Esri is offering two major capabilities in Site Scan for ArcGIS that will enable governments and critical infrastructure organizations to meet hardware and software regulations in the United States and Europe. Site Scan is Esri’s unmanned aerial systems flight planning and processing solution.
Through an established partnership with Auterion, creator of an open-source drone autopilot operating system, security-conscious U.S. organizations will be able to use Site Scan to plan and execute missions with Auterion’s Freefly Astro drone.
In Europe, data from publicly funded or critical infrastructure projects cannot leave the European Union (EU). For these organizations, a new and fully independent instance of Site Scan for ArcGIS has been deployed to a server cluster in Ireland, ensuring that organizational data resides within the region.
Site Scan for ArcGIS is used by organizations that require drone imagery for visual inspections, site monitoring, asset management and situational awareness. It’s an all-in-one, cloud-based drone mapping solution for managing fleets and collecting, processing, analyzing, and sharing data products. Industries using this solution include architecture, engineering, construction, natural resources, infrastructure and government.
Freefly Astro uses U.S. Department of Defense-approved Blue sUAS software architecture from Auterion, and is fully supported by Site Scan. The first vehicle integrates the software with the Freefly Astro, with more vehicles becoming available.
Auterion’s secure, integrated workflow for mapping uses the Freefly Astro drone, Sony A7R4 camera and Esri Site Scan within a single platform.
The Freefly Astro and Site Scan integration will be available by December. The European deployment of Site Scan is available now.
GMV will take charge of the command and control and C4ISR interoperability system under the Integrated Modular Unmanned Ground System (iMUGS).
The European Commission’s European Defence Industrial Development Programme (EDIDP) has assigned 30.6 million euros to the iMUGS project for the development of an unmanned ground system. This makes it one of the European Commission’s biggest defense investments to date.
The Integrated Modular Unmanned Ground System (iMUGS) project will be carried out by a consortium primed by Milrem Robotics, with another 11 high-tech defense firms, including the technology multinational GMV.
The common development of this vehicle will build from Milrem Robotics’s previous program called THEMis, with the addition of various mission systems and autonomy solutions.
The aim is to develop a valid scalable architecture applicable to both manned and unmanned vehicles, with the idea of standardizing Europe’s ground and air systems and its command-and-control and communications systems, sensors, payloads and autonomy algorithms.
The system will consist of a robust and modular ground vehicle fitted with an electronic-warfare-resistant command, control and communications system and secure autonomous mobility software to allow the operator to control many different ground and air platforms securely and simultaneously.
iMUGS will include several components:
system cybersecurity
autonomous mobility
advanced communications systems and further driving-related developments
manned-unmanned teaming (MUT) including swarms.
iMUGS will enable European countries to use unmanned vehicles with logistics and ISR functions, trimming the load and increasing troop security.
With this joint initiative, the European Defence Fund meets member states’ requirements and draws on the skills of Europe’s industry to boost defense capabilities and strategic autonomy.
European Defence Industrial Development Programme (EDIDP)
The European Defence Industrial Development Programme (EDIDP) is the first initiative of the European Union’s 2019 and 2020 defense research window of capabilities. Announced on June 7, 2017, EDIDP can be considered the “preparatory action” of defense research to prove the feasibility of a joint defense-capability development and procurement program.
EDIDP’s aim is to drive the European Union’s strategic autonomy and cooperation between member states, making it possible for armed forces to carry out high level operations, with special attention to intelligence, secure communications and cybernetics.
Under the EDIDP 2019-2020 program, GMV is participating in the iMUGS, GEODE, ESC2 and PANDORA projects.
GMV‘s iMUGS role
GMV will be coordinator of the command and control and C4ISR interoperability subproject. GMV is bringing to the table experience in C2 ground systems and JISR (joint intelligence, surveillance and reconnaissance interoperability).
The overall aim is to develop the C2ISR tactical component for planning and carrying out joint manned and unmanned systems operations, using and distributing sensor data from the unmanned ground vehicle.
JISR interoperability synchronizes and integrates the planning and operation of all information-obtaining capacities with operation and processing capacities, sending on the resulting information to the assigned person at the right time in the right form and in direct support of present and future operations.
The Boxer Mechanised Infantry Vehicle (MIV) is used by many allied forces. (Photo: U.K. Ministry of Defence)
The C2 command and control subsystem will be fitted in a Boxer 8 x 8 vehicle for manned-unmanned teaming (MUT) coordination tests.
GMV’s participation in iMUGS is based on its experience in C2 ground systems, dismounted soldier C2 systems and JISR interoperability, areas where GMV is one of the leading companies in Europe. GMV is a supplier of Artillery and Dismounted Soldier Command and Control Systems for the Spanish MoD.
Since 2016 it has been responsible for maintenance and upgrading of the EUCCIS C2 system of the European External Action Service (EEAS).
The research and demonstration projects addressed topics such as drone operations; critical communications; surveillance and tracking; information management; aircraft systems; ground-based technologies; cyber-resilience; and geo-fencing.
“Drones are disrupting business as usual in air traffic management,” said Florian Guillermet, executive director, SESAR Joint Undertaking. “A simple adaptation of our current air traffic management system is not enough; accommodating these air vehicles in the numbers forecast requires a new approach.”
The projects map progress on development of the technological capabilities and all services
required for making U-space a reality, starting with foundation services (U1) before progressing to initial services (U2), advanced services (U3) and finally full services (U4).
Results of the projects summarized in the brochure will be fully detailed in a comprehensive report, expected to be published in the second half of 2020.
Chart: SESAR JC
SESAR 2020
SESAR 2020 is a European Union innovative program for researching the future of air traffic management in Europe. It builds on its predecessor, SESAR 1, to deliver high-performing operational and technological solutions for uptake by the aviation industry.
