This paper describes the impact that extreme ionospheric spatial gradients occurring during severe ionospheric storms have on Global Navigation Satellite System Ground Based Augmentation Systems and how the U.S. Local Area Augmentation System (LAAS) mitigates the integrity risk due to these events. Gradients in slant ionospheric delay of as large as 425 mm/km over baselines of 40–100 km have been observed in the United States during ionospheric storms since April 2000 by both the U.S. Wide Area Augmentation System and the network of Continuously Operating Reference Stations receivers. Because ionospheric gradients affecting a LAAS site may not be observed by the LAAS Ground Facility (LGF) before users are affected, a simulation-based method has been developed to determine, in near real time, which potential LAAS user geometries would be unacceptably threatened by a hypothetical worst-case ionosphere gradient. Geometries of this type are made unavailable to LAAS users by having the LGF inflate the broadcast ionospheric-gradient sigma, which increases the Vertical Protection Level of the unacceptable geometries so that they exceed the allowed Vertical Alert Limit; thus ensuring user safety.
 Ground Based Augmentation Systems (GBAS), such as the U.S. Local Area Augmentation System (LAAS), augment satellite navigation systems by providing differential corrections and integrity information to aviation users within several tens of kilometers of GBAS-equipped airports. Because the separation between GBAS reference stations and users is small and because GBAS corrections are updated twice per second, differential GBAS user errors due to typical spatial and temporal variations in ionospheric delay due to signal refraction at L band frequencies are almost negligible, even during solar-maximum conditions [Lee et al., 2007]. However, unusual behavior during ionospheric storms observed by both the U.S. Wide Area Augmentation System (WAAS) and the network of Continuously Operating Reference Stations (CORS) yielded spatial gradients in slant (meaning nonzenith, or along the actual path between satellite and receiver) ionospheric delay of as large as 412 mm/km (or 412 parts per million) over baselines of 40–100 km. Gradients this large could cause vertical position errors for GBAS users of 20 m or more if these gradients coincide with poor user satellite geometry and the worst-case approach geometry and timing with respect to a single aircraft's approach to a specific GBAS-equipped airport.
 This paper describes the procedure by which worst-case anomalous ionospheric spatial gradients are modeled, analyzed, and mitigated for GBAS. Section 2 identifies the largest ionospheric gradients discovered in WAAS and CORS data collected within the conterminous United States (CONUS) since April of 2000. Section 3 briefly describes the data analysis method used to examine past CORS data for large gradients, and section 4 explains the simplified ionospheric anomaly “threat model” for LAAS use in CONUS generated from this data analysis. This threat model is combined with GPS and airport geometry simulations to predict the maximum differential range and position errors that LAAS users might suffer. A method for limiting these worst case errors to acceptable levels by real-time broadcast integrity parameter inflation is developed and validated. Section 5 describes how this technique is implemented in the LAAS Ground Facility (LGF), the impact that this mitigation has on CAT I LAAS precision approach availability, and potential means to reduce the resulting availability loss by obtaining real-time ionospheric information from WAAS.
2. Severe Ionospheric Gradients Discovered in CONUS
 Prior to 2002, it was believed that, during unusual ionospheric activity, ionospheric spatial gradients would not be more than 5–10 times greater than the value of 4 mm/km that was derived as a conservative one-sigma bound on nominal zenith ionospheric spatial gradients during “active” ionospheric conditions at solar maximum [Lee et al., 2007]. At the very worst, it was thought that known ionospheric anomalies, including ionospheric storms and the potential impacts of scintillation in equatorial and auroral regions, could not produce a spatial gradient larger than roughly 50–75 mm/km [e.g., see Klobuchar et al., 1995], which would not be a significant threat to LAAS users. However, WAAS data analysis of gradients that occurred in the northeastern quadrant of the United States during the 6−7 April 2000 ionospheric storm showed gradients perhaps as large as 320 mm/km moving in a pattern similar to that of a tropospheric weather front and with a varying propagation speed [Datta-Barua et al., 2002]. Gradients this large could not be bounded by any reasonable sigma value broadcast by a GBAS ground station, and they could generate vertical position errors significantly exceeding the 10-m Vertical Alert Limit (VAL), or safe error bound, for users flying GBAS-supported precision approaches to Category (CAT) I weather minima [Radio Technical Commission for Aeronautics, 2004].
