Evaluation of the Integrity Risk for Precise Point Positioning

Abstract

Global Navigation Satellite System (GNSS) Precise Point Positioning (PPP) is an attractive positioning technology due to its high precision and flexibility. However, the vulnerability of PPP brings a safety risk to its application in the field of life safety, which must be evaluated quantitatively to provide integrity for PPP users. Generally, PPP solutions are processed recursively based on the extended Kalman filter (EKF) estimator, utilizing both the previous and current measurements. Therefore, the integrity risk should be qualified considering the effects of all the potential observation faults in history. However, this will cause the calculation load to explode over time, which is impractical for long-time missions. This study used the innovations in a time window to detect the faults in the measurements, quantifying the integrity risk by traversing the fault modes in the window to maintain a stable computation cost. A non-zero bias was conservatively introduced to encapsulate the effect of the faults before the window. Coping with the multiple simultaneous faults, the worst-case integrity risk was calculated to overbound the real risk in the multiple fault modes. In order to verify the proposed method, simulation and experimental tests were carried out in this study. The results showed that the fixed and hold mode adopted for ambiguity resolution is critical to an integrity risk evaluation, which can improve the observation redundancy and remove the influence of the biased predicted ambiguities on the integrity risk. Increasing the length of the window can weaken the impact of the conservative assumption on the integrity risk due to the smoothing effect of the EKF estimator. In addition, improving the accuracy of observations can also reduce the integrity risk, which indicates that establishing a refined PPP random model can improve the integrity performance.

1. Introduction

Precise single positioning (PPP) technology can provide high-precision positioning for Global Navigation Satellite System (GNSS) users with the help of precise correction information, and by utilizing the code and carrier phase observations [1,2,3]. Generally, the positioning accuracy of the kinematic PPP solution with float-ambiguity after convergence can reach the decimeter to centimeter level. An even better solution and shorter convergence time can be obtained with the integer carrier-phase ambiguities resolved correctly [4,5,6,7,8]. Unlike traditional differential positioning, such as real time kinematic (RTK) and network RTK, PPP is an absolute positioning technology that requires no reference stations and can be applied anywhere in the world. Moreover, PPP can also be augmented by a regional reference station network or integrated with satellite based augmentation system services [9,10,11,12,13,14]. Benefiting from the high precision and flexibility, the application range of PPP is gradually expanding, even moving toward the life-critical field, such as in automotive, maritime and air navigation applications [15,16,17,18]. For users in the field relating to life safety, the accuracy is no longer the most concerning requirement but the safety, which means the positioning solution must be reliable and trustworthy [19,20]. Compared with single point positioning (SPP), PPP is more vulnerable because there are more potential sources of failure, which are categorized into the following five groups in [21]: satellite and signal faults, atmosphere anomalies, product and correction faults, work environment anomalies, and user-end faults. These faults may contaminate observations and result in unsafe PPP location results. Typically, observation faults can be detected, to some extent, based on the data quality control algorithms in PPP [22,23]. Unfortunately, the ones that successfully escape detection may cause a hazardous position error (PE) to the unaware users due to poor observation geometries. In GNSS integrity monitoring, this situation is called hazardous misleading information (HMI), defined as the user’s PE exceeding the alert limit (AL, defined by the requirements), while no timely alarm is triggered. For life-critical applications, the HMI events can cause great potential dangers to the user’s positioning safety. Therefore, it is of vital importance to evaluate the probability of HMI (also called integrity risk) quantitatively to provide confidence on the current positioning results.

