Required Navigation Performances for Drone Flight Operations ^†

Abstract

Drone flight operations require ensuring the containment of the drone along the desired flight path in the domain of the Total System Error (TSE). The paper proposes a number of Required Navigation Performance (RNP) specifications tailored to drones by assessing the contributing error sources: the definition of the desired flight path, flyability, autopilot envelope, positioning errors, and operational environment (bottom-up approach). Ongoing work with drone operators is collecting their navigation requirements (top-down approach) in order to determine to which extent RNP navigation specifications meet their requirements along the flight profile.

1. Introduction

This study describes ongoing research by the European Union Agency for the Space Programme (EUSPA) on navigation specifications’ concepts for drone flight operations. The general principles are based on Performance-Based Navigation (PBN), as described by ICAO Doc 9613 [1] and the EUROCAE ED-75E [2]. A variety of drone use cases, including multi-copters and fixed wing drones, are being assessed from which typical mission requirements are derived. Those requirements are technology-agnostic and commensurate with the risk of the operation (based either on mission or safety arguments). The desired flight path must be entirely contained within the drone’s flight geography, both in the horizontal and vertical planes. When flying that path, there will be errors in the horizontal and vertical components. In both cases, the TSE includes three error sources, i.e., the Navigation System Error (NSE), Flight Technical Error (FTE), and Path Definition Error (PDE). Therefore, a careful allocation of the TSE to these error sources is necessary to keep it under control, considering the environmental aspects from the mission such as spatial constraints, RF interference, and meteo conditions (e.g., wing and gust). The paper outlines a number of RNP specifications for drones, including an On-Board Performance Monitoring and Alerting (OBPMA) mechanism. The proposed concept is motivated as a response to the requirements stated by EASA in the Special Condition (SC) for Light UAS-Medium Risk [3], applicable to SAIL III and IV of the specific category of operation, in particular, Light-UAS.2510 Equipment, Systems, and Installation, Light-UAS.2511 Containment, and Light-UAS.2529 UAS Navigation Function. The study focuses on the bottom-up approach, i.e., the aggregation of error sources to derive the resulting TSE (95%) or RNP values, which were discussed at the User Consultation Platform held in October 2022 in the frame of the EU Space Week with positive feedback. Ongoing work with drone operators is collecting their navigation requirements (top-down approach) that will allow for validating a set of RNP navigation specifications covering the whole drone flight profile. Following the introduction, the concepts of RNP for drones and TSE containment are presented in Section 2 and Section 3, respectively. Section 4 describes the TSE error sources and Section 5 presents the RNP calculations. The GNSS performance requirements (focusing on accuracy and integrity) are described in Section 6. Finally, Section 7 presents the conclusions and way forward.

2. RNP Concept for Drones

Within PBN, the proposed concept relies on area navigation, including the requirement for OBPMA. Therefore, it is built on RNP navigation specifications tailored to drones. The aim is to ensure the containment of the drone within a narrow 3D corridor along the desired flight trajectory, i.e., in the domain of the TSE.

2.1. Total System Error

The TSE includes three error components: NSE, FTE, and PDE.

2.1.1. Navigation System Error

The NSE depends on a number of factors, such as the GNSS (it is assumed here that GNSS is the only source for position determination (position fixing), but other sources are possible as well) constellations and frequencies used by the GNSS receiver, the absence of RFI, and the number and geometry of satellites in view from the drone’s GNSS antenna (affected by terrain or obstacles that may mask satellites signals or generate multipath), as well as the attitude of the drone during manoeuvres. The drone operator may consult the user manual (typically, open sky conditions are assumed) for the specific drone and GNSS sensor to determine the a priori expected horizontal and vertical NSE in each case.