 A detailed search of known ionospheric storms in CONUS, using the method described in section 3, uncovered other examples of severe gradients. The most significant gradients were observed during the storm of 20 November 2003, which created, loosely speaking, a “filament” of greatly increased ionospheric delay over the eastern half of CONUS, as shown in Figure 1. Very large spatial gradients existed on both the leading (westward) and trailing (eastward) edges of the “finger” of enhanced delay, which moved in a roughly westward direction at an average speed of between 100 and 200 m/s (but with substantial local variation) [Ene et al., 2005; Datta-Barua et al., 2007]. Note that constructing a composite map of ionospheric delays requires that slant delay measurements be converted to equivalent “vertical” or “zenith” delays by use of the standard ionospheric obliquity factor defined by Radio Technical Commission for Aeronautics . The resulting “vertical” delays are what are plotted in Figure 1.
Figure 2 shows the slant ionospheric delay over time from this event as observed by 7 CORS receivers tracking GPS SVN 38 in northern Ohio and southern Michigan, where the largest spatial gradients were observed [Ene et al., 2005]. Note the rapid growth in delay associated with the passing of the leading edge of the “filament” in just under an hour, followed by a lengthy interval of erratic variation in ionospheric delay within the “filament” while the overall delay remains high, followed by a sudden, steep dropoff corresponding to the very sharp gradient associated with the trailing edge of the enhanced-delay feature. The largest gradient corresponding to this sharp depletion among the 7 stations shown in Figure 2 is about 330 mm/km, but another pair of CORS stations in northern Ohio (ZOB1 and GARF) observing GPS SVN 38 experienced a gradient of about 412 mm/km when the trailing edge passed, as shown in Figure 3.
 While almost all extreme-gradient cases observed were for high-elevation satellites (satellites at or above 60 degrees), a few cases existed where gradients as large as 360 mm/km were observed on low-elevation satellites (below 15 degrees). One example of an extreme gradient on a low-elevation satellite was observed by CORS stations WOOS and GARF tracking GPS SVN 26 on 20 November 2003, as shown in Figure 4. While, under normal conditions, the obliquity factor derived from the thin-shell model of the ionosphere suggests that slant ionospheric delay for low-elevation satellites would be as much as 3 times larger than that for satellites at zenith (i.e., at 90 degrees elevation) [Radio Technical Commission for Aeronautics, 2007], this model does not apply well to ionospheric storms, when it is thought that the bulk of the increased delay occurs at varied altitudes within the ionosphere [Datta-Barua et al., 2007]. Thus, while the vertical delay estimates plotted Figure 1 are thought to form a useful illustration, they were not used in the data analysis procedure and threat-model development described in sections 2 and 3.
 The discovery of gradients of this magnitude during ionospheric storms (gradients far larger than ever seen from any other type of ionosphere behavior) was a major surprise to the GBAS and LAAS community and required the development of new mitigation strategies. Such gradients could, under worst-case geometries between the LGF, user aircraft, ionosphere gradient, and affected GPS satellites, create differential pseudorange errors as large as 8.5 m without being observable to the monitoring algorithms in the LGF (see section 4). The hazard implied by this possibility to aircraft performing precision approaches to CAT I weather minima (with the 10-m VAL mentioned earlier) was unacceptable without further mitigation within the LGF.
3. Ionospheric Storm Data Analysis Procedure
 The largest gradients identified in section 2 were the product of an exhaustive automated and manual analysis of all known ionospheric storm days in CONUS for which WAAS availability was affected (this would be due to the reaction of the WAAS ionospheric storm detector [see Walter et al., 2000; Federal Aviation Administration, 2004]). The details of this method are described by Ene et al. . The primary data source for this analysis is both raw and postprocessed CORS reference station data from hundreds of stations throughout CONUS. Ionospheric spatial gradients are calculated automatically for all satellites tracked by “clusters” of CORS stations within close proximity (several tens of kilometers) of each other in regions known to be affected by ionospheric storms. All apparent gradients of large anomalous magnitude (e.g., above 100 mm/km), calculated by dividing the difference in slant ionospheric delay between two CORS stations by the distance between the two stations, are put through a series of automated screening algorithms. These algorithms attempt to eliminate the most common nonionospheric causes of apparent large gradients, which are CORS receiver “glitches” and errors in the CORS data storage process [Ene et al., 2005]. The CORS network includes a variety of “off-the-shelf” dual-frequency receivers that are particularly vulnerable to codeless or semicodeless tracking errors on L2 measurements during ionospheric anomalies, and these errors can make nominal or moderately anomalous gradients seem much larger than they really are. In fact, apparent “gradients” due to L2 cycle slips can be as large as several thousand mm/km, but practically all receiver-instigated events of this magnitude are removed by automated screening.