Receiver autonomous integrity monitoring (RAIM) is a user-level algorithm to ensure the reliability of positioning that originates in the field of civil aviation [24]. RAIM contains two basic functions; one is fault detection and exclusion, and the other is the evaluation of integrity risk. The former is realized by the designed fault detector and threshold. The latter quantifies the risk of the undetected faults by providing an upper bound of the real integrity risk, or equivalently, providing the protection level (PL) to overbound the PE according to the integrity risk requirement [25]. After decades of development, RAIM has evolved from traditional RAIM to Advanced RAIM (ARAIM) [26]. The former was originally designed to provide services for GPS (Global Positioning System) aviation users during the on route phase calculating the PL under no more than one undetected fault hypothesis [27,28]. The latter was developed with the emergence of multi-frequency and multi-constellation to provide integrity for flight phases with more stringent requirements (for instance, Localizer Performance with Vertical Guidance 200 foot minima, LPV-200) considering multiple simultaneous undetected faults [29,30]. The aviation RAIM algorithms are implemented for SPP with the least-squares estimator (snapshot estimator), which only uses the observations at the current moment. Differently, the extended Kalman filter (EKF) estimator is widely adopted for PPP positioning, which is a recursive estimator utilizing both the previous and current measurements [31]. Indeed, the EKF solution coincides with the batch least square solution that uses the current and all the previous measurements as well as the propagation equations [32]. However, it is unsuitable to directly apply the existing snapshot RAIM algorithms to PPP in the batch least square form because of the increasing amount of matrix storage and calculation over time, especially for the long-time mission. To provide integrity for EKF applications, Tanil et al. [33,34] proposed a sequential integrity monitoring method using chi-square detection considering all the measurement faults in history. However, it still cannot avoid the problem of the increasing computation load. In this regard, Arana et al. [35] introduced a time window monitoring method to maintain the constant computation requirements. Meanwhile, it is robust against faults prior to the window, which is important for the practical implement of integrity monitoring for the EKF estimator.

Limited studies for PPP integrity have been conducted in recent years and have not been well-accepted in models and methods. The authors of [36,37] adopted the traditional RAIM algorithms directly in PPP, which potentially assumed that the predicted states were fault-free and only a single fault in the current observations. However, the assumptions are not appropriate for PPP because the predicted states may contain biases caused by the previous undetected faults. Moreover, the use of observations from multi-frequency and multi-constellation will increase the possibility of instantaneous multiple faults, especially when utilizing the phase observations. Based on the ARAIM algorithms developed earlier, Gunning et al. [38] initially designed the integrity monitoring for PPP using the multiple hypothesis solution separation algorithm, but brought a computational burden due to the use of a bank of parallel filters. Accordingly, Blanch et al. [39] chose the suboptimal filters to reduce the calculation cost and, therefore, degraded the integrity performance due to the increased PL. However, the results suggested that the degradation may be acceptable given the potential computational load savings. To provide PL for PPP in multipath prone environments, Blanch et al. [40] further modified the threat model to better account for local threats to guarantee the integrity in challenging environments such as urban and suburban roads. Facing the challenge of providing the integrity for land users, the Spanish company GMV proposed their own integrity concept, which was a little different from that commonly used in the aviation field [41]. The PL they constructed claimed to have good performance under different test conditions; however, adequate mathematical explanations of the related methods rarely appear in the literature.

In order to extend PPP to the life-critical field, the integrity risk of the PPP solution should be evaluated quantitatively to ensure the users’ safety. The evaluation method should not only adapt to the characteristics of the PPP processing, but also have an appropriate calculation cost for practical applications. This study evaluated the integrity risk considering multiple simultaneous undetected faults under the conservative assumption that the predicted states in the EKF are biased, which are caused by the previous measurement faults. Based on a previous study [35], a time monitoring window was adopted to reduce the impact of the conservative assumption and maintain the computation load. Moreover, the influence of ambiguity was also considered. The remainder of this contribution is organized as follows. First, Section 2 introduces the EKF processing and the method of integrity risk evaluation. Secondly, the PPP simulation experiment is designed, and the related results are analyzed in Section 3. Finally, some conclusions and future work are given in Section 4.