With a budget of 1.6 billion euros between now and 2024, SESAR 2020 will support projects to deliver solutions in these four key areas:
GMV has been awarded the SUGUS project (Solution for E-GNSS U Space Service), which aims to speed the adoption of GNSS and Galileo in the unmanned aerial vehicle (UAV) segment and ensure safe airspace access by unmanned aircraft.
SUGUS is an 18-month, 485,000-euro European Union research and development project. A series of trials will be held to show the benefits of E-GNSS for drone operators as well as its approval by aviation authorities.
The demand for UAV services is steadily increasing, with the potential to generate significant economic growth, as recognized in the 2015 European Union Aviation Strategy. More recently, the 2016 European Drones Outlook Study (by SESAR — Single European Sky ATM Research) estimated that the European drone market will clock up 10 billion euros a year by 2035 and more than 15 billion euros annually by 2050.
U-Space services
U-Space is a set of new airspace-management services and procedures designed to ensure airspace access too UAVs while looking out for operational security, the right to privacy and the safety of persons and infrastructure. These services rely on a high level of digitization and function automation, whether onboard the drone itself or part of the ground-based environment.
Several initiatives are underway in Europe to develop U-Space and work toward the safe and efficient coexistence of manned and unmanned air traffic.
At the same time, new European legislation on operating unmanned systems is providing a uniform, Europe-wide framework. The new regulation is broken down into three drone operation categories:
Open, calling for no AESA clearance or operator declaration
Specific, where both clearance and declaration will be necessary
Certified, reserved for riskier operations.
To help integrate drones into the airspace, SUGUS will center on the Open and Specific flight categories.
SUGUS tasks
SUGUS will demonstrate the benefits for drone operations of the measures implemented at service-provision level and the new EGNSS API (European GNSS application programming interface) to be implemented in the project.
These benefits included the mitigation of operating risks, improvement of preparation processes and clearance of the operator’s mission. Such measures as expected to ease future urban aerial mobility operations, such as aero taxis or parcel delivery.
For the first step in this endeavor, SUGUS will carry out a review of the results of previous EGNSS projects while also pinpointing the needs of drone operators and unmanned traffic service providers in complex operations and built-up areas.
This analysis will help to define and then implement the new EGNSS-based API.
SUGUS will also be running several flight trials in complex environments to prove the benefits of the drone-operation measures. The overarching idea is to raise awareness and contribute towards drone standardization and regulation to maximize the chances of the proposed services being implemented as a U Space service.
Aircraft throughout Europe are guided by EUROCONTROL, which will have access to ADS-B data through Aireon. Here, a plane lands at Schiphol Airport in The Netherlands. (Photo: Sjo/iStock Unreleased/Getty Images Plus)
Aireon and EUROCONTROL have signed a 10-year agreement to integrate space-based ADS-B data into their air traffic management processes across EUROCONTROL’S 41 Member States and two Comprehensive Agreement (CA) States.
The space-based automatic dependent surveillance-broadcast (ADS-B) data will enhance aircraft management capabilities, contributing to improve predictability, capacity, environmental impact supporting sustainable growth throughout the European region.
It will also support other applications, such as crisis management, contingency management, environmental monitoring, performance monitoring and expanded datasets for post-analysis, traffic statistics and safety-related assessments.
Spanning 43 countries from Turkey to Ireland, Finland to Portugal, EUROCONTROL’s aircraft management states encompass over 11.5 million square kilometers of terrestrial airspace, as well as part of the airspace over the North Atlantic, Mediterranean and Baltic.
Aireon data will be integrated into the EUROCONTROL’s enhanced tactical flow management system (ETFMS), which provides data to European aviation stakeholders, regardless of operational borders, in real time.
Space-based ADS-B data will enrich ETFMS’s complex traffic demand and slot allocation calculations, which currently rely on ground-based surveillance data and flight plan processing systems. As a result, Aireon’s data will support Europe’s primary flow management system to be more accurate in its trajectory predictions and unlock an otherwise unavailable operational capacity.
“With Aireon’s high-integrity, high-quality data, the EUROCONTROL network manager will have the ability to work with information from beyond the European airspace,” said Eamonn Brennan, director general, EUROCONTROL. “Full integration of Aireon space-based ADS-B data will allow us to be more accurate in our trajectory predictions and ensure higher levels of safety, predictability and efficiency in our flow management operations. This partnership is the latest development in our effort to ensure European airspace is one of the most dynamic and efficient in the world.”
EUROCONTROL. Having been nominated as the Network Manager by the European Commission until the end of 2029, EUROCONTROL is driving a coordinated and technologically advanced approach to the challenges faced by the European air traffic network.
Helping address the improvements that are needed in operations, cybersecurity, service provision, crisis management, airspace design, utilization and more, EUROCONTROL provides support and expertise to air navigation service providers (ANSPs), airlines, airports and military partners in the region to help make European aviation, safe, synchronized, efficient and environmentally friendly.
Aerion. In 2019, the European Aviation Safety Agency (EASA) certified Aireon as the first provider of aircraft surveillance-as-a-service. Additionally, Aireon has the only global, single-source dataset available to the industry.
For EUROCONTROL, this means that once the service is integrated into its systems, it will have unprecedented visibility into the full picture of aircraft arriving, departing and crossing over Europe over an area of six flight hours and 3,000 nautical miles around EUROCONTROL Member States.
“EUROCONTROL is a leader in air traffic flow management. They are the first customer to use Aireon data well beyond their own area of responsibility. This will enable them to maximize the effectiveness of their processes and procedures by including long-range arrivals and neighboring States into their capacity and demand measures,” said Don Thoma, CEO, Aireon. “EUROCONTROL recognizes the global value in connecting ANSPs through a common, high-fidelity, global data source that provides situational awareness of actual aircraft position information. We look forward to the benefits all EUROCONTROL customers will see in the near, medium and long-term.”
