardman | Public transport values of time[END_REF]. 19 Obviously, the investment costs of improving service frequency and reliability should also be factored in the analysis to confirm this point.

Extension: in-vehicle congestion

Headway has an impact on waiting times, but also on in-vehicle congestion (see section 2). When headways are irregular, longer headways are associated with both longer waiting times and greater passenger vehicle loads, hence a "double punishment" (and vice versa for shorter headways). To take this effect into account, we amend the model by linking the value of in-vehicle time to the number of passengers N:

        Θ * * w w v v w v w v C t T N T t t T T t T T t                 (27)
where Θ(N) represents in-vehicle discomfort and increases with N. For the sake of exposition, we choose a simple specification for Θ:

    0 0 1 if if N N N N k N N           (28)
If the number of passengers is greater than N0, the vehicle is overcrowded. The value of in-vehicle time is penalized by a factor k > 1. Otherwise, it retains its former value α v .

We assume that the rate of new travelers arriving on the platform is constant and equal to q. All travelers, our individual included, are impatient: they board the first train regardless of congestion. Furthermore, we consider that trains are empty when they arrive at A, which is the departure station. Under these assumptions, a simple relationship links the passenger vehicle load to the headway: N = qH. We rewrite Θ as a function of H instead of N:

    00 0 1 if / if H H H N q H k H H             (29)
Our individual being impatient, introducing congestion does not change the choice of departure time since headways are not time dependent. 20 It changes the expected travel cost, however (note that we still consider exponential headways):

        2 2 22 * Θ 1 if 1 2 1 * Θ ln if 1 2 1 H H H v v U w W H H H H H H v v U w W H H H H C T E H C T E H                                                                        (30)
Note that because we take the user point of view, we take the expectation of Θ(HU) and not of Θ(H ). Computations give:

          0 0 0 0 Θ if Θ 1 1 if H H H U H H H H U H H H E H k H H E H k e H                               (31)
If H0 < μH -σH, all trains are congested. The expected trip cost increases by a constant (k -1)α v T v . If H0  μH -σH, only trains with a headway above H0 are congested. This model, seemingly simple at first glance, leads to strong discontinuities when H0 is close to μH (Figure 5). When H0 increases, congestion is less severe, the case with no congestion corresponding to the limit case H0 = +∞. For a fixed headway variability σH, the travel cost always decreases with H0. The reverse is not true: H0 being fixed, the expected travel cost does not always increase with σH. There are two polar cases. If H0  μH, frequency is high enough and no train is congested when σH = 0. In this "normal regime", congestion only arises because headway variations can cause headways to exceed H0. In the "degraded regime" (H0 < μH), all trains are congested when the service is perfectly reliable. The

travel cost jumps from * det C to   * 1 det v v C k T  
when σH = 0. This time, service unreliability causes some trains to run with headways shorter than H0 and be uncongested. This explains why the travel cost may fall when σH increases in the degraded regime (Figure 5).

          0 0 0 2 0 0 2 VoSH VoSH 1 1 VoSR VoSR 1 1 HH H HH H H H H H c u v v HH H H H c u v v H H H k T e HH k T e                                                        (32)
Congestion increases the VoSH: VoSHc  VoSHu seeing that the second term in ( 32) is always positive.

In the degraded regime, the VoSH is discontinuous with a spike at σH = μH -H0 (Figure 6). This is the limit between the "fully degraded" mode (all trains are congested) and the "partly degraded" mode (only a fraction of them are). From this point on, improving service frequency leads to more and more trains being uncongested, hence the surge in the VoSH.

Contrary to VoSHc, VoSRc can be lower than VoSRu in the degraded regime. In (32), the term

   2 0 0 1 / H H H H H      
is positive in the normal regime (H0  μ H ), but negative in the degraded mode when

     0 0 0 0 ;1 / 2 3 H H H H H H H H H                 
. On this interval, increasing headway variability reduces the number of congested trains, which causes the travel cost to fall. Headway variability entails a "double punishment" in the normal regime. Travel time variability increases, raising the mean schedule delay cost, and some trains get overcrowded. Service unreliability is less detrimental in the degraded mode: it still raises schedule delay costs, but lowers the mean congestion cost by reducing the number of overcrowded trains. These results stem from the properties of the congestion function presented in equation ( 28): because it is a step function, it does not increase gradually and convexly with the number of passengers. In particular, in the normal regime, it is convex around μH, but in the degraded regime it is concave around μH. 22 If the congestion function was convex, headway variability would always raise the mean congestion cost, and conversely for a concave function.23

Conclusion

Service frequency and reliability impact the travel cost of transit users through three channels: waiting time, schedule delay and congestion. Transit users behave strategically and adjust their departure time in order to minimize these costs. The safety margin, which represents the time allocated to waiting, decreases 22 To be specific, equation ( 29) implies that the congestion function satisfies

      Θ Θ U H H   E for H0  μ H (normal regime) and       Θ Θ U H H   E
for H0 < μ H (degraded regime).

with service reliability, as expected. It increases with service headway, except for specific distributions of headways.

The values of service headway (VoSH) and service reliability (VoSR) measure the marginal effect on the expected travel cost of a change in the mean and in the standard deviation of headways, respectively. They complete the values of in-vehicle time and in-vehicle time variability by capturing the influence that headways have on waiting times and congestion. Furthermore, they can easily be computed: they relate to the distribution of headways, which are easily measured unlike waiting times or total travel times. This makes the VoSH and the VoSR well suited for the economic appraisal of public transport projects.

In the case of exponentially distributed headways with no congestion, we show that the VoSH is actually not constant and decreases with service reliability. Conversely, the VoSR increases with the reliability level. The relative values of the VoSR and the VoSR can help guide investments aiming to improve the quality of service towards either frequency or reliability improvements.

The analysis is subject to a certain number of caveats. First and foremost, in-vehicle travel time variability is not modeled. The extent to which modeling the variability of both headways and in-vehicle times would change our findings should be investigated by future research. The extension to congestion could be refined further and take into account the fact that travelers may want to wait for the next train in case of heavy congestion (in which case the phenomenon of "bunching" should also be represented). Last, the extent to which our results depend on the choice of ( α , β , γ ) scheduling preferences has also to be established.