2. Methods

2.1. EKF Processing

EKF estimator is widely adopted in PPP algorithms, which is implemented based on the following prediction model:

$$x_k={\Phi }_{k|k-1}{x}_{k-1}+{\Gamma }_k{w}_k\mathrm{where}{w}_k~N(0,Q_k)$$

(1)

and the following observation model:

$$z_k=H_k{x}_k+f_k+v_k\mathrm{where}{v}_k~N(0,R_k)$$

(2)

where the subscript $k$ stands for the current epoch; $x$ is the true states including the user’s coordinates, receiver clock or other estimates; $\Phi$ is the state evolution matrix and $\Gamma$ is the noise coupling matrix; $z$ represents the linearized observation vector and $H$ is the linearized design matrix; $w$ and $v$ denote the nominal process noise and observation error, which are both assumed to be white Gaussian noise with the covariance matrix $Q$ and $R$, respectively; and $f$ is the observation fault vector caused by the various anomalies mentioned in the introduction part. Generally, $f$ is modeled as an unknown bias vector whose elements are nonzero only when measurements are contaminated. This means that under a fault-free condition, $f$ is a zero vector. In this study, the state evolution model was assumed to not have any faults, and the faults only appeared in the observations. The EKF processing can be implemented using the following equations:

$$x_k^{(-)}={\Phi }_{k|k-1}{x}_{k-1}^{(+)}$$

(3)

$$P_k^{(-)}={\Phi }_{k|k-1}{P}_{k-1}^{(+)}{\Phi }_{k|k-1}^T+{\Gamma }_k{Q}_k{\Gamma }_k^T$$

(4)

$${\gamma }_k=z_k-H_k{x}_k^{(-)}$$

(5)

$$W_k={(H_k{P}_k^{-}{H}_k^T+R_k)}^{-1}$$

(6)

$$K_k=P_k^{-}{H}_k^T{W}_k$$

(7)

$$x_k^{(+)}=x_k^{(-)}+K_k{\gamma }_k$$

(8)

$$P_k^{(+)}=(I-K_k{H}_k)P_k^{(-)}$$

(9)

where the superscript (−) and (+) denote the predicted and updated values, respectively; $P$ is the variance covariance matrix that contains the uncertainties of the states; $W$ is the weight matrix of the innovation vector $\gamma$; and $K$ is the Kalman gain matrix. The EKF can be operated recursively once $x_{k-1}^{(+)}$ and $P_{k-1}^{(+)}$ are initialized.

2.2. Integrity Risk Evaluation

For integrity monitoring, an integrity risk evaluation is required to quantitatively describe the impact of undetected faults on the safety of current positioning, which is expressed as the probability of HMI as follows:

$$P(HM{I}_k)=P(\left|{\epsilon }_k\right|>AL\cap D_k<T)$$

(10)

where ${\epsilon }_k=\alpha \delta x_k^{(+)}$ is the PE in the direction of interest and $\delta x_k^{(+)}=x_k^{(+)}-x_k$ is the EKF estimated state error. $\alpha$ is the corresponding extraction vector; for instance, $\alpha =\left[\begin{array}{ccccc}1& 0& 0& \cdots & 0\end{array}\right]$ is set for the PE in the first direction. $D_k$ is the designed fault detector and $T$ is the corresponding threshold. To calculate (10), the probability distributions of ${\epsilon }_k$ and $D_k$ are required, which will be demonstrated next.

2.2.1. The Distribution of PE and Detector

Under the normality of the observation error and process noise, PE is normally distributed as follows:

$${\epsilon }_k~N(\alpha {\mu }_k^{(+)},\alpha P_k^{(+)}{\alpha }^T)$$

(11)

where ${\mu }_k^{(+)}$ is the expectation of $\delta x_k^{(+)}$. As shown in Appendix A, ${\mu }_k^{(+)}$ is influenced by the current and all previous observation faults. Given a time window of $M$ epochs prior to $k$, ${\mu }_k^{(+)}$ can be expressed as follows:

$${\mu }_k^{(+)}=A_k^M{f}_k^M$$

(12)

where $A_k^M$ is a known matrix containing EKF information in the window as shown in Appendix A. $f_k^M={\left[\begin{array}{ccccc}{f}_k^T& f_{k-1}^T& \cdots & f_{k-M}^T& {\mu }_{k-M-1}^{(+)}{}^T\end{array}\right]}^T$ is the combined fault vector that contains the faults in the window and encapsulates the faults prior to the window into the bias at $k-M-1$ epoch.

