Return to Session D3
Next Abstract
### Session D3: GNSS Augmentation and Robustness for Autonomous Navigation (GNSS Integrity Augmentation)

Return to Session D3 Next Abstract

**An Integrity Concept for GNSS-IMU-Tacho Based Train Localization**

*Carl Milner, Ecole Nationale de l'Aviation Civile; Nicolas Mendoza Pila, Elisa Gallon, Airbus Defense and Space*

**Date/Time:** Thursday, Sep. 19, 8:35 a.m.

In the scope of the CLUG2 project, a LOCalisation On-Board or ‘LOC-OB’ unit is being developed to provide along-track, track selectivity and start-of-mission positioning functions to the ERTMS (European Rail Traffic Management System). In this paper, we treat primarily the along-track positioning where the section of track is known but the absolute position along the track is unknown. The CLUG2 architecture employs a high-precision high-safety (1e-9) digital map along with a Dual-Frequency Multi-Constellation (DFMC) Satellite-Based Augmentation System (SBAS) Global Navigation Satellite System (GNSS) receiver, Inertial Measurement Unit(s) (IMU) (safety level 10-5 per hour or better), odometry or speed sensor (safety level 10-5 per hour or better). An Extended Kalman Filter (EKF) is employed to estimate the train’s front-end position, speed and their respective confidence intervals, or protection levels in the navigation integrity terminology must be determined for these critical outputs at the 10-9 per hour level.

In this paper an integrity tree allocation is performed based on the assumptions described and a monitoring scheme is defined which will robustly and conservatively account for all fault modes including local failures. Since DFMC SBAS is employed, satellite payload faults are considered to occur at the 2×10-6 per hour rate accounting for both the SBAS faulty case and failed bounding of the SBAS fault-free case, whilst local faults, due to extreme multipath or Non-Line-of-Sight (NLOS) are assumed to occur with unit probability. A scheme combining the FDE at the filter level, termed here System-FDE and FDE at the GNSS level, termed here Sensor-FDE is used to resolve the difficulty of this highly conservative but in the authors’ view necessary assumption. GNSS sensor-level FDE is based on divergence-free code-minus-carrier statistics [1], whilst system-FDE employs sequences of innovations [2]. The alternative, solution separation based FDE, is excluded for engineering reasons due to the computational difficulties of IMU mechanization for a multitude of sub-filter solutions. Innovations sequencing employs a window of quadratic forms of the innovations.

An initial allocation between fault-free and the multitude of faulty cases is made where a baseline of 20/80 split is taken initially. The fault-free risk, as with the other hypotheses may be decomposed into the number of effectively independent samples, the prior probability of the hypothesis, the probability of missed detection and the probability of a positioning failure with respect to the hypothesis protection level. Let us describe these four terms in further detail. The number of effectively independent samples (or number of effective samples) relates the risk of misleading information per hour to the probability of misleading information at a single epoch. Here, misleading information refers to the fact that the positioning error exceeds the protection level without an alert. This number of effective samples must be determined offline from the temporal correlation properties of the filter output in the fault-free case. The prior probability of the fault-free hypothesis may be determined by subtracting the probabilities of the faulty hypotheses but is usually taken to be one in approximation. In the fault-free case, there are no detection metrics to check for the presence of fault-free integrity failure and thus this is set to unity. The allocation, scaled by the number of effective samples is then assigned to the probability of a positioning failure. The fault-free protection level may then be defined.

Let us now consider the faulty case. The fault hypotheses are GNSS system failure (SBAS integrity loss), GNSS local failure (no SBAS impact), IMU failure, tacho failure, GNSS local failure and IMU failure and finally, GNSS local failure and tacho failure. A margin is kept for the non-monitored faults such as triple failures. An example allocation is shown in the figure below. Once again the chosen values of the allocation are only indicative of a premier iteration. It may be that the dual failures sensor failures can be discarded if the Sensor-FDE of GNSS based on the CMC metrics can ensure that the combined prior probability is sufficiently low.

