Vulnerabilities and integrity of precise point positioning for intelligent transport systems: overview and analysis

Abstract

The implementation of Intelligent Transport System (ITS) technology is expected to significantly improve road safety and traffic efficiency. One of the key components of ITS is precise vehicle positioning. Positioning with decimetre to sub-metre accuracy is a fundamental capability for self-driving, and other automated applications. Global Navigation Satellite System (GNSS) Precise Point Positioning (PPP) is an attractive positioning approach for ITS due to its relatively low-cost and flexibility. However, GNSS PPP is vulnerable to several effects, especially those caused by the challenging urban environments, where the ITS technology is most likely needed. To meet the high integrity requirements of ITS applications, it is necessary to carefully analyse potential faults and failures of PPP and to study relevant integrity monitoring methods. In this paper an overview of vulnerabilities of GNSS PPP is presented to identify the faults that need to be monitored when developing PPP integrity monitoring methods. These vulnerabilities are categorised into different groups according to their impact and error sources to assist integrity fault analysis, which is demonstrated with Failure Modes and Effects Analysis (FMEA) and Fault Tree Analysis (FTA) methods. The main vulnerabilities are discussed in detail, along with their causes, characteristics, impact on users, and related mitigation methods. In addition, research on integrity monitoring methods used for accounting for the threats and faults in PPP for ITS applications is briefly reviewed. Both system-level (network-end) and user-level (user-end) integrity monitoring approaches for PPP are briefly discussed, focusing on their development and the challenges in urban scenarios. Some open issues, on which further efforts should focus, are also identified.

Introduction

Intelligent Transport System (ITS) technology relies on one or more Global Navigation Satellite Systems (GNSS) for absolute positioning (Dovis et al. 2020; Firmin 2006; Imparato et al. 2018b). What is required is a low-cost positioning technique for decimetre to sub-metre accuracy, with real-time capability to enable automated vehicle navigation (Green et al. 2013; Stephenson et al. 2011). The GPS (Global Positioning System) Standard Positioning Service (SPS) using L1 coarse/acquisition (C/A) code observations results in a horizontal position error of the order of 5–10 m (at 95% probability), which is insufficiently accurate for critical ITS applications (U.S. Department of Defense 2020). The possible GNSS positioning techniques that can be used in ITS include Real-Time Kinematic (RTK) and Network RTK (NRTK), use of a Satellite Based Augmentation System (SBAS), and Precise Point Positioning (PPP) (Green et al. 2013; Lovas et al. 2011).

RTK and NRTK are both differential positioning techniques which require one or more nearby continuously operating GNSS reference station. In contrast, PPP is an absolute positioning technique that can be applied anywhere in the world (Zumberge et al. 1997). However, PPP can also be augmented by a regional reference station network or integrated with SBAS services (Heßelbarth and Wanninger 2013; Wübbena et al. 2005). Hence PPP is more flexible than the differential GNSS positioning techniques, making it an attractive technique for many precise positioning applications. With the development of new GNSS signals, new GNSS constellations, and infrastructures, PPP with real-time Ambiguity Resolution (AR) is an attractive alternative to the differential GNSS positioning techniques (Collins 2008; Ge et al. 2008; Laurichesse and Mercier 2007). The advent of dual-frequency mass-market GNSS chipsets with carrier-phase measurement capability further enhances the PPP technique for autonomous driving applications (de Groot et al. 2018; Murrian et al. 2016; xAUTO technology 2017). Moreover, the integration of PPP with other technologies, such as an Inertial Navigation System (INS), can shorten the convergence/reconvergence time of the PPP solution and improve the positioning availability, making PPP more applicable, even in an urban environment (Gao et al. 2017; Zhang and Gao 2008).

One of the key issues for ITS technology is safety, which cannot be assured without reliable and trustworthy positioning. However, due to the weak GNSS satellite signals, GNSS measurements are vulnerable to a number of threats and faults caused by satellites and/or receiver problems, as well as the environment, particularly in urban areas where ITS technology is most in demand (Ioannides et al. 2016; Martins 2014; Thomas et al. 2011). Furthermore, unlike differential GNSS positioning methods such as RTK and NRTK, PPP only relies on the measurements from the user receiver. Many error sources, such as satellite clock offsets, initial satellite and receiver phase biases and so on, cannot be eliminated or mitigated in undifferenced processing (Bisnath and Gao 2009). As a result, PPP is more affected by such errors. On the other hand, the carrier-phase cycle slip and outlier editing for PPP is more challenging than for the differential positioning methods (Kouba et al. 2017). Although GNSS threats have been investigated in many studies, and monitoring systems are increasingly being deployed (Bhatti and Ochieng 2007; Martins 2014; Ochieng et al. 2003; Thomas et al. 2011; Thombre et al. 2017), few refer explicitly to the PPP technique.

ITS applications require high levels of integrity, which is one of the most important performance indicators (Zhu et al. 2018). Integrity is concerned with how much we can trust the positioning results in the cases of both nominal and faulted conditions. In recent years, the issue of integrity for land transportation and/or high accuracy positioning has attracted more attention. However, the classical integrity concept and algorithms developed for aviation cannot be applied directly for ITS applications due to different requirements and the challenging urban environment (Zhu et al. 2018). Moreover, considering the different types of observations and models of positioning techniques, it is especially difficult to provide integrity for PPP users.

Knowledge of the characteristics of PPP vulnerabilities and their mitigation methods is essential to improving the reliability and integrity of PPP. This paper extends the work of Imparato et al. (2018b), which provided an overview of vulnerabilities in RTK and SBAS. The goal is to review potential faults and threats in GNSS PPP as well as the research developments and key issues of PPP integrity monitoring, focusing on the challenges of its application in ITS. Section A brief overview of PPP characteristics gives a brief introduction to the PPP technique, including its concept, models, and implementations. Section Vulnerabilities and integrity fault analysis in PPP lists the potential failure modes of PPP, with the demonstrations of fault analysis methods and detailed discussion of the main vulnerabilities of GNSS PPP. Section GNSS integrity concept and approaches reviews the status of PPP integrity research and identifies some open research issues concerned with PPP vulnerabilities and integrity, with a focus on urban scenarios. A summary is given in section Integrity of PPP in ITS context.