The fault detector should react when a fault occurs. In the EKF, the innovations measure the consistency between the actual measurements and the predicted ones. As a result, in this study, the fault detector was defined as the sum of squares of the normalized innovations in the time window as follows:

$$D_k={({\gamma }_k^M)}^T{W}_k^M({\gamma }_k^M)$$

(13)

where ${\gamma }_k^M={\left[\begin{array}{cccc}{\gamma }_k^T& {\gamma }_{k-1}^T& \cdots & {\gamma }_{k-M}^T\end{array}\right]}^T$ denotes the innovations in the window. $W_k^M$ is the correspond weight matrix expressed as $W_k^M=Diagblk\left[\begin{array}{cccc}{W}_k& W_{k-1}& \cdots & W_{k-M}\end{array}\right]$, where $Diagblk[·]$ means forming a diagonal block matrix. Since the innovations at different epochs are independent [33], the detector follows a non-central chi-squared distribution as follows:

$$D_k^M~{\chi }^2(n_k^M,{\lambda }_k^M)$$

(14)

where $n_k^M$ is the degree of freedom, which is equal to the number of observations in the window. ${\lambda }_k^M$ is the non-centrality parameter as follows:

$${\lambda }_k^M={(f_k^M)}^T{Y}_k^M(f_k^M)$$

(15)

where $Y_k^M$ is a known term derived in Appendix B. Under the fault-free condition ($f_k^M=0$), the detector follows a central chi-squared distribution and the threshold $T$ can be determined for a given false alarm requirement, $P_{fa}$, as follows:

$$T={\chi }_{n_k^M}^{-2}{\displaystyle [}1-P_{fa}{\displaystyle ]}$$

(16)

where ${\chi }_a^{-2}[·]$ is the inverse central chi-squared cumulative distribution function with the degree of freedom of $a$.

One advantage of selecting an innovation-based detector is that the PE and fault detector are independent [33]. Therefore, the Equation (10) becomes the following:

$$P(HM{I}_k)=P(\left|{\epsilon }_k\right|>AL)P(D_k<T)$$

(17)

Under the fault-free condition, Equation (17) can be calculated directly based on the known distributions of the PE and detector. However, the distributions are not clear for the faulted conditions due to the unknown $f_k^M$, which is the difficulty for integrity risk evaluation.

2.2.2. Fault Mode

To simplify the problem, the integrity risk can be evaluated under all potential fault modes, which are all combinations of observation faults in history. However, as the number of observations used by EKF estimator increases, the number of fault modes rises exponentially, which will cause the calculation load to explode over time [31]. In this regard, this study only considered the fault modes within the time window to maintain the computation cost, since the number of fault modes within the time window was relatively stable [35]. In addition, a non-zero bias ${\mu }_{k-M-1}^{(+)}$ was conservatively introduced to contain the effect of the observation faults prior to the window. This conservative assumption is reasonable, because, on the one hand, the integrity risk can be appropriately given a conservative value; on the other hand, its impact can be weakened by the window due to the smoothing effect of the EKF estimator.

Using the total probability rule, the integrity risk can be expressed as follows:

$$P(HM{I}_k)={\displaystyle {\displaystyle \sum }_{i=0}^{n_h}\left[P(HM{I}_k|h_i)P(h_i)\right]}$$

(18)

where $h_i$ represents the i-th fault mode and, in particular, $h_0$ means the observations in the window are fault free. Given the independence of different observation faults, $P(h_i)$ indicates the probability of $j$ instantaneous faults as follows [29]:

$$P(h_i)=P(h_0){\displaystyle \prod _{s=1}^j\frac{P_{s\_fault}}{1-P_{s\_fault}}}$$

(19)

where $P(h_0)={\displaystyle \prod _{s=1}^{n_k^M}(1-P_{s\_fault}})$ and $P_{s\_fault}$ is the probability of the fault on the s-th observation. In ARAIM, $P_{s\_fault}$ is obtained from the integrity support message [30]. However, in this study, $P_{s\_fault}$ was given by a prior value for the purpose of algorithm research.