Appendix A. Mathematical appendix

A.1 Optimal head start

For reminder, the optimal head start solves:

  Φ* w m      (A.1)
We start by showing * * det mm  . When σH = 0, the p.d.f. of waiting times is:

  , 1/ W det H x    for   0, H x   . As   1 Φ 1 H H H x     , we have     , w w det x x   and thus     , Φ Φ w w det x x x   R . Considering that     * * , Φ Φ w w det det m m    , * * det mm  follows.
We then compute the derivatives of m* with respect to μH and σH. Rewrite Φw( m*) as:

      * * * 0 0 0 1 Φ 1 Φ Φ* H h m m m H H w w H H x x m x dx dx dx                     (A.1) is therefore equivalent to: * 0 1 Φ m H h H H x dx          (A.2)
Differentiating (A.2) with respect to μH yields:

* * * 1 Φ Φ Φ H H H h h h H H H H m m dm d                                              assumption of positive headways implying     Φ / Φ 0 0 h H H H      , we have:           Φ * Φ * Φ * * 1 Φ * 1 Φ * H w H H H H m m m dm d mm       (A.3)
Since κ < 1, dm*/dμH < 1 follows. The denominator being strictly positive, the sign of dm*/dμH is the same as for the numerator. The sign of Φw -ΦH depends on the shape of the headway distribution. While in most cases, including the deterministic and exponential cases, Φw( x )  ΦH( x ) , the opposite can occur for fat-tailed distributions (an example is available from the authors upon request). Differentiating (A.2) with respect to σH yields:

  * 2 0 * 1 Φ * 0 m H H H h H H H x x dm m dx d                  



Integrating by parts gives:

    Φ* * 1 * 1 Φ* H H HH H m dm m d m              (A.4) Using β > 0 and ** 0 det H mm   , we have       Φ * * 1 0 1 Φ * H H H H H m dm d m         .

A.2 VoSH and VoSR

Using ( 5) and ( 8), we rewrite (18) as:

    * 0 * 1 Φ m H v v w w h H H x x c T dx                           (A.5)
We derive the VoSH:

            2 *
C C                                                                       (A.10)
The second mode corresponds to the case m*  μH -σH, which is equivalent to

                                                    
The minimum expected trip cost is given by:

      * * v v w w w m C T x x dx                   * * v v w w H C T m             22 * ln 2 H H H v v w w H H H CT                                 
We can use this last formulation to derive the VoSH and VoSR: .11)

2 2 2 VoSH 1 1 2 2 1 VoSR 1 ln 1 w H H H H H H H w H H H                                                          (A

Figure 1 :

 1 Figure 1: Probability distribution function of waiting times (exponential case, μH = 1)

  equal to the average waiting time μ H / 2 when β = γ. If β < γ, the individual dislikes being late more than being early and plans more time for waiting than the mean waiting time, and vice versa.

  2

Figure 2 :

 2 Figure 2: Influence of headway variability on the head start (exponential case, μH = 1)

Figure 3 :

 3 Figure 3: Influence of service reliability on the VoSH and the VoSR (exponential case, β = 0.8, γ = 3, α w = 2)

Figure 4 :

 4 Figure 4: Density of waiting times during the morning peak hour for westbound passengers arriving randomly at Nation and Bondy stations (Web-sourced data for RER A, Transilien data for RER E)

Figure 5 :

 5 Figure 5: Influence of 𝐻 0 on the expected travel cost curve (exponential case, α v = 1, T v = 3, α w = 2, β = 0.8, γ = 3, k = 2 and μH = 1)

Figure 6 :

 6 Figure 6: Influence of congestion intensity H0 on the VoSH (exponential case, α v = 1, T v = 3, α w = 2, β = 0.8, γ = 3, k = 2 and μH = 1)

Figure 7 :

 7 Figure 7: Influence of congestion intensity H0 on the VoSR (exponential case, α v = 1, T v = 3, α w = 2, β = 0.8, γ = 3, k = 2 and μH = 1)

  . When the operator increases the service headway (while keeping reliability at the same level), the user increases his margin by less than the increase in μH. Lastly, : the less reliable the service, the greater the head start. This is again coherent with intuition.

					Second, * / dm d	  H	1
					* / dm d	 	0
					H
			The sign of	* /  dm d	is not clear cut in the general case, however. While one would expect
					H
	* / dm	d	 	0
			H

  Assume m*  μH -σH.(A.8) gives m* = κ μH . We rewrite the condition m*  μH -σH as It is now easy to derive the values of service headway and reliability:

			      	    w w Φ Φ x x   1 H x    	H H		e	HH H     x   			for 0 for x	H  H  H x     	H	(A.8)
	We seek to solve	  Φ* w m	  . Two regimes naturally emerge depending on whether m* is greater or
	lower than μH -σH.
		VoSH H H   	1 , hence 2 w        H 	H H H   	2          H   1  	0 m  . The minimum expected trip cost is: ** 1 Φ* H H H H dm m m d       	x		w	x			H	x	dx
			VoSH * v c  T  v  		         * 0 m x    Φ * H m   w x dx      2 2  1 H H         w    2 w    w   	  m HH *      v v w m T     *      w Φ       * H m        * 2 2 H m
	  ΦΦ Hw x   2 /2 H H     2 * m 0 H  yields:    x dx   2 1 2 w H H H               2   2 v  H   w   VoSH  Using m* = κ μH and This simplifies to: v w w C T        * 0 ΦΦ m Hw x x     22 HH dx H 2 det w C                  	(A.6) (A.9)
	We now derive the VoSR: * VoSH		2 w				1			H	2 2	2	1 2	1	H	2 2	2 w	H	2 2	2
			VoSR VoSR 	   H w  *		  	     H  w H H	 H dm H ** H m d  	  1 Φ*  H H 			H   	* m 0 	x	x	 	H H H 		H	  x	dx
											H														H
				VoSR				w					 	H		  		m 	*	 	m	 * 1 Φ 	H	  * m				H		Φ	H	  * m				 
																							H			H		H
										H    		 ** H mm  		H	   Φ * H m		H H     	* m 0 		2	x			H		 1		H w  	  x dx 
	Integrating by parts the last term and simplifying yields:
						VoSR		   w 		HH H     	H m 	*	    		* H m 		2	H   	* m 0 	Φ	w	  x	dx	(A.7)
	A.3	Exponential case
	In the exponential case, according to (11) we have:
									w w         	    xx 1 for 0 1 for HH H H x H x e x           H     	 	H 	H 		H
	Computation gives:

Published in : Transportation Research Part B (2013), Vol 58, p.1-15 DOI: http://dx.doi.org/10.1016/j.trb.2013.09.009

Bates et al. (2001, pp.208-210) treat departure time as a continuous variable when considering the special case where the transit service departure time is random. However, they only provide a very general discussion of this case and do not give any significant result.

Again, Bates et al. (2001) is to the best of our knowledge one the few works to consider headway variability, in a brief manner to boot. Some other works do also consider headway variability (e.g.[START_REF] Bowman | Service frequency, schedule reliability and passenger wait times at transit stops[END_REF][START_REF] Furth | Service reliability and hidden waiting time: insights from automatic vehicle location data[END_REF], but they do not use scheduling preferences and resort to ad-hoc cost functions instead.

Service reliability encompasses two major dimensions in the case of headway-based services: headway regularity and in-vehicle time variability. This paper focuses on the former issue.

