Autonomous Integrity Monitoring for Relative Navigation of Multiple Unmanned Aerial Vehicles

Abstract

Accurate and reliable relative navigation is the prerequisite to guarantee the effectiveness and safety of various multiple Unmanned Aerial Vehicles (UAVs) cooperation tasks, when absolute position information is unavailable or inaccurate. Among the UAV navigation techniques, Global Navigation Satellite System (GNSS) is widely used due to its worldwide coverage and simplicity in relative navigation. However, the observations of GNSS are vulnerable to different kinds of faults arising from transmission degradation, ionospheric scintillations, multipath, spoofing, and many other factors. In an effort to improve the reliability of multi-UAV relative navigation, an autonomous integrity monitoring method is proposed with a fusion of double differenced GNSS pseudoranges and Ultra Wide Band (UWB) ranging units. Specifically, the proposed method is designed to detect and exclude the fault observations effectively through a consistency check algorithm in the relative positioning system of the UAVs. Additionally, the protection level for multi-UAV relative navigation is estimated to evaluate whether the performance meets the formation flight and collision avoidance requirements. Simulated experiments derived from the real data are designed to verify the effectiveness of the proposed method in autonomous integrity monitoring for multi-UAV relative navigation.

1. Introduction

Nowadays, multiple Unmanned Aerial Vehicles (UAVs) cooperation is playing an important role in various civilian and military applications, such as remote sensing, packet delivery, flight show, and low altitude surveillance [1,2,3]. During the process of multi-UAV applications, the scheduled missions are usually completed cooperatively and efficiently through information synchronization, formation keeping, path planning, and many other applications. For high-precision multi-UAV systems, one of the most important keys to guarantee the effectiveness and safety is an accurate and reliable “relative navigation”–the relative positions of a UAV with respect to the others. For example, during multi-UAV remote sensing missions, the relative navigation solutions amongst the UAVs must be precisely known to synthesize a single large imaging aperture using all the measurements of the formation flying UAVs [4]. For flight show missions, a stringent navigation performance on a relative position is required for each UAV to display different formations in order to obtain an impressive show effect and avoid collision accidents [5].

The relative positions amongst the UAVs can be obtained using the relative range and bearing data of navigation sensors in the case when the absolute positioning data are unavailable or inaccurate [6]. The commonly used relative navigation techniques for UAVs include Global Navigation Satellite System (GNSS), Ultra Wide Band (UWB), vision system, radar, and many other sensors [7,8]. In particular, GNSS is the main source to measure the position due to its potential for high accuracy implementation, worldwide coverage and simplicity in relative navigation. Nevertheless, since the nominal accuracy of a stand-alone GNSS absolute positioning is about a few meters, the relative position by differencing two absolute positions may be unable to meet the requirements of some high-accuracy applications. To solve this problem, improved solutions, the so-called Real-Time Kinematic (RTK) and Differential GNSS (DGNSS), are commonly applied to obtain a much more accurate relative navigation for the multi-UAV system [9,10]. Studies on RTK have been actively conducted to accurately estimate the relative location of UAVs at centimeter-level, while the solutions might be unstable due to computing complexity in determining the integer carrier-cycle ambiguities [11]. Considering that GNSS pseudorange is more stable and continuous than carrier phase, differenced GNSS pseudoranges are usually used to improve the availability of multi-UAV navigation systems [12].

Although GNSS-based high accuracy relative positioning can be obtained for multi-UAV, the observations of GNSS still suffer from different kinds of faults due to transmission degradation, ionospheric scintillations, multipath, spoofing, and many other factors. These faults will bring catastrophic consequences to the multi-UAV system [13,14,15]. On the one hand, the relative positioning failure of a UAV will be input and mislead the flight control system directly. On the other hand, since each UAV uses the relative position, one positioning failure might be spread and corrupted throughout the UAV network, which poses a serious threat to mission completion and flight safety. Thus, to improve the reliability of multi-UAV relative navigation, the fault observations should be detected and excluded effectively.