A brief overview of PPP characteristics

PPP is a high precision positioning technique which can be performed with a single GNSS receiver, utilising the undifferenced measurements of both code and carrier-phase. The PPP technique requires the precise orbit and clock information of satellites (via so-called “data products”) to achieve high positioning accuracy. Real-time orbit and clock products are expressed as the corrections to broadcast ephemeris messages and are disseminated via the Internet or broadcast by satellites (either SBAS or GNSS satellites, in the case of the latter as for the planned High Precision Service of Galileo navigation satellite system) (Fernandez-Hernandez et al. 2018; Heßelbarth and Wanninger 2013; the International GNSS Service (IGS) 2019; Weber et al. 2007). In addition, the observations are corrected for the errors due to relativity, satellite and receiver Phase Centre Offsets (PCO) and Phase Centre Variations (PCV) (Schmid et al. 2005), phase wind-up (Wu et al. 1993), troposphere (dry component), Earth tides, ocean tide loading, and various hardware delays or biases, using appropriate models. Other error sources including ionospheric effects, multipath, Non-Line-of-Sight (NLOS) errors, and cycle slips remain the most challenging for real-time ITS applications. These errors contribute to most of the fault incidents for the PPP implemented in urban environments. However, neither empirical models nor effective methods exist to completely correct for these errors. To improve the positioning accuracy and integrity, it is necessary to carefully investigate all these error sources.

There are two approaches for PPP processing, namely float-ambiguity PPP (float-PPP) and fixed-ambiguity PPP (fixed-PPP) or PPP-AR. Both approaches can be implemented in real-time. The major problem with the float-PPP technique is that it needs a longer time for the phase ambiguities to converge to their best estimates (for a filter-based solution) (Kouba and Héroux 2001). Moreover, a re-initialisation process is needed once most of the satellite signals are lost. Such situations happen more frequently in urban environments. The positioning accuracy of the kinematic float-PPP solution after convergence can reach the decimetre- to centimetre-level (Bisnath and Gao 2009; Choy et al. 2017), which is high enough for ITS applications, when sufficient satellites with good data quality are observed. However, the convergence/reconvergence problem restricts the use of PPP for ITS applications.

The convergence period can be shortened by exploiting the integer property of carrier-phase ambiguities through the application of AR techniques (Bisnath and Gao 2009; Collins et al. 2010). To resolve the integer values of the phase ambiguities, additional network-level satellite products are required. There are several alternate formulations, such as Uncalibrated Phase Delays (UPD) or Fractional-Cycle Biases (FCB), Integer Recovery Clocks (IRC), Decoupled Satellite Clocks (DSC) (Collins 2008; Bertiger et al. 2010; Ge et al. 2008; Laurichesse and Mercier 2007). PPP-AR can be further augmented with the corrections derived from a regional RTK or Continuously Operating Reference Station (CORS) network, a technique referred to as PPP-RTK or PPP-RA (PPP with regional augmentation), where PPP provides rapid convergence to centimetre-level positioning accuracy (Geng et al. 2011; Li et al. 2011; Teunissen et al. 2010; Wübbena et al. 2005). The regional network is used not only to estimate the parameters such as the satellite clock corrections and satellite phase biases, but also to interpolate ionospheric (and sometimes tropospheric) delays (Teunissen et al. 2010; Wübbena et al. 2005; Shi et al. 2014). The a priori knowledge of the ionosphere is the key to rapid convergence (Choy et al. 2017).

It should be noted that the accuracy and integrity of the PPP solutions are only evaluated after convergence. This is because during solution convergence the system cannot provide the required level of performance, i.e. sub-metre accuracy and related integrity. Likewise, integrity monitoring for PPP-AR is only performed after fixing the ambiguities. However, an extra procedure, known as ambiguity validation, is needed for monitoring of the integrity of the resolved ambiguity parameters, and the probability of wrong ambiguity fixing must be taken into account in the integrity risk budget.

Vulnerabilities and integrity fault analysis in PPP

To improve GNSS positioning performance, especially with respect to integrity, it is necessary to have a good knowledge of all potential threats and faults, or the so-called failure modes (Bhatti and Ochieng 2007). The analysis of failure modes can help identify GNSS integrity requirements and develop a threat model as well as prevent and/or protect against possible failures (van Dyke et al. 2003). There are many works published on the fault analysis of GNSS (Bhatti and Ochieng 2007; van Dyke et al. 2003; Milner and Ochieng 2008; Ochieng et al. 2003), but failure modes in the PPP technique are seldom discussed. In this paper the potential faults that need to be considered for PPP integrity (some of which are common for both PPP and SPS techniques) are investigated with two representative fault analysis methods: (1) Failure Modes and Effects Analysis (FMEA), and (2) Fault Tree Analysis (FTA). A detailed discussion on some of the major threats is also presented, focusing on their impacts on PPP.

Integrity fault analysis

Failure Modes and Effects Analysis (FMEA)

FMEA usually involves identifying all potential failure modes with their causes and characteristics, impacts on users, probabilities of occurrence and/or corresponding mitigation methods (van Dyke et al. 2003; Milner and Ochieng 2008). The potential failure modes of the PPP algorithm are summarised in Table 1. They are compiled from existing literature (Bhatti and Ochieng 2007; Imparato et al. 2018b; Kouba et al. 2017; Martins 2014; Ochieng et al. 2003; Thomas et al. 2011; Witchayangkoon 2000), and are categorised into five groups: satellite and signal, medium (atmosphere), products (corrections), work environment, and user. The mathematical models for different types of failures, which were proposed by Bhatti and Ochieng (2007), are listed in Table 2. Such models, although approximate, can help design and evaluate integrity monitoring algorithms in a simulation context (Bhatti and Ochieng 2007). Prior probabilities shown in Table 1, which are cited from the existing literature, are empirical assumptions or estimates, mainly supported by historical data, and they are subject to ongoing refinements.

Table 1 Compiled failure modes of GNSS PPP

Table 2 Mathematical models of faults (Bhatti and Ochieng 2007)

Fault Tree Analysis (FTA)

The FTA is a risk analysis procedure that breaks down a failure event to lower-level events or factors to determine the probabilities of loss of integrity or to allocate risks using a fault tree diagram (European GNSS Agency 2015; Hexagon Positioning Intelligence 2019). Figure 1 shows an example of an integrity fault tree based on the FMEA analysis in section Failure modes and effects analysis (FMEA), modified after (Hexagon Positioning Intelligence 2019).

