ITHACA
Integrity Service Complementing EGNSS High-Accuracy

Figure 2. OBU architecture

One important conclusion obtained from this process is that user algorithm standardization is however considered as a key step to ensure Service Liability. Nevertheless, GNSS high accuracy algorithms are currently a field of active research, where tailored solutions are being defined for each particular application. Therefore, with the goal in mind to provide to the service enough flexibility to be widely accepted by the industry; at least, a minimum set of requirements can be set to the usage of integrity message in order to be able to apply some kind of liabilities, namely:

1) OBU Integrity concept adequately interprets the usage of the integrity message in the Protection Level

2) Risk allocation is compatible with message content

A set of requirements were derived in order to better define the functionality of the intended E-GNSS integrity concept. Several aspects on service operation were analysed resulting into requirements to the supported constellations, GNSS network topology and equipment, security constraints, authentication needs, dissemination means or even the concept of operations.

Subsequently, a multi-layered validation approach is proposed in order to perform a full test campaign. This approach involves validation of the OBU Integrity concept and the GNSS integrity service separately, as well as so-called End-to-end validation of the combination. High level requirements to perform defined validation were provided.

E-GNSS Integrity Service definition

Proposed service consists on the addition of an integrity layer on top of the High accuracy corrections provided as evolutions of current Galileo and EGNOS services.

Figure 3. High Level Architecture EGNSS+ Integrity Service

Main requirements fulfilled by the proposed system are presented in Table 1.

Table 1. Identified Service requirements

ITHACA Service Integrity concept presents a multi layered approach, considering two complementary concepts of “Online” and “Offline” integrity:

• Offline integrity is based on the analysis of the service history, obtaining an offline estimation of the service accuracy with respect to external reference products. This provides the user with a fair estimation on what error he can expect from the received corrections in their different components in nominal situations (orbit, clock, atmosphere effects, hardware biases)
• Online integrity is designed to deal with situations that seldom occur in reality (feared events) targeting integrity risks up to 1.5e-6/h in line with integrity analysis performed. This bound is based at real-time monitoring which aims to detect the errors introduced by the feared events and provide an upper bound of the non-detectable errors. This process is executed by continuously monitoring information to fulfil with very low Time to alert. 

These corrections are computed by the Integrity processing Facility, operating independently from EGNSS HA corrections generator. However, proposal is to have these two processing servers in the same location, to optimise the architecture and maximise the synergies as shown in Figure 4.

Figure 4. Processing Facility high level architecture

Usage of EGNSS infrastructure provides the remarkable opportunity to make available this message through several dissemination means which has several advantages:

• Firstly, if the user is able to receive the message from more than one source, it is likely that implementing the correct algorithm, it will be able to reconstruct the complete message without the need of waiting for a whole broadcast cycle to end.
• The usage of EGNOS GEO satellites ensures a good coverage in Europe and certain level of added redundancy over the whole service area
• As well, an extra layer of integrity is offered for the user, as this allows to compare and discard erroneous messages if discrepancies are detected.

Following the example in EGNOS for Aviation Users, it is key to establish certification processes for the EGNSS Integrity service specifically tailored for each specific sectors. An independent Authority should audit the terms of such certification, for which a Service Definition Document should be prepared in detail. ESA and EUSPA will not be held responsible or liable for any direct damage resulting of a misuse of the Service. 

Decision criteria Analysis

A dedicated activity was endeavoured to quantify costs and benefits which might play a role in the decision process for the three main stakeholder groups involved: manufacturers, end users, and service providers. The analysis has stressed that manufacturers (i.e. OEMs) will most likely require to invest additional funding in each OBU to include the integrity concept, however these additional costs could be balanced by the fact that they will not have to pay a subscription fee to commercial service providers. Regarding end-users, the drivers, the outcome will most likely depend on how OEMs will pass on, or not, additional costs to end-users (or if they will find another way to balance the additional cost of the integrity concept – for example, savings on commercial subscriptions, exploitation of users data, etc.). 

The analysis has also stressed that the decision criteria, in addition to the costs and potential benefits, will be impacted by other elements: the window of opportunity, and reliability of the system among others. It is expected by OEMs that if the integrity concept is not operational by then they will be strong commercial alternatives already implemented in their process for L5 vehicles. Another important element is the expected reliability of the system, OEMs will not risk their reputation, and thus their financial profitability, with a system which has not proven reliable enough compared to commercial alternatives.

