RAIM Fault Detection and Exclusion with Spatial Correlation for Integrity Monitoring

Abstract

For safety-of-life applications used together with global navigation satellite systems, such as in civil aviation and autonomous driving, integrity is of paramount importance. Integrity monitoring protects the user safety based on two general approaches: mitigating large signal failures and bounding the residual errors. The fault detection and exclusion (FDE) of faulty satellites is part of the former approach. In the classical integrity monitoring algorithms in civil aviation, the use of test statistics based on least squares residuals relies on the assumption that the observations from different satellites are independent. When applied to urban environments with spatial correlation introduced by large multipath errors, a review of the FDE method is needed. With the optimal FDE method defined as the one with minimized integrity risk, we propose two optimization criteria for use in fault detection and fault exclusion. The optimal test statistics were obtained by analytical derivation for cases with and without correlations among different satellites. This method was theoretically compared with another commonly used test statistic using the minimum detectable bias, and it was numerically compared using the horizontal protection level under the scenario of advanced receiver autonomous integrity monitoring. The optimal test produces less conservative protection level results, and its advantage is especially obvious when the geometries are weak, or when the correlation coefficients among the satellites are high.

1. Introduction

Global navigation satellite systems (GNSSs) may contain various forms of signal failures (e.g., ionosphere anomalies, satellite clock and ephemeris failures, signal deformation, etc.). The integrity is a measure of the trust that can be placed in the correctness of the information supplied by a navigation system, including the ability of the system to provide timely warnings about when it should not be used. For safety-of-life applications, such as civil aviation [1] and intelligent transport systems (ITSs) [2,3], the integrity is of paramount importance. In civil aviation, different integrity monitoring systems are available for different flight phases, including receiver autonomous integrity monitoring (RAIM), space-based augmentation systems (SBASs), and ground-based augmentation systems (GBASs). The required integrity risk or probability of hazardously misleading information (PHMI) must not exceed 10⁻⁷/h for enroute users with RAIM and the SBAS, and it must not exceed 10⁻⁷/150 s for precision approach users with the SBAS and GBAS [1]. For ITSs, the safety integrity level four, with a tolerable hazard rate, must not exceed 10⁻⁹/h for railway navigation [4], and an integrity requirement of 10⁻⁸/h has been preliminary derived for autonomous vehicles [5].

The general purpose of integrity monitoring is to mitigate large faults and bound residual errors within a confidence level. For example, in RAIM, after fault detection and exclusion (FDE), the undetected position errors are bounded by the protection level (PL) within a required integrity risk [6]. If the PL exceeds an alert limit, the navigation service is considered unavailable. RAIM FDE is performed via a consistency check based on the redundancy in the measurements using least squares residuals [7]. In the GBAS and SBAS, although the integrity monitoring scheme becomes more complicated, a basic RAIM FDE function is still needed. For example, a consistency check based on least squares residuals is conducted on the satellite clock fault when computing the user differential range error in the SBAS [8], and this has been used as one of the options to accomplish the integrity monitoring function in ITSs [9].

Compared with the least squares estimator using the Gauss–Markov model in civil aviation, the main navigation solution in ITSs is mostly based on the Kalman filter using the first-order Gauss–Markov model [10]. The previous FDE method based on least squares residuals no longer performs as well as that based on the Kalman filter. For example, the slowly growing errors can be assimilated and may not be reflected in the innovations. Moreover, an undetected satellite fault of the previous epoch maintains its impact on the current epoch estimation. Therefore, a basic RAIM FDE function using least squares residuals is often implemented with the Kalman filter to exclude the faulty satellite from further processing [10,11].

In the classical integrity monitoring techniques in civil aviation, the observations from different satellites are assumed to be independent [1]. With the use of these techniques for ITSs, the multipath-introduced spatial correlations among different satellites become nonnegligible [12]. Although the FDE function under the scenario of integrity monitoring in civil aviation is mature, it may no longer be an optimal method for ITSs. Therefore, the optimality of the classical RAIM FDE method was reviewed and evaluated for cases both with and without correlation.

The optimal FDE method is defined as the one with a minimized PHMI, or equivalently, a less conservative PL. Recently, a new FDE estimator for minimizing the PL was proposed [13] in which the spatial correlation is not considered. In this paper, two new optimization criteria were designed from a deterministic perspective for either fault detection or fault exclusion. Based on the analytical derivations, explicit conclusions on formulating the test statistics were obtained for cases both with and without correlation.