Integrity monitoring is one criterion to evaluate GNSS performance, which refers to the capability of the system to detect faults and warn the user when the system should not be used [16,17,18]. Although the related work, such as Receiver Autonomous Integrity Monitoring (RAIM) [19,20], has been a topic of constant research in the community of GNSS absolute positioning, research about integrity in relative positioning for multi-UAV is relatively poor. During the last few years, several methods have been proposed to improve the integrity of UAVs navigation. For example, to meet the high-accuracy requirements for multiple moving platforms applications, Sun et al. proposed a fault detection and exclusion method for relative positioning using carrier phase [21]. However, as mentioned in [22], carrier phase measurements might suffer from cycle slip problems. Instead, double differenced pseudoranges were employed for integrity monitoring of relative navigation systems for multi-UAV in urban dynamic applications, and the relative protection level was proposed for collision avoidance. Nevertheless, one main bottleneck of the two methods might be that they detected the faulty observations by exploiting the redundancy of stand-alone GNSS signals to check the measurement consistency. To further improve the integrity of the navigation system, some other sensors or datasets were adopted as aids to provide additional measurements for integrity monitoring. Groves et al. proposed a processing architecture for high-integrity carrier-phase relative Global Positioning System (GPS)/Inertial Navigation System (INS), while the error of the INS may drift over time and contaminate the integrity result [23]. Calhoun et al. proposed a vision-based precision relative navigation system for determining uncertainty and integrity [24]. An integration of inertial, vision and Differential GPS (DGPS) was proposed to increase the reliability of UAV sensor fault detection and identification in [25]. However, the performance of the vision system suffers greatly from occlusion and lighting conditions, which is unpredictable in high dynamic UAV applications. Terrestrial signals of opportunity (including cellular signals, digital television signals, and low Earth orbit satellite signals) were applied for the UAV integrity monitoring improvement [26], while the signals of opportunity might not always be available in the environments. The concept of integrity for cooperative systems has also been investigated in intelligent transportation systems. In urban vehicular scenarios, GNSS measurements from all the collaborators were used to improve the detection of faulty GNSS measurements [27,28]. With the aid of vehicle-to-vehicle communication, an autonomous integrity monitoring method was researched for real-time relative positioning systems based on a fusing of GNSS pseudoranges and Dedicated Short Range Communication (DSRC) measurements [29]. More recently, also for vehicular cooperative positioning in urban scenarios, a cooperative integrity monitoring method was proposed based on an extended Kalman filter [30].

To improve the performance of autonomous integrity monitoring for multi-UAV relative navigation, a novel method is proposed with the fusion of the double differenced GNSS pseudoranges and the UWB ranging units. Compared with other sensing devices obtaining relative navigation measurements, UWB stands out in accurate and reliable ranging due to its ability to alleviate multipath effects and robustness to light changing [31,32]. Inspired by the existing work of UWB positioning system, this paper proposes a new method using the relative distance measurement of UWB signals as an aid to improve the integrity performance of multi-UAV relative navigation. First, a new framework of autonomous integrity monitoring for multi-UAV relative navigation is proposed. Then, the proposed method is designed to detect and exclude the fault observations through a consistency check in the relative position of multi-UAV using double differenced GNSS pseudoranges and UWB relative range observations. Note that this work only considers the faults on GNSS observations, while the problem of fault detection and exclusion for multiple sensors of a cooperative system in the concept of integrity will be researched in the future, which is usually regarded to be much more difficult [30]. Finally, the protection level for multi-UAV relative navigation is calculated, which is used to advise whether to meet the requirements of the flight mission. To verify the effectiveness of the proposed method in autonomous integrity monitoring for multi-UAV relative navigation, simulated experiments derived from the real data are designed. The experimental results show that the proposed method outperforms the baseline integrity monitoring method in fault detection and exclusion.

The remainder of this paper is organized as follows. Section 2 is the details of the proposed integrity monitoring for multi-UAV relative navigation, including the descriptions of the framework, the fault detection and exclusion method, and the protection level estimation. Section 3 shows and discusses the experimental results. Finally, the conclusions are shown in Section 4.

2. Integrity Monitoring for Multi-UAV Relative Navigation

In this section, the details of the proposed integrity monitoring for multi-UAV relative navigation are illustrated as follows. First, the framework of the proposed method is presented. Then, the fault detection and exclusion method based on double differenced GNSS pseudoranges and UWB ranging units is proposed, followed by the protection level estimation method for multi-UAV relative navigation.

