ION GNSS+ 2021

SBG-Systems

High Integrity Multi-Sensor Navigation System
For Safety Critical Applications
M. Saidani, D. Gallego Maya, A. Guinamard
SBG-Systems SAS - 1 avenue Eiffel - 78420 - Carrières-sur-Seine - France
KEY WORDS
Integrity Monitoring, GNSS, INS, Odometer, Tightly Coupled Data Fusion, RTK, ARAIM, FDE, PL.
ABSTRACTThe high increase of safety critical applications such as autonomous driving, Advanced Driver Assistance System (ADAS),Intelligent Transportation System (ITS) and many applications that can cause human or economic losses pose a significant
challenge of navigation integrity. Although the integrity concept is not new, a major challenge in these applications is toensure both high accuracy and high integrity in very challenging environments. In response to the high requirements ofthese applications, this paper will present a high integrity multi-sensor navigation system specially designed for safety criticalapplications. The system is composed of a MEMS Inertial Measurement Unit (IMU), a multi-constellation multi-frequency
GNSS receiver and an odometer communicating via a CAN bus. A tightly coupled solution [1] based on an Extended Kalman
Filter (EKF) has been developed by SBG-Systems to fuse all these sensors to deliver a high accuracy and availability especiallyin complex environments where satellites signals are prone to attenuation or even unavailability. In addition, advanced vehicle
modeling and constraints [2] have been added with respect to the motion profile to provide a navigation solution for the targeted
applications. The integrity management starts with the correction service such as the State Space Representation Corrections(SSR) [3]; many services now provide SSR corrections over the world with integrity messages. Another challenging aspect ofrobust navigation is the integration of an Advanced Receiver Autonomous Integrity Monitoring (ARAIM) [4], which can be
defined as a two steps process. First, a Fault Detection and Exclusion (FDE) is performed, then if a consistent solution is foundthe Protection Levels (PL) are calculated [5]. The system will assure a continuous monitoring of multiple integrity indicator,
the PL will be computed and compared to an Alert Limit (AL) threshold to notify the user about system availability. During
the GNSS outages, the INS and the odometer not only keep the precision of the position solution, but also scale and propagate
the PL using the inertial models [6]. This paper also focuses on the integrity assessment of the developed system. Indeed, an
extensive test campaign has been conducted to evaluate the maturity of the technology and its compliance with autonomousvehicles requirements. Several ranges of products and configurations are tested to measure the performance driving factors andevaluate the typical use case.
I.

INTRODUCTION

The integrity monitoring and availability of a navigation system has been for the last decade one of the main subjects in the
research community. Initiated with Safety of Life aviation applications, the GNSS integrity was designed using a combinationof two major components. A ground or satellite based augmentation systems (SBAS or GBAS) are used to track satellites orconstellations issues, and a receiver side integrity monitoring used to track the receiver specific errors like interference issues.
Traditionally, the RAIM algorithm is used for that purpose, with the ability of detecting a single satellite fault. New land based
applications face a major challenge with a lot of multi-path errors affecting the system performance while requiring a muchhigher precision than in the aviation field (typically targeting a lane level accuracy). It’s then necessary to consider solutions
that integrate more sensors to overcome these challenges: A high accuracy augmentation systems like SSR or RTK, a robust
multi-fault ARAIM system, and the aid of external sensors like odometer, IMU and possibly perception sensors.
This paper will present a high integrity multi-sensor navigation system for safety critical applications, it will be structured asfollows: the first section defines the principles of INS, GNSS and odometer data fusion. The second section introduces thenotion of integrity applied to the multi-sensor navigation system, where the concept of detection and exclusion and protectionlevel are detailed. Finally, the last section will illustrate the performance of the developed system for an automotive motion
profile under three different scenarios: open sky, light urban and harsh urban.

ION GNSS+ 2021

II.