The rest of this paper is organized as follows. First, the basic model is defined in the parity space using the least square estimator. Next, the optimal test statistics are derived based on the optimization criteria for both fault detection and fault exclusion. Then, the PL calculation is extended for the optimal method and illustrated with a numerical example. Finally, the main conclusions are drawn.

2. Basic Model

Without a loss of generality, a basic GNSS observation model can be assumed for either civil aviation or ITSs with different positioning modes:

$$y=\mathit{Ax}+𝜖$$

(1)

where $y\in R^{m\times 1}$ is the observation vector, which can be the undifferenced pseudorange observation for single-point positioning in ARAIM, the double-differenced carrier phase observation in real-time kinematic (RTK) positioning, or the undifferenced carrier phase observation for precise point positioning (PPP); $x\in R^{n\times 1}$ is the unknown state vector; m is the number of visible satellites; n is the number of unknown parameters; $A$ is the design matrix; $ϵ$ is the residual error, which is assumed to follow the Gaussian distribution with the zero mean and covariance matrix of the $Q_y$.

With dual-frequency and multi-constellation signals available in civil aviation, RAIM is evolving toward advanced RAIM (ARAIM) [6]. In both the RAIM and ARAIM algorithms, the off-diagonal elements in the $Q_y$ are assumed to be zeros without correlations among different satellites. To bind the standard deviation for each observation with each diagonal element, different errors are individually bounded according to the established error models (e.g., satellite clock and orbit errors, ionosphere errors for single-frequency users, troposphere errors, multipaths, and noise). The squared sum of the standard deviation for each error is used as the variance of each observation [6].

For urban environments, the off-diagonal elements in the $Q_y$ can be nonzero values with large multipath errors [12], which can be bounded using a machine learning method [14]. Further study is needed to bound both the off-diagonal and diagonal elements in $Q_y$, which is not within the scope of this paper. With the $Q_y$ assumed to be given, the following derivatives and conclusions are not affected by its specific values. To be applicable in both civil aviation and ITSs, two cases of the $Q_y$ are considered: (1) with correlation, and (2) without correlation.

The parity space is defined as an orthogonal space relative to the observation space. The purpose of using the parity space is to simplify the derivation process. A general parity matrix is defined as $P\in R^{m\times m}$, with two conditions satisfied: $PA=0$ and $e_i^{T}P\ne 0$, where $e_i\in R^{m\times 1}$ represents a unit vector with zeros in all positions except for the i_th position, which has a value of one, indicating the location of a single-satellite fault. The general parity vector $p=Py$ is used to define a scalar $p_i$:

$$\begin{array}{c}{p}_i=e_i^{T}p=e_i^{T}Py=P_{i}y\end{array}$$

(2)

The general form of a test statistic under the faulty hypothesis ($H_i$) with standard normal distribution is defined as:

$$\begin{array}{c}t{s}_i=\frac{p_i}{\sqrt{P_i{Q}_y{P}_i^T}}\end{array}$$

(3)

There are multiple choices of $P$ that satisfy the two conditions, and an optimal parity matrix is derived as follows to achieve an optimal FDE performance.

3. Optimal Fault Detection and Exclusion

Considering the case of horizontal positioning, the integrity risk ($P_{HMI,Hi}$) is defined under the faulty hypothesis ($H_i$) for which the i^th satellite is faulty:

$$\begin{array}{c}{P}_{HMI,Hi}=P\left\{\left({\tilde{x}}_H>HP{L}_i\right)\cap \left(\left|t{s}_i\right|<T_i\right)|H_i \right\}{P}_{H_i}\end{array}$$

(4)

where ${\tilde{x}}_H$ is the horizontal positioning error; $HP{L}_i$ is the horizontal protection level (HPL); $T_i$ is the test threshold, which, with the test statistics ($t{s}_i$) of a standard normal distribution, can be determined by a given probability of false alarm (PFA) under the fault-free hypothesis; $P_{H_i}$ is the prior probability of hypothesis $H_i$, and the sum of the prior probabilities of the fault-free and all faulty hypotheses is 1; ${\tilde{x}}_H$ is independent of the $t{s}_i$, with a least squares estimator using either residual-based test statistics or statistics based on solution separation. The two types of test statistics are equivalent [7]. The method based on residual-based test statistics is used as the example in this paper. Because ${\tilde{x}}_H$ and $t{s}_i$ are independent, $P\left\{\left({\tilde{x}}_H>HP{L}_i\right)\right\}$ and $P\{(t{s}_i<T_i)|H_i\}$ are two independent probabilities. Therefore, the integrity risk is expressed as a multiplication of three separate probabilities: $P\left\{\left({\tilde{x}}_H>HP{L}_i\right)\right|H_i\left\}P\right\{(t{s}_i<T_i)\left|H_i\right\}{P}_{H_i}$. With $P_{H_i}$ given beforehand, if $P\{(t{s}_i<T_i)|H_i\}$ is minimized separately, then the totally integrity risk can be reduced. Therefore, an optimal FDE test is one with minimized risk of $P\{(t{s}_i<T_i)|H_i\}$, which is related to the probability of missed detection (PMD).