Aireon’s data will also be integrated in EUROCONTROL’s new system called iNM, which will implement incremental updates to all of EUROCONTROL’s operational systems and digital infrastructure in the course of this decade.
A key feature of a new high-accuracy GNSS correction service
Innovation Insights with Richard Langley
INTEGER VITAE SCELERISQUE PURUS. So wrote the Roman poet Horace at the beginning of one of his odes — one which, incidentally, was sung by college choirs at one time. It is usually translated as “upright of life and free from wickedness” and is just about the only common Latin quotation in which we find the word “integer.”
Besides upright, the word can be translated as unimpaired, perfect or whole. It is this latter meaning that the English mathematician Thomas Digges appropriated to describe whole numbers. The modern mathematics definition of the set of integers includes the additive inverses of the whole numbers plus zero. We have to worry about the integer nature of carrier-phase ambiguities when trying to achieve high-precision GNSS positioning but that is a story for another day.
The Latin word integer is the root of the English word integrity. In everyday speech, integrity means the quality of being honest or trustworthy (and having strong moral principles). But it is also used to describe something that is unimpaired or uncorrupted, especially in regard to electronic data such as that provided by a navigation system.
As I wrote in an Innovation column back in 1999, “The performance of any navigation system is characterized by its accuracy, availability, continuity, and integrity. From a safety point of view, integrity is arguably the most important factor. Without some assurance of a system’s integrity, we have no way of knowing whether the information we receive is correct: How are we to know whether a navigation system is actually achieving its advertised accuracy and not misleading us with faulty information?” Navigation systems that provide safety-of-life services must ensure a very high level of integrity. For example, the Wide Area Augmentation System (WAAS) continuously assesses the integrity of GPS satellite signals as well as its own corrections, warning WAAS users when a failure is encountered within about 6 seconds of failure. This helps to ensure that aircraft do not use misleading data that could potentially create hazards.
And now, high-precision GNSS positioning technology using real-time augmentation is being adopted for autonomous applications in the automotive, rail, aviation and marine industries. These applications need high integrity in their position determinations in addition to high accuracy. As with the pioneering non-autonomous aviation use, augmentation services for the new market will need to monitor many aspects of their service to ensure a high level of integrity including the high-end data processing algorithms, real-time data transmission, end-to-end encryption, and functional safety assurance. This will be a challenging task that will require a multi-disciplinary approach, deep understanding of GNSS error modeling and risk assessment.
In this month’s column, we look at the design, construction, operation and performance of the first safety-critical, high-accuracy augmentation service created specifically for autonomous applications.
In addition to the need for high accuracy, the adoption of high-precision GNSS positioning technology for autonomous applications in the automotive, rail, aviation and marine industries has brought with it the need for high integrity and reliability. GNSS integrity concepts had their beginning in safety-critical applications in the aviation and marine industries, which have used GNSS to provide absolute position for precision runway approach, enroute navigation, port approaches, open sea and coastal waterway navigation.
For precision GNSS users (those using precision or high-end equipment) in the surveying, construction and agriculture industries, the focus has primarily been on accuracy. Over the past decade, real-time networks have been developed to offer sub-2-centimeter performance to end users. Although some integrity information has been provided, it has often been in the form of disturbance indices that network operators can use to inform users of suspected down time or periods of poor performance. But the information lacks a functional safety component. Additionally, this information has not typically been integrated in real time into position engines to aid in the generation of reliable integrity parameters for the end users.
Although GNSS does have limitations, particularly in urban environments, GNSS equipment is one of the few sensor types available to system integrators that can provide absolute position in autonomous applications.
This realization — combined with the further miniaturization, lower power consumption and expansion of inexpensive multi-frequency, multi-constellation GNSS chips capable of real-time-kinematic- (RTK-) style processing — has made the adoption of GNSS for mass-market applications very appealing.
Most mass-market applications don’t have the same accuracy requirements that drive the professional high-precision market. TABLE 1 summarizes applications that can benefit from a high-precision GNSS correction service. In most cases, decimeter-to-meter-level accuracy is typically acceptable. Reliability becomes more critical for these applications.
Table 1. Applications that can benefit from a high-precision GNSS service with integrity. (Data: Sapcorda)
The integrity demand, which we define as the degree of difficulty an application poses to the integrity monitoring system, is based on the required accuracy, availability, failure rate and continuity requirements of the application. Applications with a high integrity demand pose the most difficult challenges.
With the spread of autonomous applications in various areas, the likelihood of liability and legal cases being decided based on PVT data provided by the systems is high. This eventuality brings with it a need for a non-proprietary open standard for ensuring consistent implementation of the integrity information and functional safety along with the separation of end-user and provider responsibility. In this article, we describe the requirements and concepts for a high-precision GNSS correction system with high integrity.
SYSTEM OVERVIEW
Our Sapcorda correction service provides high-precision GNSS correction data on a continental scale. Its core component is an underlying tracking network of reference stations used to generate the precise corrections. The reference stations operate in real time and continuously transmit their data to the data control center. The data control center processes the data, computing orbit, clock, instrumental bias and atmosphere corrections and integrity information, and then encrypting the data before broadcasting it to the end user (see FIGURE 1).
The corrections are broadcast in the Safe Position Augmentation for Real Time Navigation (SPARTN) format developed by a consortium of GNSS manufacturers and service providers, via two communication channels, L-band and the internet. The data is then received by the end users who must decrypt it before it is used in processing. The SPARTN correction format consists of a set of messages that broadcast the GNSS corrections in a state-space representation. With our network, Sapcorda can offer a high-accuracy positioning service with fast convergence. An example of positioning performance for a monitoring station in Sapcorda’s European network coverage area is shown in FIGURE 2. The typical accuracy level is close to that of traditional network RTK services.