2.1.2. Flight Technical Error

Since the flight dynamics of multi-copters and fixed wing drones are different, the ability of the drone’s autopilot to fly the defined path, i.e., the FTE, will also differ. Experience shows that the FTE is generally the dominant error source, in particular, for fixed-wing drones that cannot hover on waypoints or perform instantaneous heading changes. Additionally, it is essential to define a trajectory that is actually flyable by the drone, and this requires operation within the operational envelope (ground speed, wind, and gust conditions) and a careful definition of the turns at the waypoints, as well as the minimum stabilisation distance in the straight segments. The behaviour of autopilots and therefore the FTE in drone flight operations needs to be characterised. A relevant reference for this exercise is the FAA AC 20-138D “Airworthiness Approval of Positioning and Navigation Systems” [4], where several sections might be tailored for new drone-specific RNP navigation specifications, in particular, Table 9 ‘RNP FTE Performance’ in Chapter 17 ‘Installation Considerations-RNP’. In the absence of validated values on the characterisation of the FTE, it may be assumed that (in manned aviation) the autopilot will be able to ensure that:

$$\mathrm{F}\mathrm{T}\mathrm{E}\left(95\%\right)\le \frac{1}{2}\mathrm{R}\mathrm{N}\mathrm{P} \mathrm{v}\mathrm{a}\mathrm{l}\mathrm{u}\mathrm{e}$$

(1)

Such a condition does not necessarily hold for drone flight operations, since FTE is typically the dominant error source. It is also assumed that the desired flight path is properly designed (it is flyable), coded, and processed by the autopilot, considering the type of drone, its dynamics, and the environmental conditions. When the FTE deviates (exceeds) the expected behaviour, a specific alerting mechanism on the FTE may be convenient.

2.1.3. Path Definition Error

The PDE, i.e., defined vs. desired flight path, depends on the quality of the database of the terrain, as well as the vertical reference to define the altitude/height along the trajectory. In manned aviation, the PDE is typically disregarded with respect to the other error sources, but this is not necessarily the case for UAS and has to be confirmed.

2.2. Longitudinal Navigation

Longitudinal (along track) performance implies navigation against a position along the track (e.g., 4D control). However, UAS missions requiring 4D control are not considered is this study, so there is no FTE in the longitudinal dimension. Therefore, along-track accuracy only includes NSE and PDE (not necessarily negligible). The along-track accuracy affects position reporting, i.e., the awareness of reaching a waypoint (WP) or a certain lead distance before a WP when flying a turn.

2.3. Lateral Navigation

Figure 1 shows the lateral TSE and its components: NSE and FTE, where it has been assumed that the PDE is negligible (in such a case, the defined path is the desired path).

To be noted that the sequence of WPs from the active flight plan is not the same as the reference trajectory offered to the guidance and control functions (from which FTE results), particularly during the turns, even though it is governed by those WPs.

3. TSE Containment Concept

To ensure the containment of the drone in a 3D corridor along the desired flight path, the TSE must lie within suitable limits. To this end, the TSE must meet two requirements derived from manned aviation, [1] ICAO Doc 9613 (II-A-2-6) and [2] EUROCAE ED-75E (1.7.3 Lateral Containment Concept):

• TSE accuracy requirement: the TSE remains equal to or less than the required RNP value (accuracy value) for 95 per cent of the flight time; i.e.,

  $$\mathrm{T}\mathrm{S}\mathrm{E}\le \mathrm{R}\mathrm{N}\mathrm{P} \mathrm{v}\mathrm{a}\mathrm{l}\mathrm{u}\mathrm{e} \mathrm{f}\mathrm{o}\mathrm{r} 95\% \mathrm{o}\mathrm{f} \mathrm{f}\mathrm{l}\mathrm{i}\mathrm{g}\mathrm{h}\mathrm{t} \mathrm{t}\mathrm{i}\mathrm{m}\mathrm{e}$$

  (2)
• TSE integrity requirement: the probability that the TSE exceeds the specified TSE limit (equal to two times the RNP value) without annunciation is less than the applicable Integrity Risk (IR).

  $$\mathrm{P}(\mathrm{T}\mathrm{S}\mathrm{E}>2\times \mathrm{R}\mathrm{N}\mathrm{P} \mathrm{v}\mathrm{a}\mathrm{l}\mathrm{u}\mathrm{e},\mathrm{w}\mathrm{i}\mathrm{t}\mathrm{h}\mathrm{o}\mathrm{u}\mathrm{t} \mathrm{a}\mathrm{l}\mathrm{e}\mathrm{r}\mathrm{t})<\mathrm{I}\mathrm{R} \mathrm{p}\mathrm{e}\mathrm{r} \mathrm{f}\mathrm{l}\mathrm{i}\mathrm{g}\mathrm{h}\mathrm{t} \mathrm{h}\mathrm{o}\mathrm{u}\mathrm{r}$$