In the current test procedures, if the maximum test statistic exceeds a predefined threshold, then the corresponding satellite is regarded as faulty. Therefore, optimizing the fault detection performance is equivalent to maximizing the sensitivity of the test statistics with regard to the faults and minimizing the sensitivity of the test statistics to other errors. In this way, a small enough fault can trigger an alarm, and the effects of unavoidable random errors can be suppressed to minimize the PMD. If the fault exclusion performance is also optimized by maximizing the fault from satellite i in the $t{s}_i$, the continuity risk can benefit from it [15]. Therefore, two criteria are defined to optimize the fault detection and fault exclusion from a deterministic perspective: (a) the maximization of the expectation of the $t{s}_i$ under hypothesis $H_i$ in the presence of other random errors among the multiple choices of $P$; (b) the maximum expectation of all the test statistics needs to be $t{s}_i$ under hypothesis $H_i$. The criteria (a and b) are further expressed by Equations (5) and (6), respectively:

$$\begin{array}{c}max\left\{E\left(\left|t{s}_i\right||H_i\right)\right\} \mathrm{among} P \end{array}$$

(5)

$$\begin{array}{c}\mathit{max}\left\{E\left(\left|t{s}_j\right||H_i\right)\right\}=E\left(\left|t{s}_i\right||H_i\right) j=1\dots m.\end{array}$$

(6)

3.1. Optimal Fault Detection

To obtain an optimal parity matrix under criterion a, the following proof is provided. Assuming the standard parity matrix ($P_s$) is the orthonormal basis of the left null space of $A$ (i.e., $P_s{P}_s^T=I_{m-n}$ and $P_{s}A=0$), $P_i$ is expressed as a linear combination of the $P_s$ with $c_i\in R^{1\times \left(m-n\right)}$ as a coefficient vector:

$$\begin{array}{c}{P}_i=c_i{P}_s\end{array}$$

(7)

An optimal $c_i$ can be obtained by using the square of criterion a, which can be expressed as:

$$\begin{array}{c}\underset{c_i}{\max }\left\{E^2\left(t{s}_i|H_i\right)\right\}=\underset{c_i}{\max }\left\{E\left(\frac{f_i^2{\left(c_i{P}_s{e}_i\right)}^2}{c_i{Q}_{p_s}{c}_i^T}|H_i\right)\right\}\end{array}$$

(8)

where $Q_{p_s}=P_s{Q}_y{P}_s^T$, and $f_i$ is the magnitude of a fault on satellite (i). With $Q_{p_s}$ as a symmetric positive definite, the maximum value is obtained with the following condition based on the Cauchy–Schwarz inequality [16]:

$$\begin{array}{c}{c}_i=k{e}_i^T{P}_s^T{Q}_{p_s}^{-1}\end{array}$$

(9)

where $k$ is an arbitrary nonzero real number. Therefore, for a given size of a single fault, $E\left(\left|t{s}_i\right||H_i\right)$ is maximum when the optimal parity vector ($p_{i,o}$) is used at $k=1$:

$$\begin{array}{c}{p}_{i,o}=P_{i}y=c_i{P}_{s}y=e_i^T{P}_s^T{Q}_{p_s}^{-1}{P}_{s}y\end{array}$$

(10)

The corresponding optimal test statistic for fault detection is given by:

$$\begin{array}{c}t{p}_i=\frac{p_{i,o}}{\sqrt{Q_{p_{i,o}}}}=\frac{e_i^T{P}_s^T{Q}_{p_s}^{-1}{P}_{s}y}{\sqrt{e_i^T{P}_s^T{Q}_{p_s}^{-1}{P}_s{e}_i}}\end{array}$$

(11)

Another test statistic based on least square residuals is denoted as the v-test [11,17]:

$$\begin{array}{c}t{v}_i=\frac{e_i^{T}v}{\sqrt{e_i^T{Q}_v{e}_i}}\end{array}$$

(12)

where $v$ is the least square residual, and $Q_v=Q_y-A{\left(A^T{Q}_y^{-1}A\right)}^{-1}{A}^T$ is the covariance matrix of the $v$. The $t{p}_i$ is equivalent to the $t{v}_i$ only when there is no correlation in the $Q_y$. Therefore, the $t{p}_i$ is an optimal choice for fault detection both with and without correlation, while the $t{v}_i$ can be used only for independent observations to maintain the optimal fault detection performance.

