International Journal

on Marine Navigation

and Safety of Sea Transportation

Volume 3

Number 3

September 2009

287

1 INTRODUCTION

Galileo is the European Global Navigation Satellite

System, under civilian control. Galileo will provide

to their users highly accurate global positioning ser-

vices and their associated integrity information. The

element within the Galileo Ground Mission Segment

(GMS) in charge of the computation of Galileo in-

tegrity information is the IPF (Integrity Processing

Facility), being developed by GMV (Grupo Mecani-

ca del Vuelo).

The integrity algorithms of the GMS are respon-

sible of providing a real-time monitoring of the sat-

ellite status with timely alarm messages in case of

failures. The accuracy of the integrity monitoring

system is characterized by the SISMA (Signal In

Space Monitoring Accuracy), which is broadcast to

the users through the integrity message together with

the satellite integrity flags (OK, Not Monitored, Do

Not Use)

Galileo is currently in its detailed design and de-

velopment phase. The design and development

phase for the IPF started in May 2005. The Critical

Design Review (CDR) of the system has been suc-

cessfully at the beginning of 2008, while the Factory

Qualification Review (FQR) is expected for 2009.

The SW prototypes of the integrity algorithms have

already been implemented and the assessment of the

critical performance figures has already been per-

formed with outstanding results.

The main objective of this paper is therefore to

explain the basis of the Galileo integrity concept,

which is fundamental for safety-critical applications

such as maritime navigation. It will include the

mathematical formulation that shall be present at re-

ceiver level together with the details that are re-

quired to understand it from the maritime user point

of view. A review of the potential level of perfor-

mance based on the preliminary results available

from the development phase will be also provided.

Additionally, information is provided related to

the potential evolutions of the Galileo integrity con-

cept, which is currently being defined in the frame

of the GNSS evolution program led by ESA and in

the 7th Framework Program of the European Com-

mission led by the GSA, in which GMV takes an ac-

tive role. In this environment, requirements from the

maritime user community are being considered.

2 THE GALILEO INTEGRITY CONCEPT

2.1 Overview

Integrity can be defined as a measure of the trust that

can be placed in the correctness of the information

supplied by the system. Integrity includes the ability

of the navigation system to provide users with time-

ly and valid warnings (alerts) when the system must

not be used for the intended operation (ICAO,

2006). In the current Galileo baseline the integrity

aspects concerning the SIS errors will be achieved

by means of two parameters: Signal-In-Space Accu-

racy (SISA) and the Integrity Flag (IF). Together

with a new satellite ephemeris and clock models

broadcast to the users, it is also sent the SISA, which

is a prediction of the associated errors with a certain

confidence level for the whole coverage area and

valid for the applicability time of the models. The

computation of this parameter is performed in an-

other element of the GMS named OSPF (Orbito-

Galileo Integrity Concept and its Applications

to the Maritime Sector

C. Hernández, C. Catalán & M. A. Martínez

GMV S.A., Madrid, Spain

ABSTRACT: Galileo is the European Global Navigation Satellite System, under civilian control. Galileo will

provide their users with highly accurate global positioning services and their associated integrity information.

The main objective of this article is to explain the basis of the Galileo integrity concept, which is fundamental

for safety-critical applications such as maritime navigation. A review of the expected performance that will be

achieved has been also included.

288

graphy and Synchronization Processing Facility)

based on off-line data processing. Additionally, in

order to meet the stringent integrity requirements

such as the maximum Time To Alert (TTA), it is

broadcast in real time the Integrity flags, which in-

form the users if SISA is properly bounding or not

the SIS errors in that moment.

The Signal-In-Space Accuracy (SISA) plays an

important role in the Galileo integrity concept, as it

should cope with the navigation message errors in

fault-free conditions. The description of the algo-

rithms in charge of the SISA computation is out of

the scope of this paper, which is devoted to the real-

time integrity monitoring system of Galileo allocat-

ed to the IPF.