As for the fault-free case, the risk of the faulty hypothesis may be broken down into the same four factors. However, the number of effective samples may be different, and could depend upon not just the state estimation error temporal correlation parameters but also the test statistic temporal correlation parameters or even the fault profile. In the case of an SBAS failure, due either to an undetected satellite payload fault (H1 in the SBAS integrity tree) or bounding failure (H0 in the SBAS integrity tree) the allocated probability is determined as shown in the figure. It is assumed that the probabilities of missed detection (System-FDE) and probability of positioning failure (EKF output exceeding the protection level) are independent. This has been demonstrated in [3], however, studies shown in [4] question the validity of this assumption in the weighted least squares case when the assumed model is not in line with the true performance. It is clear that for the EKF an equivalent conclusion could be formed and further investigation into this correlation is needed, which is left to future work.

In the case of local GNSS failures, an initially conservative assumption is taken that all satellites are subject to extreme multipath or Non-Line Of Sight (NLOS) at all times. This appears at first to be extremely conservative, particularly if the train (or vehicle) is in open sky or even suburban conditions. However, since no video sensors are employed here, and the algorithms designed for environment detection are not currently sufficiently robust for this application, such an assumption is necessary. The presence of NLOS or extreme multipath cannot be treated probabilistically since the distribution of errors is highly non-stationary.

In order to employ this assumption but also facilitate the definition of an integrity concept, the use of sensor level FDE is to be used. Sensor level FDE, in this case FDE employing only GNSS measurements and not the estimated states of the filter. The paper assesses the correlation of the CMC based test and the System FDE test. This will determine whether the System FDE metric must be modified to exclude the impact of the satellite’s past measurements and ensure independence. It should also be noted that the CMC metrics are only capable of detecting changes in the measurement errors. Therefore, at CMC initialization, it is not appropriate to take credit for this test and a waiting period is needed, before the satellite can be included in the filter, during which a dummy System FDE test is performed to validate that no faults are present in this initialization period.

For each of the system states defined by the integrity tree, a protection level is defined to account for the potential impact of that state. The paper outlines the means to do this, in particular, a minimum detectable fault profile for the defined metrics against each case is designed employing the approach described in [1] with some modifications. This development, whilst not required in the solution separation approach, is needed to account for the possibility of undetected faults over time. It is a generalization of the minimum detectable bias (MDB) concept employed in certain RAIM algorithms. Two protection levels are then defined, including the standard slope-based approach.

Given the integrity allocation, FDE design, conservative local fault event model and protection level calculation, performance of the LOC-OB may be determined and is shown for a typical train route.

[1] Jiang, Y., Milner, C. & Macabiau, C. Code carrier divergence monitoring for dual-frequency GBAS. GPS Solut 21, 769–781 (2017). https://doi.org/10.1007/s10291-016-0567-4

[2] Tanil, Cagatay, Khanafseh, Samer, Joerger, Mathieu, Pervan, Boris, "Sequential Integrity Monitoring for Kalman Filter Innovations-based Detectors," Proceedings of the 31st International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2018), Miami, Florida, September 2018, pp. 2440-2455.

https://doi.org/10.33012/2018.15975

[3] Tanil, S. Khanafseh, M. Joerger, B. Pervan, “An INS Monitor to Detect GNSS Spoofers Capable of Tracking Aircraft Position,” IEEE

Transactions on Aerospace and Electronics, vol. 54, no. 1, pp. 131–143, Feb 2018.

[4] Bang, Eugene, Milner, Carl, Gallon, Elisa, Pervan, Boris, Macabiau, Christophe, Estival, Philippe, "Test Statistic and Position Error Correlation in (Advanced) RAIM," Proceedings of the 32nd International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2019), Miami, Florida, September 2019, pp. 534-551.

https://doi.org/10.33012/2019.16894

Return to Session D3 Next Abstract

For Attendees * *Technical Program * *Registration * *CGSIC * *Hotel * *Travel and Visas * *Smartphone Decimeter Challenge * *Exhibits * *Submit Kepler Nomination For Authors and Chairs * *Abstract Management * *Author Resource Center * *Session Chair Resources * *Panel Moderator Resources * *Student Paper Awards * *Editorial Review Policies * *Publication Ethics Policies For Exhibitors * *Exhibitor Resource Center * *Marketing Resources Other Years * *Future Meetings * *Past Meetings