3.2. Optimal Fault Exclusion

For the FDE, the necessity to include fault exclusion was examined, and it was concluded that airborne exclusion is required to meet the enroute continuity risk of the H-ARAIM [15]. Similarly, fault exclusion is needed to improve the service continuity in ITSs. The optimal test statistics for fault exclusion under criterion b are derived from the following:

Criterion b can be met if the $P$ in (2) is a symmetric semipositive definite:

$$\begin{array}{c}P=P^T and P=P{Q}_y{P}^T\end{array}$$

(13)

For a symmetric semipositive definite ($P$), the diagonal entries ($P_{ii}$) are real and nonnegative. Assuming the deterministic fault is $e_{i}f$, where $f$ is the magnitude of the fault size on satellite i, then:

$$\begin{array}{c}E\left(\left|t{s}_i\right||H_i\right)=E\left(\frac{\left|e_i^{T}P{e}_{i}f\right|}{\sqrt{e_i^{T}P{Q}_{y}P{e}_i}}|H_i\right)=E\left(\frac{\left|P_{ii}f\right|}{\sqrt{P_{ii}}}|H_i\right)=\sqrt{P_{ii}}f\end{array}$$

(14)

$$\begin{array}{c}E\left(\left|t{s}_j\right||H_i\right)=E\left(\frac{\left|e_j^{T}P{e}_{i}f\right|}{\sqrt{e_j^{T}P{Q}_{y}P{e}_j}}|H_i\right)=E\left(\frac{\left|P_{ji}f\right|}{\sqrt{P_{jj}}}|H_i\right)=\frac{\left|P_{ji}f\right|}{\sqrt{P_{jj}}}\end{array}$$

(15)

Because $P$ is symmetric semipositive, the following inequality can be obtained:

$$\begin{array}{c}\sqrt{P_{ii}}\sqrt{P_{jj}}>\left|P_{ji}\right|, j=1\dots m, j\ne i\end{array}$$

(16)

In other words, for any $j\ne i$, it holds that:

$$\begin{array}{c}E\left(\left|t{s}_i\right||H_i\right)>E\left(\left|t{s}_j\right||H_i\right)\end{array}$$

(17)

Therefore, $t{p}_i$ can also satisfy criterion b, which is an optimal choice for fault exclusion with or without correlation. $t{v}_i$ is only an optimal choice for fault exclusion if there is no correlation between the observations.

4. Protection Level

Instead of calculating the integrity risk, the HPL is computed as the position error bound within a required integrity risk. Generally, there are two types of RAIM methods: the classical method and multiple-hypothesis solution separation method [18]. With the classical method, the random positioning error is bound by the HPL under the fault-free hypothesis ($H_0$) within an allocated integrity risk:

$$\begin{array}{c}HP{L}_0=K\left(1-\frac{I{R}_0}{2P_0}\right){\sigma }_h\end{array}$$

(18)

where $I{R}_0$ is the allocated integrity risk under $H_0$, $P_0$ is the prior probability of hypothesis $H_0$, and ${\sigma }_h$ is the standard deviation of the horizontal position error. The HPL under the faulty hypothesis is designed to bind the positioning error by two terms separately: the bias and random error. The bias term is used to bind the undetected error from the statistical test. For a given standard deviation of test statistics, a non-centrality parameter of the test statistics (${\delta }_i$) can be bound by the PFA allocated from the continuity risk and the PMD allocated from the integrity risk. The MDB is then defined by transferring the ${\delta }_i$ from the test statistic domain to the range domain. Therefore, the MDB represents the magnitude of a fault in an observation, which can be detected under given PFAs and PMDs. The MDBs of the optimal test and v-test can be expressed by both the parity space and least squares residuals, respectively, using $Q_y^{-1}{Q}_v{Q}_y^{-1}=P_s^T{Q}_{ps}^{-1}{P}_s$ [17]:

$$\begin{array}{c}MD{B}_{i,p}=\frac{{\delta }_i}{\sqrt{e_i^T{P}_s^T{Q}_{ps}^{-1}{P}_s{e}_i}}=\frac{{\delta }_i}{\sqrt{e_i^T{Q}_y^{-1}{Q}_v{Q}_y^{-1}{e}_i}}\end{array}$$