The mean headway μ H is inversely commensurate to service frequency, so one should understand "an increase in service frequency" as a decrease in μ H . Similarly, an increase in service reliability corresponds to a decrease in σH.

To illustrate this point, consider a transit line with headways of 59.9 and 0.1 minutes with equal probabilities (which is a Bernoulli process with mean 30 minutes). When a traveler arrives at the platform in a random manner, he has practically zero chance of arriving between two trains separated by 0.1 minute. He experiences a mean headway of 59.9 minutes (approximately), which is twice the mean objective headway.

This choice is also empirically supported (see subsection 5.2).

For the sake of brevity, we will often omit the term "centered".

We could easily apply the same framework to another utility function. Closed-form solutions would not be guaranteed in the exponential case, however.

There is likely some linkage between the variability of headways and in-vehicle times, and thus of waiting times and in-vehicle times. However, there is a direct link between headway variability and waiting time variability, which is less clear for headway variability and in-vehicle time variability. Were the connection between the two to be established (literature on this topic being currently seldom to the best of our knowledge), we could model Tv as a random variable function of H and take this phenomenon into account.

In the example discussed in footnote 5, slightly increasing μ H would actually be beneficial to transit users as they would have more chance to board the trains with very short headways, hence a shorter safety margin.

Interestingly, the term βμ H /2 is similar to the term βκN/s that appears in the equilibrium cost of the bottleneck model of road congestion.

We thereby extend the work of[START_REF] Fosgerau | The marginal social cost of headway for a scheduled service[END_REF] by completing his analysis on the value of headway in the case of deterministic headways to the case of variable headways.

Indeed, one can apply the model of Fosgerau and Karlström to the case where the travel time is the sum of a constant in-vehicle time and a variable waiting time. Travel time variability would entirely stem from waiting time

Less intuitive is the fact that, in the exponential regime, the VoSH does not depend on γ. This property is likely specific to the exponential distribution, but further investigation would be necessary to assert this point.

This point was not trite considering the example in footnote 5. When headways are highly irregular, increasing the mean headway could lead to a better allocation of travelers between trains, and subsequently to a decrease of the expected cost of travel.

In a way symmetric to what happens for the VoSH, the VoSR does not depend on β in the deterministic regime. Again, we did not find an easy interpretation of this intriguing result, which is most surely linked to the specificities of the exponential distribution.

If our individual is patient, the problem is more complex. If the first train to arrive is crowded, the individual can wait for the next train hoping that it will not be crowded. This possibility modifies the problem of the choice of departure time, and depending on how much the individual dislikes congestion, he might increase his safety margin to insure himself against this eventuality. For the sake of simplicity, we do not consider this possibility. This model does not include inter-personal variability either, in the sense that all passengers experience the same level of congestion while in reality, some passengers are comfortably sitting, even in overcrowded vehicles.

We still call VoSH and VoSR the derivatives of the expected cost with respect to μ H and σH. However, it is worth noting that these are now different from the willingness-to-pay of travelers for an increase in frequency or reliability. Indeed, passengers are not likely to take a diminution of congestion into account when faced with an improvement in service frequency or reliability, because congestion is not intrinsic to passengers' preferences. However, the VoSH or VoSR can still be used to assess the socio-economic consequences of a change in operations. Published in : Transportation Research Part B (2013), Vol 58, p.1-15 DOI: http://dx.doi.org/10.1016/j.trb.2013.09.009

Similarly, it is likely that were travelers to be patient (meaning that congestion at one instant can spill over to various departures), the mean congestion cost would be more regular and would always increase with headway variability. We could not confirm this point, however.

Acknowledgments

We thank Transilien for making their database available, and Fabien Leurent and François Combes who contributed in stimulating this paper. We also wish to thank participants of the TSU seminar in Tokyo, in particular Mogens Fosgerau, for comments and for providing useful references.


Carl Milner
email: milner@recherche.enac.fr

Christophe Macabiau

Paul Thevenon

Bayesian Inference of GNSS Failures Equation Chapter 1 Section 1

Keywords: Integrity, GNSS Vulnerability, Failure Modes and Effects Analysis, Bayesian

The probability of failure (failure rate) is a key input parameter to integrity monitoring systems used for safety, liability or mission critical applications. A standard approach in the design of Global Positioning System (GPS) integrity monitoring is to utilize the service commitment on the probability of major service failure, often by applying a conservative factor. This paper addresses the question of what factor is appropriate by applying Bayesian inference to real and hypothetical fault histories.

Global Navigation Satellite System (GNSS) anomalies include clock or signal transmission type faults which are punctual (may occur at any time) and incorrect ephemeris data which are broadcast for a nominal two hours. These two types of anomaly, classified as continuous and discrete respectively are addressed. Bounds on the total probability of failure are obtained with given confidence levels subject to well defined hypotheses relating past to future performance. Factors for the GPS service commitment of 10 -5 per hour per satellite are obtained within the range two to five with high confidence (up to 1-10 -9 ).

INTRODUCTION

The Global Navigation Satellite System (GNSS) failure rate is a key parameter in the design of safety, liability or mission critical applications. At present, only the Global Positioning System (GPS) publishes a Performance Standard (PS) for civilian use which includes service commitments relating to this probability (GPS, 2008). The commitment of 10 -5 per hour per satellite, translates to about 3 per year over the entire constellation (GPS, 2001). This value is based on a blend of experience obtained from past failure events [START_REF] Van Dyke | GPS Integrity Failure Modes and Effects Analysis[END_REF][START_REF] Van Dyke | Status Update on GPS Integrity Failure Modes and Effects Analysis[END_REF]) and reliability analysis undertaken for the constellation and ground segment.

The use of GNSS within the safety critical domain of civil aviation has led to many integrity monitoring developments. Placing trust within the service commitments provided by GNSS Service Providers (GSPs) represents an external risk to aviation certification authorities whose primary role it is to maintain the safety of passengers and crews within its airspace. To meet aviation's strict requirements, a number of approaches have been undertaken to lessen the external risk of the certification authority.

These solutions or augmentations are the Satellite Based Augmentation System (SBAS), the Ground Based Augmentation System (GBAS) and the Aircraft Based Augmentation System (ABAS) (ICAO, 2006). The latter includes the class of consistency checking algorithms known as Receiver Autonomous Integrity Monitoring (RAIM). SBAS is built on dense regional networks of stations incorporating fault monitors which place very little trust in the core GNSS. GBAS utilizes local reference stations with monitors whose performance is based on equally conservative prior probabilities of fault occurrence. In fact, the U.S GBAS implementation known as LAAS assumes 10 -4 per hour per satellite, ten times that of the service commitment [START_REF] Lee | [END_REF].