Although a time window was adopted, evaluating the integrity risk under all fault modes was still computationally intensive. Fortunately, it was unnecessary because the probability of a large number of instantaneous faults was very low. Therefore, this study only evaluated the risk for the modes with no more than $n_{max}$ simultaneous faults, and conservatively overbounded the risk for the modes with more than $n_{max}$ faults as $P_{unevaluated}$ using the following equation [29]:

$$\frac{1}{n_{max}!}({\displaystyle \sum _{s=1}^{n_k^M}{P}_{s\_fault}{)}^{n_{max}}}\le P_{unevaluated}$$

(20)

where $P_{unevaluated}$ is the user defined integrity risk allocation that accounts for the risk of unevaluated fault modes and $n_{max}$ can be determined as the largest integer that from Equation (20). Therefore, $P(HM{I}_k)$ can be overbounded as follows:

$$P(HM{I}_k)\le {\displaystyle {\displaystyle \sum }_{i=0}^{n_{h\_max}}\left[P(HM{I}_k|h_i)P(h_i)\right]}+P_{unevaluated}$$

(21)

where $n_{h\_max}$ denotes the number of fault modes with no more than $n_{max}$ faults.

2.2.3. The Worst-Case Integrity Risk

In the i-th fault mode, the unknown fault vector $f_{k,i}^M$ is still left to be determined to calculate the term $P(HM{I}_k|h_i)$ in Equation (21). In this regard, the concept of “worst-case” commonly used in integrity monitoring is introduced to determine the worst-case integrity risk. Angus et al. [42] showed that the direction of $f_{k,i}^M$ that maximizes $P(HMI|h_i)$ is the one that results in the highest slope, which is defined as follows:

$$Slop{e}_i=\frac{{(\alpha A_k^M{f}_{k,i}^M)}^T\alpha A_k^M{f}_{k,i}^M}{{(f_{k,i}^M)}^T{Y}_k^M{f}_{k,i}^M}$$

(22)

where the numerator is the squared expectation of the PE, and the denominator is the non-centrality parameter of the fault detector. For $f_{k,i}^M\ne 0$, the denominator of Equation (22) is positive. Therefore, $Y_k^M$ is a positive definite matrix that can be orthogonally decomposed as $Y_k^M=C\Lambda C^T$, where $\Lambda$ is a diagonal matrix composed of the eigenvalues of $Y_k^M$, and $C$ is an orthogonal matrix composed of the corresponding eigenvectors. Equation (22) can be expressed further as follows:

$$Slop{e}_i=\frac{{(f_i^{*})}^{T}G{f}_i^{*}}{{(f_i^{*})}^T{f}_i^{*}}$$

(23)

where $f_{k,i}^M=C{\Lambda }^{-1/2}{C}^T{f}_i^{*}$ and $G=C{\Lambda }^{-1/2}{C}^T{(A_k^M)}^T{\alpha }^T\alpha A_k^{M}C{\Lambda }^{-1/2}{C}^T$. For the expression of Equation (23), the maximum slope is the maximum eigenvalue of $G$ and the worst direction of $f_i^{*}$ is that of the corresponding eigenvector $q_{dir}$. Therefore, the worst direction of $f_{k,i}^M$ can be expressed as follows:

$$f_{k,i,worst\_dir}^M=C{\Lambda }^{-1/2}{C}^T{q}_{dir}$$

(24)

and the worst $P(HM{I}_k|h_i)$ can be obtained by searching the magnitude of $f_{k,i}^M$ ($\Vert f_{k,i}^M\Vert$) along $f_{k,i,worst\_dir}^M$:

$$P{(HM{I}_k|h_i)}_{worst}=\underset{\Vert f_{k,i}^M\Vert }{\max }\left[P(|Z|>AL)P(D_k<T)\right]$$