  (3)

For drones, the first requirement is taken as it is, but the second one needs to be adjusted to drone flight operations in the specific category, i.e., the IR is not necessarily 1 × 10⁻⁵, since other risk levels might be acceptable, in particular for low- or medium-risk operations. Note that the concept of 95% containment volume as well as the ‘deviation threshold’ are also referred to in the EASA AMC and GM to Regulation (EU) 2021/664 [5].

4. TSE Error Sources

4.1. Horizontal TSE

The horizontal subspace has lateral (cross-track) and longitudinal (along-track) components, sub-indexed as “Lat” and “Long”.

4.1.1. Horizontal NSE

HNSE is radial, i.e., it has both lateral and longitudinal components. It can be modelled as a bivariate normal distribution.

$$\mathrm{H}\mathrm{N}\mathrm{S}\mathrm{E}=\left({\mathrm{H}\mathrm{N}\mathrm{S}\mathrm{E}}_{\mathrm{L}\mathrm{a}\mathrm{t}},{\mathrm{H}\mathrm{N}\mathrm{S}\mathrm{E}}_{\mathrm{L}\mathrm{o}\mathrm{n}\mathrm{g}}\right)\sim \mathrm{N}\left(0,{\mathsf{\Sigma }}_{\mathrm{H}\mathrm{N}\mathrm{S}\mathrm{E}}\right)$$

(4)

where the covariance matrix is given by:

$$\mathsf{\Sigma }=\left[\begin{array}{cc}\mathrm{V}\mathrm{a}\mathrm{r}\left(\mathrm{X}\right)& \mathrm{C}\mathrm{o}\mathrm{v}\left(\mathrm{Y},\mathrm{X}\right)\\ \mathrm{C}\mathrm{o}\mathrm{v}\left(\mathrm{X},\mathrm{Y}\right)& \mathrm{V}\mathrm{a}\mathrm{r}\left(\mathrm{Y}\right)\end{array}\right]\hspace{1em}\hspace{1em}\hspace{1em}\mathrm{X}={\mathrm{H}\mathrm{N}\mathrm{S}\mathrm{E}}_{\mathrm{L}\mathrm{a}\mathrm{t}},\mathrm{Y}={\mathrm{H}\mathrm{N}\mathrm{S}\mathrm{E}}_{\mathrm{L}\mathrm{o}\mathrm{n}\mathrm{g}}$$

(5)

HNSE is assumed to have a circular distribution, i.e., the covariance matrix is diagonal with variances ${\sigma }_x^2={\sigma }_y^2$. If GNSS is the PVT source, this hypothesis does only hold if certain conditions are imposed on the mission trajectory to ensure a good visibility of satellites above the local horizon. The R95 for the HNSE is the radial quantile within which navigation accuracy lies for 95% of the flight time. Its value can be found in the corresponding GNSS documentation. Three different GNSS sensors onboard the drone are considered and the corresponding values of the horizontal NSE are shown in

Table 1. ${\sigma }_{HNSE Lat}$ for three GNSS receiver configurations.

	HNSE (R95) [m]	${\mathit{\sigma }}_{\mathit{H}\mathit{N}\mathit{S}\mathit{E} \mathit{L}\mathit{a}\mathit{t}}$ [m]
GPS-EGNOS	3	1.23
GPS-Galileo	4.16	1.70
GPS	8	3.27

:

(a)

GPS-EGNOS: data are taken from EGNOS SoL SDD [6] (Table 6-2); HNSE (R95) = 3 m.

(b)

GPS-Galileo: A GNSS uBlox receiver is used as representative for the multi-constellation mode, where accuracy values are found as CEP (circular error probable, CEP value is the 50% confidence interval) in NEO-M9N-00B data sheet (Ublox NEO-M9N-00B Standard precision GNSS module, Table 1, page 5, CEP position accuracy (GPS, Galileo) = 2 m). The conversion factor from CEP to R95 is 2.08. In this case, HNSE (CEP) = 2 m, or HNSE (R95) = 4.16 m.

