2. Integrity and RAIM

integrity risk), which is the probability that the position error exceeds a certain tolerance, without being detected and an alert being raised in time. The given position information will then be misleading, as it is not correct within specified bounds, and the user is not aware of the

While IM was considered until recently only in aviation, it is currently a key performance parameter in safety-critical land applications. Even though integrity requirements in vehicular transport have not been defined yet, the demand for higher levels of automation in an increas-

Today, integrity monitoring in aviation is implemented in two different ways, at system level or at user level. At system level, two types of external augmentation systems can be distinguished, Space-Based Augmentation Systems (SBAS), see [3, 4], and Ground-Based Augmentation Systems (GBAS), see [5]. Both are Differential GPS systems (DGPS). SBAS and GBAS develop corrections that improve the accuracy of the measurements and generate real-time error bounds. These bounds are called Protection Levels (PL) and must exceed the actual error under all conditions with very high probability [6]. SBAS and GBAS are both very powerful means of guaranteeing integrity, but they present the drawback of needing a very complex and

At user level the GNSS integrity can be monitored by exploiting the redundancy of the GNSS signals as collected at the receiver. This is done by performing calculations within the user equipment itself to check the measurements consistency. This method is known as Receiver Autonomous Integrity Monitoring (RAIM). RAIM is possible as long as a number of observations larger than the minimum necessary for a position fix are available. RAIM strictly relies on the strength of the satellite geometry. With the deployment of the new GNSS constellations many more satellite signals will soon be available: this will increase the redundancy of mea-

Both SBAS/GBAS and RAIM methods can in principle be adopted for IM in land applications, since the fundamental positioning problem is the same. However, some important differences in the applications may make the task not straightforward. GNSS positioning in aviation is generally restricted to Single Point Positioning (SPP), based on code observations on the civil frequencies, L1 (E1 for Galileo) and soon L5 (E5). With SPP, accuracy of few meters is attainable. However, most current and future land applications (such as ITS) require lane-level accuracy, i.e., sub-meter accuracy [7]. As such level of accuracy is considered unattainable with SPS, ITS applications are foreseen to be relying on Satellite Based Augmentation Systems

The different positioning methods and the corresponding higher precisions involved bring with them a new set of specific vulnerabilities. For instance, anomalies that would create positioning errors of too small magnitude in an SPP context, and could therefore been

ing number of applications is pushing the relevant authorities to fill this gap.

potentially hazardous situation.

24 Multifunctional Operation and Application of GPS

1.1. Integrity monitoring in aviation

costly infrastructure.

surements and the RAIM power.

1.2. Integrity monitoring on land

(SBAS), RTK or Precise Point Positioning (PPP) techniques [7].

#### 2.1. Navigation performance parameters

The navigation system's role is to collect and process measurements or other input data and deliver a position/state estimation, and guide the user to reach their destination. Based on the input data, called observables1 , the parameters of interest are estimated. In the GNSS case, the model for the estimation problem is non-linear, but it is standard practice to transform it into a linear form, such as:

$$
\underline{y} = A\mathbf{x} + \underline{\mathbf{e}} \tag{1}
$$

where y is a vector of m observables, x is the state vector (n components) of the parameters on which the observables depend, among which are the parameters of interest, the m � n matrix A is the design matrix and e is a vector of measurement errors. y and e are random variables (indicated by an underscore).

In the GNSS case, the observable y is constituted by the range measurements (code and carrier phase) from each visible satellite, and in some cases by the Doppler observations, to determine

<sup>1</sup> the term observable is used to refer to the random variable, while the term observation refers to its realization.

the velocity of the user. Such observable can be further augmented with external measurements/ information, such as estimates of the ionosphere, troposphere, corrections for biases, or by other navigation systems, such as INS. The design matrix A in (1) is determined by the geometrical configuration of the satellites in view, which links the range measurements to the unknowns, and by all the linear relations that link the eventually available additional information (e.g. INS or external corrections) to the unknowns.