(25)

where $Z~N(\Vert f_{k,i}^M\Vert \alpha A_k^M{f}_{k,i,worst\_dir}^M,\alpha P_k^{(+)}{\alpha }^T)$ and $D_k~{\chi }^2(n_k^M,{\Vert f_{k,i}^M\Vert }^2{f}_{k,i,worst\_dir}^M{Y}_k^M{f}_{k,i,worst\_dir}^M)$. Ultimately, the integrity risk output to the user is as follows:

$$P{(HM{I}_k)}_{output}={\displaystyle \sum _{i=0}^{n_{h\_max}}P{(HM{I}_k|h_i)}_{worst}}P(h_i)+P_{unevaluated}$$

(26)

Once $P{(HM{I}_k)}_{output}$ exceeds the requirement, the current positioning solution will be considered unreliable, and the system will be declared unavailable.

3. Experiments

3.1. Design of the Simulated PPP

In this section, a simulated PPP was designed to verify the method of integrity risk evaluation. The reason for adopting a simulation test is that on the one hand, it can strictly guarantee the normality of the errors, which is the precondition for integrity monitoring; on the other hand, it is more effective to control the changing of inputs in order to validate the performance of the algorithm. In this study, a simulated dynamic ionosphere-free (IF) PPP was designed and the states included the receiver coordinates, velocities, accelerations, receiver clock, zenith tropospheric delay (ZTD), and IF ambiguities.

Figure 1 shows the entire simulation process, including the prediction of states, observation simulation, linearization, fault detection, update, and risk evaluation. The process started with the prediction of the states. The coordinates, velocities, and accelerations were predicted using a constant acceleration model. The receiver clock error was modeled by the white noise. ZTD was modeled as random-walk noise using a Saastamoinen model and Niell Mapping Function [43,44]. The ambiguities were considered to be time invariant. In the observation simulation part, the IF code and phase observations were generated based on the truth of states and the satellite precise orbit and clock products provided by the GeoForschungsZentrum Potsdam (GFZ) center. The observation errors were randomly generated by the given covariance. The generation of process noise in the prediction part was similar but is not shown in the figure for brevity. In the update part, the fixed and hold mode was adopted for an ambiguity resolution. That is, if the ambiguity change of a certain satellite is continuously smaller than the given threshold for epochs, the ambiguity will be fixed and no longer be estimated in the EKF until the satellite descends.

Table 1. Configuration of the parameters for the simulated PPP and integrity risk evaluation.

Input Information	Settings
Navigation system	GPS
Calculation interval	10 (s)
Period	9/19/2021 00:00:00–9/19/2021 02:00:00
Cut-off elevation	10°
Weighted model	Elevation weighted
Standard deviation of raw observations	Code: ${\sigma }_P=100{\sigma }_{\varphi }$ Phase: ${\sigma }_{\varphi }=0.3$ (cm)
Standard deviation of initialized states\process noise	${\sigma }_{Position}=1\backslash 0.01$ (m) ${\sigma }_{Velocity}=10\backslash 0.01$ (m) ${\sigma }_{Acceleration}=10\backslash 0.01$ (m) ${\sigma }_{ReceiverClock}=10\backslash 0$ (m) for every epoch ${\sigma }_{ZWTD}=0.5\backslash {10}^{-4}$ (m) ${\sigma }_{Ambiguity}=1\backslash {10}^{-6}$ (m)
$P_{fa}$	${10}^{-7}$
$P_{s\_fault}$	${10}^{-5}$
$P_{unevaluated}$	${10}^{-8}$
$AL$	0.1 (m) for the east and north directions and 1 (m) for the up direction
Length of the window	2 epochs

shows the configuration of the related parameters for the simulated PPP positioning and integrity risk evaluation.

