In the absence of selective availability, the ionosphere represents the largest source of positioning error for single-frequency users of the Global Positioning System (GPS). In differential GPS systems such as the Wide Area Augmentation System (WAAS), vertical ionospheric delays are modeled at regularly spaced intervals in geographic latitude and longitude. The broadcast bound on the error at each of these points is designated the grid ionospheric vertical error (GIVE). Higher performance standards planned for future implementations of WAAS require a reduction in the magnitude of the GIVE broadcast under nominal conditions. Achieving this reduction depends upon a better understanding of the decorrelation of ionospheric delay, in both space and time. In this paper we focus on temporal decorrelation. We report a methodology for assessing the impact on WAAS posed by a sudden increase in the level of ionospheric disturbance. The methodology is based upon forming an estimate of the probability PD that a WAAS user will confront a sudden increase in the level of ionospheric disturbance following a period of relative calm. We have determined a limiting upper bound of PD to be 4 × 10−7, which lies well within the margin needed to meet WAAS integrity requirements.
 The Wide Area Augmentation System (WAAS) is designed to provide reliable differential GPS corrections for aircraft navigation [RTCA, 1996]. In the absence of selective availability, the largest source of positioning error is the carrier phase advance and pseudorange group delay caused by the ionosphere. Since WAAS user measurements generally do not coincide with reference station measurements, it is necessary to rely on ionospheric correlation to infer the state of the ionosphere in regions sampled by the user. In WAAS, vertical ionospheric delays are modeled at regularly spaced intervals in geographic latitude and longitude, i.e., at ionospheric grid points (IGPs). The broadcast bound on the error at each of these points is designated the grid ionospheric vertical error (GIVE). A critical integrity requirement of WAAS is that the broadcast GIVE at each IGP bounds the residual error with a very high degree of confidence. Specifically, the probability of broadcasting hazardously misleading information (HMI) must not exceed 10−7 per approach at any point in the service volume under the worst foreseeable conditions. Here hazardously misleading information refers to a broadcast GIVE that fails to bound the actual error, and foreseeable conditions include any event that is regular, common, or strongly correlated with observed parameters (by definition, unforeseeable conditions must be extremely rare, not adhering to any predictable pattern).
 The threat posed by the ionosphere manifests itself in three ways: (1) instantaneous residual errors due to mismodeling of the ionosphere at the IGPs; (2) residual errors that arise when interpolating IGP delays to a user position; and (3) residual errors that grow over the life span of the broadcast message.
 The broadcast GIVE must protect the user from each of these threats. The rate, in both space and time, at which neighboring measurements of ionospheric delay become decorrelated is a critical component in the calculation of the WAAS GIVE. Irregularities in the ionosphere represent a threat to the accuracy of the confidence bounds describing the integrity of the broadcast corrections [Hansen et al., 2000a, 2000b; Lejeune et al., 2001].
 Under nominal quiet-time conditions, a planar fit of slant delay measurements projected to vertical provides estimates of the local vertical delay that are of sufficient accuracy for WAAS operation. When the ionosphere is disturbed, the residual error associated with the planar fit increases, indicating that delay estimates based on this fit are less reliable. Consequently, the confidence bounds must be increased or the fit declared unusable. As long as the fit residuals accurately reflect the degree of disturbance of the ionosphere, the integrity of the corrections should remain high. Since fits are performed at finite intervals, however, it is possible that significant growth in the degree of disturbance could occur between fit evaluations. In this case the fit residuals no longer accurately reflect the true ionospheric state as encountered by the user.
 The WAAS GIVE is based, in part, on the uncertainty in the vertical ionospheric delay as modeled by the planar fit. In the first phase of WAAS implementation, this uncertainty is conservatively assumed to be a constant (35 cm) independent of both measurement elevation angle and distance from the IGP. Subsequent implementations of WAAS that have higher performance requirements will demand a reduction in the magnitude of the GIVE broadcast under nominal conditions. Achieving this reduction will require a better understanding of the decorrelation of ionospheric delay, in both space and time.