2.2 High-Level Description

In order to validate the navigation message being

broadcast by the satellites, an independent estima-

tion of the Signal-In-Space Error (SISE) is per-

formed in real-time. This estimation, which is also

modeled as a random process with an associated un-

certainty, allows the verification of the overbound-

ing of the true SISE distribution by the broadcast

SISA. The assumption made in this case is that the

difference between the true SISE projected at Worst

User Location (WUL) and the estimated one can be

overbounded by a Gaussian distribution with the

standard deviation equal to SISMA. In this context,

the SISMA can be considered as a quality measure

of the integrity check within the IPF. Additional in-

formation on the Galileo integrity concept can be

found in (Oehler, 2005). From the operational point

of view, the IPF design does not consider any real-

time human intervention, so key factors are the algo-

rithms’ robustness and reliability, directly derived

from the stringent integrity and continuity require-

ments.

Before entering more deeply in the explanation of

the Galileo user integrity concept and its potential

applications for the maritime community the Galileo

overbounding concept should be clarified. As stated

in (Hernández, 2008), it can be defined in the fol-

lowing way:

Table 1. Galileo Overbounding definition.

___________________________________________________

The distribution of a random variable A is over-bounded by a

distribution of a random variable B, if for all L≥0:

___________________________________________________

P(|A|≥L) ≤ P(|B|≥L) for all L≥0

___________________________________________________

This definition of the Galileo overbounding con-

cept is quite similar to the CDF (Cumulative Density

Function) overbounding definition stated by (De-

Cleene, 2000), although there are some differences

as explained in (Hernández, 2008).

The objective of the IPF is to validate the naviga-

tion message of the satellites. The validation is based

on IPF estimation of the SISE and its comparison

with the broadcast SISA and the internally computed

SISMA. According to the assumptions mentioned

earlier, the IPF will assume that the estimated SISE

is overbounded by a Gaussian unbiased distribution:

− True SISE overbounded by

( )

SISAN ,0

;

− SISE estimation error (True SISE minus Estimat-

ed SISE) overbounded by

( )

SISMAN ,0

;

− Estimated SISE overbounded by

(

)

,0 SISMASISAN +

;

Under these assumptions, the user considers that

the threshold applied at IPF level in order to decide

if a navigation message is valid or not is given by

the variance of the distribution characterizing the es-

timated SISE, together with the required false alarm

probability:

SISMASISAkT

upfa

+⋅=

(1)

( )

usenotDo

IFTSISEEstimatedIf =⇒>

(2)

being k

pfa,u

the point of the normal distribution that

leaves in the tails (two-tail problem) a probability equal

to the specified false alarm rate. Thus, if the estimated

SISE projected to the worst user location is higher than

the allowed threshold, the satellite is flagged as “DO

NOT USE” in order to indicate the user that its naviga-

tion message is not valid and the satellite should not be

used for positioning.

The current specification of the IPF element en-

visages a maximum false alarm probability in the

order of 10

-7

in 15 seconds, which gives a k

pfa,u

fac-

tor approximately of 5.212. Considering that the re-

quired values for SISA and SISMA are 0.85 and 0.7

meters, respectively, in case no more barriers were

implemented, the minimum detectable errors by the

IPF would be in the order of 6 meters.

2.3 User Integrity Risk Computation

Galileo users will compute the Integrity Risk (IR),

which is the probability of having Hazard Mislead-

ing Information (HMI). This will come out as a re-

sult of a combination of the horizontal and vertical

errors, considering both the fault-free situation (FF)

and the one where there is one failing satellite (1F).

The case of multiple satellite failures is excluded

from the user integrity risk computation since they

are covered by other mechanisms established in the

Galileo system Fault Tree Analysis (FTA). It is im-

portant to note that satellites with an IF set to “DO

NOT USE” will be excluded from the user position

and integrity computation.

The basic underlying assumptions allowing the

user to determine the integrity risk of his position so-

lution at any global location are:

289

− In a “Fault-Free-Mode” the true SISE for a satel-

lite is overbounded by a zero-mean Gaussian dis-

tribution with a standard deviation equal to SISA;

− In general, the IPF will detect the faulty satellites

and they will be flagged as "don't use";

− One satellite of those flagged as "OK" is consid-

ered to be faulty but not detected ("Failure

Mode"). For this satellite the true SISE is over-

bounded by a Gaussian distribution whose mean

is the “IPF rejection threshold” (T) and the stand-

ard deviation is equal to SISMA,

( )

SISMATN ,

;

− The probability that more than one satellite at

each instance in time is faulty but not detected is

negligible for the user equation.

Therefore the computation of the integrity risk is as

follows:

Table 2. Galileo Integrity Risk Computation.