Integrity Monitoring techniques are often founded on equating the integrity risk for a failure to the product of the probability of occurrence of the failure, often expressed in the range domain, and the probability of missed detection, expressed in the position domain and defined as the event of the positioning error 𝑒 exceeding the alert limit 𝐴𝐿 and the monitoring test statistic 𝑇 not exceeding the threshold 𝑇 % [START_REF] Lee | Analysis Performed in Support of the Ad-Hoc Working Group of RTCA SC-159 on RAIM/FDE Issues[END_REF]. 𝑰𝑹 = 𝑷 𝒇𝒂𝒊𝒍 × 𝑷 𝒎𝒅 (𝒆 > 𝑨𝑳|𝑻 < 𝑻 𝒉 )

(1)

The total integrity risk is then predicated on summing mutually exclusive failure cases. The RAIM methodology employed in ABAS [START_REF] Lee | Analysis Performed in Support of the Ad-Hoc Working Group of RTCA SC-159 on RAIM/FDE Issues[END_REF]RTCA, 2004), is inherently founded on a satellite fault probability of 10 -5 per hour [START_REF] Lee | [END_REF][START_REF] Lee | Analysis Performed in Support of the Ad-Hoc Working Group of RTCA SC-159 on RAIM/FDE Issues[END_REF].

Future architectures are being assessed within the aviation community which aim to provide the relative autonomy and low costs of RAIM without the need to place significant trust in the core GNSS (FAA, 2010;[START_REF] Blanch | Critical Elements for a Multi-Constellation Advanced RAIM[END_REF]). One such architecture, Advanced RAIM (ARAIM), is the subject of the Working Group C ARAIM Technical subgroup (ARAIM SG) [START_REF] Blanch | Critical Elements for a Multi-Constellation Advanced RAIM[END_REF][START_REF] Wg-C | Milestone I Report Working Group C ARAIM Technical Subgroup, EU-US Cooperation of Satellite Navigation[END_REF]. Discussion within the ARAIM SG has focused on the question of how much trust can be placed in the core GNSS? This paper proposes a solution to the associated question of how do we quantify the trust we place in the core GNSS?

The methodology presented is applicable to any safety, liability or mission critical GNSS application that places trust in the core GNSS. The alternative is to assume that all GNSS fault modes occur with a probability of unity as taken for the ionosphere threat to CAT II/III GBAS [START_REF] Murphy | Validation of Ionospheric Anomaly Mitigation for GAST D. Working paper presented at Working group of the whole meeting[END_REF].

The paper is organized as follows. Section 2 presents the available methodologies. Section 3 presents the failure types and partitions them for the appropriate analysis of sections 6 and 8. Section 4 introduces the failure rate model. Section 5 presents the Bayesian inference methodology. Section 6 applies Bayesian inference to the observed continuous time fault history. Section 7 presents the application to new satellite blocks. Section 8 addresses discrete time failures. Section 9 presents the combined failure model including an algorithmic framework outlining the role of the preceding sections before Section 10 concludes.

FOUNDATIONS

This paper determines the probability of failure onset without accounting for the transition from a fault mode to the fault-free mode following control segment intervention (GPS, 2008;[START_REF] Blanch | Briefing at the EU-US Working Group C ARAIM Subgroup[END_REF]. A number of different approaches may be taken as outlined below.

Acceptance of the Performance Standard

A first approach could be to accept the standards provided by the core GNSS such as in the GPS Standard Positioning Service (SPS) Performance Standard (PS) (GPS, 2008) and the associated external risk. The GPS SPS PS defines a Major Service Failure (MSF) to occur when the Instantaneous User Ranging Error (IURE) exceeds 4.42 times the satellite's broadcast User Ranging Accuracy (URA). The standard then states that an MSF will not occur with a probability greater than 10 -5 per hour per satellite which equates to approximately three failures per year over the constellation. The URA is broadcast for each satellite and varies with time, as does the true distribution of the IURE, whereas from the user perspective, a ranging failure, which may lead to a positioning failure, depends upon the time-varying user-satellite geometry. Furthermore, the MSF magnitude could potentially be larger than the failures which must be addressed, to support, say LPV-200 operations with ARAIM (ICAO, 2006;FAA, 2010;[START_REF] Wg-C | Milestone I Report Working Group C ARAIM Technical Subgroup, EU-US Cooperation of Satellite Navigation[END_REF].

Fault Tree Analysis

Alternatively, fault tree analysis could be applied within a risk assessment of the core GNSS space and ground segments. A Failure Modes and Effects Analysis (FMEA) is performed, capturing the faults with the potential to cause a positioning failure [START_REF] Van Dyke | GPS Integrity Failure Modes and Effects Analysis[END_REF][START_REF] Van Dyke | Status Update on GPS Integrity Failure Modes and Effects Analysis[END_REF].

Table 1 presents the list of feared events considered for ARAIM [START_REF] Wg-C | Milestone I Report Working Group C ARAIM Technical Subgroup, EU-US Cooperation of Satellite Navigation[END_REF]. The advantage of this approach is setting very low probabilities to rare faults with sufficient justification. However, there is a tendency to conservatively but arbitrarily inflate the prior probabilities of other failure events, thus negating the gains.

Empirical Approach

The approach taken in this paper is to estimate the failure rate for the ensemble of feared events using the fault history. It is a methodology readily available to the navigation community given the extensive data stored globally and thus enables the use of data mining activities to capture the occurrence of failure events [START_REF] Heng | GPS Signal-in-Space Anomalies in the Last Decade: Data Mining of 400,000,000 GPS Navigation Messages[END_REF]. Previous fault analyses employed within the augmentation system definitions have assumed failure rates for different feared events based on an analytical expert opinion, to which conservative factors are then applied [START_REF] Shively | Analysis of Probability of Misleading Information for LAAS Signal In Space[END_REF].

FAILURES AND FEARED EVENTS

The approach taken in this paper is based on the true unknown time-varying satellite failure rate 𝜆. In order to fully understand its properties, the following failure definitions are considered:

• Ranging/Positioning Failure: the event that the instantaneous error (range or position domain) exceeds a predefined threshold (Figure 1 & Figure 2) (GPS, 2008).

• Integrity Failure:

the event that the probability of an instantaneous position error exceeding a predefined threshold without timely detection, exceeds a predefined probability limit (Figure 3) (ICAO, 2006) • Overbounding Failure:

the frequency density which lies outside the assumed model (Figure 4) (DeCleene, 2000) • Statistical Failure: a change in the underlying error distribution to a 'failure' state defined by statistical parameters (i.e. mean and sigma) (Figure 5) [START_REF] Lee | [END_REF] These definitions may be applied in the range domain, position domain or test statistic domain [START_REF] Sturza | Navigation System Integrity Monitoring Using Redundant Measurements[END_REF]. Whilst the performance commitments are naturally in the range domain (GPS, 2008), the position domain is used for the application requirements (ICAO, 2006). In this paper, the range failure of Figure 1 is taken as the baseline. Whilst, such events may be understood to occur at the onset of the defined failure windows shown in Figure 1, Figure 2 and Figure 3, it is not immediately obvious how a rate can be applied to the failure interpretations expressed by Figure 4 and Figure 5.