Fig. 1

Integrity fault tree example; P_LOI: probability of loss of integrity; P_{LOI, sat & sig}: P_LOI related to satellite and signal faults; P_{LOI, atm}: P_LOI related to atmospheric anomaly; P_{LOI, prod}: P_LOI related to product (correction) faults; P_{LOI, env}: P_LOI related to work environment anomaly; P_{LOI, user}: P_LOI related to user-end faults. See Table 1 for detailed failure modes in each group. Adapted from “Quantifying Integrity”, by Hexagon Positioning Intelligence 2019, Velocity, 2019, p. 20. Copyright 2019 by Novatel Inc. Adapted with permission

For integrity risk allocation, the total integrity budget, i.e. the probability of loss of integrity (P_LOI), addresses failure events under both nominal and faulted conditions, including single fault and constellation-wide fault conditions. The integrity risk resulting from faulted conditions is decomposed into the probabilities of different types of faults, i.e. satellite and signal faults, atmospheric anomaly, product (correction) faults, operating environment anomaly, and user-end faults. The integrity risks of different types of faults should be further broken down to all potential failure modes according to Table 1, although not shown explicitly in the fault tree in Fig. 1. It should be noted that the a priori probability of occurrence of each failure mode, which for example is shown in Table 1, is not necessarily smaller than the allocated risk, as the faults may be detected. Only faults neither detected by system-level monitoring nor user-level monitoring contribute to the integrity loss (Hexagon Positioning Intelligence 2019). The total integrity risk depends both on the integrity requirement of a specific application and on technical feasibility (Schubert et al. 2014). The work to determine the integrity requirements for different applications and the corresponding risk allocation (to each failure mode) are ongoing (Schubert et al. 2014), requiring continued efforts from both academia and industry.

PPP vulnerabilities: a discussion on major threats

Satellite and signal

Satellite and signal faults are general anomalies that have common impacts on all GNSS users regardless of the positioning technique used. Such faults include satellite clock jump and drift, bad navigation data uploaded, low signal power/power fluctuations, signal deformations, Radio Frequency filter failures, Non-Standard Code (NSC), unannounced orbit manoeuvres, ionisation of payload silicon material, satellite induced code-carrier divergence, leap second anomaly and so on (Bhatti and Ochieng 2007; Martins 2014; Ochieng et al. 2003; Thomas et al. 2011). Some of the faults, e.g. satellite clock jump and drift, can result in ranging errors of up to several kilometres and sometimes loss of signal tracking (Bhatti and Ochieng 2007). A conservative empirical assumption on the probability of satellite and signal faults for GPS, which is suggested by GPS SPS Performance Standard (5th edition), is less than 1 × 10⁻⁵/h per satellite in total (U.S. Department of Defense 2020). Regarding other GNSS systems, the a priori probabilities of satellite and signal faults are still under investigation, hence they are not yet specified. It should be noted that the IGS Multi-GNSS Experiment (MGEX) and the International GNSS Monitoring and Assessment Service (iGMAS), which was developed by China, play a significant role in monitoring and evaluating satellite and signal anomalies for multi-GNSS systems (Fan et al. 2019; Huang et al. 2018; Ouyang et al. 2019; Ye et al. 2017). These faults have been investigated extensively in the literature, e.g. Bhatti and Ochieng (2007), and Imparato et al. (2018b).

Medium (Atmosphere)

• Ionospheric errors. Most of the ionospheric effect can be eliminated through dual-frequency Ionosphere-Free (IF) combinations or the Group and Phase Ionospheric Calibration (GRAPHIC) approach (Yunck 1992). The main threat to dual-frequency PPP users comes from ionospheric scintillation (Datta-Barua et al. 2003; Kintner et al. 2009; SBAS Ionospheric Working Group 2010). The occurrence of scintillation is more frequent at low and high latitudes than at mid-latitudes. Scintillation mostly happens after sunset and may last for a few hours during solar maximum years and exhibits seasonal variation (Conker et al. 2003; Guo et al. 2017). Ionospheric scintillation can cause positioning degradation in three ways: (1) loss of lock of tracked satellite signals, (2) abnormal measurement blunders, and (3) frequent cycle slips which are difficult to detect due to the high rate of total electron content (TEC) variation (Zhang et al. 2013). Typically, scintillations only affect a few satellites at a time; the probability of two satellites simultaneously having a Rate of TEC Index (ROTI) greater than 3 Total Electron Content Units (TECU) per minute is about 2% (Imparato et al. 2018b; Jacobsen and Dähnn 2014). Signal loss due to ionospheric scintillation was studied in terms of its temporal and spatial behaviours in Liu et al. (2017); however, the probability of such a risk has not been analysed (Imparato et al. 2018b).

  For single-frequency users or uncombined PPP, ionospheric delay variability is the greatest challenge for PPP using an empirical ionospheric model (Chen and Gao 2005; Montenbruck 2003; Øvstedal 2002), or ionospheric delay estimation based on a local CORS network (Chen and Gao 2005; Li et al. 2011; Li et al. 2012). Due to its irregular spatiotemporal patterns, the ionospheric delay is difficult to describe by either deterministic or stochastic models (Shi et al. 2012). However, studies show that the uncertainty of ionospheric delay estimation can be reduced by increasing the density of the local CORS network used in its estimation (Murrian et al. 2016). The characteristics and risks of ionospheric storms are discussed in Imparato et al. (2018b).

• Tropospheric errors. In the conventional PPP algorithm, the hydrostatic (dry) delay is corrected for using an empirical model, and the (zenith) wet delay is estimated as a free parameter. Tropospheric delay variations will increase during a storm. The troposphere can be assumed to be horizontally stratified and azimuthally symmetric; however, ignoring horizontal gradients may introduce range errors at the decimetre-level at low elevation angles and will generally map into the horizontal position bias (Collins and Langley 1998; Kjørsvik et al. 2006). Gradient parameters can be estimated together with zenith wet delay; however, this will introduce additional parameters which can weaken the model strength. Similarly, external tropospheric delay corrections can also be estimated with the data from a regional CORS network in real-time to reduce the time for PPP solution convergence and ambiguity fixing (Hadas et al. 2013; Li et al. 2011; Shi et al. 2014).

Products (corrections)

• Errors in real-time corrections. Precise orbit and clock products for real-time users are derived from the measurements made by a tracking network and are routinely provided by IGS and the analysis centres (AC). The IGS products are the combined solutions generated by processing the individual solutions of the participating ACs. The combination results in a higher quality and reliability than that of any single AC’s product (Dow et al. 2009; IGS 2019). The typical accuracy (RMSE, i.e. Root Mean Square Error) of the IGS Real-Time Service (RTS) products can reach 5 cm for orbits and 300 ps for clocks (IGS 2014). However, outliers are still present in the IGS combined solutions (Caissy et al. 2012; Guo et al. 2016). Furthermore, the IGS products may suffer from systematic errors (Griffiths and Ray 2013; Weiss et al. 2017). Although RTS products from IGS and the ACs have been evaluated in many studies in recent years (Hadas and Bosy 2015; Kazmierski et al. 2018; Zhang et al. 2018), the anomaly events and corresponding failure rates have been rarely investigated.