(c)

GPS: data from GPS SPS Performance Standard [7] (Table 3.8-3), HNSE (R95) = 8 m.

The standard deviation of the lateral component of the HNSE is given by:

$${\mathsf{\sigma }}_{\mathrm{H}\mathrm{N}\mathrm{S}\mathrm{E} \mathrm{L}\mathrm{a}\mathrm{t}}=0.4085 \mathrm{H}\mathrm{N}\mathrm{S}\mathrm{E}\left(\mathrm{R}95\right)$$

(6)

It is stressed that those figures require open sky conditions. Moreover, in the case of GPS-EGNOS, it is necessary to ensure that the EGNOS signal broadcast by geostationary satellites is received at the drone’s GNSS antenna, which results in certain limitations such as a maximum bank angle depending on the latitude.

4.1.2. Lateral FTE

The HFTE is lateral by definition and can be modelled as 1D normal distribution.

$$\mathrm{H}\mathrm{F}\mathrm{T}\mathrm{E}={\mathrm{H}\mathrm{F}\mathrm{T}\mathrm{E}}_{\mathrm{L}\mathrm{A}\mathrm{T}}=\mathrm{L}\mathrm{a}\mathrm{t} \mathrm{F}\mathrm{T}\mathrm{E}\sim \mathrm{N}\left(0,{\mathsf{\sigma }}_{\mathrm{L}\mathrm{a}\mathrm{t} \mathrm{F}\mathrm{T}\mathrm{E}}^2\right)$$

(7)

The instantaneous FTE is known in real time, as it is the cross-track distance between the defined flight path (DFP) and the estimated position. Nonetheless, typical values of the Lat FTE can be indicated based on experience for fixed and rotary wing drones. Values of 25 m and 10 m are the 95% confidence values chosen, respectively, as shown in

Table 2. $\mathrm{L}\mathrm{a}\mathrm{t} \mathrm{F}\mathrm{T}\mathrm{E}\left(95\%\right) \mathrm{a}\mathrm{n}\mathrm{d} {\mathsf{\sigma }}_{\mathrm{L}\mathrm{a}\mathrm{t} \mathrm{F}\mathrm{T}\mathrm{E}}$ for fixed-wing and rotary-wing drones.

	Lat FTE (95%) [m]	${\mathit{\sigma }}_{\mathit{L}\mathit{a}\mathit{t} \mathit{F}\mathit{T}\mathit{E}}$ [m]
Fixed wing	25	12.76
Rotary wing	10	5.10

.

$${\mathsf{\sigma }}_{\mathrm{L}\mathrm{a}\mathrm{t} \mathrm{F}\mathrm{T}\mathrm{E}}=\frac{\mathrm{L}\mathrm{a}\mathrm{t} \mathrm{F}\mathrm{T}\mathrm{E}(95\%)}{1.96}$$

(8)

4.1.3. Horizontal TSE-Lateral

The NSE and FTE are assumed to be independent, zero-mean, and Gaussian distributions. The TSE is also Gaussian with standard deviation equal to the root sum square (RSS) of the standard deviations of the error components.

$$\mathrm{L}\mathrm{a}\mathrm{t} \mathrm{T}\mathrm{S}\mathrm{E}=\mathrm{L}\mathrm{a}\mathrm{t} \mathrm{F}\mathrm{T}\mathrm{E}+{\mathrm{H}\mathrm{N}\mathrm{S}\mathrm{E}}_{\mathrm{L}\mathrm{a}\mathrm{t}}\sim \mathrm{N}\left(0,{\mathsf{\sigma }}_{\mathrm{L}\mathrm{a}\mathrm{t} \mathrm{F}\mathrm{T}\mathrm{E}}^2+{\mathsf{\sigma }}_{\mathrm{H}\mathrm{N}\mathrm{S}\mathrm{E} \mathrm{L}\mathrm{a}\mathrm{t}}^2\right)$$

(9)

4.2. Vertical TSE

VNSE and VFTE are also assumed to be independent and Gaussian.