 In this paper we focus on the temporal decorrelation of the ionospheric delay. The objective is to establish a methodology for assessing the risk to the WAAS user of sudden increases in the level of ionospheric disturbance. Our means of risk assessment relies on defining PD, the probability that a WAAS user will sample a region of the ionosphere during the onset of a significant disturbance. An upper bound on PHMI, the probability of broadcasting HMI, is shown to depend linearly upon PD. We have determined a limiting upper bound on PD of 4 × 10−7, which falls well within the margin needed to meet WAAS integrity requirements.
 In section 2 we derive an upper bound on PHMI and examine its dependence on PD. In section 3 we review the WAAS model for ionospheric delay and related algorithms. We provide in section 4 a precise definition of PD, upon which a quantitative evaluation can be based. Section 5 describes our method for estimating an upper bound on PD. Section 6 presents an iterative method for calculating σdecorr, the standard deviation of the local vertical total electron content of the ionosphere relative to a planar approximation. In section 7 we discuss the manner in which observational data have been processed. Section 8 reports the results of our analysis, and conclusions are presented in section 9.
2. Bounding the Probability of Transmitting HMI
 Under disturbed ionospheric conditions, the magnitude of the errors in the vertical delays estimated by WAAS tends to increase. Consequently, WAAS uses an irregularity detector to monitor the level of ionospheric disturbance. When the detector at a given IGP trips, the GIVE at that IGP is set to an appropriately large number or the IGP is designated as not monitored. The transmission of HMI can occur when the irregularity detector does not trip and the broadcast GIVE fails to bound the actual error with a sufficiently high probability. In this section we will derive an upper bound on the probability of transmitting HMI.
 Let us characterize the level of ionospheric disturbance by some scalar parameter σ, where σ ≤ 1 corresponds to the nominal (or undisturbed) ionosphere and σ > 1 indicates the presence of an irregularity. Then, the probability of transmitting HMI as a function of σ can be represented formally as
where PMD(σ) is the probability of missed detection, i.e., the probability that the irregularity detector will fail to trip, and PGIVE(σ) is the probability that the broadcast GIVE fails to bound the actual error. If we postulate that at any given instant σ can be chosen at random from some a priori distribution with density f(σ) normalized such that ∫0∞f(σ)dσ = 1, then the PHMI can be written as an integral over σ:
By dividing the domain of integration into two regions separated by σ = 1, an upper bound on PHMI may be written as follows:
 The WAAS GIVE algorithm is constructed to ensure that when the ionosphere is actually in a nominal or undisturbed state, the broadcast GIVE will bound the actual delay error with a high degree of certainty, that is, PGIVE(σ) is negligibly small when σ ≤ 1. We can therefore anticipate that PHMImax will satisfy the integrity requirement of 10−7 per approach provided the second term on the right-hand side of equation (3) is sufficiently small.
 Demonstrating that the probability of WAAS transmitting HMI is less than the integrity limit of 10−7 is actually a much more complex task than the simple discussion presented here might suggest, and a detailed discussion of it is far beyond the scope of this paper. There are other possible sources of HMI, and thus integrity analysis demands that PHMImax be, in fact, nearly an order of magnitude smaller than 10−7. An independent analysis of
has indicated that PD must be less than 4 × 10−5 in order that the upper bound on PHMImax be sufficiently small to ensure WAAS integrity (T. R. Schempp, personal communication, 2003).
3. Review of WAAS Ionospheric Algorithms
 In this section we briefly review algorithms that WAAS uses to model the ionospheric delay and to detect ionospheric irregularities.