FIGURE 2. Horizontal position performance for a monitoring site in Europe using Sapcorda’s high-precision service. (Image: Sapcorda)
The system provides coverage for both North America and Europe as shown in FIGURE 3. Unlike traditional local or regional network RTK systems, Sapcorda’s network provides seamless coverage on the continental scale and operates in broadcast-only mode.
The integrity of a system can be described as the trustworthiness of the positions generated by the position engine. Trustworthiness is defined by the protection level associated with a given solution. Many of the concepts related to GNSS integrity originated from the development of the Wide Area Augmentation System (WAAS). The integrity concept was formalized by the Stanford Integrity Diagram, which outlines the key concepts related to integrity. TABLE 2 defines the terminology surrounding the integrity concept.
Table 2. Integrity terms. (Data Sapcorda)
The integrity risk is the probability that a user will experience a position error larger than the alert limit without an alarm being triggered. When this occurs, the user is in a potentially dangerous situation as the system is providing dangerously misleading information to the user, who is unaware.
The protection levels are computed based on the expected behavior of the error sources encountered in a GNSS positioning system. If the protection level is less than the system’s alert limit, then the system is operating within its normal bounds. If the error sources are not properly monitored or quantified, protection levels become optimistic. This occurs when the true position error, which is typically unknown, exceeds the protection level supplied by the system. When this situation occurs, it is labeled hazardously misleading information (HMI) because the system may believe that its position is more accurate than it truthfully is. If the true position error remains less than the alert limit, then this is classified as misleading information. As the true position is not beyond the alert limit, the operator/system can continue to rely on this information without being in a potentially dangerous scenario.
To define the true integrity risk of the system, it is necessary to understand its error sources, threat models, frequency of occurrences and potential failure modes. Many threats could render a correction service unavailable, including hardware failures, data outages or software bugs, atmospheric anomalies and satellite failures. The following section describes these threats along with the capabilities used for monitoring them.
Error Sources. The primary error sources in high-precision GNSS positioning are described in TABLE 3.
Table 3. GNSS network error sources, their magnitude and mitigation approach. (Data Sapcorda)
Although not mentioned in this table, additional error sources include site displacement effects such as solid earth tides, ocean tide loading and polar tides; carrier-phase wind-up at both the receiver and satellite; and satellite and receiver antenna phase-center variations and relativistic delays. These effects must be consistently modeled at both the server and the end-user for centimeter-level positioning.
Based on the error sources described in Table 3, it is necessary to convert this information into a format that can be used by the position engine to derive protection levels for each solution. How the final protection level is derived by a position engine is not within the scope of this article. For this, several approaches can be used including carrier-phase-based receiver autonomous integrity monitoring (CRAIM), solution separation and others.
The following equation can be used to describe the overall error contribution for each measurement:
where
is the total uncertainty for satellite i
is the uncertainty of the ionosphere model
is the uncertainty of the troposphere model
is the uncertainty of the combined orbit, clock and bias (ephemeris) corrections
is the uncertainty of the measurements in the given environment
The terms , and are derived from the real-time reference network operator while the term must be computed by the end-user receiver. This final term is perhaps the most difficult to determine, particularly for kinematic environments, as the value is highly dependent on antenna quality, multipath and measurement quality.
PERFORMANCE AND RESULTS
We processed 24 hours of data at three stations covered by Sapcorda’s European network and within the red circle shown in FIGURE 5.
FIGURE 5. Location of stationary testing carried out within Sapcorda’s European network. (Image: Sapcorda)
The test stations were situated in an open-sky environment with high-quality geodetic antennas and receivers. The position results and protection levels were derived from Sapcorda’s own position engine.
FIGURE 6. Integrity plots for the horizontal error and protection levels for three stations within Sapcorda’s European network coverage area.(Image: Sapcorda)
FIGURE 6 shows the horizontal component integrity plots for the three stations. The protection levels are computed for the five-sigma level. In all three examples, the protection level can properly bound the horizontal position error. In terms of the measured accuracy, the typical performance observed at the three stations is between 3 and 7 centimeters for the 95th percentile.
In addition to the stationary testing, two kinematic trials were carried out in cooperation with a system integrator. The integrator setup consisted of a commercial RTK receiver and position engine being fed with SPARTN corrections. The equipment was mounted onto the vehicle used for the tests. Both tests were carried out in an urban environment, which introduced measurement outages due to trees, overpasses and urban canyons. FIGURE 7 shows the area in which the kinematic trails were carried out, as well as some of the urban conditions with which the system had to contend.
FIGURE 7. Location of kinematic trials using Sapcorda’s North American correction service and examples of the environment encountered during the testing. (Image: Sapcorda)
FIGURES 8 and 9 show the position performance and integrity plots for the two kinematic trial scenarios. The reference trajectory was computed using a short baseline post-processed kinematic solution computed with a third- party application. The typical accuracy of the Sapcorda-enabled solution was on the order of 2 to 4 centimeters, while the maximum error was 10 centimeters. In both cases, the protection levels were able to properly bound the horizontal position error. Figure 8 shows an area of increased position error, which occurs around the 22.6- to 22.7-hour mark of the day. This period coincides with the image in the bottom right of Figure 7, where the vehicle passes into a difficult environment with overhead trees and walkways, as well as significant shading from a tall building. Even in this type of environment, the protection levels were able to properly bound the horizontal position error.
FIGURE 8a. Horizontal position performance for kinematic trial #1. The red line indicates the 1-sigma error of the position engine. (Image: Sapcorda)FIGURE 8b. Horizontal position performance for kinematic trial #1: The 5-sigma integrity diagram. (Image: Sapcorda)FIGURE 8b. Horizontal position performance for kinematic trial #1: The 5-sigma integrity diagram. (Image: Sapcorda)FIGURE 9b. Horizontal position performance for kinematic trial #2: The 5-sigma integrity diagram. (Image: Sapcorda)
In addition to the position performance, re-initialization time plays a critical role for precise positioning systems operating in difficult environments. Due to the regular outage and signal blockages, which occur in urban environments, the re-initialization time is critical to providing high availability. Traditional precise point positioning (PPP) systems, even those that perform ambiguity resolution, can take anywhere from 5 to 20 minutes to re-initialize and achieve an acceptable accuracy level (typically 10 centimeters) after a complete outage. Researchers in both academia and industry have developed several methods to reduce this time by “bridging the gap” after outages.
