Towards Global Integrity

Dr. Wolfgang Werner

IfEN GmbHHauptstr. 37

D-85579 Neubiberg, GermanyTel.: +49-89-6006-9595, Fax: +49-89-6006-9591

E-Mail: W.Werner@ifen.com

BIOGRAPHY

Dr. Wolfgang Werner received a diploma incomputer science from the University ofTechnology in Munich in 1994. Subsequently hehas been Research Associate at the Institute ofGeodesy and Navigation of the University FAFMunich. He received his Ph. D. in the field of high-precision DGPS/DGLONASS, carrier-phaseambiguity resolution and pseudolite investigationsin 1999. Since 1998 he is Technical Director atIfEN GmbH, a technology transfer company of thesame institute. Currently, he is working in the fieldof satellite navigation integrity algorithmdevelopment.

ABSTRACT

As availability, accuracy and continuity have alreadybeen implemented in the first satellite navigationsystems GPS and GLONASS, the focus of attentionhas been shifting towards integrity. Of course, thefirst three navigation system performance parametersmust be re-considered in a new light, when integrityis added to the service.

Wide area augmentation systems like WAAS,EGNOS or MSAS are expected to deliver themissing integrity service for a regional area, thusforming the GNSS1. Experiences in WAAS orEGNOS have shown that integrity is an extremelydifficult issue and not yet fully validated in GNSS1systems.

For GNSS2 systems, like the European GALILEO,the issue is even more complex as these systems areexpected to be global systems. Therefore, integrityhas to be tackled globally and a new integrity concepthas to be developed.

This paper describes the integrity issue from theintegrity monitor (IPF, integrity processing facility)and algorithmic point of view. An approach formonitoring the satellite signal integrity globally ispresented and early simulation results are given. Thecapability of the proposed algorithm with respect tointegrity and continuity performances is shown.

SISE AND SISA

Due to satellite orbit and clock errors every userexperiences a certain error on his direct line-of-sight measurement to this satellite. Of course, thereare still other (local) error effects that sum up in thetotal pseudorange the user measures, but from asystem point of view local errors can not beaccounted for and, thus, have to be left in the user’sresponsibility. The errors due to satellite orbit andclock, however, are in system responsibility and canbe managed at system level. For this reason, thiserror, consisting of clock and orbit errors, is calledthe Signal-In-Space Error (SISE). The system mustestimate this error and hand over appropriateinformation to the user for further use in hisposition and availability computation. While theorbit error is responsible for the residual surfaceattitude, a clock error shifts the surface up anddown. Fig. 1 shows the geometric situation.

To protect all potential users, the system has toidentify a “worst-case” user and be sure to protecthim. This is done by computing the Signal-In-SpaceAccuracy (SISA) as an upper bound for the worst-case, true, but unknown, SISE and broadcasting thisvalue to all users. Of course, the SISA value willalways be somewhat conservative to account for thesystem inherent uncertainties.

True SatellitePosition

CalculatedSatellite Position

Different IMS Positions

LOS Residuals due to Orbit Error Residual Orbit Error Bias Curve

Service Area

True SREW

Residual Orbit ErrorBias Line Estimation

WUL

SREWEstimation

Figure 1: Orbit and Clock Error Effects on LOS

From the integrity monitor point of view, it must beverified, that the true worst-user SISE is indeedbounded by the broadcast SISA.

SYSTEM INTEGRITY ALGORITHMS

Baseline of the future GALILEO system is a globalintegrity approach. “Global” means here that theintegrity algorithms have to work over the wholeearth, and not restricted to a certain service area likeECAC in EGNOS or CONUS in WAAS.

The main task of the integrity algorithm is tocompute an estimate for the true SISE based on theintegrity monitoring station observations. Thisestimate is then compared against the SISA and analarm is raised when it seems necessary.

The estimation of the SISE can be done by makinguse of the following algorithms:1. Compute tangent plane in satellite foot-point2. Project monitoring stations onto tangent plane3. Estimate residual orbit and clock error surface4. Evaluate surface to obtain worst-case error

We will go step by step through these algorithms.

