More commonly used in civil GNSS applications are “1-sigma” and “2- sigma” error limits. In the case of position errors that follow Gaussian Solutions: distributions, these limits express the 63rd and 95th percentiles of navigation errors, respectively, for a one- Quantifying the What are the dimensional parameter (e.g., altitude). differences between For higher-dimension parameters, performance such as 2-D horizontal position, the accuracy, integrity, one- and two-sigma limits represent of navigation lower percentiles than in the one- continuity, and dimensional case and can be computed systems and availability, and from a chi-squared distribution if the underlying range-domain errors are standards for how are they Gaussian. computed? Because the Gaussian distribution assisted-GNSS describes most navigation system hese four words describe param- error distributions fairly well out to eters that quantify the perfor- the 95th percentile, many accuracy “GNSS Solutions” is a mance of navigation systems. descriptions use “95%” and “2-sigma” regular column featuring T The terms are not unique to numbers interchangeably. However, questions and answers satellite navigation, as they have been this convention should not be taken about technical aspects of used for many years with respect to to mean that the underlying error other navigation systems and, with distribution is actually Gaussian, GNSS. Readers are invited to broader definitions, throughout the particularly in the “tails” beyond 2- send their questions to the practice of engineering. This column sigma, where the norm is for variations columnist, Dr. Mark Petovello, will describe the use of these terms for from the Gaussian distribution to exist. Department of Geomatics navigation and focus on their applica- Accuracy is obviously a value of bility to GNSS. paramount importance when selecting Engineering, University of Accuracy is the navigation among candidate navigation systems Calgary, who will find experts performance parameter that is most and deciding what use can be made of to answer them. commonly used and is the easiest their measurements. Because accuracy to understand. It is a measure of the defines errors under typical conditions, error, or the deviation of the estimated it expresses what users will experience position from the unknown true in normal, everyday use. position, of a given navigation tool or system. More precisely, accuracy is a Beyond Accuracy statistical quantity associated with the To varying extents, the other three probabilistic distribution of navigation parameters described next express Mark Petovello is an Assistant error. relatively rare phenomena that may not Professor in the Department of Geomatics Engineering at Depending on the system and its be noticed by typical users (unless sys- the University of Calgary. He intended application, this quantity can tem performance is far short of what has been actively involved in be expressed in somewhat different is required) and thus are mostly evalu- many aspects of positioning and ways. For example, many military ated by offline analysis and simulation. navigation since 1997 including systems express accuracy in terms Integrity relates to the level of trust GNSS algorithm development, of “circular error probable” (CEP) in that can be placed in a navigation inertial navigation, sensor two dimensions or “spherical error system. Here, “trust” refers to reliance integration, and software probable” (SEP) in three dimensions. that gross errors (errors much larger development. This represents the median position than the accuracy of the system) can be Email: mark.petovello@ error — it exceeds 50 percent of all avoided. ucalgary.ca position errors and falls below the In practice, this concept is other 50 percent. expressed quantitatively using three 20 InsideGNSS SEPTEMBER/OCTOBER 2008 www.insidegnss sub-parameters. The first isintegrity bounds, such as a horizontal alert limit position error to exceed its alert limit risk, which denotes the probability (HAL) and a vertical alert limit (VAL), under “nominal” conditions without (per operation or per unit of time) that often exist depending on the intended any particular system fault or anomaly the system generates an unacceptable application. taking place. The probability of this is error without also providing a timely The third sub-parameter istime typically extremely low given the gap warning that the system’s outputs to alert (TTA), which is defined as between typical system accuracy and cannot be trusted. Such an event is the time between the occurrence of errors large enough to be unsafe, but it called “loss of integrity” (LOI) in some potential misleading information (i.e., cannot be ruled out. contexts and “misleading information” one or more alert limits are violated) Because no failure or anomaly (MI) in others. Depending on the and the time at which an alert or is involved in this form of integrity potential consequence of “misleading correction (i.e., exclusion of the failed loss, there is nothing to detect. Thus, information,” a word expressing the measurements) is issued to the system in such cases, integrity monitoring severity of the consequence may user to protect him or her from the in general and the time-to-alert be added, such as “hazardously underlying problem. metric in particular do not apply, at misleading information” or HMI. Note that the TTA “clock” begins least in theory. In practice, because The second sub-parameter is ticking not when a failure takes place many degrees of “off-nominal” the alert limit, which defines the but when this failure causes navigation circumstances exist between magnitude of error that, if exceeded, errors to grow to the extent that one or “nominal” and “faulted” conditions, is unacceptable from a safety more alert limits might be exceeded. detection is possible, but this standpoint. Alert limits generally possibility is normally not considered come from requirements for particular Losing Integrity in analysis. applications and are expressed in terms Loss of integrity generally occurs in The second and more likely of position error bounds. Multiple two ways. The first of these is for a possibility for loss of integrity is a fault www.insidegnss.com SEPTEMBER/OCTOBER 2008 InsideGNSS 21 GNSS SOLUTIONS defined meet the requirements of a particular application. The most common definition of availability is the long-term average probability (subject to certain conditions) that the accuracy, integrity, and continuity requirements are simultaneously met. This does not always apply in practice, however. For example, some applications do not require that continuity be assured at the time the operation is conducted. Also, many Copyright iStockphoto.com/Mark Evans common applications only have accuracy requirements. Therefore, or anomaly occurring that leads to loss because of the actions of one or more when availability is mentioned, the of integrity if detection and exclusion integrity monitors in detecting a real or requirements that must be met for a do not occur within the time to alert. imaginary fault, and then either failing given operation (at a given moment in In this case, the prior probability of to exclude the affected measurements time) to be declared “available” should the fault occurring is an important (leading to complete loss of navigation) be clear or commonly understood. contributor to integrity risk, as is the or implementing an exclusion that probability of missed detection, or leaves the remaining measurements All Together Now the probability that the fault will not incapable of meeting the required To compute a long-term average prob- be detected before the time to alert performance. ability of a GNSS system meeting all expires. For applications that cannot be of its requirements simultaneously, Although detailed analysis of interrupted without some level of simulations of satellite orbits and vis- these scenarios must be done offline, danger, such as aircraft precision ibility at one or more user locations are the results of these analyses can be approach and landing under Category conducted. These simulations normally encapsulated into real-time user III weather minima, loss of continuity include the possibility that one or more calculations of protection levels, which poses its own safety hazards. satellites are unhealthy for one reason express the position-error bounds Two additional parameters or another, including planned mainte- that can be protected to the required are useful in analyzing continuity nance, unplanned failures that are still probability level of integrity risk. performance. Theprobability of false being corrected, and “end-of-life” out- By ensuring that these protection alert (or false detection or fault-free ages of a satellite that has not yet been levels are no greater than the alert) is the probability that one or replaced with a new one. corresponding alert limits (i.e., more integrity monitors issue an alert Because GNSS satellite ground confirming that, in the vertical (leading to measurement exclusion tracks typically repeat (e.g., every position axis, the vertical protection and possibly continuity loss) when no 24 hours for today’s GPS satellites), level or VPL ≤ VAL), integrity can be underlying fault is present. simulations need only cover the period verified in real-time for the set of GNSS A critical satellite for GNSS before the ground tracks (and thus user satellites available to the user. applications refers to one whose loss satellite geometry)