However, these approaches rely on assumptions about either the vehicle trajectory or the stability of the ionosphere before and after outages. The impact of these assumptions on overall integrity have not been adequately studied. Systems that rely on inertial measurement units (IMUs) to constrain the position after an outage introduce a dependency between what should be two independent sensors in the overall system.
FIGURE 10 shows the re-initialization time of the integrator’s position engine when using Sapcorda’s correction service. In this case, the re-initialization time is computed as the time it takes to return to RTK-ambiguity-fixed mode as indicated in the position engine output after an outage. Results based on comparisons against short-baseline RTK positioning showed typical accuracies below 10 centimeters upon re-initialization. In this definition, the time of the outage is included in the overall re-initialization time. In nearly all of the 42 occurrences, the time to re-initialize is less than 10 seconds. This is sufficient to allow an IMU to provide position updates during the GNSS outage.
FIGURE 10. Re-initialization time of the integrator’s position engine enabled by Sapcorda’s correction service. (Image: Sapcorda)
SYSTEM DESIGN CONSIDERATIONS
In addition to understanding GNSS error sources and performance, it is also important to consider the integrity of the entire system. This includes software development processes, hardware selection, data communication standards and security.
Software Design
Aspects needing to be addressed include:
Software Coding Standards. As software is used more and more in safety-critical scenarios, standards have been developed to minimize common errors and failures. Some standards relevant for safety-critical applications development include International Organization for Standardization (ISO) standard 26262 and Motor Industry Software Reliability Association (MISRA) C/C++ coding standards. Many of these standards can be automated via the static analysis tools described below.
Functional Safety. The objective of this analysis is to understand the possible failure modes of a system, how likely they are to occur, and how to mitigate their risk. Several methods can be applied for functional safety analysis. One such approach is failure mode effect analysis (FMEA). In general, functional safety analysis is a complex task requiring a wide range of experience and expertise. Understanding how design or feature choices impact overall failure modes is also critical for simplifying the number of cases and overall system complexity.
Test Coverage. Unit tests provide the fundamental verification that a function can perform its expected task. Coverage analysis tools provide insight into which sections, paths and combinations are being tested. Various metrics are possible, including:
statement coverage: measures the number of executable lines of code that are evaluated
branch coverage: measures which code paths are being evaluated (for example, if statements, both true and false must be covered)
modified condition/decision coverage (MC/DC): in addition to checking all branches, all combinations of branches must be considered.
The degree of effort to meet target coverage metrics greatly varies based on the type of metric chosen.
Code Quality Metrics. Code quality metrics attempt to reduce the complexity of functions and methods in the software. Code quality metrics may include:
cyclomatic complexity scores
establishing the maximum number of control statements within a function
establishing the maximum number of lines or methods called within a single function.
Static Analysis. Static code analysis provides an examination of source code prior to execution. It can detect common implementation issues such as divide-by-zero errors, bounds overrun, poorly defined loops or control statements, among others. Most commercial products provide support for MISRA C/C++ guidelines and other best practices for safety-critical applications.
Automated Testing. Test automation is critical for monitoring performance changes and ensuring high-quality code changes. Critical scenarios such as leap-second changes, week rollovers and ephemeris failures can be logged and then used as part of the automated test plan. And, as bugs emerge, adding additional test scenarios for these is also beneficial.
Data Communication Protocol
One must also consider several aspects related to the transmission of the correction service to users.
Open Source. A standardization of an open-source data communication protocol for mass-market applications allows for a receiving system to employ multiple corrections from more than a single specific provider without requiring independent functional safety requirements. This can provide a much higher level of redundancy than is possible when depending on only a single service provider.
Integrity and Functional Safety. To properly quantify the protection level, it is necessary to provide quality information about the corrections being provided by the service. Employing “do not use” flags ensures users drop satellites that may be unhealthy or performing poorly. General system status messages identifying the cause of a failure are also critical for proper separation of issues between server and recipient.
Encryption and Anti-Spoofing. As the use of GNSS expands, the threat of spoofing has become more significant. Data message encryption must be robust and resilient to protect the user of the data against external threats.
Self-Contained and Repeatable. Replication of events is important for safety-critical applications. A message format used for such applications should be self-contained and not rely on any external sources for factors such as initialization or the expansion of data. This may include the expansion of time-tagged data, or limiting the expansion of ephemeris to a specific Issue of Data Ephemeris (IODE).
SUMMARY
High-precision GNSS correction services for applications requiring both accuracy and integrity will continue to grow. To meet these demands, GNSS correction services that previously focused on accuracy as their primary goal must begin to work toward providing adequate integrity information to provide reliable positions and protection levels. This requires a multidisciplinary approach to achieve an in-depth understanding of GNSS error sources, integrity concepts and functional safety.
End users will benefit from the clear separation of the server and recipient responsibilities and through an open communication standard that facilitates the use of multiple correction service providers and is developed with safety and integrity at its core.
The adoption of formal safety practices, including software development strategies to reduce risk and mitigate errors, is also critical in achieving a reliable and safe high-precision correction service.
ACKNOWLEDGMENT
This article is based on the paper “Integrity for High Accuracy GNSS Correction Services” presented at ION ITM 2019, the 2019 International Technical Meeting of The Institute of Navigation, Reston, Virginia, Jan. 28–31, 2019.