  In addition to IGS and ACs, other institutes also provide real-time products with comparable accuracies (Ding et al. 2018; Fu et al. 2019), as well as some companies which provide their commercial users with real-time PPP services (Jokinen et al. 2018; Leandro et al. 2011; Liu 2018; Tobías et al. 2014). Apart from satellite orbit and clock corrections, some of these companies also provide global/regional ionospheric corrections and/or regional tropospheric corrections. All these products are vulnerable to outliers or failures. Take Trimble RTX corrections as an example, the probability of failure derived from historical and real-time data (with empirical overbound) is at the 1 × 10⁻⁶ (for GPS and Galileo orbit + clock and regional troposphere) to 1 × 10⁻⁵ (for GLONASS orbit + clock and regional ionosphere) level (Rodriguez-Solano et al. 2019).

  The performance degradation in orbit and/or clock products is due to various causes, such as unannounced thrusting events on GNSS satellites, unhealthy satellites (Caissy et al. 2012), changes of reference clock and Differential Code Biases (DCB), lack of broadcast almanac, and satellite modelling problems (Hadas and Bosy 2015). Meanwhile, the quality of orbit and clock products can be affected by tracking network errors, such as undetected cycle slips, tropospheric mismodelling, errors in assumed antenna heights, and the quality of the station-satellite geometry (Zumberge et al. 1997). Similarly, tracking network errors can also affect regional ionospheric and tropospheric corrections. Thus, it is important to perform quality control or integrity monitoring both at the network-end and at the user-end.

  It should be noted that for traditional real-time PPP processing, the observations are combined with orbit and clock corrections. Accordingly, faulty corrections will result in the exclusion of the corresponding observations (together with the corrections), degrading the positioning results (El-Mowafy 2018). Some methods were proposed, e.g. using orbit and clock corrections as quasi-observations (El-Mowafy 2018), to overcome this kind of deficiency.

• Satellite antenna PCOs and PCVs. Satellite PCO can reach a few metres, and PCV centimetres, depending on the line-of-sight direction, signal frequency and the satellite (Bilich and Mader 2010; Schmid et al. 2005). PCOs and PCVs are nominal errors which can be modelled at the network-end, and are available from the IGS. However, the satellite PCO cannot be well corrected for without reliable satellite attitude information, which is difficult to model during short periods of noon and midnight turns during the eclipse period (Schmid et al. 2007).

• Receiver antenna PCOs and PCVs. Various phase centre patterns exist for different antenna models, manufacturing, radome designs and antenna installations (Bilich and Mader 2010; Hatanaka et al. 2001). To correct for these effects, mean absolute calibrations of certain antenna types and models can be determined using a specially designed field robot (Bilich and Mader 2010) or an anechoic chamber (Becker et al. 2010). There are nevertheless some challenges, for example phase centre patterns may be not known for new antennas (i.e. uncalibrated equipment); or integrated antenna-receiver units without an external clock input; some antennas may be substantially different from the type mean; antenna phase centres of low-cost equipment may be instable (Bilich and Mader, 2010; Murrian et al. 2016); etc. Thus, it is essential to have calibrations for non-standard antenna models and installations, as well as for new antenna types (Bilich and Mader, 2010).

• Code bias estimation errors. These instrumental delays include Time Group Delay (TGD) for single-frequency C/A users, DCB, Inter-System Bias (ISB) when using multi-GNSS and Inter-Frequency Bias (IFB) when using GLONASS, to name a few. They are therefore either observation-type-dependent, frequency-dependent, or system-dependent. They are all relative delays and contain satellite-dependent or receiver-dependent parts (although sometimes they are inseparable) (Villiger et al. 2016). Even though PPP performance is partially tolerant to the errors in code observations, incorrect code biases can affect the convergence time of float-PPP and reliable ambiguity fixing in PPP-AR (El-Mowafy et al. 2016; Kouba et al. 2017).

  These biases constitute the nominal errors and can be either estimated at the user-end or the network-end (Dach et al. 2006; El-Mowafy et al. 2016). They are assumed to be constant during short-to-medium observing periods, but may vary slowly or abruptly in various situations including receiver or antenna replacement, satellite component switching or activation, thermal variation of receiver or satellite (during eclipse season), aging and so on (Imparato et al. 2018b).

• Incorrect phase biases. These biases are also frequency-dependent and system-dependent, and are relative values (between satellites and receivers). Similar to code biases, phase biases are considered stable, although short-term variations have been observed due to ambient temperature effects (Zhang et al. 2017). In fact, the factors leading to code bias variations can also affect phase biases. Network generated phase biases may be either not reliable or not fully available due to network-end errors. Mismodelling of the hardware delay, i.e. biases in the estimated UPDs/FCBs, IRCs or DSCs, will be absorbed into the estimated ambiguity terms, causing incorrect fixed-PPP solutions, or even failure in ambiguity fixing (Geng et al. 2012). Cheng, et al. (2017) proposed a quality control and reliability analysis procedure for their own FCB and IRC estimation to achieve reliable PPP-AR. Their detector for FCB was able to detect small phase outliers (larger than 0.4 cycles) and the undetectable outliers had insignificant impact on estimated FCBs.

Work environment

• Multipath and NLOS. Code multipath may cause range errors of up to 150 m for L1, while NLOS errors can be up to several kilometres (Groves et al. 2013). The dual-frequency IF combinations will further amplify these effects. Carrier-phase multipath is much lower (about two orders of magnitude) than those of code observations. The maximum carrier-phase multipath error is frequency-dependent and amounts to 1/4 cycle (Georgiadou and Kleusberg 1988; Braasch 1992). NLOS carrier-phase error is within half a cycle (modulo one carrier cycle) (Groves et al. 2013). Since the accuracy of PPP depends on the carrier-phase observations, the impact of code multipath on PPP can be down weighted and is not as severe as that for code-only positioning techniques. The major adverse effect of code multipath is the longer time needed for the solution convergence or ambiguity fixing, and the resultant unreliability of ambiguity fixing (Henkel et al. 2016; Seepersad and Bisnath 2015).