Table 1 lists the most commonly considered feared events (WG-C, 2012). Column three codifies whether the fault occurs at a punctual continuous (and random) point in time (C) or during a discrete sample with correlation throughout the sample period (typically two hours) (D). These cases are handled separately in sections 5-6 and 8 respectively. Nominal events consisting of both types are denoted (B). A failure (condition) as defined by Figures 1 to 5 is distinguished from a fault being the physical event (payload functioning in an abnormal state). The table of feared events presents both faults and other events which may occur nominally and lead to a failure condition. In that regard a feared event is a type of fault.

The rate 𝜆 does not include failures due to the signal environment or user segment equipment. The probability of space and control segment failures depends upon the satellite's hardware (clock age, payload, block design) or the ground control segment (network, software, operational status). This variability of the failure rate λ as a function of time is addressed in the following section.

FAILURE RATE MODEL

This paper presents a Bayesian approach to determining the true failure rate (O' Hagan and Forster, 2003). It is assumed that the physical process's true failure rate exists and may be estimated using Bayesian analysis as opposed to a classical approach [START_REF] Neyman | Outline of a Theory of Statistical Estimation Based on the Classical Theory of Probability[END_REF]. Whilst a confidence distribution may be constructed by extending the classical notion of the confidence interval, such an approach has not been extensively formalised [START_REF] Fraser | Is Bayes Posterior just quick and dirty confidence[END_REF]. The advantages of a Bayesian approach are that it allows a more natural means to express the posterior distribution for the estimated random parameter. Furthermore, understanding this parameter to be time-varying and random allows an easier interpretation of the conditions in which the approach is valid (as expressed in hypotheses 1-3). Finally, whilst this paper ultimately selects a non-informative prior, the Bayesian approach maintains the possibility of combining the technique with prior information from an FMEA.

Following this Bayesian approach, initially the mathematical formulation is restricted to punctual, continuous time events. If the true instantaneous failure rate is known to be constant then the number of failures observed over a given duration would follow a Poisson process [START_REF] Cox | Point Processes[END_REF]. Due to changes in the control segment, the active satellite clock and aging of payload components, the true instantaneous failure rate varies with time. The Non-Homogeneous Poisson Process (NHPP) with variable failure rate 𝜆(𝑡) models this real system [START_REF] Pham | Software Reliability Modeling. System Software Reliability[END_REF]. Under the NHPP the true expected number of failure events up to time 𝑇 is:

𝒎(𝑻) = = 𝝀(𝒕) 𝑻 𝟎 𝒅𝒕 (2)
The probability of 𝑘 failures having occurred over the period [0, 𝑇] is then known to follow the standard Poisson relation:

𝑷(𝒌) = 𝒎(𝑻) 𝒌 𝒌! 𝒆 H𝒎(𝑻) (3)
To utilise this result in the future, the following two hypotheses are assumed:

H1. Short term variations in 𝜆(𝑡) are not observable

H2. ∀𝑇 ∃𝑆 > 𝑇 𝑠. 𝑡 𝑚(𝑇) 𝑇 ≥ ∫ 𝜆(𝑡)𝑑𝑡 S T

𝑆

Hypothesis 1 states that whilst the system changes from ground operational actions, satellite aging and other factors, the impact on the instantaneous probability of failure cannot be determined from data. It is a hidden variables statement that supposes all that is undeterminable may be considered random. What is of interest is the likelihood that the number of failure events exceeds the number that is predicted.

Aircraft perform approach and landing operations using monitoring algorithms predicated on a particular failure probability. If the true failure probability exceeds this value during an approach but this value is not determinable as the fluctuations from causal relations are too complex to determine, it is then appropriate to assert that the system meets the integrity requirements based on the best available knowledge. The alternative is to estimate the impact of satellite aging and all other factors upon the failure rate. However, the authors' view is that this is too complex to model appropriately.

Hypothesis 2 goes further by relating the expected failure rate at time 𝑇 to future expectations of the failure rate. It states that a future time 𝑆 exists where the true expected failure rate will be no greater than the current expected rate. It may be understood that the total system reliability does not degrade over the long term. Note this hypothesis applies to the total system rather than a particular satellite. It asserts that a future time 𝑆 may be found, and not that the condition holds for all 𝑆.

The service commitment may then be understood as implementing sound processes, by maintaining the same rigour in satellite and ground system design, mitigating observed problems in the control segment operations and maintaining satellites as they age. The variable 𝝀 is then used as the true mean failure rate 𝜆 = 𝑚(𝑡)/𝑇 which for the purposes of notational simplicity is scaled to be the rate per 𝑇 (to be rescaled when expressing the results per hour as in Table 4) and the model reduces to the Poisson Process (Cox and Isham, 2006).

𝑷(𝒌) =

𝝀 𝒌 𝒌! 𝒆 H𝝀 (4)

BAYESIAN INFERENCE

Inference may be made using past failure data to estimate the posterior distribution of 𝜆. Bayes theorem for a continuous variable 𝜆 with discrete events 𝑘 is as follows [START_REF] Box | Bayesian Inference in Statistical Analysis[END_REF]:

𝒇(𝝀|𝒌) = 𝑷(𝒌|𝝀)𝒇(𝝀) ∫ 𝑷(𝒌|𝝀)𝒇(𝝀) 𝒅𝝀 (5)
where:

𝑃(𝑘|𝜆) -probability of 𝑘 failure events occuring over 𝑇 given 𝜆 𝑓(𝜆) -continuous prior PDF for 𝜆 𝑓(𝜆|𝑘) -continuous posterior PDF for 𝜆

The quantity of interest is the continuous posterior distribution for the failure rate 𝑓(𝜆|𝑘). Over a given period with a given definition of failure, 𝑘 may be determined. The Poisson model determines the values the function 𝑃(𝑘|𝜆) takes whilst the prior probability 𝑓(𝜆) may be formed using two approaches [START_REF] Box | Bayesian Inference in Statistical Analysis[END_REF][START_REF] Jeffreys | An Invariant Form for the Prior Probability in Estimation Problems[END_REF]:

A. Non-informative reference priors giving the data maximum weight over prior information B. Priors expressed using standard conjugates based on 'expert opinion'

For completeness, both approaches are used to check whether the choice of prior has a strong impact on the results. The form of the conjugate prior distribution does not influence the inference output significantly, what is critical are the CDF percentiles.