<sup>y</sup><sup>∈</sup> <sup>Ω</sup> ! <sup>b</sup><sup>x</sup> <sup>¼</sup> <sup>F</sup> <sup>y</sup>

• PFA is the requirement of False Alert probability, the maximum allowable probability that an Alert is raised by the algorithm and the continuity of the operation is interrupted, without any actual reason. PFA is a sub-allocation of the full continuity requirement c, which has to account also for justified Alert (e.g. in the occurrence of an actual hazardous anomaly). • ΩAL is the 'integrity region' around the true position which boundaries are the Alert Limits (AL). Fundamentally the position error is required to lie within the boundaries defined by the ALs (therefore inside ΩAL) with an extremely high probability, 1 � PHMI. While in aviation this region is cylindrical, with the radius of the cylinder defined by the Horizontal Alert Limit (HAL) and height defined by the Vertical Alert Limit (VAL), in ITS the shape of this region has not been defined yet, and possibly will be dependent on the specific application. It is expected that in most land applications the vertical error will not need to be monitored, and only limits in the horizontal plane will be considered. On the horizontal plane, distinction shall be made between along-track (AT) and cross-track (CT) directions of motion. A rectangular integrity region could be used, defined by the ALs in the two directions, ALAT and ALCT respectively. Alternatively, an ellipsoidal region could be adopted with semi-axes ALAT

• PHMI, the (maximum allowed) Probability of Hazardous Misleading Information PHMI, is the integrity requirement per epoch. This is the probability that the information on the vehicle position is wrong by an amount larger than the ALs, without any alert or warning on possibly present anomaly being provided along. In aviation PHMI values range from 10�<sup>7</sup> to 10�<sup>9</sup> per operation (e.g. approach), whereas for ITS there are yet no

<sup>P</sup> <sup>b</sup><sup>x</sup> � <sup>x</sup><sup>∉</sup> <sup>Ω</sup>AL <sup>∩</sup> <sup>y</sup> <sup>∈</sup> <sup>Ω</sup>

P y∉ Ω

and ALCT. Figure 1 shows the different types of integrity regions.

candidate values apart from those for aviation.

Figure 1. Integrity regions in aviation and in ITS.

such that:

and

where:

� � (2)

http://dx.doi.org/10.5772/intechopen.75777

27

Integrity Monitoring: From Airborne to Land Applications

� � <sup>¼</sup> <sup>P</sup>HMI <sup>≤</sup> <sup>P</sup>HMI <sup>∀</sup><sup>x</sup> (3)

� � <sup>¼</sup> <sup>P</sup>FA <sup>≤</sup> <sup>P</sup>FA <sup>∀</sup><sup>x</sup> (4)

In ITS, integrity is listed among the navigation key performance parameters (KPP), which have been identified [1, 2] as: nolistsep [noitemsep].


The KPPs are inter-related. In particular, integrity is tightly connected with continuity, since raising an Alert constitutes a disruption to the continuity of the operations.

## 2.2. RAIM problem definition

Assume a single epoch scenario in which a user at an unknown position receives signals from the GNSS satellites, and eventual positioning information from other augmentation systems/ external linkage. In this scenario, the RAIM problem is defined as: for any satellite geometry, to which corresponds a certain statistical distribution of the observable y, find an 'acceptance' region Ω ∈ Rm (sub-domain of Rm) and an estimation/detection function F y � � that to the observable <sup>y</sup><sup>∈</sup> <sup>Ω</sup> assigns a position estimator <sup>b</sup>x:

Integrity Monitoring: From Airborne to Land Applications http://dx.doi.org/10.5772/intechopen.75777 27

$$
\underline{y} \in \Omega \to \widehat{\underline{x}} = F\left(\underline{y}\right) \tag{2}
$$

such that:

$$P\left(\widehat{\underline{x}} - \mathbf{x} \notin \Omega\_{\text{AL}} \cap \underline{y} \in \Omega\right) = P\_{\text{HM}} \leq \overline{P}\_{\text{HM}} \qquad \forall \mathbf{x} \tag{3}$$

and

the velocity of the user. Such observable can be further augmented with external measurements/ information, such as estimates of the ionosphere, troposphere, corrections for biases, or by other navigation systems, such as INS. The design matrix A in (1) is determined by the geometrical configuration of the satellites in view, which links the range measurements to the unknowns, and by all the linear relations that link the eventually available additional information (e.g. INS or