 While the automated screening algorithms described by Ene et al.  greatly reduce the set of large spatial gradient events that are output by the data analysis software, most of what remains is due to CORS receiver or data collection errors when manually examined by researchers familiar with GPS receiver behavior. Therefore, all significant events output by the software were reviewed by a group of researchers who met regularly during the data analysis process to examine the software results and determine if a significant, verifiable ionosphere-created gradient was present. If so, the best manual estimate of the resulting gradient was computed and added to the list of “valid” anomalous ionosphere events. The key to the manual review process is a comparison between the apparent ionospheric gradient based on the postprocessed dual-frequency measurements and those based on code-minus-carrier measurements from the raw, single-frequency (L1-only) CORS measurements for the same stations and satellites [Ene et al., 2005]. As noted above, most receiver “glitches” affect the semicodeless L2 measurements, and while postprocessing removes most of these errors, the unusual measurement changes during ionospheric anomalies can introduce new errors. Figures 3 and 4 show two examples where large gradients reported by the data analysis software (based on postprocessed L1–L2 ionospheric-delay estimates) were validated by comparison with gradient estimates computed from raw L1 code-minus-carrier measurements from the same CORS receivers.
4. CONUS Ionospheric Anomaly Threat Model
 On the basis of the largest validated ionospheric gradients reported in section 2, Figures 5 and 6 show the resulting ionospheric spatial-gradient threat model for CONUS [Ene et al., 2005; Lee et al., 2006; Ramakrishnan et al., 2008]. Figure 5 shows the ionospheric-front geometry used in this threat model. The model assumes a linear change of ionospheric delay from high to low (or low to high) values, with the delay being constant on either side of the linear ramp. The front shown in Figure 5 is assumed to move with constant speed relative to the ground, and the other parameters of the front model (gradient, or “slope” in Figure 5, and width) are assumed to also remain constant (when simulating this threat model, a “frozen geometry” assumption is commonly used that keeps the satellite positions fixed over the duration of a single aircraft approach). It is known that these assumptions are not exactly true, but they serve as the most practical means of modeling the impact of a sharp ionospheric gradient on a GBAS or LAAS installation.
 Note that, in Figure 5, the front speed with respect to the ground and the speed of the notional LGF ionospheric pierce point (IPP) for the affected satellite are the same in magnitude and direction. This is not typically the case, but it represents the worst case from the point of view of the LGF because no relative front motion would be observed by the LGF Code-Carrier Divergence (CCD) monitor, which can only observe significant changes in ionospheric delay over time. Thus, the LGF cannot detect this small subset of the overall threat model. For this reason, the matched-speed case shown in Figure 5 is the one that is used in the simulation described in section 5 to generate worst-case front scenarios for individual satellites [Simili and Pervan, 2006; Lee et al., 2006; Ramakrishnan et al., 2008].
Figure 6 shows the upper bound on the maximum gradient of this threat model as a function of satellite elevation angle. These bounds slightly exceed the largest gradients validated from the data analysis due to a limited amount of margin that was added to account for measurement error. In addition to the plotted maximum gradient, bounds exist on speed with respect to the ground (up to 750 m/s), width (distance between high and low delay regions; between 25 and 200 km), and total differential delay (up to 50 m) [Ene et al., 2005; Ramakrishnan et al., 2008]. The differential-delay bound disallows those combinations of gradient and width that, though separately within their respective bounds, have a product that exceeds the maximum differential delay observed in data analysis [Ene et al., 2005].