(19)

$$\begin{array}{c}MD{B}_{i,v}=\frac{{\delta }_i\sqrt{e_i^T{Q}_y{P}_s^T{Q}_{p_s}^{-1}{P}_s{Q}_y{e}_i}}{\left|e_i^T{Q}_y{P}_s^T{Q}_{p_s}^{-1}{P}_s{e}_i\right|}=\frac{{\delta }_i\sqrt{e_i^T{Q}_v{e}_i}}{\left|e_i^T{Q}_v{Q}_y^{-1}{e}_i\right|}\end{array}$$

(20)

With the bias term bounded, the remaining random errors need to satisfy the allocated integrity risk. The classical HPL under hypothesis $H_i$ can be defined by:

$$\begin{array}{c}HP{L}_i=S_{Hi}MD{B}_i+K\left(1-\frac{I{R}_i}{2P_i}\right){\sigma }_h\end{array}$$

(21)

where $i=1\dots m$, with $m$ is the number of visible satellites; $S_{Hi}$ is the horizontal projection matrix from the range domain to the position domain for satellite i; $K$ is the inverse of the cumulative distribution function with standard normal distribution; $I{R}_i$ is the allocated integrity risk for hypothesis $H_i$; $P_i$ is the prior probability of hypothesis $H_i$. The final HPL is the maximum one among all the hypotheses.

Therefore, if different FDE test statistics are selected, then their differences in the HPL formula relate only to the MDB parameter. As proven in Appendix A, the MDB of the optimal test is always equal to or smaller than that of the v-test. It should be noted that the equality holds if and only if there is no correlation among observations. Therefore, the optimal test has a better FDE performance and produces less conservative HPL results than the v-test.

5. Numerical Results

To further demonstrate the performances of the classical HPL with different FDE methods, 24 h data were used to obtain the numerical results. The user’s static position was set as 22.3042°N and 114.1798°E at Hong Kong Polytechnic University. The GPS almanac data on 27 November 2022 with 32 satellites was used to calculate the satellite position under a one-minute sampling interval. Given the user and satellite positions, the elevation angle was then computed, which was used to formulate the matrices of $A$, $P_s$, $Q_v$, and $S_{vi}$. The mask angle was set to 5°. The total required integrity risk was 10⁻⁷, which was evenly distributed among the fault-free and faulty hypotheses. The prior probability of each faulty hypothesis ($P_i$) was 1 × 10⁻⁴. The PFA and PMD of each hypothesis were 3.33 × 10⁻⁷ and 10⁻³, respectively [18]. The observation errors from each satellite were assumed to follow a standard normal distribution with a correlation existing between two satellites. Two examples with correlation coefficients of 0.2 and 0.9 are illustrated in Figure 1 and Figure 2, respectively, with the classical HPL method based on the optimal test and v-test.

Comparing Figure 1 and Figure 2, the optimal test maintains low HPL values in both the low- and high-correlation cases, while the v-test generates high HPL values in the high-correlation cases with reduced service availability. The high peaks in both Figure 1 and Figure 2 occur simultaneously, which indicates that the v-test amplifies the weak geometry under the spatial correlation in the HPL. Therefore, the optimal test is feasible for scenarios both with and without spatial correlation among the observations, while the v-test can only be used for cases in which there is little correlation.

6. Conclusions

The conventional RAIM FDE method was developed based on the assumption that the observations from different satellites are independent. To apply this method to other safety-of-life applications (e.g., ITSs) with spatial correlation among the observations, the design of the test statistics was reviewed. The optimal test statistics are defined as those that minimize the integrity risk, and the optimal solution is derived from a deterministic perspective. It was valid for cases both with and without correlation without a loss of generality. To further validate this conclusion, the MDBs of the optimal test statistics and those of another commonly used statistic were compared. It was theoretically demonstrated that the optimal test always generates smaller MDBs than the alternative method with correlation. Smaller MDBs indicate an enhanced FDE performance and less conservative HPL results, which is equivalent to a minimized integrity risk. This conclusion was also demonstrated with numerical results with 24 h GPS data. The HPL results with the optimal test were lower than those with the alternative test, which was especially obvious with high correlation coefficients and weak geometries. With its proven optimality, the FDE method can be used in integrity monitoring for both civil aviation and ITSs with improved service availability. Further research is planned for binding the observation error with spatial correlation for urban environments.