3.2. Experimental PPP Test

To verify the effect of the proposed method in the real environment, the static IF PPP experiments were carried out using the data collected by four International GNSS Service (IGS) tracking stations (as shown in Figure 2). The observation data and precise products could be accessed from the Crustal Dynamics Data Information System (CDDIS) center. The state parameters contained receiver coordinates, a receiver clock, ZTD, and IF ambiguities. The receiver coordinates were considered to be time invariant, and the other parameters were modeled in line with the description in the simulated PPP. The fixed and hold mode was still adopted for the ambiguity resolution. Moreover, the ambiguity parameters would be reinitialized when a new satellite rose, and a cycle slip occurred. The detailed processing strategies for the experimental PPP are listed in

Table 2. Detailed processing strategies for the experimental static PPP.

Items	Strategies
Navigation system	GPS
Frequencies	L1, L2
Calculation interval	30 (s)
Period	9/19/2021 00:00:00–9/19/2021 04:00:00
Weighted model	Elevation weighted
Standard deviation of raw observations	Code: ${\sigma }_P=100{\sigma }_{\varphi }$ Phase: ${\sigma }_{\varphi }=0.3$ (cm)
Standard deviation of initialized states\process noise	${\sigma }_{Position}=1\backslash 0$ (m) ${\sigma }_{ReceiverClock}=10\backslash 0$ (m) for every epoch ${\sigma }_{ZWTD}=0.12\backslash {10}^{-4}$ (m) ${\sigma }_{Ambiguity}=0.6\backslash {10}^{-4}$ (m)
Precise satellite orbits and clocks	Products provided by the GFZ center
Differential code bias	Corrected by the products provided by the Chinese Academy of Sciences
Relativistic effect	Corrected
Phase wind-up	Corrected
Earth rotation effects and tidal displacements	Corrected by the earth rotation file provided by the GFZ center
Antenna phase center offset and variation correction	Corrected by the igs14_2178.atx file
Truth of station coordinate	Provided by the igs21P21760.snx file
Ambiguity resolution	Fixed and hold mode

. The configuration of parameters for integrity risk evaluation is the same as that set for the simulated PPP in Table 1.

4. Results and Discussion

4.1. Simulated Results

This section shows the results of the simulated PPP. Figure 3 shows the PEs, three times of updated standard deviations (STDs) and ALs for the east (E), north (N) and up (U) directions. After a period of convergence (about 15 min), the accuracy of the PEs can reach the centimeter level and the RMSs are 1.0, 0.8 and 2.5 cm for the E, N and U directions, respectively. Figure 4 demonstrates the integrity risk evaluated for the E, N, and U directions. The green solid lines and blue dotted lines show the output integrity risk with and without ambiguity fixed, respectively. It can be seen that if the strategy of ambiguity fixed is not adopted, the integrity risk is almost equal to one all the time, which means that the algorithm will not be available. This is because when the ambiguities are estimated as floating points in the EKF, there are fewer redundant observations. In addition, the algorithm assumes, conservatively, that the updated states before the window are biased, which amplifies the impact of ambiguities on the integrity risk. Therefore, the ambiguities are partially fixed in this study and, subsequently, are no longer estimated in order to reduce the number of states in the EKF and improve the observation redundancy. From Figure 5, it can be seen that as the filtering progresses, the ambiguities begin to be partially fixed, and the number of estimates in the EKF decreases accordingly. After about 17 min, all the ambiguities are fixed, and the integrity risk is drastically reduced correspondingly, as shown by the green solid lines in Figure 4.

Figure 6 demonstrates the change of the fault detector and threshold. Since no faults were added into the simulated observations, the chi-square test statistic is always less than the threshold. For the strategy of ambiguity fixed adopted in this study, the fault detector can protect the PE from the contamination of the ambiguity fixed error. Furthermore, even if the ambiguity fixed error escapes detection, the integrity risk caused by the wrong ambiguities can be quantified to ensure the reliability of the positioning.

Figure 7 shows the integrity risk evaluated using the configuration in Table 1 but with windows of different lengths. It can be seen that increasing the length of the window will reduce the integrity risk, since the longer window reduces the impact of the conservative assumption that the undetected faults prior to the window always exist and result in the worst estimate bias at the $k-M-1$ epoch. However, increasing the length of the window without a limit will result in a computational burden due to the increased number of fault modes. Therefore, the length of the window should be selected appropriately, trading off the computing performance of the hardware and the actual integrity requirements.