$$\mathrm{V}\mathrm{T}\mathrm{S}\mathrm{E}=\mathrm{V}\mathrm{N}\mathrm{S}\mathrm{E}+\mathrm{V}\mathrm{F}\mathrm{T}\mathrm{E}\sim \mathrm{N}\left(0,{\mathsf{\sigma }}_{\mathrm{V}\mathrm{N}\mathrm{S}\mathrm{E}}^2+{\mathsf{\sigma }}_{\mathrm{V}\mathrm{F}\mathrm{T}\mathrm{E}}^2\right)$$

(10)

As in the horizontal subspace, the values of VTSE (95%) can be derived from its error components and considering that:

$${\mathsf{\sigma }}_{\mathrm{V}\mathrm{N}\mathrm{S}\mathrm{E}}=\frac{\mathrm{V}\mathrm{N}\mathrm{S}\mathrm{E}\left(95\%\right)}{1.96}\hspace{1em}\hspace{1em}\mathrm{a}\mathrm{n}\mathrm{d}\hspace{1em}\hspace{1em}{\mathsf{\sigma }}_{\mathrm{V}\mathrm{F}\mathrm{T}\mathrm{E}}=\frac{\mathrm{V}\mathrm{F}\mathrm{T}\mathrm{E}\left(95\%\right)}{1.96}$$

(11)

4.2.1. Vertical NSE

The VNSE (95%) values for the three GNSS systems considered are shown in

Table 3. ${\sigma }_{VNSE}$ for three GNSS receiver configurations.

	VNSE (95%) [m]	${\mathit{\sigma }}_{\mathit{V}\mathit{N}\mathit{S}\mathit{E}}$ [m]
GPS-EGNOS	4	2.04
GPS-Galileo	6.24	3.18
GPS	13	6.63

. The sources are the same as in the previous section, except for GPS-Galileo, as it is not provided in the manual. Thus, it is estimated following the rule of thumb that the vertical accuracy is roughly 1.5 times the horizontal one.

4.2.2. Vertical FTE

The VFTE (95%) values shown in

Table 4. VFTE (95%) and ${\sigma }_{VFTE}$ for fixed wing and rotary wing drones.

	VFTE (95%) [m]	${\mathit{\sigma }}_{\mathit{V}\mathit{F}\mathit{T}\mathit{E}}$ [m]
Fixed wing	10	5.10
Rotary wing	5	2.55

are estimated from flight trials:

5. RNP Lateral/Vertical Calculation

Once assumptions on how to model the errors are made, it is possible to derive the accuracy or RNP values (“RNP Lateral” and “RNP vertical”) and the containment regions that characterize the 3D corridor where the drone is confined throughout its trajectory.

5.1. RNP Lateral

$$\mathrm{R}\mathrm{N}\mathrm{P} \mathrm{l}\mathrm{a}\mathrm{t}\mathrm{e}\mathrm{r}\mathrm{a}\mathrm{l}=\mathrm{L}\mathrm{a}\mathrm{t} \mathrm{T}\mathrm{S}\mathrm{E}\left(95\%\right)=1.96 {\mathsf{\sigma }}_{\mathrm{H}\mathrm{T}\mathrm{S}\mathrm{E} \mathrm{L}\mathrm{a}\mathrm{t}}=1.96\sqrt{{\mathsf{\sigma }}_{\mathrm{H}\mathrm{N}\mathrm{S}\mathrm{E} \mathrm{L}\mathrm{a}\mathrm{t}}^2+{\mathsf{\sigma }}_{\mathrm{L}\mathrm{a}\mathrm{t} \mathrm{F}\mathrm{T}\mathrm{E}}^2}$$

(12)

The driving component in the lateral HTSE is the ability to follow the defined trajectory, i.e., the FTE is typically greater than the NSE. Values for the RNP lateral are presented below in

Table 5. RNP Lateral values.