Figure 7 shows the results of a simulation that characterizes “typical” impacts on GBAS users from an ionospheric anomaly posed by this threat model impacting two GPS satellites simultaneously for the LAAS facility at Memphis, Tennessee. This simulation generates GPS satellite geometries at 5-min intervals over a 24-h period and examines all possible combinations of LGF-aircraft-satellite ionosphere geometry for each point in time [Lee et al., 2006; Ramakrishnan et al., 2008]. Note that, for a LAAS user performing a CAT I precision approach in CONUS and reaching a 200-foot decision height (DH) 6 km from the centroid of the LGF reference antennas, the maximum differential pseudorange error generated by this threat model is 0.425 m/km × 20 km = 8.5 m. The 20-km effective separation between LGF and user is the sum of 6 km of actual separation and 14 km of synthetic separation (= 2 τvair ≅ 2 × 100 s × 0.07 km/s) due to the memory of the single-frequency carrier-smoothing filter (with τ = 100 s) in the airborne receiver [Simili and Pervan, 2006; Ko, 2000].
Figure 7 shows how pseudorange errors resulting from the range of allowed ionospheric front widths, velocities (only the largest and second-largest gradient sizes observed in the data analysis were used), and airborne positioning geometries combine to produce a range of vertical position errors. In about 75% percent of the cases simulated, both affected GPS satellites are detected by the LGF CCD monitor before any differential error occurs [Simili and Pervan, 2006], and in these cases, zeros are not entered into the histograms. In most of the remaining undetected cases that are shown in the histograms, the resulting nonzero vertical position error is small and nonthreatening to precision-approach users, but in the very worst case, the error is as large as 41 m. While the combination of worst-case events needed to generate errors of this magnitude would be extremely rare, even given the fact that the ionosphere was known to be “stormy,” this condition is deemed to be unsafe for CAT I precision approaches because the worst-case error magnitude exceeds an upper limit of 28.8 m at the 200-foot DH for a CAT I approach (see Shively and Niles  for the derivation of this limit). Given that the worst-case scenario cannot be detected by the LGF, and knowing that user aircraft are not required to monitor for abnormal ionospheric rates of change [Radio Technical Commission for Aeronautics, 2007], the only means to further mitigate this risk is in the position domain, as described in the next section.
5. Worst Case Scenario Mitigation via Geometry Screening
Figure 8 shows a flow diagram of the methodology used by the LGF to protect users against unacceptable ionosphere-induced errors by restricting the set of GPS satellite geometries that are available to them [Lee et al., 2006; Ramakrishnan et al., 2008]. The loop shown in Figure 8 is executed at regular intervals within LGF processing (every 1–5 min, and every time a satellite rises into view or falls out of view). The first step is to enumerate all “credible” satellite geometries that aircraft approaching that LGF might use. In theory, any subset of 4 or more satellites of the set of N satellites for which corrections are broadcast can be used, but in practice, it is very unlikely that more than 2 of these N satellites will not be used (one complication involves airborne receivers with the minimum number of satellite-tracking channels allowed by the RTCA LAAS Minimum Operational Performance Standards, or MOPS, which is 10 [Radio Technical Commission for Aeronautics, 2007]). On the basis of this constraint, the LGF builds a list of all credible airborne geometries, determines which geometries from this subset could actually be used by the aircraft (meaning that they meet the VPL ≤ VAL requirement for CAT I precision approaches), and evaluates the worst-case ionosphere-induced vertical position error, or “MIEV,” for each usable geometry at all CAT I DH locations supported by that LAAS site. Otherwise usable geometries for which the MIEV exceeds the safe error limit of 28.8 m at any DH location must be made unavailable so as not to threaten users, and this is done by increasing one or more of the broadcast sigma or P values that help determine the Vertical Protection Level (VPL) such that VPL for all “unsafe” geometries exceeds VAL and makes all such geometries unavailable [Radio Technical Commission for Aeronautics, 2007]. An optimized method for doing this based on inflation of both σpr_gnd and P values for each individual satellite is given by Ramakrishnan et al. . A simpler method of inflating only the single σvig value that covers all satellites is given by Lee et al. .
 While sigma and/or P value inflation is required to eliminate “unsafe” geometries, it has the unavoidable impact of making “safe” geometries unavailable as well. Furthermore, the inflation required to protect the most demanding approach (typically the one furthest from the LGF) exceeds what is required for all other LAAS-supported approaches at that airport. As a result, the achievable CAT I system availability with geometry screening included is significantly lower than what it would be if geometry screening were not required. However, most major airport locations in CONUS will still achieve CAT I availabilities of 0.999 or better when all 24 GPS satellites in primary orbit slots are healthy. Note that this penalty is suffered because the threat model in section 4 is presumed to be present at all times. The best way to reduce this penalty is to remove this conservative assumption, and the most practical means to do so at present is to receive Wide Area Augmentation System (WAAS) ionospheric corrections and Grid Ionospheric Vertical Error (GIVE) values at LAAS sites. When WAAS GIVE values at the ionospheric grid points (IGPs) surrounding a given satellite being tracked by the LGF indicate that all four IGPs are not affected by ionospheric storms, that LAAS site can be assured that the satellite in question has no risk of being affected by a threatening ionosphere gradient. Therefore, geometry screening is not needed for that satellite [Pullen et al., 2004].