SBG-Systems

MULTI-SENSOR NAVIGATION SYSTEMThe INS, GNSS and odometer data are commonly fused through the Kalman filter. The fusion of multiple sensors provides
high precision of position, velocity, and attitude. The advantage of the multiple sensor fusion is that each sensor overcomes
the drawbacks of the others. In fact, the GNSS provides measurements with a long-term absolute accuracy, typically witha low rate under 10 Hz, but the signals can be blocked or have a poor quality especially in harsh environments. An Inertial
Navigation System (INS), including gyroscopes, accelerometers, and odometers in contrary has good short-term accuracy, but
an overtime growing error due to integration of drift and noise. The INS has a high update rate, usually more than 100 Hz anda high availability. A combination of these systems has the possibility of providing a high bandwidth with both short and longterm accuracy. In addition to the data fusion, an advanced dynamic modeling specific to the tracked vehicle is applied, which
improves significantly the performances.
There exists a different method for fusing GNSS, INS and odometer data with each having its owns pros and cons. In this paper,
we will be interested in a tightly coupled architecture, which proved its superiority over the loosely coupled solution, especiallyin the context of robust navigation. Using this architecture, the measurements from the GNSS receiver, IMU and odometerdata are integrated at a deeper level in a single filter which overcomes the problems that could arise with colored noises. The
pseudorange and the carrier phase measurements from the GNSS receiver are integrated with the IMU and odometer in thesame filter as depicted in Figure 1

Figure 1: Tightly Coupled Architecture.

III.

INTEGRITY

Integrity is defined as the measure of the trust that can be placed in the correctness of the information supplied by a navigation
system. The aim of integrity monitoring is to provide timely warnings to users when the system results are abnormal or
unavailable for navigation. This integrity can be achieved by using several complementary methods. For instance, using
corrections services that include integrity monitoring such as SSR serve as a pre-validation step for GNSS signals, but suchcorrections don’t overcome the receiver related errors such as multipath. To overcome the receiver errors, an ARAIM algorithm
is developed in this paper. An ARAIM algorithm detects and removes the faulty observations, thanks to the Fault Detection
and Exclusion (FDE) part. Once a consistent subset of observations is found, the protection levels are calculated to assess thequality of the calculated solution.
To evaluate the developed integrity algorithm, we will use the Stanford diagram (Figure 2) which is considered as the reference
tool to evaluate such types of algorithms.

ION GNSS+ 2021

SBG-Systems

Figure 2: Stanford Diagram.

1.

Navigation Engine

Figure 3 shows an overview of the navigation and integrity system. It is clear that the integrity plays a major role in each step of
the process. In the first place, all the inputs are validated before entering the system. Then, the data from all the sensors is fusedusing an Extended Kalman Filter in an RTK tightly coupled architecture with INS data. At this stage we enter the RAIM/FDE
block that oversees multiple complex tasks. During this phase the GNSS observations are validated using a statistic test, wheremultiple satellites can be rejected if needed. Following this validation, an integer ambiguity resolution method is applied to fix
the carrier phase ambiguities following a confirmation step of the fixed values. At this point a second detection and exclusion
strategy is used to keep only the ambiguities that were properly fixed. Once an optimal solution is obtained, the protection levels
are computed, and the outputs are generated.

Figure 3: Integrity Overview.

2.

Fault Detection and Exclusion

The FDE is generally based on the calculation of the residuals between the measurements and the Kalman prediction, as seenin Equation1.

ION GNSS+ 2021

SBG-Systemsr̂ = z − H x̂(1)

The FDE can be described as an iterative function that consists of two separate steps:a)Global Test

The objective of this test is to check the consistency of the solution according to a predefined integrity risk and a statistical test
that follows a Chi-squared distribution. The statistic test t in Equation 2 used is also knows as Normalized Sum of Squared
Error (NSSE) [7], which can be expressed as:
t = r̂T W −1 r̂

(2)

W = Hk Pk− HkT + Rk

(3)

With:

Under fault-free conditions, the statistic test t follows a central χ2 distribution. With a predefined probability of false alarm Pf a
and a calculated redundancy, a threshold (T h) can be deduced, and the statistical hypothesis test can be conducted as follows:
H0 : fault free conditions t ≤ T h
Ha : faulty conditions t > T h(4)

In case the null hypothesis H0 is rejected, and the alternative hypothesis Ha is accepted, then the fault identification procedureis needed to isolate and exclude the faulty measurement. The local test is the used method to release the fault identification.
b)

Local Test

The rejection of the null hypothesis in the GT means that one or several measurements are faulty. The essence of fault exclusion
is to survey for anomalies in all observations, and if a fault is detected, the corresponding measurement should be excluded.
The residual ( r̂) cannot be normalized simply by dividing the corresponding diagonal term of its covariance matrix S, due tothe matrix S involves the cross correlations of the state components.The Cholesky decomposition is used to remove correlations[8], as shown in Equations 5 and 6:
S −1 = M T M(5)r̃ = M r̂

(6)

An iterative process has been developed to identify and exclude faulty measurements. The valid measurement subset is thentested according to H0 test to be validated, which ends with a valid navigation solution. In the case the number of measurements
becomes too small, the solution is then declared as invalid.
3.