Drone	Sensor	${\mathit{\sigma }}_{\mathit{H}\mathit{N}\mathit{S}\mathit{E} \mathit{L}\mathit{a}\mathit{t}}$ [m]	${\mathit{\sigma }}_{\mathit{L}\mathit{a}\mathit{t} \mathit{F}\mathit{T}\mathit{E}}$ [m]	RNP Lateral [m]
	GPS-EGNOS	1.23		25.13~25
Fixed wing	GPS-Galileo	1.70	12.76	25.23~25
	GPS	3.27		25.82~26
	GPS-EGNOS	1.23		10.28~10
Rotary wing	GPS-Galileo	1.70	5.10	10.54~11
	GPS	3.27		11.87~12

for both fixed and rotary-wing drones, as well as for the three GNSS sensors studied.

The results show that the “RNP Lateral” values differ significantly depending on the type of drone, whereas the influence of the GNSS sensor is noticeably smaller than the FTE, based on the assumptions taken.

5.2. RNP Vertical

$$\mathrm{R}\mathrm{N}\mathrm{P} \mathrm{v}\mathrm{e}\mathrm{r}\mathrm{t}\mathrm{i}\mathrm{c}\mathrm{a}\mathrm{l}={\mathrm{V}\mathrm{T}\mathrm{S}\mathrm{E}}_{}\left(95\%\right)=1.96 {\mathsf{\sigma }}_{\mathrm{V}\mathrm{T}\mathrm{S}\mathrm{E}}=1.96\sqrt{{\mathsf{\sigma }}_{\mathrm{V}\mathrm{N}\mathrm{S}\mathrm{E}}^2+{\mathsf{\sigma }}_{\mathrm{V}\mathrm{F}\mathrm{T}\mathrm{E}}^2}$$

(13)

Values for the RNP vertical are presented in

Table 6. RNP Vertical values.

Drone	Sensor	${\mathit{\sigma }}_{\mathit{V}\mathit{N}\mathit{S}\mathit{E}}$ [m]	${\mathit{\sigma }}_{\mathit{V}\mathit{F}\mathit{T}\mathit{E}}$ [m]	RNP Vertical [m]
	GPS-EGNOS	2.04		10.77~11
Fixed wing	GPS-Galileo	3.18	5.10	11.78~12
	GPS	6.63		16.39~16
	GPS-EGNOS	2.04		6.40~6
Rotary wing	GPS-Galileo	3.18	2.55	7.99~8
	GPS	6.63		13.92~14

.

6. GNSS Performance Requirements

6.1. GNSS Accuracy

The GNSS position error is the difference between the estimated position and the actual position, as defined in ICAO Annex 10 [8] (Attachment D). HNSE (R95) values are shown in Table 1 and VNSE (95%) values in Table 3 for the three GNSS sensor configurations considered.

6.2. GNSS Integrity

Drone operations in the specific category may require an integrity (OBPMA) mechanism. The drone’s navigation system should raise an alert in the case of exceeding the containment limits in either the lateral or vertical dimensions, and the probability of doing so without alerting should be lower than the applicable IR. To this purpose, an integrity mechanism is defined including Integrity Risk, Alert Limits, and Time to Alert. Protection Levels (xPL), computed in real time by the onboard GNSS sensor, are upper confidence bounds on position errors (xNSE), which are unknown in real time (HPL bounds the HNSE and VPL the VNSE). A graphical depiction of the integrity mechanism is shown in Figure 2.

When considering the application of the integrity mechanism, it is important to distinguish between VLOS and BVLOS operations. Such a mechanism is especially relevant for BVLOS, as in VLOS operations, the remote pilots can also work as an external integrity mechanism themselves, by taking control over the drone if they detect visually that it deviates from the expected trajectory or is about to leave the flight geography.

The HPL is assumed to be isotropic with a circular distribution. This assumption requires ensuring enough numbers of GNSS satellites are in view with a good geometry. Otherwise, the horizontal region where the true position lies around the estimated position becomes an ellipse instead of a circle. Moreover, this condition has an impact on the definition of the desired flight path (minimum height and ground track). Figure 2 above shows the integrity mechanism in the lateral dimension. The green corridor represents the RNP value or ‘accuracy region’ within which the drone lies at least for 95% of the flight time. For the remaining 5%, it may be located outside the green corridor. The red lines delimit the containment region with a width of four times the RNP value. The integrity mechanism works as follows in the lateral dimension:

P (LatTSE > 2 × RNP_Lat, without alert) = P(HNSE > HAL = 2 × RNP_Lat − Lat FTE, without alert) < IR per flight hour

(14)

In the vertical dimension, an equivalent mechanism is implemented with the difference that the VNSE is a 1D distribution.