In ITS, integrity is listed among the navigation key performance parameters (KPP), which have

• Accuracy. Accuracy defines how well the estimated or measured position agrees with the true position. It is usually measured by the 95% confidence level for the position error, or by the Root Mean Square Error. Accuracy is computed assuming that the system is

• Integrity. Integrity defines the level of trust that can be given to the system. It is the ability of the positioning system to identify when a pre-defined Alert Limit (a bound to the position error) has been exceeded and to then provide timely warnings to drivers. Integrity is measured by either: a) the Probability of Hazardous Misleading Information, PHMI, which is the probability that a position error larger than an Alert Limit (AL) occurs without a warning being timely raised, or b) the Protection Levels, which are the largest position error that may occur without any warning being timely raised, with probability

• Continuity. Continuity is the capability of the navigation system to provide a navigation output with the specified level of accuracy and integrity throughout the intended period of operation (POP). Continuity is expressed as the probability that during the POP the system is providing trustworthy navigation information, without any disruption or Alert

• Availability. Availability is the fraction of time the navigation function is usable, as determined by its compliance with accuracy, integrity and continuity requirements. At any epoch of time, the navigation system is deemed either available or unavailable, depending

The KPPs are inter-related. In particular, integrity is tightly connected with continuity, since

Assume a single epoch scenario in which a user at an unknown position receives signals from the GNSS satellites, and eventual positioning information from other augmentation systems/ external linkage. In this scenario, the RAIM problem is defined as: for any satellite geometry, to which corresponds a certain statistical distribution of the observable y, find an 'acceptance'

� �

that to the

on whether the availability, integrity and continuity requirements are satisfied.

raising an Alert constitutes a disruption to the continuity of the operations.

region Ω ∈ Rm (sub-domain of Rm) and an estimation/detection function F y

working in fault-free conditions, with standard performance.

external corrections) to the unknowns.

26 Multifunctional Operation and Application of GPS

been identified [1, 2] as: nolistsep [noitemsep].

smaller than the maximum allowed PHMI.

being raised.

2.2. RAIM problem definition

observable <sup>y</sup><sup>∈</sup> <sup>Ω</sup> assigns a position estimator <sup>b</sup>x:

$$P\left(\underline{\underline{y}} \notin \Omega\right) = P\_{\rm FA} \leq \overline{P}\_{\rm FA} \qquad \forall \mathfrak{x} \tag{4}$$

where:


Figure 1. Integrity regions in aviation and in ITS.

The acceptance region Ω fundamentally defines the set of all the measurements y from which it is possible to determine a safe position estimate <sup>b</sup>x, i.e., for which the requirement on the <sup>P</sup>HMI is satisfied.

In any geometry, the rule can be optimized in different ways. The two extreme approaches would be: 1) minimizing the PHMI given the requirement on the continuity is satisfied, or viceversa 2) minimizing the PFA (maximizing the continuity c) given the requirement on the PHMI is satisfied. The first is usually the preferred approach.

#### 2.3. Protection levels (PL)

To define the PLs the total requirement on the PHMI, the PHMI, must be split into the different position components. In aviation, it is to be split into horizontal and vertical allocations, P hor HMI and P ver HMI. In ITS instead, it is to be split between the horizontal along-track (AT) and crosstrack (CT) components, P AT HMI and P CT HMI, whereas the vertical component is (generally) not of concern. PLAT and PLCT are defined as the maximum position error size (in the AT direction and in the CT direction) that can pass undetected with a probability smaller or equal to the probability requirements, P AT HMI and P CT HMI, i.e.,

$$\begin{aligned} \text{PL}\_{\text{AT}} &= \arg\min\_{\delta} P(|\hat{\underline{\mathbf{x}}}\_{\text{AT}} - \mathbf{x}\_{\text{AT}}| &> \delta |\text{No Alert}) \leq \overline{P}\_{\text{HM}}^{\text{AT}}\\ \text{PL}\_{\text{CT}} &= \arg\min\_{\delta} P(|\hat{\underline{\mathbf{x}}}\_{\text{CT}} - \mathbf{x}\_{\text{CT}}| &> \delta |\text{No Alert}) \leq \overline{P}\_{\text{HM}}^{\text{CT}} \end{aligned} \tag{5}$$

with P AT HMI þ P CT HMI ¼ PHMI. To satisfy the navigation availability requirement it has to be:

$$\text{PL}\_{\text{AT}} \leq \text{AL}\_{\text{AT}} \quad \text{and} \quad \text{PL}\_{\text{CT}} \leq \text{AL}\_{\text{CT}} \tag{6}$$

unavailable. Such availability assessment can be made at each epoch on the basis of the model