3.1. Ionospheric Delay Model
 At each ionospheric grid point (IGP), WAAS models the vertical ionospheric delay by constructing a planar fit of a set of slant delay measurements projected to vertical. Each slant delay value is converted to a vertical delay value using the standard thin-shell model of the ionosphere: At the ionospheric pierce point (IPP), i.e., the point where the ray path crosses the shell height hi, the ratio of the slant delay to the vertical delay is approximated as
where RE is the Earth radius and σ is the satellite elevation angle. All IPPs that lie within a minimum fit radius Rmin are included in the fit. If the number of IPPs within this minimum radius is less than Nmin, the fit radius Rfit is extended until it encompasses Nmin points. In this study we do not tabulate data when the fit radius reaches a maximum value of Rmax without encircling Nmin points.
 Formally the planar fit approximation can be written as
where x is a vector of planar fit parameters, y is a vector of vertical delay values, and G is a matrix of partials with each row of the form [1 dEdN], where dE and dN are the distances from the IGP to the IPP in the eastern and northern directions, respectively. The least squares solution x is obtained by solving the equation
is the observation weighting matrix, σ2 characterizes spatial decorrelation in the local vertical delay of the ionosphere, the σIPP,i2 are measurement error variances, and the σbias,i,j2 are covariances that account for the correlation of the bias errors between vertical delay measurements made with common satellites or common receivers [Walter et al., 2000].
3.2. Ionospheric Irregularity Detector
 As discussed above, the WAAS estimation of ionospheric delay and its confidence is based upon a local planar model with uncertainties bounded by a limiting σ. To ensure the integrity of the broadcast delay and confidence values, it is imperative to determine whenever such a model does not accurately describe ionospheric behavior. To address this question, WAAS relies on an irregularity detector based upon the χ2 of the planar fit. (Walter et al.  have provided a full description of this detector.) The χ2 of the fit may be written as follows:
where all quantities were defined in the previous section. In WAAS operation, each planar fit is performed with σ = σdecorrnom, where σdecorrnom is the standard deviation of the local vertical total electron content with respect to a plane under nominal, i.e., quiet, conditions (this parameter is currently set conservatively to 35 cm). Local storm conditions are declared whenever the χ2 exceeds a specified threshold that depends upon the number of observations used in the fit. On such occasions, the ionosphere is no longer assumed to be characterized by nominal behavior and the bound on the error at the IGP is raised to a maximum limit.
4. The Probability of Sudden Ionospheric Decorrelation
 Our goal is to assess the risk to the WAAS user posed by a sudden increase in the level of ionospheric disturbance. We will need to address two distinct aspects of this problem: the degree of disturbance and the timescale of its onset. Let PD be the probability that a WAAS user will sample a region of the ionosphere experiencing a sudden, significant growth in perturbation following a period of relative calm. To quantify the period of relative calm, we define a nonstorm duration as a period of time Tns during which the local ionospheric storm detector has not tripped. As a measure the magnitude of a disturbance, we define the decorrelation ratio to be
where σdecorr is a representative standard deviation of the local vertical total electron content with respect to a plane, and σcrit is a critical bound required for user safety, that is, the decorrelation ratio must be less than 1 to a very high degree of confidence. In current WAAS algorithms, σcrit = Rirregσdecorrnom, where Rirreg is the irregularity inflation factor [Walter et al., 2000] and σdecorrnom is defined in the previous section. If time t = 0 corresponds to the conclusion of a nonstorm duration of length Tns, then we define PD = PD(t,Tns) to be the probability at time t > 0 that a user samples the ionosphere in a region where the local ionospheric decorrelation ratio exceeds 1.
 We anticipate that PD(t,Tns) will tend to be an increasing function of t, becoming flat when t is sufficiently large. In other words, the ionosphere can become progressively more disturbed with the passage of time following a nonstorm duration, increasing the likelihood that the decorrelation ratio will exceed unity. This remains true until the time is sufficiently great that the state of the ionosphere is statistically uncorrelated with the prior nonstorm duration, at which point the probability of the decorrelation ratio exceeding unity becomes nearly constant. Rather than approximate PD(t,Tns) directly, we will seek an upper bound on PD(t,Tns) for t ≤ tsample, where tsample is a sample period of interest. The nonstorm duration period and sample period currently of interest in WAAS are, respectively, Tns = 900 s (15 min is the length of time that a WAAS message may be used) and tsample = 85 s (the time it takes for WAAS to perform a planar fit at each active IGP; currently there are 170 IGPs and two planar fits are performed per second).