6.2.1. Integrity Risk

Special Condition (SC) Light UAS defines objective requirements for UAS operated in the specific category and is limited to specific assurance and integrity level (SAIL). The maximum allowable rate of loss of control of the operation per flight hour (FH) is linked with the SAIL and achieved by the means of Operational Safety Objectives (OSOs).

$${\mathrm{P}}_{\mathrm{l}\mathrm{o}\mathrm{c}}<\frac{{10}^{-\mathrm{S}\mathrm{A}\mathrm{I}\mathrm{L}}}{\mathrm{F}\mathrm{H}}$$

(15)

According to SORA, “The Loss of control of operation corresponds to situations: where the outcome of the situation highly relies on providence; or which could not be handled by a contingency procedure; or when there is grave and imminent danger of fatalities”. A loss of control of the operation means that the drone may be flying out of the operational volume, potentially leading to harm to third parties in the air or on the ground. A loss of control condition represents an emergency situation that is potentially caused by the occurrence of a contingency event. A number of contingency events can be identified as directly related to the occurrence of the out-of-control condition: C2 link loss, GNSS loss of performances, or loss of control in flight, among others. Within the GNSS loss of performance, a dangerous situation may occur, as determined by a Functional Hazard Assessment, in the case of non-integrity of the PVT solution, i.e., not valid for the intended operation without annunciation. Such a situation is referred to as Integrity Risk (IR) and it is assumed that its allowable occurrence is at most one order of magnitude lower than the $P_{loc}$.

$$\mathrm{I}\mathrm{R}(\mathrm{G}\mathrm{N}\mathrm{S}\mathrm{S} \mathrm{P}\mathrm{V}\mathrm{T})={\frac{1}{10}\mathrm{P}}_{\mathrm{l}\mathrm{o}\mathrm{c}}<\frac{{10}^{-\left(\mathrm{S}\mathrm{A}\mathrm{I}\mathrm{L}+1\right)}}{\mathrm{F}\mathrm{H}}$$

(16)

Table 7. IR per flight hour for SAIL III and IV.

SAIL	IR (GNSS PVT)	Hours per Failure	Days or Years per Failure
III	<${10}^{-4}$ per FH	>10,000	>417 days = 1.14 years
IV	${<10}^{-5}$ per FH	>100,000	>4167 days = 11.4 years

presents the integrity risks per flight hour for SAIL III and IV, the equivalent number of flight hours and flight days or years per failure, giving a more understandable figure to assess the acceptability of such IRs for drone flight operations. This has to be assessed considering the typical duration of a flight operation and the number of flight operations performed by a drone during its entire operational life. For instance, for a drone package delivery mission, a flight duration of 10 min may be assumed. In this case, for SAIL III: IR < ${10}^{-4}$ per flight hour, resulting in >10,000 flight hours per failure or >60,000 missions per failure. The integrity of a GNSS solution requires (a) strict application of the SiS ICDs and the implementation of an augmentation scheme (e.g., RAIM, SBAS, or GBAS) to mitigate the SiS risk, (b) development constraints (DAL) to protect against the SW or HW design/development errors, and (c) integration/architecture constraints (equipment redundancy and cross-checks between equipment) to protect at least against HW failures. Receivers have to be duly qualified to obtain the pertinent approval or certification.

6.2.2. Alert Limits

Alert limits define the error tolerance not to be exceeded without issuing an alert, i.e., the maximum position error allowed for an operation, [8] 3.7 and [9] (2.2.2).

