Demonstration of a Functionally Safe GNSS/INS Positioning Software Library for Autonomous Land Vehicles

Over the last 15 years, there has been substantial interest in and funding into the autonomous vehicle industry. While plenty of practical applications have been exhibited and released into the market, the technology is not fully established in the area of functionally safe GNSS/INS localisation. The utility of sensors for GNSS based localization is greatly limited in safety critical applications if the positioning algorithms are not robust to possible faults that might affect their performance, especially when operating in non-ideal environments. This paper shows how Hexagon’s Safety Critical Positioning Solution (hereafter: Positioning System) addresses the need for both precision and safety in autonomous land vehicles. Hexagon’s Positioning System is a safety-first positioning software library that uses GNSS signals aided by state space corrections from Hexagon’s integrity monitored functionally safe TerraStar-X Enterprise service, Inertial Measurement Units (IMU), and additional vehicle sensors as inputs. Given the cost-sensitive nature of mass market autonomous applications, the Positioning System is designed to be sensor agnostic, allowing integrators to select GNSS and IMU chipsets that meet their system and safety design goals. That is, a wide variety of low-cost sensors that meet risk classification requirements defined by ISO 26262 are supported. The safety concept used is an extension of the Receiver Autonomous Integrity Monitoring (RAIM) techniques developed for the aviation industry. The Positioning System computes multiple navigation solutions using a technique known as solution separation: the main “all-in-view” solution that uses all observed GNSS signals, and several subset solutions that exclude various fault hypotheses (such as faulty GNSS signals). These separate solutions are used to compute Protection Levels (PLs) which are an estimated upper bound on the positioning error that account for systematic biases and measurement faults such as satellite failures, extreme atmospheric events like ionospheric storms and scintillation, local environment errors like multipath, etc. They indicate the maximum degree of error that could be encountered at any given instant. The computed PLs may be compared against alert limits, similar to applications in aviation, to determine whether the navigation solution is accurate enough for autonomous decision making. PLs are generated for all navigation components of the separate solutions (that is, position, velocity, and attitude). There are two main components contributing to the PL computation: the estimated standard deviation of the navigation solution, and the separation of the solutions from the various subsets. Both terms are influenced by the selection of an integrity allocation, which depends on the application’s requirements. Hexagon has completed a Failure Modes and Effects Analysis (FMEA) and a Fault Tree Analysis (FTA) to comprehensively and quantitatively address all possible faults that can affect the Positioning System. This ensures that the output navigation solution meets its safety requirements even in the presence of external faults. This detailed safety analysis has led to several innovative algorithm designs that have enabled the fulfilment of functional safety and integrity requirements without sacrificing positioning accuracy. The Positioning System achieves decimetre-level precision and supports alert limits at lane level, indicating it is suitable for autonomous vehicle applications. Example results of injecting simulated code measurement and correction faults into the solution estimation show how the PL increases to bound position error and effectively indicate the current accuracy of the system.