Firstly, the conjugate distribution to the Poisson distribution which may be used for the prior 𝑓(𝜆), the Gamma distribution, is introduced [START_REF] Raiffa | Applied Statistical Decision Theory[END_REF]:

𝒇(𝝀) = 𝜶 𝝂 𝝀 𝝂H𝟏 𝒆 H𝜶𝝀 𝜞(𝝂) (6)
with shape parameter 𝜈, scale parameter 1 𝛼 ⁄ , and the gamma function 𝛤(•)

Three reference priors are employed [START_REF] Box | Bayesian Inference in Statistical Analysis[END_REF][START_REF] Jeffreys | An Invariant Form for the Prior Probability in Estimation Problems[END_REF] :

Bayes Uniform Prior: (𝜈 = 1 & 𝛼 = 0) 𝒇(𝝀) ∝ c 𝟏/𝑴 𝟎 𝟎 ≤ 𝝀 ≤ 𝑴 𝒐𝒕𝒉𝒆𝒓𝒘𝒊𝒔𝒆 where 𝑴 → ∞ (7)
Albert's Prior:

(𝜈 = 0 & 𝛼 = 0) 𝒇(𝝀) ∝ 𝟏 𝝀 (8) Jeffrey's Prior (𝜈 = 1/2 & 𝛼 = 0): 𝒇(𝝀) ∝ 𝟏 √𝝀 (9)
Although there is no single standard reference prior, Jeffrey's prior is the most commonly employed.

In addition, hypothetical expert opinions are considered, expressed in terms of the conjugate prior.

The gamma distribution parameters and percentiles are given in Table 2, selected with respect to the GPS constellation. The positive expert in the first row of Table 2 is the expert opinion of following the recent trend.

The realistic expert view follows GPS SPS PS (2008) whilst the conservative view holds a 95% confidence that a fault per month is to be expected and the highly conservative a 95% confidence of a fault per week. Table 3 presents the respective Gamma distribution parameters. Employing the parameters given in Table 3 gives the following posterior distributions:

1 𝑓(𝜆|𝑘, 0,1 ) = 𝑒 Hn 𝜆 o 𝛤(𝑘 + 1)

2

𝑓(𝜆|𝑘, 0,0) = 𝑒 Hn 𝜆 oHq 𝛤(𝑘)

3 𝑓 r𝜆|𝑘, 0, q s t = 𝑒 Hn 𝜆 oH u v 𝛤w𝑘 + q s x 4-7 𝑓(𝜆|𝑘, 𝛼, 𝜈) = 𝑒 H(qyz)n 𝜆 oy{Hq (1 + 𝛼) oy{ 𝛤(𝑘 + 𝜈)
Integrating the posterior distributions with a 𝑘 value taken from the fault history determines the true failure rate with a given level of confidence. Example results are given in the appendix for various 𝑘 values and show only minor differences. The exception is for a low 𝑘 value (Table 12) as a result of choosing the conjugate distribution parameters to best fit the tail. For full constellations with a long service history, the differences are much smaller (Table 9) and the prior distribution has little impact on the posterior distribution. In the case of low 𝑘 value it may be more appropriately argued that the no prior information rule should be applied. Therefore, Jeffrey's prior is employed for the remainder of the paper.

FAULT HISTORY

Consider the fault history of the existing constellations, GPS and Glonass. A data mining approach presented in [START_REF] Heng | GPS Signal-in-Space Anomalies in the Last Decade: Data Mining of 400,000,000 GPS Navigation Messages[END_REF][START_REF] Heng | Safe Satellite Navigation with Multiple Constellations: Global Monitoring of GPS and GLONASS Signal-In-Space Anomalies[END_REF] found a total of 28 potential GPS anomalies over the period 2004 to mid-2012. Here an anomaly is defined with respect to the service commitments, when the instantaneous user ranging error exceeds 4.42 times the URA (GPS, 2008). The anomalies are potential as they have not been fully verified in an independent manner and any faults lasting less than 15 minutes may not be included. Of the 28 potential anomalies, 21 were clock faults and fit the continuous definition.

Using the posterior distribution given by Jeffrey's prior:

𝒇 r𝝀|𝒌, 𝟎, 𝟏 𝟐 t = 𝒆 H𝝀 𝝀 𝒌H 𝟏 𝟐 𝜞w𝒌 + 𝟏 𝟐 x (10)
and the fault history obtained by [START_REF] Heng | Safe Satellite Navigation with Multiple Constellations: Global Monitoring of GPS and GLONASS Signal-In-Space Anomalies[END_REF] gives the confidences for the true past mean failure probability shown in Table 4. Note that a constellation of 30 satellites is assumed for the purposes of transforming to a per satellite basis. This gives a total number of hourly periods of 2235330 over the 8½ year period. 1.9×10 -5 1.6×10 -5 99.9% 2.2×10 -5 1.8×10 -5 1-10 -5 2.6×10 -5 2.2×10 -5 1-10 -7

3.0×10 -5 2.5×10 -5 1-10 -9 3.3×10 -5 2.8×10 -5

Table shows that whilst values greater than the service commitments are obtained for all confidence levels larger than 95%, the inflation of 10 -5 is not excessive. The relationship between confidence percentile and failure rate is approximately log-linear. Confidence bounds up to 10 -9 are presented as this presents the lower bound on risks which must be mitigated, known to have potentially catastrophic consequences in civil aviation [START_REF] Easa | Certification Specifications and Acceptable Means of Compliance for Large Aircraft[END_REF]. A confidence level is considered rather than fault rate but this provides some justification to the range of percentiles.

The highest confidence percentile of 10 -9 requires a reasonable inflation factor of only 2.8 over the GPS service commitments. However, note that the discrete time faults addressed in section 8 must also be included.

Heng (2012) also analyses the Glonass fault history. Using an arbitrary fault threshold of the IURE of 50m (no public service commitments exist for Glonass) a total of 192 potential anomalies were identified between 2009 to August 2012. Using this result, Table 5 presents the equivalent confidence levels of the Glonass failure rate based on the assumption of a 24 satellite constellation. This gives a total number of hourly periods of 777888 over the assessment period in [START_REF] Heng | Safe Satellite Navigation with Multiple Constellations: Global Monitoring of GPS and GLONASS Signal-In-Space Anomalies[END_REF].

Table 5. Glonass Failure Rate Confidence Percentile Ponset/hr/sat All Faults 95% 2.8×10 -4 99% 3.0×10 -4 99.9%

3.1×10 -4 1-10 -5 3.4×10 -4 1-10 -7

3.6×10 -4 1-10 -9

3.8×10 -4

Using the data from [START_REF] Heng | Safe Satellite Navigation with Multiple Constellations: Global Monitoring of GPS and GLONASS Signal-In-Space Anomalies[END_REF], the Glonass failure rates are an order of magnitude greater than those of GPS. The log-linear relationship is preserved and a high confidence leads to only a reasonable inflation over the best estimate.

