HAL Id: hal-01709519
https://hal.archives-ouvertes.fr/hal-01709519
Submitted on 15 Feb 2018
HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entic research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.
L’archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diusion de documents
scientiques de niveau recherche, publiés ou non,
émanant des établissements d’enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.
GNSS Position Integrity in Urban Environments: A
Review of Literature
Ni Zhu, Juliette Marais, David Betaille, Marion Berbineau
To cite this version:
Ni Zhu, Juliette Marais, David Betaille, Marion Berbineau. GNSS Position Integrity in Urban Envi-
ronments: A Review of Literature. IEEE Transactions on Intelligent Transportation Systems, IEEE,
2018, 17p. �10.1109/TITS.2017.2766768�. �hal-01709519�
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS 1
GNSS Position Integrity in Urban Environments:
A Review of Literature
Ni Zhu, Juliette Marais, David B
´
etaille, Member, IEEE, Marion Berbineau, Member, IEEE
Abstract—Integrity is one of the criteria to evaluate GNSS
performance, which was firstly introduced in the aviation field.
It is a measure of trust which can be placed in the correctness
of the information supplied by the total system. In recent years,
many GNSS-based applications emerge in the urban environment
including liability critical ones, so the concept of integrity attracts
more and more attention from urban GNSS users. However,
the algorithms developed for the aerospace domain cannot be
introduced directly to the GNSS land applications. This is because
a high data redundancy exists in the aviation domain and the
hypothesis that only one failure occurs at a time is made, which
is not the case for the urban users. The main objective of
this paper is to provide an overview of the past and current
literature discussing the GNSS integrity for urban transport
applications so as to point out possible challenges faced by GNSS
receivers in such scenario. Key differences between integrity
monitoring scheme in aviation domain and urban transport
field are addressed. And this paper also points out several open
research issues in this field.
Index Terms—GNSS, Integrity, urban environment, protection
level (PL)
I. INTRODUCTION
T
HE GNSS integrity concept has been firstly developed
and formalized in the aviation field for Safety-of-Life
(SoL) applications [1]. It is defined as a measure of trust
which can be placed in the correctness of the information
supplied by the total system [2]. As one of the most essential
performance parameters, GNSS integrity has recently
attracted interest from other transportation fields especially
in the urban environment. This is because the GNSS-based
urban applications proved to be a huge and appealing market
which is currently in a constant growth [3].
For GNSS land applications such as the rail and the
vehicular domains, knowing the certainty of one’s localization
is of great importance. The framework of GNSS integrity
in urban environment is firstly introduced especially in the
vehicle domain, for instance, the famous Liability Critical
Applications, here the computed Position, Velocity and/or
Time (PVT) are used as the basis for legal decisions or
economic transactions [4] [5], such as Electronic Toll
Collection (ETC) and Pay as you Drive insurance. In
such kinds of scenario, large errors can lead to serious
consequences such as wrong legal decisions or wrong charge
N. Zhu and J. Marais are with the LEOST (Laboratory on Electronics,
Waves and Signal Processing for Transport) laboratory of the IFSTTAR (the
French Institute of Science and Technology for Transport, Development and
Network) (e-mail: ni.zhu@ifsttar.fr; juliette.marais@ifsttar.fr).
D. B
´
etaille and M. Berbineau are with the Components and SYStems
Department (COSYS) of the IFSTTAR (e-mail: david.betaille@ifsttar.fr; mar-
ion.berbineau@ifsttar.fr).
Fig. 1. An example of impact of positioning for Road User Charge [7]
computation as the example shown in Fig. 1. In addition, an
increasing number of Unmanned Aerial Vehicles (UAV) in
urban environment require also high integrity performances
[6] since multipath effects associate with their low-level
flights. Consequently, it is necessary and important to bound
the errors and to ensure that the probability of errors not
properly bounded is below a certain limit in order to reduce
the probability of the harmful effects and to guarantee the
correctness and fairness of the decision. These requirements
attach extreme importance to the concept of positioning
integrity in urban environment.
However, the urban environment presents great challenges
to common commercial GNSS receivers [8] [9]. This is
mainly because the GNSS positioning performance can be
severely degraded by the limited satellite visibility, multipath
effect, interference and other undesired impairments such as
foliage attenuation [10] [11] [12]. Much research has been
developed in terms of techniques to mitigate the effect of
multipath interference and Non-line-of-sight (NLOS) signals
at different levels, for example, the antenna design techniques
[13] [14], the receiver-based techniques [15], as well as the
post-receiver techniques [16], which help to improve accuracy
and reliability of the GNSS positioning in urban environment.