  Multipath/NLOS is environment-dependent and is especially severe in dense urban areas where tall buildings reflect, diffract and/or block the GNSS signals (Groves et al. 2013; van Nee 1995). Furthermore, low-cost GNSS receivers may suffer from larger multipath and NLOS errors than geodetic-grade receivers due to their poor multipath/NLOS suppression (Murrian et al. 2016; Pesyna et al. 2014) and low-quality antennas, challenging their use in high precision positioning for ITS. Therefore, quality control and stochastic modelling are very important in PPP processing when using low-cost devices (Bisnath et al. 2018). A comprehensive overview of multipath and NLOS characteristics and their mitigation can be found in Imparato et al. (2018b).

• Cycle slips. There are five main causes for cycle slips: signal obstruction, low signal-to-noise ratio, receiver software faults (Hofmann-Wellenhof et al. 2001), receiver dynamics (Julien 2005), and high level of ionospheric disturbance (Cai et al. 2012). Cycle slips are more likely to occur in dense urban environments, especially for receivers mounted on a moving vehicle. As a result, ITS applications are easily affected by cycle slips. Cycle slips are a major challenge for PPP processing for both float-PPP and PPP-AR solutions. Unfixed or incorrectly fixed cycle slips can result in the need for re-initialisation and reconvergence of ambiguity parameters or lead to incorrect ambiguity estimation. Consequently, the reliability, continuity and availability of the navigation system may not meet the performance requirements of ITS.

  A number of algorithms for cycle slip detection and correction which apply to standalone GNSS positioning have been proposed. Real-time dual-frequency cycle slip correction algorithms are typically based on a time-differenced geometry-free combination (Banville et al. 2010; Kim and Langley 2001; Zhang and Li 2012). This kind of measurement combination is sensitive to the temporal variation of ionospheric delay, receiver phase wind-up, and multipath. Thus, ionospheric variations and other parameters should be estimated along with the integer cycle slips. In addition, an integer validation procedure is needed to determine the correct number of integer cycle slips (Zhang and Li 2016).

  It has been shown that availability of multi-frequency signals can enhance cycle slip detection (Dai et al. 2009; El-Mowafy and Deo 2015; Zhang and Li 2016). This is because there are more geometry-free combinations, which can help in identifying the signal frequency (and hence the carrier-phase measurement) on which the cycle slip has occurred. For single-frequency PPP based on GRAPHIC combinations, small cycle slips may be hard to identify due to the high noise level. To overcome these difficulties, Banville and Langley (2012) and Carcanague (2012) have proposed algorithms for cycle slip detection/repair using time-differenced carrier-phase observations and a geometry-based method.

  As there are various causes for cycle slips, and they are highly dependent on the local environment, it is extremely difficult to characterise the prior probability of cycle slips. It may be easier to evaluate the probability of undetected cycle slips after a detection and repair procedure using a specific method.

User

• Incompatibility or inconsistency. PPP processing should be consistent and compatible with the conventions followed by the product generation processes. Mixing the orbits generated by one AC with the clocks from another will introduce positioning errors because of correlations in the computation of the orbit and clock corrections (Zumberge et al. 1997). The data type, as well as the transmitter antenna (PCO and PCV) and attitude models, used in PPP processing should also be consistent with the ones to which the products refer (Kouba et al. 2017; Montenbruck et al. 2015). Inconsistency of the geodetic reference frame among station coordinates, EOPs, satellite/receiver PCV, satellite orbit products, and the coordinate and time systems of different GNSSs can also introduce additional errors, as mentioned earlier.

  Since PPP-AR algorithms are complex and do not have a standard methodology, users will possibly face the risks of inconsistency when using publicly available orbit, clock, and other products. It is important that the user-end adopts the algorithms and models consistent with those adopted for the computations of the biases and corrections at the network-end. “Mixing” of different conventions may lead to incorrect AR or even positioning failure (Seepersad and Bisnath 2016). For example, there are three different commonly used PPP-AR models—UPD/FCB, IRC and DSC—as mentioned earlier. To achieve fixed-ambiguity PPP solutions, one should carefully choose the corresponding PPP-AR products.

  To explore interoperability of the various PPP-AR products, Seepersad and Bisnath (2016) developed a transformation matrix to allow users to transform the IRC and FCB products to the DSC format. Their method also enabled multiple AR solutions to improve the reliability of the user solution, especially in cases of interruptions in specific PPP-AR products. Though their method is feasible, differences in satellite antenna conventions and/or in the satellite yaw attitude models can still cause AR failure with the transformed products (Seepersad 2018).

  Unfortunately, PPP service providers seldom reveal the detailed conventions and models adopted in their network solutions, and sometimes the corrections are not clearly defined (Seepersad and Bisnath 2016). It also should be noted that the potential faults caused by incompatibility or inconsistency depend on users themselves. Once introduced, such faults will continuous to exist until their removal.

• Incorrect fixed ambiguity. Ambiguities fixed to wrong integer values will introduce large errors into the PPP-AR solutions. To check whether the resolved ambiguities are correct, an ambiguity validation procedure is needed. There are several ambiguity validation methods, e.g. the ratio-test, F-test, t test, difference test and integer aperture estimation and its variants, which are all in the framework of hypothesis test theory (Euler and Schaffrin 1991; Frei and Beutler 1990; Han 1997; Teunissen 2003, 2005a, b; Tiberius and De Jonge 1995; Verhagen 2005; Wang et al. 1998). However, no single approach is totally reliable in all situations, and further improvements need to be explored (Li et al. 2013; Verhagen 2004; Verhagen and Teunissen 2013; Yu et al. 2017).

  In contrast to other threats in observations, incorrect fixed ambiguity is a solution domain failure caused by the correlation between the estimator and parameter (between ambiguities and other parameters). It should be treated separately in the integrity monitoring procedure. In fact, ambiguity validation is a separate integrity monitoring or quality control procedure of integer ambiguity estimates.

• Communications problem. Errors may occur over the communication link that transmits real-time corrections, causing erroneous data, data loss, or high data latency. Short-term prediction of real-time corrections can be used to bridge small communications outages, with quality degradation over time (Hadas and Bosy 2015; El-Mowafy et al. 2017).

GNSS integrity concept and approaches

Definition and indicators of GNSS integrity

Integrity is a critical requirement for navigation and real-time positioning, for both safety–critical and liability-critical applications, since potential threats and faults to GNSS positioning may have serious consequences (Kealy 2011; Zhu et al. 2018). The integrity concept was first developed in the field of civil aviation and is defined as “a measure of the trust that can be placed in the correctness of the information supplied by a navigation system” (U.S. Department of Defense et al. 2008). It includes both the ability to provide valid and timely warnings to users when the system should not be used and the fundamental reliability to avoid such circumstances (U.S. Department of Defense et al. 2008; Kovach et al. 2008).

