Consecutive navigation-error samples are not independent: the filter has memory measured in seconds, and a 0.1-s sampling interval gives you essentially the same number twice. Treating them as independent inflates your apparent confidence by orders of magnitude and produces test plans that fail audit immediately.
\(R(\tau) = \mathbb{E}[e(t)\,e(t+\tau)]\). For exponentially-correlated errors: \(R(\tau) = \sigma^2 e^{-|\tau|/T_{\rm corr}}\). At \(\tau = 0\) it equals the variance; at \(\tau = T_{\rm corr}\) it has fallen to \(\sigma^2/e \approx 0.37\sigma^2\).
\(T_{\rm corr} \approx 15\) s for horizontal navigation error in steady-state operation. It sets the floor on how long an accuracy-assessment run must be: \(T_{\rm total} \geq 2\,T_{\rm corr}\,N_{\rm eff,\,req} = 2 \cdot 15 \cdot 300 = 9{,}000\) s, or about 150 minutes.
\(N_{\rm eff} = T_{\rm total} / (2\, T_{\rm corr})\). The factor of 2 comes from the fact that each sample is correlated with neighbors both forward and backward in time, so each "independent look" occupies a window of \(2 T_{\rm corr}\) on the timeline.
Take the ACF down to 10% of its peak; that lag \(L \cdot dt = T_{\rm corr} \ln 10 \approx 2.30\, T_{\rm corr}\) is the decimation interval that yields effectively-independent samples. The standard formula uses an implicit threshold of \(\rho = e^{-2} \approx 13.5\%\), so the 10% rule yields an \(N_{\rm eff}\) about 13% smaller — a conservative estimate.
\(T_{\rm total} \geq 2 \cdot 15 \cdot 300 = 9{,}000\) s = 150 min. The raw sample count at 10 Hz would be 90,000 — vastly more than 300 — but only 300 of those are independent. Sampling faster does not help; only longer runs increase \(N_{\rm eff}\).
\(N_{\rm eff}\) depends only on \(T_{\rm total}\) and \(T_{\rm corr}\); the sample rate cancels out. Faster sampling adds redundant measurements that all sit inside the same correlation window. To grow \(N_{\rm eff}\) you must run longer or reduce \(T_{\rm corr}\); faster sampling alone gives you no new statistical information.
A tail. The right tool is the 95th-percentile of the empirical CDF of \(e_H\): \(e_{H,95} = \mathrm{prctile}(e_H, 95)\). A 95% CI on the mean tests a different question (where the mean lives) and is the wrong tool for this requirement, even if the language sounds similar.
Because operational performance is dominated by worst-case events, not average events. A system with zero mean error and a fat tail can still violate operational requirements; a system with a small bias but a tight distribution can be perfectly acceptable. The 95th-percentile threshold says "bad days happen at most 5% of the time", which is operationally meaningful in a way the mean is not.
Model: \(e_H(t) = a + b t + \varepsilon(t)\). OLS: stack \(\mathbf{X} = [\mathbf{1}\;\mathbf{t}]\) and solve \(\hat{\boldsymbol{\beta}} = \mathbf{X} \backslash \mathbf{e}_H\). The slope \(\hat{b}\) in m/s converts to NM/hr by \(\hat{b}_{\rm NM/hr} = \hat{b}_{\rm m/s} \cdot 3600/1852\).
The upper 95% confidence bound on the slope: \(b_{\rm upper} = \hat{b} + t_{N-2,\,0.975} \cdot \hat{\sigma}_b\). Even if the point estimate is below 1.0 NM/hr, a wide CI can leave the upper bound above the requirement, in which case the system fails. The CI is the test's honest statement of "what the data has ruled out".
The upper-bound rule rejects systems whose drift could plausibly be above the requirement. As \(N_{\rm eff}\) grows, the OLS standard error \(\hat{\sigma}_b\) shrinks, the CI tightens, and the upper bound moves toward the point estimate. With enough data, the upper bound and the point estimate converge — and that is the only honest path to declaring a marginal system compliant.
The SPO has directed that DT use only production-representative sensors and avionics-bus data. There is no Flight Test Instrumentation tap into the integrity-monitoring algorithm, so the internal "fault detected" flag is not available. \(t_D\) must be inferred from the externally-observable navigation-error time history.
(1) Compute pre-fault baseline \(e_{\rm base}\) from a window ending just before \(t_0\). (2) Find peak error \(e_{\rm peak}\) in the post-fault search window. (3) Set snapback threshold \(e_{\rm thr} = e_{\rm base} + \alpha(e_{\rm peak} - e_{\rm base})\) with \(\alpha = 0.25\). (4) \(t_D\) is the first time after the peak at which \(e_H \leq e_{\rm thr}\) for at least 0.5 s.
It immunizes the algorithm against single-sample noise dips that happen to fall below threshold. Requiring the error to stay below threshold for at least 0.5 s ensures the system has actually snapped back, not just briefly oscillated through the threshold value. Without it, very short coincidental dips would produce false-low \(t_D\) readings.
For 30 independent spoof events, at least 27 must satisfy \(T_D \leq 5\) s, \(\mathrm{HMI}_H \leq 1\) s, and \(\mathrm{HMI}_V \leq 1\) s. Three failures are tolerated. The implied per-event success probability is in the 0.90 to 0.95 range, computed from the binomial distribution: with \(p = 0.95\), \(P(\geq 27\,\mathrm{of}\,30) \approx 0.94\).
data_AllSource: Requirement 1 (AllSource accuracy). data_AltNav: Requirement 2 (AltNav accuracy). data_Inertial: Requirement 3 (inertial drift). data_Spoof: Requirement 4 (fault detection / integrity). Critical: data_Spoof must NOT be used for accuracy assessment because the fault-injection events produce episodic high errors that inflate the 95th-percentile readout artificially.