M

S

F

d1

d2

r2

r1

R

ε

γ / 2

....

∆R

h

Figure 2: Situation and definitions

Fig. 2 shows the basic situation. Let us assume wehave a satellite located at the point S. The earthcenter is at M and the satellite foot-point is at F.The satellite height over ground is h and theGALILEO elevation mask angle is set to ε. Theearth radius is named R and the distance of thesatellite from the points of minimum elevation is d1.

The area of interest - the area, in which integrity hasto be provided - is the part of the earth limited bythe points of minimum elevation, which cuts a ballsegment of height ∆R out of the earth. In principle,it is sufficient to estimate the SISE on a circle onthe tangent plane around F with radius r2, which isdefined as can be seen from the figure.

The following table 1 gives the dependency of thesmaller circle on the used minimum elevation mask.

MinimumElevation [deg]

Radius r2 [km](smaller circle)

0.0 4988.3092.5 4983.2725.0 4968.1767.5 4943.066

10.0 4908.01512.5 4863.12415.0 4808.52517.5 4744.37220.0 4670.84722.5 4588.15425.0 4496.522

Table 1: Radius r2 dependent on elevation mask

A representation of the tangent plane in the satellitefoot-point can simply be given in normal-form by:

RTTT czzyyxxT =⋅+⋅+⋅:

where

++=

S

S

S

SSST

T

T

zyx

zyxzyx

222

1

with xS, yS, zS being the satellite WGS84coordinates and where Rc is chosen so that theplane touches the earth surface:

RcR =

Now, a local coordinate system has to be defined onthis plane. This is defined by (arbitrarily) choosingthe directions “east” and “north” for the coordinateaxes. The two coordinate vectors Nv (“north”) and

Ev (“east”) can be computed as follows:

The east-vector can be obtained by building thevector product of the vector (0, 0, 1)T and thesatellite vector:

−

+=

×

×

=0

1

100100

22 S

S

SS

S

S

S

S

S

S

E xy

yx

zyxzyx

v

The second coordinate vector can then be derivedas a vector product from the satellite vector and thefirst coordinate vector:

+⋅−⋅−

+++=

×

×

=

2222222

11

SS

SS

SS

SSSSS

E

S

S

S

E

S

S

S

N

yxzyzx

yxzyx

vzyx

vzyx

v

These computations do not work, when the satelliteis near to the elongation of the earth rotation axis.In such cases - which will not occur for GALILEO -special handling of these situations can be madeeasily.

Now, the tangent plane parameters are computedand the local coordinate system has been defined.Therefore, step one of the algorithm above iscomplete.

The second step is the projection of the measuredpseudorange residuals onto the tangent plane circle.The following formulas can be used to project anobservation at a IMS location

)()()( MSTMSTMST

MTMTMTR

zzzyyyxxxzzyyxxc

−+−+−−−−

=λ

where xM, yM, zM are the monitoring stationcoordinates.

Now the projected point can be computed accordingto:

−−−

⋅+

=

MS

MS

MS

M

M

M

P

P

P

zzyyxx

zyx

zyx

λ

where xP, yP, zP are the unknown coordinates of theprojected point.

This WGS84 vector has now to be expressed incoordinates of the tangent plane local coordinatesystem. This is done by linear combining thecomputed north and east vectors:

EENN

FP

FP

FP

vvzzyyxx

⋅+⋅=

−−−

αα

where Nα and Eα are scalars. and Fx , Fy , and

Fz are the satellite foot-point coordinates.

With ( )EN vvH |= the linear system

( )

−−−

⋅=

−

FP

FP

FPTT

E

N

zzyyxx

HHH 1

αα

delivers the coordinates.

All measured residuals can now be attributed totheir corresponding projected point planecoordinates:

),( ,, iEiNi ααεε =

This is the starting point for the residual surfaceestimation algorithms. Each of the latter step 3algorithms approximate the above equation via afunction ),( yxf with:

),(),( 0,0, yxyxf iEiN −−≈ ααε

where ),( 00 yx is some arbitrary chosen centerpoint of the estimated surface.