Integrity can be characterised by the following main parameters (International Civil Aviation Organization (ICAO) 2006; Navipedia 2011a; Radio Technical Commission for Aeronautics (RTCA) 2006):

• Alert Limit (AL) The maximum acceptable position error, beyond which an alert should be triggered. It can be further characterised as Horizontal AL (HAL) and Vertical AL (VAL).

• Time to Alert (TTA) The maximum time allowed before raising an alert since the system exceeds the tolerance level.

• Integrity Risk (IR) The probability (per time unit) that the position error exceeds the AL.

• Protection Level (PL) An estimate of the upper bound of position error given the probability no larger than the required IR. Similarly, Horizontal PL (HPL) and Vertical PL (VPL) can be specified separately.

AL, TTA and IR are usually prescribed as integrity requirements, while PL is calculated by users or by the monitoring system. The computed PL is then compared with AL and actual position error (if known) to determine whether (Navipedia 2011a):

• (a) the system is unavailable (when PL > AL); and,

• (b) an integrity event occurs (when PE > PL).

GNSS integrity monitoring procedures and methods

The integrity monitoring techniques, methodologies and algorithms for code-based navigation have been investigated over many years. GNSS integrity can be monitored at system-level or user-level or both. Basic system-level integrity messages that are broadcast by GNSS satellites can be generated by on-board monitors (Viðarsson et al. 2001; Weiss et al. 2010), or uploaded by the GNSS control segment, monitoring only satellite and signal faults (Kovach et al. 2008). Additional integrity information can be provided by augmentation systems, including Ground Based Augmentation System (GBAS) and SBAS, by comparing the ground truth of the monitoring station with the position solution computed using the GNSS Signal-in-Space (SIS) (Langley 1999; Ochieng et al. 2003; Speidel et al. 2013). The SIS integrity information, e.g. User Rang Accuracy (URA), can be used for user-level integrity monitoring (Federal Aviation Administration 2010). In addition to satellite and signal faults, GBAS and SBAS are also capable of monitoring the failures corresponding to the medium (atmosphere), e.g. ionospheric anomaly.

User-level integrity monitoring can be performed using approaches such as Receiver Autonomous Integrity Monitoring (RAIM). RAIM techniques typically include two procedures (Navipedia 2011b): (1) Fault Detection and Exclusion (FDE), and (2) PL is computed and compared against an AL. It should be noted that: (1) PL depends on satellite geometry and nominal error characteristic (stochastic model), rather than real measurements, and thus are predictable (RTCA 2006); (2) PL should be recomputed after fault exclusion.

The RAIM algorithms developed for aviation can be categorised into two classes according to the FDE technique used: residual-based RAIM and solution-separation RAIM (Gunning et al. 2018; Speidel et al. 2013). The traditional RAIM approaches rely on the consistency checks of redundant measurements. These algorithms are generally based on weighted least squares residuals or equivalent variants, e.g. parity method (Brown 1996; Parkinson and Axelrad 1988; Walter and Enge 1995). The traditional RAIM assumes that there is only one faulty measurement at any one time. As a result, it is only capable of detecting a single fault. In contrast, Advanced RAIM (ARAIM) based on Multiple Hypothesis Solution Separation (MHSS) can deal with multi-dimensional faults (Blanch et al. 2012). ARAIM tests all possible fault modes in the position domain to perform FDE and PL calculations, with explicit integrity risk allocation according to a threat model that includes multiple faults (Blanch et al. 2012, 2015; EU-U.S. Cooperation on Satellite Navigation 2016). The potential of multi-constellation, multi-frequency GNSS observations can thus be fully exploited by ARAIM, increasing data redundancy significantly. However, the computational load of ARAIM is very high due to the need to test each fault mode (i.e. a possible combination or subgroup of observations) (Blanch et al. 2019; Ge et al. 2017; Imparato et al. 2018a).

Integrity of PPP in ITS context

Position accuracy and integrity requirements of ITS

ITS applications generally require lane-level (sub-metre) accuracy to enable autonomous driving. Some applications may even need dm-level accuracy (Green et al. 2013; Stephenson et al. 2011). For position integrity, although there are some discussions and preliminary statement of ITS requirements (European GNSS Agency 2015, 2018; Reid et al. 2019; Salós et al. 2010), no standardised or generally-accepted specifications, nor mature methodology for ITS applications are currently available (Zhu et al. 2018).

The basic principle for integrity requirements is that they should be defined according to the relevant safety standards, e.g. International Organization for Standardization (ISO) 26262 and ISO/Publicly Available Specification (PAS) 21448 - Safety of the Intended Function (SOTIF) (Kafka 2012; ISO 2018, 2019; Koopman et al. 2019). However, as integrity requirements are highly dependent on applications, e.g. Advanced Driver-Assistance Systems (ADAS), collision avoidance, and different levels of autonomous driving, the specifications for various ITS applications are mandatory (Zhu et al. 2018). Furthermore, there are many practical factors that need to be considered when defining the ITS requirements, such as country and region, road geometry, vehicle type/size, driving speed, and data latency (Reid et al. 2019).

The integrity indicators should also be tailored according to specific ITS requirements. Especially for AL and PL in land applications, users are mainly concerned with horizontal positions rather than vertical ones. HAL/HPL should be further decomposed into along-track (or longitudinal) AL/PL and cross-track (or lateral) AL/PL (Imparato et al. 2018a; Reid et al. 2019). Furthermore, the test statistics and associated thresholds should be adapted for ITS applications (El-Mowafy 2019).

Integrity monitoring for PPP

GNSS PPP integrity shares some common aspects with GNSS SPS integrity in terms of definition, indicators, and basic monitoring procedure. PPP integrity can be monitored at both the system-level and user-level. However, integrity monitoring for PPP must additionally consider the following aspects (Bryant 2019; Feng et al. 2009; Pasnikowski 2015; Romay and Lainez 2012):

• (1) PPP involves more observations, especially carrier-phase measurements, which are biased by the ambiguities and contaminated with cycle slips, resulting in extra failure modes that need to be monitored.

• (2) PPP needs precise products and correction models, and hence the nominal error models and threat models used in integrity monitoring should be carefully developed.