EKF-Based Protection Level

The Protection Level (PL) is a statistical error bound (Figure 4), which characterizes the maximum allowed positioning error
with probability derived from the integrity risk. It can be divided into horizontal (HPL) and vertical (VPL) components. In
safety critical applications, it is necessary and even mandatory to meet the requirement P L > P E (Position Error when the
ground truth is known) and to ensure that PE is below a certain Alert Limit (AL). The AL is defined by a user according to its
application requirements. Different algorithms for the PL computation can be found in the literature ([9], [10], [7]); A big focus
on this paper was to select the algorithm that bounds the best the PE.

ION GNSS+ 2021

SBG-Systems

Figure 4: Protection Levels.

Several PL algorithms were tested, and the best performances were obtained using a combination of noise and bias PL as definedby [8]:P L = P Ln + P Lb

(7)

For automotive application, we focus on the horizontal dimension only. In the following section, the formulas are expressed inrelation to HPL, this is just a simplification as they are also valid for VPL.
a)

Horizontal Protection Level Noise

Caused by the noise measurement, it is defined as:
HP Ln = K × dmajor(8)

Where:• K : inflation factor applied to meet the specified integrity risk.
√• dmajor : position uncertainty calculated as dmajor = Pee + Pnn• P ee, P nn are the variance of the horizontal position from the covariance matrix P in NED.
b)

Horizontal Protection Level Bias

Caused by the biased measurements, it is defined as:
HP Lb = max(Hslope ) × pbias(9)

ION GNSS+ 2021

SBG-Systemss
Hslope =Where :
• pbias =√N SSE =√

(A21i + A22i ) ∗ redundancy
1 − Bii(10)

A = (H t W H)−1 H T W(11)

B = HA

(12)

t

IV.

EXPERIMENTAL RESULTS AND ANALYSIS

1.

Open Sky Scenario

The first scenario consists of an automotive test in an open sky environment. The trajectory followed during this test can beseen in Figure 5, it is clear that this rural area presents optimal conditions for the navigation system. The base station SBGS
located at approximately 1 km was used for the RTK, in addition to an odometer and the corresponding automotive constraints
for the application.
Two different configurations were under test. First, a GNSS only mode using an automotive grade multi-band receiver(Ublox ZED-F9P) in a RTK processing. Secondly, an industrial grade MEMS IMU (Ellipse-D) in an RTK tightly coupled
IMU/GNSS/Odometer configuration. In order to generate a high precision reference for this specific test, a FOG based INS(Navsight Horizon) with odometer also in tightly coupled integration was used to compute a trajectory in a post processing
algorithm in a FW/BW/Merge mode. The reference benefits from a 100 % fix rate.

Figure 5: Open Sky Scenario: Trajectory.

ION GNSS+ 2021

a)

SBG-Systems

GNSS Results

As expected, the results under these ideal conditions are excellent, even in a GNSS only mode. Figure 6 shows the horizontal
error of the position solution as well as the horizontal protection level. We can see that we obtain a centimeter precision andthat the protection levels are consistent. The Stanford diagram for this test is presented in Figure 7, the solution is available andinteger 100 % of the time, even as the alert limit chosen for this configuration was of only 1 m. Table 1 contains the horizontal
errors and the protection levels for three different percentiles, in the most strict case the error is about 0.029 m with an HPL of
0.711 m.

Figure 6: Open Sky Scenario: GNSS Horizontal Error.

Figure 7: Open Sky Scenario: GNSS Stanford Diagram.

Percentile
Horizontal error (m)HPL (m)

68
0.009
0.446

95
0.017
0.543

99.7
0.029
0.711

Table 1: Open Sky Scenario: GNSS Results

ION GNSS+ 2021b)

SBG-Systems

Tightly coupled INS/GNSS results

The conditions of this test are so optimal that the results of the GNSS only configuration can hardly be improved. In Figure 8
we can see the centimeter level precision of the tightly coupled solution, while the Stanford diagram shown in 9 emulates theprevious results with an integer an available solution during the whole test. The overall results compiled in Table 2 estimate thatthe tightly coupled integration improves the GNSS solution, but by only a slight margin, which was expected.