This section has presented the results of the methodology using the best available fault history data from [START_REF] Heng | Safe Satellite Navigation with Multiple Constellations: Global Monitoring of GPS and GLONASS Signal-In-Space Anomalies[END_REF], but the approach could be re-applied using different failure thresholds to obtain appropriate results. This is particularly relevant for Glonass in which reference [START_REF] Heng | Safe Satellite Navigation with Multiple Constellations: Global Monitoring of GPS and GLONASS Signal-In-Space Anomalies[END_REF] utilised a threshold of 50m, which is large with respect to some applications.

NEW CONSTELLATIONS

In section 6, the inference methodology was applied to fault history data of the existing constellations. In this section, the failure rates are derived for new constellations, such as Galileo or Beidou, or new blocks of satellites which may require a reset of the fault history.

Consider the failure rates with given confidences as a function of the observation window 𝑇, starting at an initial operating capability. It is assumed for the analysis that no faults are observed over this period but to maintain conservatism, a value of 𝑘 = 1 is used, thereby extending the applicability of the derived values in the immediate period following a failure.

Table 6. Derived Failure Probabilities vs. Constellation Operational Time Total Operational Time Ponset/const 6 months 5.4×10 -3 1 year 2.7×10 -3 2 years 1.3×10 -3 5 years 9.1×10 -4 10 years 5.5×10 -4 20 years 2.7×10 -4 30 years 1.8×10 -4 50 years 5.5×10 -5 75 years 3.6×10 -5 100 years 2.7×10 -5

Table 6 shows the total (fault-free) operational time of a constellation of 24 satellites and the corresponding derived probability of failure with a confidence of 1-10 -9 .

DISCRETE TIME EVENTS

In the previous sections the NHPP was used to model the failure rate for punctual continuous time fault events. Consider discrete time failures which occur over a sample period such as incorrect ephemeris parameters. A temporal correlation exists between the presence of a fault at neighbouring times. This may be over the standard navigation message period of applicability (2 hours for GPS) or up to a maximum of the data period used for orbit determination (48 hours).

For discrete events, the appropriate model is an inhomogenous Binomial process, but no simplification to the standard Binomial process through taking the mean over time exists. Instead the real process is considered to be a sequence of events with probability of failure 𝑠 = {𝑝 q , 𝑝 s , 𝑝 𝑘 the number of failure events 𝑛 the number of independent samples 𝑝 ‡ the true probability of fault during a single independent sample indexed by 𝑖

The conjugate prior distribution to the binomial is the beta distribution [START_REF] Johnson | Continuous Univariate Distributions[END_REF].

𝒇(𝒑)~𝒑 𝜶H𝟏 (𝟏 -𝒑) 𝜷H𝟏 (12)
The Jeffrey's prior parameter values to minimise the impact of prior information for the beta distribution are: 𝛼 = q s & 𝛽 = q s which give the following posterior distribution.

𝒇(𝒑|𝒌, 𝒏)~𝒑 𝒌H𝟏/𝟐 (𝟏 -𝒑) 𝒏H𝒌H𝟏/𝟐 (13)

The percentiles are determined by integrating up to the fault probability. Whilst the true time between independent navigation messages remains open to debate, values of 2 hours (nominal navigation message validity, 4 hours (nominal curve fit period), 12 hours (approximate orbital period) and 48 hours (data period used for orbit modelling) are used. These correlation times lead to numbers of samples of 898272, 449136, 149712 and 37428 on the basis of a 24 satellite constellation operating from the 1 st Jan 2004 to 16 th July 2012, being the period employed in [START_REF] Heng | Safe Satellite Navigation with Multiple Constellations: Global Monitoring of GPS and GLONASS Signal-In-Space Anomalies[END_REF]. Table 7 shows the probability of failure per sample following the integration of the posterior distribution, whilst 1.4×10 -5 2.2×10 -5 8.3×10 -5 3.3×10 -4 99% 1.6×10 -5 3.4×10 -5 1.0×10 -4 4.1×10 -4 99.9% 1.8×10 -5 4.2×10 -5 1.3×10 -4 5.0×10 -4 1-10 -5 2.2×10 -5 5.6×10 -5 1.6×10 -4 6.7×10 -4 1-10 -7 2.5×10 -5 6.9×10 -5 2.1×10 -4 8.3×10 -4 1-10 -9 2.8×10 -5 8.2×10 -5 2.5×10 -4 9.8×10 -4 5.7×10 -6 5.7×10 -6 7.0×10 -5 7.0×10 -6 99% 8.5×10 -6 8.5×10 -6 8.5×10 -6 8.5×10 -6 99.9% 1.0×10 -5 1.0×10 -5 1.0×10 -5 1.0×10 -5 1-10 -5 1.1×10 -5 1.4×10 -5 1.4×10 -5 1.4×10 -5 1-10 -7

1.7×10 -5 1.7×10 -5 1.7×10 -5 1.7×10 -5 1-10 -9

1.7×10 -5 2.0×10 -5 2.0×10 -5 2.0×10 -5 and show higher confidence is obtained without an extreme increase in the failure rate reflecting the continuous case. Although the larger correlation time decreases the number of samples, due to the factoring by the period, Table 8 shows only a minor sensitivity to this assumption. Note however, that the longer correlation time faults could be subject to longer exposure times if there are no guarantees of detection by the control segment. Alternatively, a more complex model could be employed to reflect this [START_REF] Blanch | Briefing at the EU-US Working Group C ARAIM Subgroup[END_REF].

Considering the discrete model for new systems or constellations gives confidence levels on the probability of failure as shown in Table 9.

Table 9. Derived Failure Probabilities vs. Constellation Operational Time Total Operational Time Independent sample period 6 months 4.5×10 -3 1 year 2.4×10 -3 2 years 1.2×10 -3 5 years 5.0×10 -4 10 years 2.5×10 -4 20 years 1.3×10 -4 30 years 8.5×10 -5 50 years 5.1×10 -5 75 years 3.4×10 -5 100 years 2.6×10 -5

ALL EVENTS MODEL

In order to summarise the steps required to arrive at the bounds of the total failure rate as given in Table 10, Figure 6 presents the process in full.