Horizontal Alert Limit

Figure 2 shows that the Horizontal Alert Limit (HAL) is given by:

HAL(t) = 2 × RNP_Lat − Lat FTE (t)

(17)

HAL is the maximum radius of the circle with the centre at the estimated position and radius HPL, until this circle is tangential to the cross-track containment limit. If HPL > HAL, then an alert must be triggered before TTA, since the drone’s true position might be outside the containment region. Figure 2 shows a case with HNSE < HPL < HAL and the system is available in nominal operation. If HNSE < HPL, but HPL > HAL, the system is unavailable (yellow zone). Finally, if HNSE > HPL, whereas HPL < HAL, the system is still available, but the HPL is not bounding the HNSE, then if HNSE > HAL, it is an HMI event (red zone) that has not been detected by the integrity mechanism. This is the dangerous case that shall occur with a very low probability, less than the IR per flight hour.

If the Lat FTE is not characterised, i.e., Lat FTE(95%) is unknown, the equation above for HAL still holds and is applicable in real time. In such a case, the HAL is a dynamic alert limit, HAL(t). The instantaneous value of the Lat FTE(t) is known in real time since it is the cross-track distance between the estimated position (output of the GNSS sensor) and the active segment of the defined flight path. In case the Lat FTE is characterised, the Lat FTE(95%) is a known value (e.g., those in

Table 8. HAL for fixed and rotary wing drones and different GNSS sensors.

Drone	Sensor	RNP Lat [m]	Lat FTE (95%) [m]	HAL [m]
	GPS-EGNOS	25		25
Fixed wing	GPS-Galileo	25	25	25
	GPS	26		27
	GPS-EGNOS	10		10
Rotary wing	GPS-Galileo	11	10	12
	GPS	12		14

) and a fixed value of the HAL may be derived for a particular drone operation or phase of flight, as shown in Table 8.

HAL = 2 × RNP_Lat − Lat FTE (95%)

(18)

Vertical Alert Limit

Similarly to HAL, the Vertical Alert Limit (VAL) is given by:

VAL (t) = 2 × RNP_Ver − VFTE (t)

(19)

where the integrity mechanism for the vertical dimension is based on 1D distributions. If the VFTE is not characterised, i.e., VFTE (95%) is unknown, the equation above for VAL still holds and is applicable in real time. In case the VFTE is characterised, the VFTE (95%) is a known value (

Table 9. VAL for fixed and rotary wing drones and different GNSS sensors.

Drone	Sensor	RNP Ver [m]	VFTE (95%) [m]	VAL [m]
	GPS-EGNOS	11		12
Fixed wing	GPS-Galileo	12	10	14
	GPS	16		22
	GPS-EGNOS	6		7
Rotary wing	GPS-Galileo	8	5	11
	GPS	14		23

) and a fixed value of the VAL may be derived for a particular drone operation or phase of flight as shown in Table 9.

VAL = 2 × RNP_Ver − VFTE (95%)

(20)

6.2.3. Time-to-Alert

The Time-to-alert (TTA) is the maximum allowable time elapsed from the onset of the navigation system being out of tolerance (the drone could be located at the boundary of the containment region in the lateral or vertical dimensions, xPL > xAL) until the equipment enunciates the alert (to the onboard autopilot or to the remote human pilot) [8] (3.7).

In the case of drones, TTAs have been derived in both horizontal and vertical dimensions. The resulting values are typically in the order of few seconds, ranging from 1 to 2 or 3 s depending on the case.

7. Conclusions and Way Forward

RNP navigation specifications tailored to drones have been studied following a bottom-up approach, i.e., based on the aggregation of error components within the TSE. The methodology and results were positively discussed at the User Consultation Platform 2022. The 2023 Report on Aviation and Drones User Needs and Requirements [10] includes GNSS requirements for drone en-route missions as shown in

Table 10. GNSS performance requirements for drone en-route.

RNP Lat/Ver [m]	HNSE (95%) [m]	VNSE (95%) [m]	IR (GNSS PVT)	TTA [s]	HAL/VAL [m]
Fixed-wing RNP 26/16 Rotary-wing RNP 12/14	3–8	4–13	SAIL III/IV: ${ 10}^{-4}$$/{10}^{-5}$ per FH	1–3	25–27/12–22 10–14/7–23

, including also figures for continuity of service and availability.

Ongoing work with drone operators is collecting their mission requirements (top-down approach) that will allow for consolidating and validating RNP navigation specifications, based mainly on GNSS PVT, covering the whole drone flight profile.