But these techniques are still an issue to be ceaselessly
developed especially for its compatibility and robustness to
different stringent environments.
Despite the existing difficulties, introducing the integrity
concept to urban GNSS receivers is more and more attractive
as a result of emerging GNSS-based applications in stringent
environments. But the integrity monitoring algorithms
developed in the aviation domain cannot be transported
directly into the urban vehicle applications. This is because,
on the one hand, the integrity monitoring algorithms developed
in the aviation context are established on the fact that a high
data redundancy exists, which is not the case in the urban
Published on line : 05/01/2018, http://ieeexplore.ieee.org/xpl/RecentIssue.jsp?punumber=6979 DOI : 10.1109/TITS.2017.2766768
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS 2
context. On the other hand, the single-fault assumption made
in the aerospace applications is not true for urban GNSS
receivers due to the potentially large and frequent errors
provoked by multipath interference and NLOS. [17]
This paper is organized as follows: Section II introduces
definitions and theoretical foundations about GNSS naviga-
tion performance criteria as well as some parameters of in-
tegrity. Section III presents the traditional integrity monitoring
approaches in the aviation context. Then the next section
analyzes the limitation of the classic integrity monitoring
approaches in the urban context by summarizing the complex-
ity of the GNSS signal reception in the urban environment.
Finally, section V gives a structured overview of the existing
integrity monitoring approaches for the urban GNSS receivers
and the last section draws the conclusion and proposes some
perspectives for the future work. The paper also has an
appendix section which presents GNSS positioning principles.
II. DEFINITIONS AND THEORETICAL FOUNDATIONS OF
GNSS INTEGRITY
A. GNSS Navigation Performance Criteria
Let us define here the concept of integrity in the context
of GNSS performance. Generally, when talking about the
performance of GNSS, we will necessarily mention the four
criteria: accuracy, integrity, continuity and availability which
are defined as follows:
Accuracy of an estimated or measured position and velocity
of a vehicle at a given time is the degree of conformance of
these position and velocity with the true ones of the vehicle
[18]. Accuracy is related to the statistical features of merit
of position or velocity error. So accuracy metrics are often
built from the statistical distribution of the errors. Thus, the
accuracy specifications are often given at a certain percentile
of the Cumulative Distribution Function (CDF) (e.g., 95
th
percentile). Generally, for ITS applications, as specified by
the European Committee for Standardization (CEN) and
European Committee for Electrotechnical Standardization
(CENELEC), accuracy is represented with a set of three
statistical value given by the 50
th
, 75
th
and 95
th
percentiles
of the CDF of the position error [19].
Integrity is conventionally defined as the measure of trust
that can be placed in the correctness of the information
supplied by a navigation system. This concept is originally
introduced in the aviation context in the last decades in order
to measure the influence of the navigation performance on
the safety. Since the concept of integrity was intended for
SoL applications, it also includes the ability of the system to
provide timely warnings to users when some system anomaly
results in unacceptable navigation accuracy [18] [20]. In
summary, it is an indicator of veracity and trustworthiness that
can be placed in the information supplied by the navigation
system.
Recently, integrity monitoring has been more and more
introduced into road transport especially for the liability
critical applications. Under this context, the definition of
integrity is re-adapted, for instance, by the SaPPART (Satellite
Positioning Performance Assessment for Road Transport)
project [7] as following:
Integrity is a general performance feature referring to the
trust a user can have in the delivered value of a given position
or velocity quantity (e.g., horizontal position). This feature
applies to 2 additional quantities associated to the value
delivered at each epoch of pseudo-range measurement: the
Protection Level (PL) and the associated Integrity Risk (IR).
The definitions of these parameters will be detailed
hereafter in the following section.
Continuity is the probability that the specified system
performance (accuracy and integrity) will be maintained
for the duration of a phase of operation, presuming that
the system was available at the beginning of that phase of
operation. Hence it expresses reliable operation (no failure)
of the system during the specific time interval given that the
system was operating at the start of the operation.
Under the context of mass-market applications, unlike
integrity, which is important for liability critical applications,
the concept of continuity is essential especially for the
Location-Based Service (LBS) [21]. These kinds of services
refer to the software applications for mobile devices that
require knowledge about where the mobile device is located.