Figure 6: Failure Rate Bounding Process

The results provided in sections 6 and 8 to complete a table of the total probability of failure per hour and per satellite using the more conservative 48 hour sample period. 1.4×10 -5 7.0×10 -6 2.1×10 -5 99% 1.6×10 -5 8.5×10 -6 2.4×10 -5 99.9% 1.8×10 -5 1.0×10 -5 2.8×10 -5 1-10 -5 2.2×10 -5 1.4×10 -5 3.6×10 -5 1-10 -7 2.5×10 -5 1.7×10 -5 4.2×10 -5 1-10 -9 2.8×10 -5 2.0×10 -5 4.8×10 -5

Table 10 shows that in order to have a high confidence, factors of the order of 2 to 5 are required based on the fault history provided in [START_REF] Heng | Safe Satellite Navigation with Multiple Constellations: Global Monitoring of GPS and GLONASS Signal-In-Space Anomalies[END_REF]. Table 11 presents the equivalent total failure model for the case of new satellite constellations or blocks and the associated operational time. 5.4×10 -3 4.5×10 -3 1.0×10 -2 4.2×10 -4 1 year 2.7×10 -3 2.4×10 -3 5.1×10 -3 2.1×10 -4 2 years 1.3×10 -3 1.2×10 -3 2.5×10 -3 1.0×10 -4 5 years 9.1×10 -4 5.0×10 -4 1.4×10 -3 5.8×10 -5 10 years 5.5×10 -4 2.5×10 -4 8.1×10 -4 3.3×10 -5 20 years 2.7×10 -4 1.3×10 -4 4.0×10 -4 1.7×10 -5 30 years 1.8×10 -4 8.5×10 -5 2.7×10 -4 1.1×10 -5 50 years 5.5×10 -5 5.1×10 -5 1.0×10 -4 4.2×10 -6 75 years 3.6×10 -5 3.4×10 -5 7.0×10 -5 2.9×10 -6 100 years 2.7×10 -5 2.6×10 -5 5.3×10 -5 2.2×10 -6

CONCLUSIONS

This work has presented a novel approach to the setting of failure probability assumptions for GNSS safety, liability and mission critical applications. A methodology has been defined whilst carefully stating the assumptions needed to infer future reliability statistics based on past data.

Results have been presented for two intrinsic fault types, continuous faults which are punctual events occurring at any continuous point in time and discrete faults whose occurrence is tied to an independent single sample. This dichotomy is crucial so not to model certain fault types using an inappropriate model.

Confidence bounds have been determined for the failure probability of continuous faults in the range of 1-3 times larger than the service commitment of 10 -5 per hour per satellite with extremely high confidence. This suggests that the analysis matches well the service commitments but could enable a quantified layer of conservatism to be applied. Similarly, for the discrete time events, conservative factors of 1-2 are determined. Therefore, for the total fault probability factors up to 5 are obtained. Application of the methodology to new blocks of satellites has shown how quickly confidence could be gained from a new constellation or modernization programs in the absence of failures.

The natural objection to this analysis is whether applying inferences on past data is applicable to future failure probability predictions. However, such inductive argument is intrinsic to the service commitment statements and any other statements relating to future performance.

The step forward taken by this paper is in introducing a quantifiable conservative bound avoiding the need for arbitrary assumptions. The probability of failure is considered a random time varying parameter whose distribution is estimated rather than deriving a more simplistic point estimate.

Secondly, justification is given to using inference on past data for future operations. From the point of view of a fastidious system designer, this paper gives confidence to the existing GPS performance commitments with some small conservative factors applied to provide the confidence margins preferred. The paper also shows the approach applied to new constellations with limited fault histories (e.g. Galileo). In future, informative priors could be included to take account of an FMEA undertaken within the constellation design, testing and validation.

Figure

  Figure 1: Range Error Failure

Figure 5 :

 5 Figure 5: Statistical Modelling Failure Navigation system requirements are expressed in terms of either positioning failures or integrity failures (ICAO, 2006), yet implicit assumptions are made that the mathematical techniques employed and the physical assumptions taken are valid. This provides the link between the natural definitions of Figure 2 and Figure 3 with those of Figure 4 and Figure 5. The MSF event (GPS, 2008) is a function of URA. However, when the IURE remains below the 4.42×URA value, a change in the underlying error distribution, such as an increased mean or inflated standard deviation can also represent a failure condition. This is the case if the zero-mean Gaussian model parameterised by URA no longer overbounds the true distribution.

Table 1 :

 1 Feared Events

	Feared Event	Comment

D Nominal Signal Deformation Incorrect overbounding/modelling through the URA and ICAO signal deformation modelling B Single Fault Signal Deformation Physical 'evil waveform' event can occur at any continuous time C Nominal code-carrier incoherence Incorrect overbounding/statistical modelling by the URA.

Table 2

 2

			Expert Opinion Conjugate Priors
	Expert Opinion	𝜈	𝛼	Mean/year 95%/year	Comments
	Positive	3	0.1	1.5	3	95% at 3/year
	Realistic	3	0.05	3	6	Mean at 3/year
	Conservative	2.5	0.02	6.25	14	95% at 1/month
	Highly -Conservative	2	0.005	67	47	5% at 3/year
						95% at 1/week

Table 3

 3

	. Prior Distribution Parameters
	ID Prior	2𝜈	2𝛼
	1 Uniform	2	0
	2 Albert	0	0

Table 4

 4

		. GPS Failure Rate Confidence
	Percentile Ponset/hr/sat All Faults Ponset/hr/sat Cts Time Faults
	95%	1.7×10 -5	1.4×10 -5
	99%

  • … } and the following assumption is imposed: H3. The sequence 𝑠 is non-increasing (𝑝 o ≥ 𝑝 oyq ) This is a stronger condition than hypotheses H1 and H2 applied in the continuous time case. It only applies to the navigation message type faults which depend on the ground network and may be understood as the ground network does not degrade over time. Under this assumption the standard Binomial process model is used to conservatively infer the posterior distribution for the current 𝑝 based on past fault data.

			r 𝒏 𝒌	t 𝒑 𝒌 (𝟏 -𝒑) 𝒏H𝒌	(11)
	where: r 𝑛 𝑘	t =	†! o!( †Ho)!

  Table 8 converts these values to per hour figures.

	2hr	4hr	12hr	48hr
	95%
	Table 7. GPS Discrete Failure Rate Confidence
	Percentile Ponset/sample/sat Discrete Time Faults
	Independent sample period

Table 8 .

 8 GPS Discrete Failure Rate Confidence per hour

	Percentile Ponset/hr/sat Discrete Time Faults
	Independent sample period
	2hr	4hr	12hr	48hr
	95%

Table 10

 10

	. GPS Total Failure Rate Confidence
	Ponset/hr/sat
	Percentile Continuous Discrete Total
	95%

Table 11

 11

	. Operational Time
	Ponset/const			Ponset/sat (24)
	Total Operational Time Cts	Dsc	Total	Total
	6 months

APPENDIX

This appendix presents tables giving the confidence bounds for different failure number cases and for each of the priors considered in the paper.

ID Expert

10 -3 10 -5 10 -7 10 -9 ID Expert 10 -3 10 -5 10

DISCLAIMER

The views and conclusions expressed in this paper are those of the authors only and do not reflect official standpoints of any organization or working group.