LANDON URQUHART is the R&D engineering manager for Sapcorda Services Inc., with offices in Berlin and Hanover, Germany, and Scottsdale, Arizona, USA. He obtained his M.Sc.E. from the Department of Geodesy and Geomatics Engineering at the University of New Brunswick (UNB), Fredericton, Canada. His research interests are GNSS correction services for mass-market applications.
RODRIGO LEANDRO is the chief technology officer at Sapcorda Services in Scottsdale. He holds a Ph.D. in spatial geodesy from UNB. Dr. Leandro has been active in GNSS R&D for more than 15 years and has served in engineering leadership roles in various companies in the GNSS industry.
PAOLA GONZALEZ is a product engineer at Sapcorda Services and is based in Hanover. She completed her B.Sc. in geodesy at Zulia University in Maracaibo, Venezuela, and her master’s degree in geomatics at Karlsruhe University of Applied Sciences in Karlsruhe, Germany. In the past few years, she has been working in the GNSS industry, focusing mostly on performance analysis, evaluation and verification of different equipment, software and services.
FURTHER READING
• Authors’ Conference Paper
“Integrity for High Accuracy GNSS Correction Services” by L. Urquhart, R. Leandro and P. Gonzalez in Proceedings of ITM 2019, the 2019 International Technical Meeting of The Institute of Navigation, Reston, Virginia, Jan. 28–31, 2019, pp. 543–553, https://doi.org/10.33012/2019.16709.
• GNSS Integrity
“GNSS Position Integrity in Urban Environments: A Review of Literature” by N. Zhu, J. Marais, D. Betaille and M. Berbineau in IEEE Transactions on Intelligent Transportation Systems, Vol. 19, No. 9, September 2018, pp. 2762–2778, doi: 10.1109/TITS.2017.2766768.
“Carrier Phase-based Integrity Monitoring for High-accuracy Positioning” by S. Feng, W. Ochieng, T. Moore, C. Hill and C. Hide in GPS Solutions, Vol. 13, No. 1, January 2009, pp. 13–22, doi: 10.1007/s10291-008-0093-0.
“New Tools for Network RTK Integrity Monitoring” by X. Chen, H. Landau and U. Vollath in Proceedings of ION GPS/GNSS 2003, the 16th International Technical Meeting of the Satellite Division of The Institute of Navigation, Portland, Oregon, Sept. 9–12, 2003, pp. 1355–1360.
“The Integrity of GPS” by R.B. Langley in GPS World, Vol. 10, No. 3, March 1999, pp. 60–63.
• Satellite-Based Augmentation Systems
“Satellite Based Augmentation Systems” by T. Walter, Chapter 12 in Springer Handbook of Global Navigation Satellite Systems, edited by P.J.G. Teunissen and O. Montenbruck, published by Springer International Publishing AG, Cham, Switzerland, 2017.
Minimum Operational Performance Standards for Global Positioning/Satellite-Based Augmentation System Airborne Equipment, RTCA/DO-229E, prepared by SC-159, RTCA Inc., Washington, D.C., Dec. 15, 2016.
“The Stanford – ESA Integrity Diagram: A New Tool for The User Domain SBAS Integrity Assessment” by M. Tossaint, J. Samson, F. Toran, J. Ventura-Traveset, M. Hernandez-Pajares, J.M. Juan, J. Sanz and P. Ramos-Bosch in Navigation, Journal of The Institute of Navigation, Vol. 54, No. 2, Summer 2007, pp. 153–162.
“Validation of the WAAS MOPS Integrity Equation” by T. Walter, A. Hansen and P. Enge in Proceedings of the 55th Annual Meeting, The Institute of Navigation, Cambridge, Massachusetts, June 28–30, 1999, pp. 217–226.
“WAAS MOPS: Practical Examples” by T. Walter in Proceedings of NTM 1999, the 1999 National Technical Meeting of The Institute of Navigation, San Diego, California, Jan. 25–27, 1999, pp. 283–293.
• Jamming and Spoofing
“Interference” by T. Humphreys, Chapter 16 in Springer Handbook of Global Navigation Satellite Systems, edited by P.J.G. Teunissen and O. Montenbruck, published by Springer International Publishing AG, Cham, Switzerland, 2017.
• Ionospheric Threats
“Ionospheric Impact on GNSS Signals” by N. Jakowski, C. Mayer, V. Wilken and M.M. Hoque in Física de la Tierra, Vol. 20, 2008, pp. 11–25.
“Ionospheric Disturbance Indices for RTK and Network RTK Positioning” by L. Wanniger in Proceedings of ION GNSS 2004, the 17th International Technical Meeting of the Satellite Division of The Institute of Navigation, Long Beach, California, Sept. 21–24, 2004, pp. 2489–2854.
Sapcorda Services GmbH has released its SAPA (Safe And Precise Augmentation) Premium GNSS positioning service.
The SAPA service enables mass-market GNSS devices to operate with increased accuracy and reliability across Europe and the continental United States. The service’s technology unlocks advanced performance with instantaneous sub-decimeter position accuracy for devices used in all market applications.
SAPA is delivered using the open industry-recognized SPARTN format, which allows efficiently delivery of the correction data via internet and satellite broadcast. “When using our service, users across Europe and the United States can experience homogeneous, gap-free, advanced positioning performance with any GNSS hardware designed for high precision positioning,” CTO Rodrigo Leandro said.
The SAPA service is tailored for mass-market applications including innovative mobility solutions, IoT applications, and traditional markets such as maritime.
SAPA was designed from ground up to support safety-critical applications such as autonomous driving.
SPARTN (Safe Position Augmentation for Real-Time Navigation) is a high-accuracy, open- and free-to-use GNSS format tailored for broadcast distribution in mass-market applications.
Sapcorda Services GmbH is a GNSS service provider focusing on the emerging high-precision GNSS mass markets. The company has designed its technology and service offering to serve high volume automotive, industrial and consumer markets.