Figure 8: Open Sky Scenario: TC INS/GNSS Horizontal Error.

Figure 9: Open Sky Scenario: TC INS/GNSS Stanford Diagram.

Percentile
Horizontal error (m)HPL (m)

68
0.007
0.444

95
0.015
0.536

99.7
0.023
0.645

Table 2: Open Sky Scenario: TC Results

ION GNSS+ 2021

2.

SBG-Systems

Light Urban Scenario

The second scenario is more challenging from an integrity point of view. This automotive acquisition was made in a lighturban area where the vehicle passed under a couple of bridges and the multi-path effects created by nearby buildings were morepresent. Regarding the RTK setup, there was a baseline of approximately 1 km between the rover and the base station and theconstraints of an automotive motion profile were used. The same two devices are under test, on the one hand an automotive
grade multi-band GNSS receiver for the GNSS only mode, and on the other hand an industrial grade MEMS INS fused with an
RTK GNSS + odometer in a tightly coupled architecture. This case a Navsight Apogee, which is a survey grade INS, was used
to compute the reference in a FW/BW/Merge post-processed algorithm.

Figure 10: Light Urban Scenario: Trajectory.

a)

GNSS Results

For the GNSS only configuration the difficulties of the scenario are obvious. In Figure 11 we can see the horizontal error and the
HPL, while Table 3 summarizes the performance of the system. Using the diagram in 12 we can clearly see that the quality ofthe solution is not perfect. In this case almost 10 % of the estimated solution is considered as unavailable, but the most important
fact is that the solution never reaches the lower part of the diagonal of the diagram, where the systems become misleading andeven dangerous. This kind of results are not enough for some safety of life applications such as the autonomous vehicle, underthese light urban environments a solution that is available most of the time is needed.

ION GNSS+ 2021

SBG-Systems

Figure 11: Light Urban Scenario: GNSS Horizontal Error.

Figure 12: Light Urban Scenario: GNSS Stanford Diagram.

Percentile
Horizontal error (m)HPL (m)

68
0.036
0.939

95
1.003
7.173

99.7
107.54119.80

Table 3: Light Urban Scenario: GNSS Resultsb)Tightly coupled INS/GNSS results

The tightly coupled implementation provides an important boost in the availability of the system. This time, Figures 13 and14 show how the solution is available more than 96 % of the time. The rest of the epochs the system falls in the zone of notavailable, but it keeps the integrity for the totality of the test. Comparing Tables 3 and 4 we can clearly see the impact of thecoupled architecture; the 99.7 percentile goes from 107.54 m in the GNSS only mode to 0.713 m in the tight implementation.

ION GNSS+ 2021

SBG-Systems

Another important note for this test is that the HPL for the 99.7 percentile are significantly high compared to the obtained
horizontal error, some optimizations of the protection levels could be made in order to improve the availability.

Figure 13: Light Urban Scenario: TC INS/GNSS Horizontal Error.

Figure 14: Light Urban Scenario: TC INS/GNSS Stanford Diagram.

Percentile
Horizontal error (m)HPL (m)

68
0.025
0.863

95
0.073
2.345

99.7
0.713
11.764

Table 4: Light Urban Scenario: TC Results

3.

Harsh Urban Scenario

The last scenario consists of a harsh urban environment, where the vehicle travels around the financial district of Paris. During
this test not only the multi-path effects due to the number of high buildings is increased, but there are also multiple tunnels

ION GNSS+ 2021

SBG-Systems

where the system is denied from any GNSS signal. Once again, two different configurations are tested, a GNSS only mode withan Ublox receiver and a tightly coupled MEMS INS / GNSS RTK mode. The reference is generated using a FOG based INS
coupled with a GNSS receiver and an odometer in a FW/BW/Merge configuration.

Figure 15: Harsh Urban Scenario: Trajectory.

a)

GNSS Results

The GNSS only solution suffers from a lack of availability, this can be seen in Figure 17 were the Stanford diagram shows that
only 60 % of the epochs produce an available solution. It is clear that the conditions have deteriorated the estimated position,
however the results are kept on the upper diagonal of the diagram which is a requirement. Looking at the horizontal error in
Figure 16 and Table 5 we can see that in such condition, the GNSS only solution is not able to reach a 68% error at a sufficientlevel for autonomous application.

Figure 16: Harsh Urban Scenario: GNSS Horizontal Error.