6. Summary and Future Developments
 This paper explains how GBAS protects users against rare but potentially threatening ionospheric spatial-gradient anomalies. The potential effects of ionospheric anomalies on GBAS and other local-area differential Global Navigation Satellite System (GNSS) users are illustrated based on severe ionospheric spatial gradients observed by both WAAS and CORS receiver networks during the late-October and mid-November 2003 ionospheric storms. These measurements of past storms have been used to construct a threat model for CONUS users describing the worst possible spatial gradients that could occur within the integrity risk probability relevant to GBAS CAT I aircraft precision approaches. A real-time algorithm to search for and eliminate GNSS satellite geometries that would not be safe to use in the presence of the worst case ionospheric anomaly has been described. One variation of this algorithm has been implemented in the Honeywell SLS-4000 LAAS Ground Facility, which will soon be certified to support CAT I precision approaches in CONUS.
 While this paper describes a solution to the ionospheric anomaly threat to CAT I LAAS in CONUS, more work is needed to expand this solution to cover the entire world. While the real-time geometry-screening strategy described in section 5 will work anywhere, we do not know if the ionospheric anomaly threat model derived from CONUS data in section 4 is sufficient to bound anomalies elsewhere in the world, particularly in regions exposed to equatorial ionospheric behavior. Therefore, providing CAT I GBAS service outside of CONUS requires the development of threat models that are not limited to CONUS data. In addition, because the current CONUS threat model is only based on ionospheric observations made available by GPS reference receiver networks since late 1999, fielded GBAS systems inside and outside CONUS should continue to monitor ionospheric behavior in case future anomalies generate larger gradients than those in the current threat model.
 In the next several years, an upgraded version of single-frequency GBAS will be introduced that will make possible CAT II and III precision approaches. This system adds real-time airborne ionospheric monitoring to the existing ground-system monitoring. Because an anomalous ionospheric front with the largest possible gradient cannot escape both airborne and ground monitoring, this version of GBAS will not be as vulnerable to the extremes of the CONUS ionospheric anomaly threat model. As a result, the degree of geometry screening needed to mitigate the remaining threatening anomalies is much reduced. This screening will be performed on the aircraft, which knows its own satellite geometry and need not defend against the many possible subset geometries that the CAT I LGF must consider [Murphy and Harris, 2007].
 The long-term solution to GBAS ionospheric vulnerability is the provision of multiple-frequency GBAS services once sufficient numbers of GNSS satellites broadcasting civil signals on multiple frequencies are available (perhaps in 10–15 years). The use of multiple frequencies allows the complete removal of ionospheric effects on GNSS measurements (at least to first order), although this is not necessarily optimal at all times because the removal process adds error and thus increases the nominal (uninflated) user protection levels [Konno, 2007]. Research on the best means of applying multiple frequencies to future GBAS is an active research topic that will expand further as GNSS satellites broadcasting multiple civil frequencies begin to be launched in larger numbers.
 The authors would like to thank Ming Luo, Jiyun Lee, Godwin Zhang, Seebany Datta-Barua, Shankar Ramakrishnan, Todd Walter, and Juan Blanch at Stanford, Mats Brenner and Kim Class at Honeywell, John Warburton, Tom Dehel, Barbara Clark, Hamza Abdusalem, and Jason Burns of the FAA, and Tim Murphy and Matt Harris of Boeing for their aid and support of this work. We would also like to thank Attila Komjathy of the Jet Propulsion Laboratory for performing the postprocessing of dual-frequency CORS reference station data. This research was funded by the FAA Satellite Navigation LAAS Program Office, and the support of Leo Eldredge, Carlos Rodriguez, and Ted Urda is greatly appreciated. However, the opinions expressed in this paper are solely those of the authors and do not necessarily represent those of the FAA.