Galileo Integrity Concept

Introduction

Galileo will provide to its users not only a global positioning service, but also the associated integrity information for SoL! (SoL!) services. This is an important contribution of Galileo against the GPS or GLONASS systems, where the SoL! integrity must provided by augmentation systems (WAAS, EGNOS...). Thanks to integrity, the users are constantly aware of whether transmitted signals can be trusted; receiving timely alert messages in case of failures and data to compute the integrity risk for the decision to start a critical operation.

The Galileo Ground Segment monitors the Signal-in-Space (SIS) using the measurements of the Galileo Sensor Stations (GSS) network and computes the range error (SIS Error, SISE)1 in real-time, from the known coordinates of satellites and network receivers. It is assumed that, in fault free conditions, a non-biased Gaussian distribution overbonds the SISE at any user location (i.e., SISE is over- bounded by N(0,SISA)). The minimum standard deviation of such Gaussian is called as Signal-In-Space-Accuracy (SISA), see figure 1, left. This expected a-priory accuracy SISA value is similar to the GPS User Range Error (URE), and is broadcasted in the Navigation message with maximum update period of 30 seconds.

The Ground System computes also an estimate of the true SISE (eSISE) at the worst location, assuming that the difference between the true and the estimated values (SISE-eSISE) is overbounded by a non-biased Gaussian distribution with standard deviation called SIS Monitoring Accuracy SISMA (i.e., SISE-eSISE is overbounded by N(0,SISMA)), see figure 1, right. Notice that in this context, the SISMA can be considered as a quality measure of the integrity check whiting the Integrity Processing Facility (IPF) [Oehler et al., 2005].

The Integrity Processing Facility (IPF) of Galileo Ground segment is comparing in real-time the eSISE with a threshold T. When the eSISE is larger than this threshold2, the Integrity Flag (IF) for the SIS associated satellite is set to Not-1Associated to navigation message (ephemeris, clock...) 2It is assumed that the estimated eSISE is also overbounded by 1 OK. The SISMA value and IF are broadcasted in the Integrity Message for all satellites every 30 seconds. Alerts can be transmitted in real-time (1-second) if required. A Galileo user receiver computes its integrity risk at the Alarm Limit (AL) at any global location, combining horizontal and vertical errors and considering both the fault-free and the faulty situation, but with only one failing satellite, and assuming ([Hernandez Mendel et al., 2008], [Oehler et al., 2005]):

• In Fault-free mode: SISE is overbounded by N(0,SISA).
• In general the faulty satellites are detected by IPF and flagged as Not-OK.
• In case of a faulty satellite not detected by IPF (Faulty mode), SISE is overbounded by N(T,SISMA), where T is the IPF rejection threshold of faulty satellites3.
• The probability of simultaneous not detected faulty satellites is negligible.