ION GNSS+ 2021

SBG-Systems

Figure 17: Harsh Urban Scenario: GNSS Stanford Diagram.

Percentile
Horizontal error (m)HPL (m)

68
0.489
5.936

95
47.43
52.33

99.7
237.82241.61

Table 5: Harsh Urban Scenario: GNSS Resultsb)Tightly coupled INS/GNSS results

Compared with the previous results, the tightly coupled configuration greatly improves the availability and integrity of thesolution. The additional sensors help to keep a consistent solution during some of the difficult periods of the acquisition, thisis also reflected in the protection levels. As it can be seen in Figure 19 The solution is now available 72.5 % of the time,compared to 59.2 % in the previous configuration. These values may not be enough for a pure autonomous application, but the
improvements found in the multi sensor solution cannot be neglected, especially considering the challenging environment of
this test. An interesting finding is that the actual error at the 99.7th percentile is still under the 3 meters limit set in this test,
although PL is at 63 m. This suggests that there could still be room for optimization in the system availability without changing
the hardware. Additionally, to the Stanford diagram, the horizontal error and protection levels for the whole test are presented
in Figure 18 with a compressed summary in Table 6.

ION GNSS+ 2021

SBG-Systems

Figure 18: Harsh Urban Scenario: TC INS/GNSS Horizontal Error.

Figure 19: Harsh Urban Scenario: TC INS/GNSS Stanford Diagram.

Percentile
Horizontal error (m)HPL (m)

68
0.128
2.52

95
0.777
10.51499.7
1.937
63.966

Table 6: Harsh Urban Scenario: TC Results

V.

CONCLUSIONS

The integrity algorithm presented in this article provides a reliable protection level that bounds the position error without
any misleading information (MI), or hazardously misleading information (HMI) reported. Moreover, the integrity algorithm
successfully detects and excludes all the faulty measurements which significantly improves the provided solution.
It has been proved that under open sky environments, both tightly coupled and pure GNSS algorithms provide a highly accurate

ION GNSS+ 2021

SBG-Systems

solution with Protection Levels that bound the position error. However, under harsh urban environments, the multi-sensor
fusion (GNSS, INS and Odometer) greatly improves the solution availability, accuracy and protection levels, this is even more
noticeable during the partial or full GNSS outages.
REFERENCES[1] G. Falco, G. Marucco, M. Nicola, and M. Pini, “Benefits of a tightly-coupled gnss/ins real-time solution in urban scenariosand harsh environments,” 02 2017.
[2] I. Klein, S. Filin, and T. Toledo, “Vehicle constraints for supporting INS navigation in urban environments,” Navigation,
vol. 58, pp. 7–15, 03 2011.
[3] S. Vana, J. Aggrey, S. Bisnath, R. Leandro, L. Urquhart, and P. Gonzalez, “Analysis of GNSS correction data standards
for the automotive market,” Navigation, vol. 66, 07 2019.
[4] T. H. Tran and G. Belforte, “An ARAIM adaptation for kalman filter,” Workshop on Maritime Communication andNavigation (COMNAVI 2017), pp. 27–37, 12 2017.
[5] I. C. A. Organization", “Annex 10 aeronautical telecommunications,” in Convention on International Civil Aviation, 6th ed.
I.C.A.O, July 2006, vol. Volume I.
[6] O. Crespillo, A. Grosch, B. Belabbas, and M. Rippl, “GNSS-aided INS integrity concept,” 09 2014.
[7] N. Zhu, D. Bétaille, J. Marais, and M. Berbineau, “GNSS integrity enhancement for urban transport applications by error
characterization and fault detection and exclusion (FDE),” 12 2018.
[8] X. Han, A. Kazim, N. Ait Tmazirte, J. Marais, and D. Lu, “GNSS/IMU tightly coupled scheme with weighting and FDE
for rail applications,” 01 2020.
[9] J. Blanch, T. Walter, P. Enge, Y. Lee, B. Pervan, M. Rippl, and A. Spletter, “Advaced raim user algorithm description:
Integrity support message processing, fault detection, exclusion, and protection level calculation,” vol. 4, 09 2012.
[10] G. Gottschalg and S. Leinen, “Comparison and evaluation of integrity algorithms for vehicle dynamic state estimation indifferent scenarios for an application in automated driving,” Sensors, vol. 21, p. 1458, 02 2021.