Two different types of estimation algorithms havebeen implemented and analyzed in the frame of theintegrity simulations.

As can be seen from fig. 3a-d, the propagated errorcan be approximated by a plane.

The first algorithm, thus, estimates a residual planeover the local coordinate system.

The form of the plane can be written in the form

0001 )()(),(: cyycxxcyxfB yx +−⋅+−⋅=

where ),( 00 yx denotes some arbitrary reference

point, and xc , yc and ),( 000 yxfc = are theunknown plane parameters.

1

0

-1

0

2

4

6

8

10

-1

0

1

Pseu

dora

nge

Res

idua

l [m

]

East

[r 2]

North [r2]

1

0

-1

0

10

0

2

4

6

8

10

-1

0

1

Pseu

dora

nge

Res

idua

l [m

]

East

[r 2]

North [r2]

1

0

-1

0

2

4

6

8

10

-1

0

1

Pseu

dora

nge

Res

idua

l [m

]

East

[r 2]

North [r2]

1

0

-1

0

2

4

6

8

10

-1

0

1

Pseu

dora

nge

Res

idua

l [m

]

East [r 2

]

North [r2]

Figure 3a-d: Typical pseudorange errors dueto satellite orbit and clock error

Now a linear equation system can be set up asfollows:

Hcl =

with the definitions

Tnl ),( 1 εε �=

−−

−−=

1

1

00

0101

yyxx

yyxxH

nn

���

Tyx cccc ),,( 0=

The solution can, thus, be written as

lHHHc TT 1)( −=

Despite the flatness of the propagated pseudorangeerror, a slight curvature remains, which will affectthe overall performance of the integrity algorithmsas a systematical error. Therefore, an alternativeapproach has been investigated by making use of asecond order instead of a first order surfaceestimation.

In this case, the surface can be written as follows:

0

00

00

20

202

)()()()(

)(

)(),(:

cyycxxc

yyxxcyycxxcyxfB

yx

xy

yy

xx

+

−⋅+−⋅+

−⋅−⋅+

−⋅+

−⋅=

where ),( 00 yx again denotes some arbitraryreference point and the set of unknown parametersis comprised of all the c-constants.

Again, a linear equation system can be set up

Hcl =

with the definitions

Tnl ),( 1 εε �=

∆∆∆∆∆∆

∆∆∆∆∆∆=

1

1

22

111121

21

nnnnnn yxyxyx

yxyxyxH ������

0

0

yyyxxx

ii

ii

−=∆−=∆

Tyxxyyyxx ccccccc ),,,,,( 0=

and again the solution

lHHHc TT 1)( −=

The final step of the algorithm is to evaluate theestimated surface at potential worst-user locations.

Dependent on whether a first-order or second-ordersurface has been estimated, candidate points are justat the edge of the visibility circle (first-orderestimation) or in addition at the analytical maximumof the surface, if it is within the visibility circle(second-order estimation). The surface is thereforesampled at the circle edge points (sufficient spacingis about 0.5°, which corresponds to about 87 kmsample point distance). In the second-order case thetheoretical maximum point is also considered, i.e.the point ),( ++ yx with

0242

xccc

ccccx

xyyyxx

xyyyxy +−

−=+

and

0242

yccccccc

yxyyyxx

yxxxxy +−

−=+

Finally, after the worst-user location and the worst-user line-of-sight error (called SREW, satelliteresidual error at worst user location) has beenestimated, a decision has to be taken, whether analarm should be raised or not.

For this decision, an HMI (hazardous misleadinginformation) definition has been adopted that is alsoused in EGNOS: an alarm should be raised if theworst-user error times 1.62 exceeds the broadcastUDRE (user differential range error). ForGALILEO, this definition can be adopted and thefollowing alarm criteria is used in the integrityalgorithm:

SISAkSREW >⋅

If the above condition is true, an alarm will beraised. The parameter k is a conservativity factorthat can be tuned to allocate risk budget betweenintegrity and continuity.

Note that this factor need not necessarily be 1.62,but may be chosen to gain maximum overall checkperformance.