Europe’s scattered monitoring of GNSS signals found almost 500,000 interference events over three years. About 59,000 were clearly intentional. European standards for resilient receivers have been published and acquisition of an interference detection network is underway.
Russia is improving its terrestrial Loran/Chayka PNT system for military use and has promised to make the upgraded service available to civilians.
China has retained its terrestrial Loran PNT system as an augmentation/backup for its BeiDou GNSS. It is also testing PNT satellites in low earth orbit (LEO) to provide more powerful and reliable signals than available from current GNSS.
In contrast to the actions of other countries, little is being done in the United States to protect civilian GPS/GNSS users.
The U.S. Department of Defense (DoD) has been very active protecting its own with GPS M-code signals and receivers. It is exploring use of LEO communications satellites and high-powered, low-frequency ground transmissions, such as Loran, to add to the GPS signals.
Yet DoD claims civilian use of GPS has limited its ability to use it as a military tool. It says it has no intention of sharing any new PNT systems with civilians.
At the same time, the 99% of GPS use in the U.S. that is non-military is arguably more important to the nation’s safety and security. GPS signals are used by every networked technology and every mode of transportation. They are so important that officials at the Department of Homeland Security have called GPS “a single point of failure for critical infrastructure.”
The U.S. military recently updated its PNT strategy, has a designated leader for its PNT efforts, and clearly defines the responsibilities of its various staffs and organizations.
Civil agency responsibilities were last updated in 2004 and are spread across more than a dozen departments, agencies, and staffs.
Most significantly, no one is in charge.
This has meant that over the past 15 years, many of the civil mandates and responsibilities to protect signals and users have gone unfulfilled. As just one example, rather than ramp up to address increases in jamming, the Federal Communications Commission has reduced its enforcement equipment and staff.
Putting someone in charge is key to reversing America’s civil PNT decline and energizing both federal and private stakeholders.
A single, empowered federal leader should be responsible, not for doing everything, but for leading and coordinating federal and other civil efforts. This would be someone to be held accountable, and to hold others accountable — an evangelist for the essentiality of these services, and their advocate at the highest levels of government.
Such a leader should be positioned outside the daily turmoil of the White House and National Security Council. They should be in the civil department with the portfolio that most depends on GPS and other PNT. The one that suffers first when GPS and other PNT are not available — the Department of Transportation (DOT).
DOT is already the federal interface with civil GPS users, and co-chairs the national PNT executive committee with DOD. A few edits to national policy and a few staff reassignments could establish a national PNT leader in DOT and make all the difference.
Regaining U.S. PNT leadership is essential to America’s future security and prosperity. We must take the first step by appointing and empowering a single federal leader to make it happen.
Volkswagen and NXP to Deliver Safety to European Roads with Rollout of Communicating Car Technology
NXP Semiconductors N.V., a provider of automotive semiconductors, has rolled out its RoadLINK V2X (vehicle to everything) communication solution in the new Volkswagen Golf.
The recently released eighth-generation Golf is the first volume European car model equipped with V2X, offering a major boost to the deployment of the technology on European roads and beyond.
Life-saving tech. The technology can prevent accidents by having cars communicate with each other, independent of car brands and without the support of cellular infrastructure.
“Road safety forms the core of VW’s commitment to its customers. As a high-volume manufacturer we aim to be a pioneer in this space,” said Johannes Neft, head of Vehicle Body Development for the Volkswagen brand. “The introduction of V2X, together with traffic infrastructure providers and other vehicle manufacturers, is a major milestone in this direction. Volkswagen includes this technology, which doesn’t involve any user fees, as a standard feature to accelerate V2X penetration in Europe.”
“Volkswagen has taken a bold step to seize the road safety initiative through the implementation of V2X,” said Torsten Lehman, senior vice president and general manager of Driver Assistance and Infotainment at NXP. “After proving our technology in more than one million test days globally, we are pleased that our RoadLINK technology, developed in cooperation with Cohda Wireless, was chosen to enable new levels of safety in Europe’s most popular car model, the new Golf.”
NXP and Volkswagen have closely collaborated for high reliability and performance, as well as for standardization of V2X communication that addresses cybersecurity and privacy protection.
V2X in Europe. Wi-Fi-based V2X is a mature technology that has been tested for more than 10 years. Today, 1,000 kilometers (km) of European roads are equipped with V2X technology based on Wi-Fi with 5,000 km planned through the end of 2019.
Its research and development, testing and standardization has occurred within a strong global ecosystem of suppliers and car manufacturers to ensure reliability in diverse road and traffic conditions.
Wi-Fi therefore forms the basis of the European standard that has been chosen for vehicle-to-vehicle and vehicle-to-infrastructure communication, according to NXP. An additional benefit is its availability independent of paid cellular services. Other developing cellular-based technologies can be added complementary to Wi-Fi-based V2X.
Migration to autonomous. V2X communication is set to become a critical part of advanced driving assistance systems (ADAS) and the migration to autonomous cars that communicate with each other and with traffic infrastructure.
The benefit of Wi-Fi-based V2X is its robust, low latency, real-time communication regardless of any car brands.
It enables awareness and communication between cars, road infrastructure like traffic lights or street signs, and other road users such as cyclists and pedestrians.
It is a technology that is collaborative, allowing it to “tap into” surrounding sensor data from mutually equipped cars to warn of hazards and prevent accidents.
V2X is a technology that complements other ADAS sensing technologies such as radar, lidar and cameras.
It helps vehicles to “see” more than a mile ahead and around corners to provide early warning of obstacles, hazards and road conditions.
It has the ability to “see” through objects, delivering more information than that obtained through line of sight only.
Its sensing capabilities are unaffected by poor weather conditions.