To quantify the effect of the random model, the configuration in Table 1 is used but with different STDs of the raw observations to evaluate the integrity risk and accuracy of the PE. Figure 8 and

Table 3. The RMS of the PEs using different STDs of raw observations after convergence (unit: cm).

${\mathit{\sigma }}_{\mathit{\varphi }}$	E	N	U
0.3	1.0	0.8	2.5
0.4	1.3	1.1	3.4
0.5	1.8	1.4	4.2

show the corresponding integrity risk and RMSs of the PE, respectively. It can be seen that reducing the STD of the raw observations can not only improve the accuracy of the positioning result, but also reduce the risk of integrity. Therefore, the establishment of a reliable and refined PPP random model is very important to improve the performance of accuracy and integrity.

4.2. Experimental Results

This section shows the results of the experimental PPP. Figure 9 displays the static PPP positioning results of the four IGS stations. It can be seen that after about 15 min of convergence, the positioning accuracy can reach the centimeter level. The RMSs of the E, N and U directions are 3.1, 2.2 and 2.8 cm for the BREW station, 1.6, 2.6 and 2.6 cm for the FAIR station, 2.5, 1.0 and 6.1 cm for the HUEG station, and 0.8, 0.5 and 4.8 cm for the DAV1 station, respectively. Figure 10 shows the time series of the fault detectors and thresholds using the window length of 2, 4 and 6 epochs for the four stations. No obvious observation faults were detected in this experimental stage. Some obvious protrusions on the change curves of the detector are caused by the initialization of the ambiguities of the newly rising satellites.

Figure 11 shows the integrity risk evaluated using the corresponding lengths of the window for the four stations. All the stations complete the initialization (ambiguity resolution) before 30 min and then start the integrity risk evaluation. It can be seen that the integrity risk results of the different stations are inconsistent during the same positioning period. This is mainly because, on the one hand, the different observation geometries are caused by the different positions of the stations; on the other hand, the difference in the ambiguity resolution results in a different observation redundancy, especially the reinitialization of the ambiguities caused by the rise of new stars and cycle slips. Noted by different colors, the integrity risk evaluated using different lengths of window for each station are also shown in Figure 11. It can be seen that increasing the length of the window can reduce the integrity risk, which is consistent with the results of the simulated PPP. However, there are periods when the degree of risk reduction is not obvious, such as from 50 to 70 min in the N direction of the HUEG station and from 90 to 120 min in the U direction of the DAV1 station. This is related to the poor observation geometries during these periods, requiring a longer window to further reduce the risk.

5. Conclusions

In this study, the integrity risk of PPP was evaluated quantitatively considering the recursive characteristics of the EKF solution. A time window was employed to maintain the computation load by traversing the fault modes limited within the window. To account for the impact of the faults prior to the window, a non-zero bias was conservatively introduced. Dealing with the multiple instantaneous potential faults, the worst-case integrity risk was quantified to overbound the real risk in multiple fault modes. Moreover, the fixed and hold mode was adopted for an ambiguity resolution to remove the influence of the ambiguities in the integrity risk.

The methodology of the integrity risk evaluation for PPP was derived rigorously. The effect was validated in both the simulated and experimental tests, which show a good consistency. The results suggest that the fixed and hold strategy adopted for the ambiguity resolution is the key to applying this method to PPP, as it can increase the observation redundancy and thereby reduce the integrity risk. Moreover, it can also remove the influence of the biased predicted ambiguities on the integrity risk under the conservative assumption. Increasing the length of the window can further weaken the impact of the bias on the integrity risk because of the smoothing effect of the EKF estimator. However, selecting the length of the window should weigh the computing load and the given integrity requirements. The STD of the raw observations was changed to investigate the influence of the random model on the integrity risk. The result shows that reducing the STD cannot only improve the positioning accuracy, but also decrease the integrity risk. This indicates that establishing a refined PPP random model can improve the PPP positioning and integrity performance, which will be studied in future work.