Note further that from a system point of view, thisparameter is a second order tuning parameter, as theSISA has to be tuned first, allocating risk betweenavailability and integrity (more precisely, the lattermeaning integrity and continuity if the IPF is alsoconsidered further down the system line).

In the simulation result section, a dependency of theintegrity algorithms’ performance will also be givenon the SISA values to demonstrate this point.

INTEGRITY SIMULATIONS

To analyze the performance of the proposedintegrity algorithms, simulations have been carriedout.

The following assumptions have been made:

Assumption 1: Monitoring station network

Three different sets of monitoring station networkshave been used in the simulations. Set 1 containedthe DOC-4 Galileo network consisting of 21stations, set 2 contained the DOC-5 Galileonetwork, and set 3 contained a dense network of108 stations with equi-longitudinal spacing of 30°and equi-latitudinal spacing of 20°. The stations ofsets 1 and 2 (refer also to [1] and [2]) are presentedhereafter in table 2.

Lat Lon Code Set 1 Set 2-37.5 77.3 AMS x x39.9 32.8 ANK x x-46.0 166.45 AUC x x-6.4 106.8 CIB x x7.2 72.3 DIE x x

-27.1 -109.4 EAS x x64.58 -147.31 FAI x-52.0 -60.0 FAL x-0.5 -89.37 GAL x x

-25.8 27.7 HAR x x21.3 -157.8 KAU x x5.1 -52.4 KOU x x

56.0 92.48 KRA x x-46.33 37.51 MAR x x28.1 -15.3 MAS x-22.2 166.2 NOU x

-17.58 -149.6 PAP x x-31.8 115.89 PER x x64.1 -21.6 REY x x-33.1 -70.7 SAN x x48.0 -52.0 STP x x35.6 138.8 TOK x x-40.3 -9.9 TRI x x

-13.16 -176.5 WAL x x62.5 -114.5 YEL x xTable 2: Set 1 and 2 IMS network

Assumption 2: Satellite orbit and clock error

During the simulation, orbit and clock errors havebeen simulated using a Gaussian distributionassumption for each position coordinate and for theclock error. It has been assumed that the residualclock error is in the same order of magnitude thanthe orbital error components. Further, the standarddeviation for each error component has been set to3 m (one sigma). This assumption is not quitecorrect, as the along- or cross-track errors of thesatellite orbit are normally bigger in size than theradial error, but for the simulation purposes here itis sufficient.

Assumption 3: Residual pseudorange errors

The simulations that have been performed in theframe of this study, have been conducted as Monte-Carlo rather than end-to-end simulations. Therefore,no time correlations have been considered and notrue satellite constellation needed to beimplemented. Instead, the residual pseudorangeerrors have been computed by using the correctline-of-sight propagated errors together with addedreceiver local error components (e.g. residualtroposphere, residual ionosphere, receiver noise,etc). All these effects have been summed up intoone additional term that has been consideredindependent for each line-of-sight and which againhas been assumed of being Gaussian-distributedwith a certain standard deviation. The precise value(20 to 40 cm, one sigma) has been varied in thesimulations.

Assumption 4: Statistics of SISA/SISE

The step from SISE to SISA is important, as theirconnection affects the precise evaluation of theperformance results. It is assumed, that the SISA isdefined as an 99.9% (3.29 sigma) error bound of aGaussian distribution that covers the true line-of-sight error distribution. This distribution isimportant for computing the continuity ratio,because a continuity event is given by the fact that acertain non-alarm situation occurs in a first step,and then in a second step an alarm is raised by theSISE-check algorithm. For computation of theintegrity figure, this assumption is not of relevance,as the integrity algorithm check for HMI is clearlydefined in terms of true SISE and SISA, i.e. trueSISE > 1.62 x SISA, but otherwise independent ofthe actual error distribution.

SIMULATION RESULTS

As a first result, the dependency of the integrityalgorithm with respect to broadcast SISA values ispresented in fig. 4.

For this simulation the residual errors of the pre-processed measurements have been set to 0.4 m(one sigma), a conservativity factor of k = 1.5 andthe first-order surface algorithm were used.