Figure 2. RAIM scheme. Integrity can be assessed first on the basis of the model strength only, and next in real time after

Integrity Monitoring: From Airborne to Land Applications

http://dx.doi.org/10.5772/intechopen.75777

29

The observation coherency assessment takes as input the observations y at each epoch. The output of the observations processing is the issue of a state of either Alert or No Alert for that epoch; in case of No Alert, a position solution is provided to the user. In this step, a real time check of the observations is performed. Alert is declared in case the sample measurement

Both blocks of the RAIM structure require as input the navigation requirements on integrity and continuity, i.e., ΩAL, the integrity region, PHMI, the maximum allowed PHMI, and PFA, the False Alert (or continuity) requirement. The performance of a RAIM algorithm can be mea-

Since RAIM is linked with the estimation method, two approaches to RAIM can be distinguished: • Fault Detection and Exclusion (FDE) procedure: one adopts a standard estimation rule, for instance the Best Linear Unbiased Estimation (BLUE [8], characterized by highest accuracy in fault-free conditions); in case the BLUE is not satisfying the integrity requirements (i.e., too large PHMI, because a fault is suspected), one can switch to a different estimator, e.g., a BLUE applied on a subset of the original measurements set. In this way the

suspected fault is excluded, and the associated bias in the estimation removed.

• Robust estimation: one adopts an estimation rule tailored to integrity. Instead of employing the BLUE, one can sacrifice on some accuracy in fault-free conditions to gain in integrity. A combination of both methods listed above is also possible. Here only FDE procedures

taken is too inconsistent: the case y ∉ Ω introduced in the definition of RAIM problem.

sured over time by computing (estimating) the actual PFA, PHMI and PLs.

strength, before the actual measurements are taken.

3. RAIM approaches

an observation is taken.

are analyzed.

If those equations are satisfied integrity is maintained for the epoch under consideration. Instead of computing the PLs, the integrity monitoring system can simply compute the actual PHMI or an upperbound for it, and then compare it to the requirement PHMI. If PHMI ≤ PHMI, integrity is maintained.

#### 2.4. RAIM input, output and performance parameters

In this Section the input and output parameters of a RAIM algorithm are summarized. Figure 2 shows a schematic representation of a RAIM algorithm. A RAIM algorithm is constituted of two blocks: the first one assesses the geometry or model strength the second one processes the real time observations and assesses their coherency.

The model strength assessment takes as input the design matrix A and the distribution function of the observable f <sup>y</sup>, i.e., the observation model, at each epoch. Output of this first assessment are the PLs and/or the PHMI, and consequently the availability prediction for that epoch: if any PL > AL, or equivalently PHMI > PHMI, the navigation service is declared

Figure 2. RAIM scheme. Integrity can be assessed first on the basis of the model strength only, and next in real time after an observation is taken.

unavailable. Such availability assessment can be made at each epoch on the basis of the model strength, before the actual measurements are taken.

The observation coherency assessment takes as input the observations y at each epoch. The output of the observations processing is the issue of a state of either Alert or No Alert for that epoch; in case of No Alert, a position solution is provided to the user. In this step, a real time check of the observations is performed. Alert is declared in case the sample measurement taken is too inconsistent: the case y ∉ Ω introduced in the definition of RAIM problem.

Both blocks of the RAIM structure require as input the navigation requirements on integrity and continuity, i.e., ΩAL, the integrity region, PHMI, the maximum allowed PHMI, and PFA, the False Alert (or continuity) requirement. The performance of a RAIM algorithm can be measured over time by computing (estimating) the actual PFA, PHMI and PLs.