___________________________________________________

IR = Vertical_IR + Horizontal_IR =

Vertical_IR_FF + Vertical_IR_1F +

Horizontal_IR_FF + Horizontal_IR_1F

___________________________________________________

( )

∑

























−⋅





































⋅

−

−+

























⋅

−

⋅⋅













⋅

−+













⋅

−

=+=

Hujsatfail

FMVu

Vuv

FMVu

Vuv

jsatfail

FFVu

HIntRiskVIntRiskhvHMI

Error

cdfP

Error

erf

Error

erf

ErrorError

erf

PPErrorErrorP

,,2,

exp

(3)

3 EXPECTED PERFORMANCE

The Galileo system will provide different services:

the Open Service (OS) providing positioning and

timing, the Commercial Service (CS) that will dis-

seminate additional ranging information on a fee-

based scheme, the Public Regulated Service (PRS)

providing positioning, timing and integrity for re-

stricted-access signals and the Safety of Life (SoL),

which will provide integrity messages for the navi-

gation data included in the OS signals.

As any other navigation system providing integri-

ty, the SoL requirements can be expressed in terms

of accuracy, availability, continuity and integrity.

The following table summarises the main Galileo

system requirements.

Table 3. Galileo OS/SoL system performance requirements

(without considering the receiver contribution).

___________________________________________________

Parameter Performance

___________________________________________________

Positioning accuracy (95%) 4 m horizontal; 8 m vertical

Integrity Risk ≤ 2.0e-7 in any 150 s

Continuity Risk ≤ 8.0e-6 in any 15 s

Availability of Service 100% nominal

99.5% degraded at WUL

Time To Alert ≤ 5.2 seconds

Horizontal Alert Limit (HAL) 12 m

Vertical Alert Limit (VAL) 20 m

Coverage Worldwide

___________________________________________________

In order to be compliant with the currently speci-

fied requirements, the design of the Galileo system

must take into account several critical aspects, which

are usually called performance drivers. First of all, it

needs to be clarified that the expected performance

are similar to those of EGNOS, but with a global

coverage instead of a regional one. Therefore the de-

sign of Galileo has been conditioned to a large ex-

tent for the compliance to the requested perfor-

mance. Moreover, performance averaging over time

or geographical location is not allowed, which

brings additional constraints.

The performance allocation to the different com-

ponents of the system has been a very complicated

process (Oehler 2008). Extensive simulations and

computations were requested to derive the current

figures. The most relevant ones are presented hereaf-

ter.

Table 4. Galileo OS/SoL system performance allocation.

___________________________________________________

Parameter Performance

___________________________________________________

Navigation Message ranging 65 cm

accuracy (67%)

SISA (67%) 85 cm

SISMA 70 cm Nominal GSS network

130 cm Degraded GSS network

GSS network 40 sensor stations

___________________________________________________

In order to meet the availability and continuity

requirements, it was required to consider not only

the nominal configuration of the system but those

degraded ones in which elements of the system were

missing, giving degraded performance. This is the

reason why the SISMA performance is specified

with the nominal and degraded GSS networks.

After the detailed performance analysis and algo-

rithm design, most of the performance figures are

expected to be accomplished, although some areas

need further work. For example, the ionospheric

scintillations have been found to be one of the major

threats affecting the performance, since they may

imply a signal quality degradation and even signal

loss, resulting in visibility gaps for certain satellites.

This is also present at user level, and it can not be

mitigated or compensated at system level, affecting

290

also to DGNSS and SBAS. This threat is neverthe-

less location-dependent, since it affects the equatori-

al and high-latitude regions and they are sufficiently

frequent so as to be considered as an intrinsic part of

the environment, even in years of low solar activity.

(Schlarmann, 2008) shows that the current assess-

ment of the expected level of performance is in line

with the requirements except for the conditions in

which scintillations are present.