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 2

Level of Bounding (TruSISE / SISA [100%])P(

"Int

egrit

y A

larm

")

SISA-Values: 1.0 1.0 1.0 1.0 1.0 1.0

SISA-Values: 2.0 2.0 2.0 2.0 2.0 2.0

SISA-Values: 4.0 4.0 4.0 4.0 4.0 4.0

SISA-Values: 4.0 3.5 3.0 2.5 2.0 1.5

Figure 4: Integrity algorithm alarm-curvedependency on broadcast SISA values

In the figure, the alarm curve of the integrityalgorithm is given. The x-axis shows the level ofbounding scaled to the broadcast SISA, i.e. trueSREW divided by broadcast SISA.

The curves show the experienced distributionfunctions of the integrity alarms, which can beconsidered of being equivalent to the SREWestimation curve. The numbers in the legend givethe used broadcast SISA values dependent on 3, 4,5, 6, 7, and 8 or more available measurements persatellite.

The first three curves show the alarm curve for afixed broadcast SISA of 1.0 m, 2.0 m and 4.0 m,respectively, while the last curve shows the alarmcurve for graduated SISA values, dependent on thenumber of measurements. It can be seen that theseparation between alarm and non-alarm cases ismuch easier, when high SISA values are to beverified. Furthermore, it is obvious, that thegraduated approach leads to a quite good (steep)alarm curve, which shows that the critical cases arethe cases of only few measurements for a givensatellite.

The conclusion here is, that such a kind ofgraduated broadcast SISA approach should be usedin a future GALILEO system to optimize overallperformance.

A summary of the final simulation results are givenin terms of probabilities for false-alarm and missed-

detection in table 4. For all simulations, the sameconservativity factor of 1.5 has been used.

The broadcast SISA has been chosen dependent onthe available number of observations according tothe following table 3:

# Obs 3 4 5 6 7 8+SISA [m] 4.0 3.5 3.0 2.5 2.0 1.5

Table 3: Used SISA dependent on number ofobservations available per satellite

Sig [m] IMS Network Integrity Alg. Pfa Pmd0.0 DOC-4 1st order 2.662059867e-006 0.000000000e+0000.2 DOC-4 1st order 6.182333919e-006 4.213520038e-0040.3 DOC-4 1st order 1.523169629e-005 2.899583198e-0030.4 DOC-4 1st order 4.521423823e-005 7.767235520e-0030.0 DOC-5 1st order 3.382028866e-006 0.000000000e+0000.2 DOC-5 1st order 8.377127150e-006 5.449037642e-0040.3 DOC-5 1st order 2.453456372e-005 3.554541631e-0030.4 DOC-5 1st order 8.182715415e-005 9.329724368e-0030.0 ideal 1st order 8.978357945e-006 0.000000000e+0000.2 ideal 1st order 1.143102221e-005 1.168224299e-0050.3 ideal 1st order 1.586064214e-005 2.957206567e-0040.4 ideal 1st order 2.473182895e-005 1.374486930e-0030.0 DOC-4 2nd order 2.474847821e-004 7.911392405e-0040.2 DOC-4 2nd order 3.872640375e-002 1.752888672e-0030.3 DOC-4 2nd order 6.324442199e-002 2.573111430e-0030.4 DOC-4 2nd order 9.439428119e-002 3.014158762e-0030.0 DOC-5 2nd order 4.762134882e-006 0.000000000e+0000.2 DOC-5 2nd order 4.186050620e-002 3.192121364e-0030.3 DOC-5 2nd order 7.409918733e-002 4.376271614e-0030.4 DOC-5 2nd order 1.121974495e-001 4.933128522e-0030.0 ideal 2nd order 8.603998453e-006 0.000000000e+0000.2 ideal 2nd order 1.867131989e-005 5.373831776e-0050.3 ideal 2nd order 4.651182206e-005 6.039364273e-0040.4 ideal 2nd order 1.342779852e-004 1.915151478e-003

Table 4: Simulation result performance figures

DOC Cases [%]0 0.001 0.002 0.003 0.194 9.945 45.806 31.097 11.358 1.639 0.00

10 0.00Table 5a: IMS network set 1 (DOC-4 set)

DOC statistics

DOC Cases [%]0 0.001 0.002 0.003 0.004 0.285 12.516 39.377 36.298 10.539 1.02

10 0.00Table 5b: IMS network set 2 (DOC-5 set)

DOC statistics

There are several important points to note intable 3. Potential conclusions drawn from thefigures presented in the table have to be analyzedvery carefully, because the presented cases can notbe compared directly.