For instance, based on the knowledge of users’ positions, LBS
can provide the nearest points of interest (bank, restaurant
etc.) For these applications, the continuity of the user positions
is more important than other criteria since ideally the service
should be available anywhere at anytime. Besides, continuity
is an important criteria for railway signaling and train control
in order to guarantee the safety of the operations [22] [23].
On the contrary, continuity is not a relevant feature for ITS
domain and is therefore replaced by another called timing
performance composed of time-stamp accuracy and output
latency, update rate, jitter and Time to First Fix (TTFF) [24].
Availability is officially defined by ICAO as the percentage
of time that the services of the system are usable by the
navigator, which is an indication of the ability of the system
to provide reliable information within the specified coverage
area. But for the road GNSS applications, this feature can
be defined in many different ways according to application
needs. For example, for certain applications, availability can
be the percentage of the measurement epochs where the
considered output is delivered with the required performance
or simply where the considered output is delivered by the
terminal, whatever its quality.
In fact, the criteria mentioned above come from the
Required Navigation Performance (RNP) concept. These
criteria are related to each other as shown in Fig.2. We
can see that accuracy is the base and the starting point of
the performance pyramid which is specified at a certain
Published on line : 05/01/2018, http://ieeexplore.ieee.org/xpl/RecentIssue.jsp?punumber=6979 DOI : 10.1109/TITS.2017.2766768
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS 3
Fig. 2. Navigation Performance Pyramid: Accuracy, Integrity, Continuity and
Availability
confidence level (e.g., %95). Then, there is a direct link
between the definition of integrity and accuracy because the
condition when a system should not be used for navigation
is a lack of confidence in accuracy. And the continuity is the
probability that accuracy and integrity will be maintained over
a certain period. So continuity builds upon both accuracy and
integrity. Finally, the definition of availability contains the
notion of reliable information. To be reliable, the information
must meet the accuracy, integrity and continuity specifications.
Thus, availability is based on the assumption of certain levels
of accuracy, integrity and continuity.
Besides these classic performance criteria from the
aeronautical RNP, in the context of urban GNSS applications,
other important performance features of GNSS can also
include: robustness to spoofing and jamming, indoor
penetration etc [25]. This article will only focus on the
integrity aspect, which will be detailed in the following text.
B. Basic Definitions of Integrity
Integrity is a measure of trust that can be placed in
the correctness of the information supplied by a navigation
system and it includes the ability of the system to provide
timely warnings to users when the system should not be
used for navigation [18] [20]. This definition can be clarified
thanks to four main parameters: Alert Limit (AL), Integrity
Risk, Time to Alert (TTA) and Protection Level (PL).
Alert Limit represents the largest position error allowable
for safe operation, more precisely:
• Horizontal Alert Limit (HAL) is the radius of a circle
in the horizontal plane (the local plane tangent to the
WGS-84 ellipsoid), with its center being at the true
position, which describes the region that is required
to contain the indicated horizontal position with the
required probability for a particular navigation mode.
• Vertical Alert Limit (VAL) is half the length of a segment
on the vertical axis (perpendicular to the horizontal plane
of WGS-84 ellipsoid), with its center being at the true
position, that describes the region that is required to
contain the indicated vertical position with the required
probability for a particular navigation mode.
In the urban context, generally we are only interested in
the horizontal dimension.
Time to Alert (TTA) is the maximum allowable elapsed
time from the onset of a positioning failure until the
equipment announces the alert. So with this parameter, the
integrity risk can be specified in a time interval.
Integrity Risk is the probability of providing a signal that
is out of tolerance without warning the user in a given period
of time [18]. It defines the maximum probability with which
a receiver is allowed to provide position failures not detected
by the integrity monitoring system [26].
Protection Level is a parameter of the integrity concept
which will be well highlighted in urban vehicular contexts. It
is formally defined as:
• The PL is a statistical error bound computed so as to
guarantee that the probability of the absolute position
error exceeding the said number is smaller than or equal
to the target integrity risk [18].
Similar to the definition of AL, PL is also typically
defined separately for the horizontal plane (Horizontal
Protection Level, HPL) and the vertical direction
(Vertical Protection Level, VPL). And here we only
focus on the horizontal dimension which is defined as:
• The HPL is the radius of a circle in the horizontal
plane (the local plane tangent to the WGS-84 ellipsoid),
with its center being at the true position, that describes
the region assured to contain the indicated horizontal
position. It is a horizontal region where the missed
detection and false alert requirements are met for the
chosen set of satellites when autonomous fault detection
is used [1].