As well, it is noted that similar approaches to what is presented in ITHACA project are being developed by private parties on the market, so it can be expected that relevant stakeholders from all studied sectors can access operational solutions that may suit their needs and specific requirements. It is therefore considered curtail for the success of such an initiative to clearly highlight potential benefits from such a public service (in terms of costs, liability, or solution trustworthiness)

This findings converge towards a clear window of opportunity (2025-2027), and late market availability would cause a transition from commercial providers to this service. 

Service Roadmap activities

ITHACA aims at the Integrity Service provision with the goal to be adopted by wide autonomous transportation industries such as road, maritime or rail. In such a strategic sector in the years to come until the horizon 2030+, the success of the investment depends greatly on the acceptance of the integrity concept and subsequent demonstrations. The realization of such project involves important modifications to the current EGNSS infrastructure, which will have proportionate associated costs and need for investment. With these premises in mind, a series of Key Decision Milestones (KDM) have been defined aiming at mitigating the probability of this risk as much as possible.

These milestones have been identified at the end of each one of the development phases. They should really be understood as scheduled GO/NO GO evaluation processes in which a suitable board involving European Commission, EUSPA, Experts and other stakeholders analyse the outputs from the former phase and decide to continue with the next one. 

Regarding the roadmap towards this solution, there are several dependencies that should be clarified and solved. In particular, one of the most relevant one relates to the available network including operational GSS and RIMS. During the service requirements analysis it is suggested that the network needs to be further densified in order to achieve accuracy commitments. This could be a critical point, as some of the use cases (in particular for Road domain) may be jeopardized if convergence times are not reduced from current capabilities for HAS Level 1. 

Several risks should indeed be monitored during the development of the project. The risks that have been identified showing a higher impact are the following:

1) Automotive Industry reaches the conclusion that GNSS is not a key element for Level 5 autonomous applications (inc. alternative technologies).

2) Protection levels are too high, not fulfilling the acknowledged requirements to enable autonomous applications. 

As part of the mitigation strategy for both situations, a transversal activity is proposed during the Service implementation roadmap, involving demonstration, open debate and “education” on the capabilities of GNSS for the automotive market. Related to this goal, it is proposed to test a validate a prototype of the service and user algorithm as soon as possible within the timeline, so that the usability and behavior of the protection levels can be refined, studied, and up for a valid debate reading their usability for the industry.

A growing trend on the use of HA and Safe positioning solutions it is currently observed with several OEM/Tier1 distributing RFI/RFPs with target dates for production around 2025-2027. The window of opportunity is clear, and later availability would cause a transition from commercial providers to this service, but the process will be for sure slower since the commercial services are typically contracted for 8-10 years periods.

As regarding EGNSS it is hard to define a realistic plan targeting an operational service in 2025, it is proposed to have as a goal to provide an entry level service for Automotive L3 in 2026-2027, targeting Automotive L4 and L5 in a longer timeframe (2030+).

Conclusions for Future work

Interviewed stakeholders showed a high interest on the possibility of the proposed Integrity service provision as a public service part of the E-GNSS roadmap. However, it has been detected that the success to fulfill identified user requirements is closely related to E-GNSS ionosphere corrections provision. Therefore, a close collaboration between E-GNSS roadmaps should be considered from the beginning, specifically in the approach to be followed to enhance current station network. 

A second important point is that is considered quite unlikely that OEMs across the studied sectors would use a standardized user integrity concept including the proposed sensor hybridization. Most likely, each company will develop their own. Nevertheless, it is considered important to demonstrate the concept including a validated user algorithm in order to engage relevant stakeholders, as well as a minimum level of standardization on the usage of the integrity message ensure adequate service liabilities. 

Last by not least, the main motivation for stakeholder involvement is considered to highly depend on what is achieved by the demonstrator, on the investment and what would be the ROI. The more details provided during these phases, the more interesting would be for the motivation and identification to relevant stakeholders, which is also in line with the goal to promote a constant “education” and promotion on the service capabilities across autonomous transportation sectors.