• Even in case of no errors on the measurements,there is a limit with respect to achievableperformance. This limit is mainly due toresidual unmodelled curvature of the surfaceand the value of the conservativity factor k that

has been applied. From table 3 it can be seenthat in case of no measurement errors, it seemsthat a reduced IMS network is better than anideal network, but in this case the figures aredeceiving, as the missed detection probabilitiesare nearly all identical zero (except the case ofthe second order algorithm in the DOC-4scenario). This clearly shows, that there is moremargin with respect to the integrity (probabilityof missed-detection) risk in the cases ofincreased IMS network. This means, that theconservativity factor k could be tunedsomewhat in favor of the continuity risk,reducing the false-alarm probability.

• Even in the case that the integrity risk is notidentical 0, it seems that a reduced IMSnetwork is sometimes better than an increasednetwork (e.g. first-order estimation algorithmfor measurement errors of 0.2 m one sigma).Here in addition the dependency of the resultson the number of available measurements isimportant. Tables 5a and b show the typicalDOC-distribution that has been experienced inthe simulations (for IMS set 3 the DOC wasalways above 20). Via this venue the sensibilityof the check algorithm on the SISA value (forcertain numbers of measurements) can be seenclearly. In fact, in the DOC-5 IMS network, themean SISA is about 0.49 m lower than in theDOC-4 IMS network, which means anincreased availability. This has to beconsidered when comparing these results.

• The overall performance of the second-ordersurface estimation algorithm is generally worsethan the first-order algorithm, especially incases with high residual errors on the pre-processed measurements. The reason for this(somewhat unexpected behavior) is that thereare six degrees of freedom in case of thesecond-order surface in contrast to only threedegrees in the first-order case. Therefore, thesecond-order surface estimator is not so stablethan the first-order estimator.

SUMMARY AND CONCLUSIONS

Two ground-segment integrity algorithms have beenpresented in very detail. Simulations have beencarried out and performance results have been givenand discussed.

The following conclusions may be drawn from theobtained and discussed results:

• From IPF point of view, the broadcast SISAshould be graduated according to number ofavailable measurements to get optimal overallperformance. The figures presented in table 4

give an indication on the overall achievableperformance (on a per satellite basis) of theanalyzed algorithms.

• Residual measurement errors on pre-processedobservations, which mainly are due to residualtropospheric, ionospheric or multipath effects,are critical to the algorithm performance.

• Even in case of an (nearly) ideal IMS networkand no (!) measurement errors, there arealgorithmic limitations to the achievableperformance.

• A first-order surface estimation algorithm issuperior to a second-order surface estimationalgorithm due to the bigger number of degreesof freedom inherent in this solution, andtherefore due to its sensitivity to measurementerrors. Especially when high residual errors inpre-processed measurements must be expected,the performance of this algorithm is notsuitable to improve performance of the first-order surface estimation algorithm.

ACKNOWLEDGEMENTS

This study has been performed without any fundingof any company except the IfEN GmbH but withexperience coming from the EGNOS CS algorithmdevelopment. The paper does not represent anofficial position of IfEN GmbH but the personalopinion of the author. However, the author wouldlike to thank ESA for funding a further study relatedto this topic.

REFERENCES

[1] GNSS-2 Comparative System Study, Phase 2,Integrity Function Trade-offs, ESA Study, GNSS2-P2-SYS-202, TN 3.2.3, Is. 3.B, 30. Nov. 1999.

[2] GalileoSat Global Integrity Definition Document,Alcatel Space Industries, GALS-ASPI-TN-291, Is.1.B, 18. Dec. 2000.