Another performance driver is the quality of the

raw data provided by the Galileo Sensor Stations

(GSS). Both the pseudorange and carrier phase

measurements are requested by the algorithms in

charge of computing the SISA and SISMA. Ad-

vanced filtering and data processing techniques are

being used; however the level of multipath at sensor

station level will be a critical factor for the achieve-

ment of the performance

4 POTENTIAL EVOLUTION AND

APPLICABILITY TO MARINE NAVIGATION

In principle, there is an important aspect in the Gali-

leo Integrity Concept compared with the operational

user requirements established by IMO in its resolu-

tion for future Global Navigation Satellite System

(IMO, 2001). IMO established the requirements for

integrity based on the concepts of alert limits and in-

tegrity risk. While in principle they are the same

concepts as those specified for Galileo, the imple-

mentation at system level is different from the one

done in SBAS systems such as EGNOS and WAAS

(RTCA, 2006). In SBAS, the user computes a Pro-

tection Level, defined as the region for which the

missed alert probability requirement (or integrity

risk) can be met, and compares it with the Alert

Limit. In Galileo, the design is in the other way

round, the user computes the integrity risk corre-

sponding to the Alert limit and then compared with

the maximum affordable limit. IMO’s resolution

does not preclude one implementation or the other,

although it seems to follow a common approach

with ICAO (International Civil Aviation Organisa-

tion), which introduced the concept of Protection

Level in its SARPS (Standard And Recommended

Practices for GNSS).

Another important difference is the definition of

the Signal-In-Space in terms of the broadcast integri-

ty information. SBAS systems rely on the UDRE

(User Differential Range Error) for satellite differen-

tial correction residual errors, which is similar to the

parameter with the same name introduced in

DGNSS (IALA, 2004). However, in the case of Gal-

ileo the concept of differential correction no longer

applies and the predicted accuracy of the broadcast

navigation message is disseminated as the SISA,

while the accuracy of the integrity monitoring sys-

tem is also broadcast as the SISMA. SISA and SIS-

MA (including the integrity alerts) play a similar

role to the UDRE.

Although IMO has established operational re-

quirements independently of the implementation of

the integrity concept, at the end it will be forced to

define a standard for the signal definition for future

GNSS in the frame of the maritime policy as it did in

the past with DGNSS. The situation is the same as

for ICAO and the use of Galileo SoL (Safety of

Life) service in the frame of the civil aviation com-

munity. Because of these reasons, an effort is cur-

rently being done in order to support the harmonisa-

tion of the Galileo integrity concept and the existing

standards that may envisage some evolutions on this

respect in the future.

However, a very important aspect of Galileo as a

navigation system providing integrity is its world-

wide coverage. With an accuracy in the same order

of magnitude as DGNSS and SBAS, the advantage

of providing seamless integrity performance over the

world may bring a huge benefit in terms of a reduc-

tion in the investment in the implementation and

maintenance of coastal DGNSS networks. Similarly

the future plans for the third generation of GPS sat-

ellites include the provision of integrity. On this re-

spect, an assessment done by IMO establishes that

Galileo could be considered in the future for Ocean-

ic, Coastal, Port approach and restricted water opera-

tions (IMO 2003).

Because of the importance of the provision of in-

tegrity in the future, both the European Space Agen-

cy (ESA) and GSA (GNSS Supervisory Authority)

have launched several projects to analyse the poten-

tial evolution of the Galileo Integrity concept. A key

factor in this process is the interoperability of Gali-

leo at the level of integrity with other existing sys-

tem, including SBAS. Some preliminary results on

the application of the concept of “transparency” to

Galileo can be found in (Catalán, 2008). Additional-

ly, the conception of GNSS as a “system of systems”

will probably have a significant role in the evolution

of Galileo and its integrity concept. In 10 to 20

years, the most probable situation is that users will

have at least four GNSS with open dual frequency

signals, GPS, Galileo, GLONASS and COMPASS

and more than 20 satellites always in view. With

such level of redundancy, the level of performance

that could be achieved by RAIM (Receiver Autono-

mous Integrity Monitoring) algorithms in terms of

availability could be fully comparable to those al-

ready provided by SBAS or in the future by a

standalone use of Galileo. Moreover, it has the clear

advantage that includes FDE (Fault Detection and

Exclusion) due to local effects (interference, multi-

path, etc.) that is neither present in DGNSS, SBAS

or Galileo, combined with a Time To Alert (TTA) of

291

just 1 second. This RAIM applied to the all the sys-

tems together could be even enhanced by the use of

the integrity information broadcast by each system.

Other options alternative to RAIM are also being in-

vestigated, such as the RANCO (Range Consensus)

algorithm, see (Schroth 2008), in which several

groups of 4 satellites are define in order to evaluate

the pseudorange of the satellites that did not enter in-

to the position solution. Based on the information

coming from the different solutions some satellites

are rejected. As it can be seen, there is a consensus

that in the case of multiconstellation GNSS the hy-

pothesis that the probability of a multiple satellite

failure is negligible is no longer valid.