• (3) PPP usually requires recursive processing, such as the use of Kalman filtering, involving dynamic models with process noise, whereas GNSS SPS uses simple “snapshot” integrity monitoring methods.

Yet there is limited literature on PPP integrity, and their monitoring methods are still under investigation.

Apart from above problematic aspects, complex urban environments make PPP integrity monitoring for ITS much more challenging. The main difficulties are in the following two aspects (Bryant 2019; Imparato et al. 2018a; Navarro et al. 2016; Zhu et al. 2018):

• (1) Multipath, NLOS errors, and signal interference occur frequently and have significant effects in urban environments, for which appropriate stochastic models and threat models are extremely difficult to develop.

• (2) Harsh environments also mean low redundancy in the number of observations and high probability of multiple faults occurring at the same time.

Integrity information on real-time products or corrections for PPP can be generated at the network-end by using the measurements from a GNSS ground tracking network, like the SIS integrity generation by GBAS or SBAS. The faults in different corrections, e.g. orbit and clock correction and ionospheric correction, can be monitored separately by forming the measurements into different monitors which are mainly sensitive to specific errors (Weinbach et al. 2018). Nevertheless, the integrity of network-generated products/corrections is rarely discussed in the literature. Currently, none of the corrections provided by IGS-RTS include integrity information, although URA is reserved according to Radio Technical Commission for Maritime Services-State Space Representation (RTCM-SSR) protocol for future integrity capability (Cheng et al. 2018; IGS 2019). A preliminary study was done by Cheng et al. (2018) to investigate the strategy of URA characterisation based on the analysis of the real-time orbit and clock corrections from CNES (Centre National D’Etudes Spatiales). A few service providers, including SBAS systems such as those from Trimble and the Quasi-Zenith Satellite System (QZSS), provide integrity information on their correction services (Hirokawa et al. 2016; Weinbach et al. 2018). Trimble CenterPoint RTX correction service utilises different types of carrier-phase observation residuals for monitoring stations to validate orbit and clock corrections, regional tropospheric corrections, and regional ionospheric corrections (Weinbach et al. 2018). A two-step integrity monitoring procedure, i.e. pre-broadcast and post-broadcast integrity monitoring, is adopted to detect and flag out-of-tolerance corrections and to generate timely alarms to users. The integrity information is provided as Quality Indicators (QI) with the correction data; however, how to calculate PLs using QIs was not mentioned. There is little literature that discusses the quality control procedures which can be used to check the integrity of PPP corrections, e.g. FCB/IRC estimation (Cheng et al. 2017), orbit and clock corrections (El-Mowafy 2018), and the combined corrections of satellite clocks, ionospheric parameters and ambiguity solutions (Khodabandeh et al. 2019). These quality control procedures can perform FDE and the analysis of different faults, as well as their impacts on the PPP solutions.

Current user-level integrity algorithms for PPP are still very preliminary, hence not well-accepted in models and methods. The Spanish company GMV developed their own integrity concept for their PPP solution, known as magicPPP (Romay and Lainez 2012; Navarro et al. 2015). Their integrity concept was a little different from that developed in the aviation field as they were not restricted to system-level only or user-level only integrity, but focused on “most favourable combination of significant indicators” which they assess (Romay and Lainez 2012). In the PPP-Wizard software developed by CNES, two FDE mechanisms are implemented, namely “Simple FDE” with post-fit residuals screened one by one against empirical thresholds and “Advanced FDE” testing all the combinations of observations to find one with all post-fit residuals below the threshold values (Laurichesse and Privat 2015). The software can also provide an integrity indicator for each solution. However, the FDE methods and the integrity indicator in PPP-Wizard are not statistically sound (for example P_FA, i.e. the probability of false alert is not specified) (see Appendix–Example 1).

Jokinen et al. (2011, 2013) and Seepersad and Bisnath (2013) adopted the traditional RAIM algorithms in PPP processing to enable FDE and PL computation. They directly performed snapshot RAIM at each separate epoch even though Kalman filters were used. On the one hand, the fault detection statistics used by them were the weighted sum of squares of post-fit measurement residuals. This kind of test is based on the assumption that the dynamic model is absent or predicted states have very large variances, which is impractical for PPP (Teunissen 1990; Wieser 2004), and thus may not be sensitive to some faults in the dynamic model (see Appendix–Example 2). On the other hand, snapshot PLs cannot protect against the undetected faults in historical observations or in the predicted states.

Additionally, as discussed previously, the traditional RAIM methods cannot handle multiple faults correctly, which have a high probability when carrier-phase measurements are used, especially for multiple GNSS constellations. In contrast to the above research, Gunning et al. (2018) adopted the well-founded models of ARAIM for civil aviation for PPP integrity monitoring. They applied an ARAIM-like methodology and algorithms of both residual-based (Chi-square) and solution-separation test statistics to determine the PLs in PPP, enabling initial integrity monitoring for a float-PPP position solution. Their method (or a similar one) was later evaluated with IGS tracking data, flight data and driving data, using GPS broadcast ephemeris and real-time corrections, including SBAS corrections (Gunning et al. 2019a, b; Norman et al. 2019; Phelts et al. 2020). However, a bank of parallel filters was used, as in Brenner (1996), for the Kalman filter to account for historical faults, based on an assumption that all faults will exist continuously for a period of time. Such a method has a high computational cost. More importantly, the nominal error model and threat model are very preliminary for complex urban environments. To provide PLs for PPP in challenging environments, Blanch et al. (2020) refined the threat model and accordingly adapted the FDE algorithm, considering the effect of Kalman filtering time updates, to address potential faults in urban and suburban areas.

Open research issues on PPP vulnerabilities and integrity for ITS applications

There are many problems to be addressed for PPP integrity in ITS applications. One of the prerequisite issues is the determination and standardisation of specific integrity requirements for various ITS applications and different levels of automation, without which the corresponding integrity monitoring methods cannot be properly evaluated. Another challenging problem is that stochastic models of different errors must be clarified, e.g. ambiguity errors, non-Gaussian range errors, as well as the error correlations amongst the measurements and over time (Bryant 2016, 2019). It is also important, though challenging, to develop a representative threat model for integrity risk evaluation and PL computation (Gunning et al. 2018). The threat model, which is a list of the failure modes with their assumed probabilities, is the focus of this paper. However, to examine the prior probabilities of different types of faults requires comprehensive studies, which are beyond the scope of this review paper.