Generally, the AL is specified by applications and the PL is
calculated by users. Since the position error is not observable,
the decision of alert is done by comparing the AL specified
and the PL calculated, more precisely:
• If PL > AL, the alert triggers;
• If PL < AL, the alert does not trigger.
C. Integrity Events
Integrity Failure is an integrity event that lasts for longer
than the TTA and with no alarm raised within the TTA.
Misleading Information (MI) is an integrity event
occurring when, being the system declared available, the
Published on line : 05/01/2018, http://ieeexplore.ieee.org/xpl/RecentIssue.jsp?punumber=6979 DOI : 10.1109/TITS.2017.2766768
IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS 4
Fig. 3. Illustration of relationship between integrity parameters and events:
PL, AL, PE and MI, HMI
position error exceeds the protection level but not the alert
limit.
Hazardously Misleading Information (HMI) is an
integrity event occurring when, being the system declared
available, the position error exceeds the alert limit. Typically,
in operating an aircraft, the risk for HMI due to navigation
system is budgeted at the level of 10
−7
to 10
−9
, which is
extremely tight in order to guarantee the safety of operations.
But the specification of HMI probability for urban applications
has not been set yet.
Fig. 3 gives us an clearer illustration of the relationship
between integrity parameters and each integrity event.
Besides, the Stanford diagram (or Stanford plot) is generally
used as a handy tool to explain and illustrate most of these
integrity events and their relations (as well as to assess
positioning systems performance), which is shown in Fig. 4.
But the disadvantage of this tool is that the true position error
should be known, which is difficult in practice.
III. CLASSIC INTEGRITY CONCEPTS IN THE AVIATION
DOMAIN
A. Traditional Approaches for Integrity Control
Since the early 90s, as the aviation domain depends more
and more on GNSS, the integrity concept was introduced as
a crucial measure of confidence of the information supplied
by the navigation system.
Generally, the GNSS integrity information can be obtained
from different ways. The most basic is the GNSS navigation
messages, which indicate the anomalies related to the system
and satellite operations such as satellite clock errors. But this
kind of integrity information cannot be used for the real-time
applications since the ground control segment can take a few
hours to identify and broadcast the satellite service failure
[28]. Thus, additional sources have to be used to deal with
Fig. 4. Stanford Diagram (or Stanford plot) [27]: a tool to illustrate the
relationship of all the integrity parameters. It also allow assessing the integrity
performance of a system. Different zones correspond to different operation
state, such as nominal operations, misleading operations, hazardous operations
and system unavailable.
the integrity control.
In the aviation field, the information of integrity is
provided by the three normalized augmentations known under
the terms ABAS (Airborne Based Augmentation System),
GBAS (Ground Based Augmentation System) and SBAS
(Satellite Based Augmentation System) [29]. Among the
three architectures, the GBAS and SBAS have to rely on
some external aiding devices, such as sensor stations.
GBAS relies on a network of ground station references.
It can provide estimates of common-mode errors and detect
GNSS faults and anomalies. And integrity information can
be obtained by comparing the true position of the ground
reference and the estimated position obtained from the GNSS.
This kind of augmentation system is mainly used at a local
level, typically in airports.
SBAS transmits differential corrections and integrity
messages for navigation satellites that are within sight of a
network of stations, typically deployed for an entire continent.
All the SBAS satellites signals covering a given zone are
monitored in order to update the error model at the raw range
measurement level [28] [29].
ABAS provides integrity monitoring for the position
solution using redundant information within the GNSS
constellation. ABAS is usually referred to as Receiver
Autonomous Integrity Monitoring (RAIM) when GNSS
information (range measurements) is exclusively used and
as Aircraft Autonomous Integrity Monitoring (AAIM) when
information from additional on-board sensors (e.g. barometric
altimeter, clock and Inertial Navigation System, INS) are also
used [29].
Receiver Autonomous Integrity Monitoring (RAIM) is a
Published on line : 05/01/2018, http://ieeexplore.ieee.org/xpl/RecentIssue.jsp?punumber=6979 DOI : 10.1109/TITS.2017.2766768
![Fig. 1. An example of impact of positioning for Road User Charge [7]](/figures/fig-1-an-example-of-impact-of-positioning-for-road-user-2kwjokiu.webp)
![Fig. 9. Effect of constructive and destructive multipath interference on the correlation function [73]](/figures/fig-9-effect-of-constructive-and-destructive-multipath-3ggf8vf5.webp)