5. Method of Determining an Upper Bound on PD(t,Tns)
 For the decorrelation ratio to exceed unity, the ionosphere must be sufficiently disturbed. In ionospheric science, the geomagnetic index Kp is often used to approximate the degree of disturbance of the ionosphere, since ionospheric disturbances are known to be highly correlated with perturbations of the Earth's magnetic field. The initial strategy for determining an upper bound on PD(t,Tns) has been to assume PD(t,Tns) to be of the form
where PiK is the probability that the value of the Kp index lies within the range i − Δ ≤ Kp ≤ i + Δ, where Δ = 0.3 (see Table 1), and PD(t,Tns∣Ki) is the conditional probability that a user, at time t following a nonstorm duration of length Tns, samples the ionosphere in a region where the local ionospheric decorrelation ratio exceeds 1, given that the Kp index lies within the range i − Δ ≤ Kp ≤ i + Δ. Note that PiK = 1. An upper bound on PD(t,Tns) can then be calculated from a determination of upper bounds on the PD(t,Tns∣Ki). The expectation is that for low values of i (i.e., for low values of Kp), upper bounds on the PD(t,Tns∣Ki) will be small, thereby ensuring that the bound on PD(t,Tns) will be small.
Table 1. The Probability That the Value of the Kp Index Lies Within the Range i − Δ ≤ KP ≤ i + Δ (Where Δ = 0.3) as Tabulated From Kp Data Over the Time Period 1932–2000a
 Let D(t,TnsKi) be an estimate of PD(t,Tns∣Ki) determined purely from data collected on days in which ionospheric storms have occurred. On such days the decorrelation ratio is more likely to attain values greater than 1, ensuring that PD(t,Tns∣Ki) ≤ D(t,Tns∣Ki). An upper bound on PD(t,Tns∣Ki) may then be determined as follows:
where t′ ≈ tsample. Since PD(t,Tns∣Ki) is roughly an increasing function of time, we can safely assume that PD(t,Tns∣Ki) ≤ D(t′,Tns∣Ki) for t ≤ t′. Note that PDstorm(t′,Tns) is likely to be a conservative upper bound, i.e., the true value of PD(t,Tns) may be considerably less than this bound, depending upon the data sets used to calculate PDstorm(t′,Tns).
6. Algorithm for Calculating σdecorr
 The value of σdecorr in the neighborhood of a given ionospheric grid point (IGP) can be defined in terms of the χ2 associated with the planar fit at that IGP. Let us define σdecorr to be the value of σ such that the χ2 per degree of freedom is unity. Since the planar ionospheric model has three fit parameters, the χ2 per degree of freedom is χ2(σ2)/(N − 3), where N is the total number of points in the fit. Thus, to obtain an estimate of σdecorr, we solve
using a Newton-Raphson method iteration:
It can be shown that
where I is the identity matrix.
 The initial guess for σdecorr is set according to the equation
(σbiassatellite)2 is the variance of the hardware bias for each satellite and (σbiasreceiver)2 is the variance of the hardware bias for each receiver (the latter two variances are assumed to be constant for all satellites and receivers, respectively). This choice of the initial guess is based upon a suggestion by E. Altschuler (personal communication, 2002); we approximate σdecorr by replacing each σIPP,i2 in W−1 with (σdecorrRMS)2 and moving the (constant) off-diagonal elements (σbiassatellite)2 + (σbiasreceiver)2 to the diagonal. From equation (8) we then obtain
which is generally found to be satisfied within three to eight iterations. Occasionally, we find that the Newton-Raphson iteration produces a negative estimate for σ2 (usually when χ2 is anomalously small). When this occurs, we replace the Newton-Raphson iteration with a false position search [see Press et al., 1988]. The false position method converges more slowly to the root of f(σ2), but the search interval can be constrained so that σ2 ≥ 0. This iteration is stopped when
is satisfied. Thereafter the Newton-Raphson iteration is resumed.