Starting this year, new-generation GNSS-based landing systems — ground-based augmentation systems or GBAS — will be deployed at airports all around Europe to increase runway capacity by up to 6% in peak traffic periods, according to Indra, a key partner of the European GBAS Alliance.
The GBAS technology allows aircrafts to make steeper approaches, which saves fuel and reduces noise and CO2 emissions. GBAS further improves airport capacity by letting approaching aircraft use different glide slopes to avoid wake turbulence left by precedent aircraft in the runway.
According to research by the European Union’s SESAR initiative supported by Eurocontrol simulations, this can lead to a runway capacity increase between 2% and 6%.
The European GBAS Alliance includes airports, airlines, air navigation service providers and air- and ground-manufacturing industry working for a coordinated and synchronized deployment of ground-based augmentation systems (GBAS).
Photo: Indra
The plan is for deployment preparations to start this year, and ramp up in 2020. The focus is particularly on precision approaches in low-visibility conditions.
The first collaborative meeting took place in Toulouse, France, in June with more than 20 organizations represented.
GBAS is recognized as a supplement and, in the future, the replacement of instrument landing systems (ILS).
A synchronized GBAS implementation for low visibility operations (GBAS GAST D for categories II and III) will lead to environmental, economical, capability and safety benefits for airports, airlines and air navigation service providers.
Indra has been a driver for GBAS development for years, and is one of the initiators behind the European GBAS Alliance. It contributes with one of the technological pillars; the NORMARC GBAS system is an Indra Air Solution capable of guiding aircraft even in low visibility conditions (CAT II and III). The technology is ready, and the focus now is on getting the infrastructure and regulatory framework in place.
“The great response to this initiative is very encouraging,” said Hugo Moen, GBAS general sales manager at Indra. “In spite of the indisputable benefits to everyone, we need a collective effort to get out of a “chicken or egg” situation. Both airlines and airports need to make some investments, but airlines are reluctant to invest in GBAS receivers for aircraft as few airports have the required infrastructure. Likewise, airports or ANSPs are not investing since few aircraft can make use of the system.”
GBAS differs from ILS in being based on GNSS instead of conventional radio signals. Whilst ILS signals can be affected by topography and other physical objects, GBAS has no critical or sensitive areas. This allows for higher capacity during precision approaches, reducing the risk of diversion, cancellation and go-around.
“GBAS enables steeper and shorter approaches. Precision landings can be performed at airports where this has not been possible due to topography or other reasons. In Norway, we have used GNSS-based landing systems at 17 airports for many years, with great results. It is nice to see the industry working together so more countries can benefit from this new technology,” said GBAS Product Manager Linda Lavik from Indra.
The FALCon research project has already carried out initial flight experiments with unmanned small aircraft. (Photo: German Aerospace Center)
The parachute safety solution manufacturer Drone Rescue Systems GmbH is supporting the European research project FALCon, the “Formation flight for in-Air Launcher 1st stage Capturing demonstration.”
Under the leadership of the German Aerospace Center (Deutsches Zentrum für Luft- und Raumfahrt; DLR), research is being conducted on how launch vehicles can be returned to the launch site as efficiently as possible for re-use.
The aim of FALCon is to achieve cost-efficient and environmentally friendly satellite transport. The focus of the project lies on the return of rocket stages after launch. To be able to reuse these stages, efforts are being made to recapture them in the air using a “rocket catcher.”
For the next three years (March 2019 to February 2022) the focus will be on the development and flight demonstration of a technical solution for this idea. While still in the air, rocket stages are to be captured by a transport aircraft over the sea and pulled into the vicinity of the landing site. There, the stages are to land independently.
“We are proud to be part of the FALCon research project together with five international partners and DLR as part of HORIZON2020 (EC grant 821953), the EU’s largest research and innovation program to date. The capture and towing of rocket stages in flight, that is, an autonomous and safe landing, is a particularly interesting topic for us as a manufacturer of parachute safety solutions,” said Andreas Ploier, CEO of Drone Rescue Systems GmbH.
The research project has already carried out initial flight experiments with unmanned small aircraft.
The European GNSS Agency (GSA) is organizing a public consultation on the Integrity & Reliability of Digital Maps for Connected and Automated Driving, in connection with the recently published Commission Communication on Connected and Automated Mobility.
This communication addresses the need to investigate the integrity and reliability of digital maps in order to facilitate the deployment of fully automated and connected vehicles.
Image: GSA
Digital maps are an essential building block to ensure a safe driving experience for highly automated driving and autonomous vehicles. Purpose-built maps will be produced that will be much more reliable and accurate than those used for traditional applications.
These digital maps will be enriched with information from public databases and sensor data from connected vehicles. Traffic information, such as speed limits or the real-time dynamics of traffic flow, will help the vehicle’s navigation system to anticipate upcoming road conditions and take decisions beyond what is enabled by the vehicle’s on-board sensors.
Key role for GNSS
Satellite navigation (GNSS), and in particular Galileo, plays a key role in providing precise and secure positioning in vehicle navigation technologies for driverless mobility. Moreover, GNSS is the primary sensor for building digital maps to provide very accurate positioning together with other sensors, such as LiDAR, for example.
Dynamic data pose specific problems, particularly given their real-time nature: they must be generated, validated and made available to the user equipment without delay. This makes their integrity validation more challenging, and their transmission can be subject to errors or disruptions affecting the overall reliability.
Addressing the issue
Currently, it is the navigation and map provider’s responsibility to ensure the integrity of its products and the reliability of the information provided by third-party suppliers. However, until now the maps have been mainly used to support navigation, giving information to the driver, rather than to support safety-related functions.
Some industry standards exist or are being developed for data exchange and map content, but there are currently no specific standards or certification procedures to assess map data quality characteristics, such as reliability, integrity, and traceability. This public consultation is a starting point in addressing this issue.
Have your say
The public consultation can be accessed here. It will be open until Jan. 27.