Therefore the situation would be that each indi-

vidual system could work in a standalone mode,

providing a certain service level in terms of integrity

performance, but their combination would yield a

better service level. For this, an effort in the satellite

navigation community should be required to stand-

ardise the requirements for the different satellite

navigation systems in terms of interoperability at the

level of integrity.

5 CONCLUSIONS

The Galileo Integrity Concept has been presented, as

it has been defined and including the required pro-

cessing at user level. The major difference with re-

spect to SBAS system specification is the substitu-

tion of the Protection Level by the Integrity Risk as

the variable to be computed at user level. Because of

the introduction of terms corresponding to a poten-

tial failure in one satellite, the concept can not be di-

rectly reversed into a Protection Level to be com-

pared with an Alarm Limit. This implies a change at

implementation level, which represents a deviation

from the standard defined by ICAO for civil aviation

and, in principle, could be adopted also by IMO.

However, the system can be compliant with the

high-level system requirements, providing a similar

level of performance to those of SBAS and perhaps

slightly worse to those of DGNSS, but with the great

advantage of a global coverage and therefore no in-

vestment at local level.

Additionally, the integrity concept of GNSS will

still evolve in the incoming years motivated by the

appearance of new satellite navigation systems and

the upgrade of the existing ones. GNSS will be con-

ceived as a “System of Systems”, each one provid-

ing service in a standalone mode and with improved

performance when all combined together.

REFERENCES

Catalán C. & Hernández C. & Mozo A. & Fernández L. &

Amarillo F. 2008. Improved Integrity Concept for Future

GNSS Evolutions. Proceedings to the 21

ION GNSS In-

ternational Technical Meeting of the Satellite Division,

September 2008.

DeCleene B. 2000. Defining pseudorange integrity - over-

bounding Proceedings to the 13

ION GNSS International

Technical Meeting of the Satellite Division., September

2000.

Hernández C. & Catalán C. & Fernández M. A. & Sardón E.

2008. The Galileo Ground Segment Integrity Algorithms:

Design and Performance. International Journal of Naviga-

tion and Observation. Volume 2008, Article ID 178927,

doi:10.1155/2008/178927.

IALA 2004. IALA Recommendation R-121 on the Perfor-

mance and Monitoring of DGNSS Services in the frequen-

cy Band 283.5 – 325 kHz. Edition 1.1, December 2004

ICAO, 2006. International Standards And Recommended Prac-

tices Aeronautical Telecommunications. Annex 10 To The

Convention On International Civil Aviation. Volume I —

Radio Navigation Aids ISBN 92-9194-772-5. Sixth Edi-

tion - July 2006

IMO 2001. Revised Maritime Policy and Requirements for a

future Global Navigation Satellite System (GNSS). Resolu-

tion A.915(22) adopted on 29

of November, 2001.

IMO 2003. Evaluation of Galileo Performance against Mari-

time GNSS Requirements. NAV 49/13. 16

of April 2003.

Oehler V. & Luongo F. & Trautenberg H. & Boyero J. P. &

Krueger J. & Rang T. 2005. The Galileo Integrity Concept

and Performance. Proceedings to the 18

ION GNSS Inter-

national Technical Meeting of the Satellite Division., Sep-

tember 2005.

Oehler V. & Krueger J. & Trautenberg H. & Daubrawa J.

2008. Galileo System Performance for different Users and

Constellations. Proceedings to the 21

ION GNSS Interna-

tional Technical Meeting of the Satellite Division., Septem-

ber 2008.

RTCA. 2006. Minimum Operational Performance Standards

for Global Positioning System/Wide Area Augmentation

System Airborne Equipment. RTCA DO-229D. 13-

December-2006.

Schlarmann B. K. & Hollreiser M. & Amarillo F. 2008. The

Galileo Ground Mission Segment Architecture and Perfor-

mance. Proceedings to the 21

ION GNSS International

Technical Meeting of the Satellite Division, September

2008.

Schroth G. & Rippl M. & Ene A. & Blanch J. & Belabbas B. &

Walter T. & Enge P. & Meurer M. 2008. Enhancements of

the Range Consensus Algorithm (RANCO). Proceedings to

the 21

ION GNSS International Technical Meeting of the

Satellite Division, September 2008.