 Note that when satellite and receiver biases are neglected and ,
with = Gx. For the data sets processed in this study, we find that this approximate equation for σdecorr2 generally holds.
7. Data Processing
 To determine the D(t,Tns∣Ki), we have tabulated values of the decorrelation ratio as a function of the Kp index for delay data from days on which moderate to severe ionospheric storms occurred. These data consist of postprocessed slant delay measurements collected by the existing 25 WAAS reference stations. The intent of the postprocessing is to eliminate interfrequency biases, to remove the effects of cycle slips in carrier phase measurements, to level the carrier phase measurements to the corresponding range measurements, and to filter spurious measurements using the redundancy provided by the presence of three receivers at each station. Such data contain minimal error, and it is due primarily to multipath and data noise.
 To identify days on which significant storms have occurred, we have examined the variation of the Kp index over the time period extending from 1 January 2000 to 1 April 2001. The following criteria were used to select data sets: (1) all days on which the Kp index equaled or exceeded 8; (2) days on which the index equaled 7 for an extended duration (typically half the day or more); and (3) storms with Kp values greater than or equal to 5 that have been found to stress WAAS algorithms (e.g., data sets where planar fits have resulted in unusually high values of χ2). The intent of the selection process has been to find storm data representative of the worst conditions that WAAS is likely to encounter. Data from the following 17 storm days have been processed: 11 January 2000, 12 February 2000, 6 and 7 April 2000, 25 May 2000, 8 June 2000, 15 and 16 July 2000, 11 and 12 August 2000, 19, 20, 28, 29, 30, and 31 March 2001, and 1 April 2001.
 The parameters used in the analysis are presented in Table 2. Fit residuals are tabulated for each epoch of data that follows a nonstorm duration of at least 900 s.
Table 2. Parameters Used in the Analysis
Ionospheric reference height (hi)
Minimum permitted fit radius (Rmin)
Maximum permitted fit radius (Rmax)
Minimum number of points in fit (Nmin)
Maximum number of points in fit when Rfit > Rmin
Standard deviation of nominal ionosphere (σdecorrnom)
Data epoch interval (t′)
Nonstorm duration (Tns)
 The distributions of decorrelation ratios as a function of Kp for individual storms are found to be highly varied. The results combined for all data sets are presented in Figure 1. Note that Kp never falls below 2 on any of the days in question. Figure 2 shows the accumulated results of tabulating σdecorr for all 17 storms. The peak of the distribution occurs below 20 cm.
Figure 3 displays the cumulative probability distribution for each Kp column in Figure 1. Each curve represents the probability of exceeding a given decorrelation ratio magnitude as a function of that magnitude. Note that the curves all exhibit similar behavior. Using the Kp probabilities listed in Table 1, the upper bound on PD is found to be 4 × 10−7. This value is 2 orders of magnitude smaller than the value of 4 × 10−5 currently required to ensure WAAS integrity.
 It can be argued that this value of PDstorm is derived from an insufficient amount of data and that we should process up to 10 times more data to be confident that this value is truly an upper bound. However, we can also argue that this value is conservative since we have only looked at data collected on days when storms have occurred. Our results imply that the decorrelation ratio will never rise above unity on a quiet day and that processing data from a representative number of quiet days will simply ensure that the upper bound of 4 × 10−7 remains valid.
 We have presented a methodology for assessing the risk to the WAAS user of sudden increases in the level of ionospheric disturbance. Risk has been quantified in terms of PD, the probability that the user will sample a region of the ionosphere experiencing such a disturbance following a period of relative calm. We have determined an upper bound on PD to be 4 × 10−7, a value that lies well within the margin required to protect the user from the transmission of hazardously misleading information.
 The research described in this paper was performed by the Jet Propulsion Laboratory, California Institute of Technology, under contract with the National Aeronautics and Space Administration.