PPP integrity at both system-level and user-level are still rudimentary. More investigations should be made with respect to the following: (1) system-level (i.e. network-end) integrity information needs to be provided along with the correction products similar to those provided by SBAS; (2) careful assessment of the probabilities of PPP threats, as mentioned earlier; (3) quality control and integrity monitoring schemes for PPP applications in different environments, including open sky, suburban and urban areas; (4) improvement of integrity monitoring algorithms corresponding to different PPP models or techniques, e.g. dual-frequency IF PPP and uncombined PPP, and float-PPP and fixed-PPP; (5) the integrity of some certain aspects of PPP processing, such as multi-GNSS PPP, multi- or single-frequency PPP; (6) efficient recursive integrity monitoring algorithms to address historical faults, utilising predicted states or time updates; (7) integrity for an integrated system of PPP and other techniques or data sources, e.g. INS, LiDAR (Light Detection and Ranging) and maps; (8) integrity of other critical states for ITS applications, such as velocity and altitude/heading (Reid et al. 2019; Binjammaz et al. 2013).

Concluding remarks

ITS applications require high accuracy and high integrity positioning. PPP as a high precision positioning technique attracts much attention for ITS applications due to its flexibility and low cost; however, it is subject to a variety of threats and faults. To improve positioning reliability and provide integrity for PPP it is vital to investigate and analyse all potential failures of PPP and to study corresponding integrity monitoring approaches.

In this review paper an overview of vulnerabilities in GNSS PPP that might impact its integrity in ITS applications is given. Failure modes and effects analysis and fault tree analysis are investigated. They are classified into different groups according to their sources. The cause and characteristics, impacts, fault models and some probabilities of these threats are summarised, with discussion on some major threats. This paper also presents a brief review of the research on integrity of PPP, with a focus on ITS scenarios. Requirements, challenges, and existing methods of integrity monitoring for PPP in urban environments are discussed. Moreover, some open issues, on which more R&D (research and development) efforts should focus, regarding PPP vulnerabilities and integrity for ITS applications are identified.

This study will assist in designing a representative threat model as needed for integrity monitoring of the PPP solutions and in developing relevant integrity monitoring procedures and algorithms. However, the probabilities of many of these threats are still under investigation and require comprehensive studies which are outside the scope of this paper and will be addressed in future work.

Appendix

Example 1: Comparison of “Simple FDE”, “Advanced FDE” and Chi-square test based FDE

The dataset shown in this example is a one-hour static dataset observed by IGS station STFU from 19:00 to 20:00 GPST (GPS Time) on January 1, 2020, with 1-s sample interval. The data was processed in kinematic float-PPP mode with the uncombined model using the modified PPP-Wizard software. Multi-frequency observations of GPS and Galileo constellation (with 16–17 satellites available and over 70 observations in total at each epoch) were adopted and GRG (Groupe de Recherche de Géodésie Spatiale of CNES) multi-GNSS final products were applied. Ten groups of outliers were randomly simulated on the GPS L1 measurements of one or two satellites during epochs 2000–3000, with random magnitudes from 0.05 to 1.05 m (see Table 3). The Positioning Errors (PE) without FDE procedures are shown in Fig. 2.

Table 3 Excluded measurements with different FDE methods compared with simulated faults in measurements

Fig. 2

PPP positioning errors (after convergence) in the case of faulty measurements, with no FDE applied. Note that faults may cause positioning errors larger than the shown 0.2 m maximum

Figure 3 shows the fault detection tests, i.e. checking if the absolute post-fit residuals are less than empirical thresholds, for code and carrier-phase measurements with the PPP-Wizard software. The positioning errors (after convergence) with “Simple FDE” and “Advanced FDE” are shown respectively in Fig. 4a and b.

Fig. 3

Fault detection tests, i.e. checking if the absolute post-fit residuals are less than empirical thresholds, for code and carrier-phase measurements with PPP-Wizard; the fault detection test was preformed group by group for different signals and constellations; threshold values were set to 10 m and 0.05 m for code and carrier-phase, respectively. Scatters with different colours represent different satellites

Fig. 4

PPP positioning errors (after convergence) with the “Simple FDE” and “Advanced FDE” in PPP-Wizard. Note the impact of undetected faults and wrong exclusions can be seen in a

For comparison purposes, an FDE procedure based on the Chi-square test was performed for the same dataset. The corresponding test statistics and positioning errors (after convergence) are shown in Figs. 5 and 6, respectively. The excluded measurements by different FDE methods, compared with simulated faults, are shown in Table 3. As can be seen in Figs. 3, 4, 5 and 6 and Table 3, all outliers except that on G09 for epoch 2870 are detected and identified by different methods. For the “Simple FDE” there are a few undetected faults and many wrong exclusions, introducing large jumps in the position solutions. On the other hand, the “Advanced FDE” and Chi-square test can identify all large faults (above 0.9 m in this case) and provide better results. It can also be seen from Fig. 5 that the Chi-square test adopts a varying threshold to account for satellite geometry (number of measurements) changes for a given P_FA.

Fig. 5

Chi-square test statistics for code and carrier-phase measurements for fault detection; P_FA = 0.01

Fig. 6

PPP positioning errors (after convergence) with the Chi-square test based FDE; P_FA = 0.01

Example 2: Comparison between two kinds of Chi-square test statistics

In this example two kinds of Chi-square test statistics were compared. The first one, referred to as the “Observation Consistency Test (OCT)” in Wieser (2004), is based on the post-fit measurement residuals only. The second one, referred to as the “Local Overall Model (LOM)” test in Teunissen (1990), is based on the post-fit residuals and states corrections, i.e. differences between the estimated and the predicted states. The same dataset as in example 1 was used; however, this time the authors simulated six faults in the predicted state vector, specifically the predicted coordinates, i.e. assuming a miss-modelling of the dynamic process, where these coordinates were obtained with code-based positioning. The simulated faults were injected to different components, i.e. X, Y and Z, from epoch 2 500 to 2 750, and had the same magnitude of 1 m but with different signs. The positioning errors without FDE are shown in Fig. 7.

Fig. 7

PPP positioning errors (after convergence) in the case of faulty predicted states, with no FDE applied

Illustrated in Fig. 8a and b are the Chi-square test statistics based on OCT and LOM, respectively. As is seen from the figure, all the simulated faults were successfully detected with LOM, while none were detected with OCT, indicating that the OCT test statistics are less powerful than LOM (for this case).

Fig. 8

OCT and LOM Chi-square test statistics for fault detection; equations from (Teunissen 1990) and (Wieser 2004) was adopted; code and carrier-phase measurements were processed together to compute these test statistics; P_FA = 0.01