2.1. Framework

The goal of this paper is to develop a highly reliable relative navigation system for multiple UAVs. To achieve this, an autonomous integrity monitoring method for multi-UAV relative navigation based on GNSS and UWB observations is proposed. The framework of the proposed method is shown in Figure 1.

Given a multi-UAV system consisting of $K$ UAVs (i.e., $U_1,\dots ,U_k,\dots ,U_K$, with $k\in [1,K]$), each UAV obtains the pseudorange observations of visible GNSS satellites ($S_i,S_j$, and other visible satellites) through an onboard GNSS receiver. Simultaneously, an onboard UWB module is applied to synchronously obtain the UWB ranging units for UAV relative distance measurements [33].

Then, during the multi-UAV cooperation, the GNSS pseudorange observation and UWB range information are shared by a mesh network module through which any two UAVs can be connected wirelessly. As shown in Figure 1, for each UAV, such as $U_k$, its available neighbor UAVs are connected through the mesh network to obtain the UWB ranging units, which are fused with the double differenced GNSS pseudoranges to construct the observation formulas for relative positioning and autonomous integrity monitoring solutions. To improve the integrity monitoring performance of the multi-UAV relative navigation system, the availability is firstly estimated and the fault detection and exclusion method is followed. Specifically, the relative protection level is estimated and then compared with Relative Alert Level (RAL) to guarantee that the relative position error between each pair of UAVs will not be exceeded without being detected. If the relative protection level is not smaller than the RAL, the Not Available (NA) message will be sent to the system. Otherwise, fault detection is processed through a consistency check amongst the relative observations. If there is an alarm of the fault detection, fault exclusion is applied to find and exclude the observation faults. The availability estimation, fault detection, and fault exclusion are loop executed until there is no alarm of the fault detection. Finally, the remaining observations are used to calculate the relative positioning between each pair of UAVs through weighted least squares methods or other methods based on Kalman filters [31].

2.2. Fault Detection and Exclusion for Relative Navigation

2.2.1. Observations for Relative Navigation

Under the framework of the proposed method, a new GNSS autonomous integrity monitoring method is proposed for multi-UAV relative navigation with the aid of UWB systems. The two kinds of relative navigation observations of GNSS and UWB are presented as follows.

(1) Double differenced GNSS pseudoranges

Since the carrier phase measurements of GNSS might suffer from frequent cycle slip problems, in this paper, double differenced GNSS pseudoranges are employed to improve the observation stability for multi-UAV relative navigation.

The raw GNSS pseudorange observations are contaminated by different kinds of errors when the satellite signals are transmitted from the satellite to the UAV receiver. The main sources of error in GNSS pseudoranges combine receiver-independent errors (i.e., satellite ephemeris and clock errors, ionosphere and troposphere errors) and receiver-dependent errors (i.e., clock offsets, receiver errors) [34]. Since the baseline distance between two neighbor UAVs is typically negligible when compared with the 20,000-km altitude of the GNSS satellites, the receiver-independent errors for two GNSS receivers of each UAV end can be regarded as similar. Then the double differenced GNSS pseudoranges method can be applied to eliminate the common errors for an accurate relative location.

Given two different UAVs $U_p$, $U_q$ (with $p,q\in [1,K]$ and $p\ne q$) and a common visible satellite S_i, the raw GNSS pseudorange of each UAV can be obtained as

$${\beta }_{ki}=r_{ki}+c\delta t_i-c\delta t_k+{\delta }_i^{eph}+{\delta }_i^{ion}+{\delta }_i^{trop}+{\epsilon }_{ki}+b_{ki}^{},fork\in \{p,q\}$$

(1)

where $r_{ki}$ is the geometric distance between the satellite $S_i$ and UAV $U_k$; ${\delta }_i^{eph}$ and $\delta t_i$ are the satellite ephemeris and clock error of the satellite $S_i$, respectively; $c=2.998\times {10}^8$ is the light speed; ${\delta }_i^{ion}$, ${\delta }_i^{trop}$, $\delta t_k$ are the ionosphere error, troposphere error, receiver clock offset, respectively; ${\epsilon }_{ki}$ collects other errors such as receiver errors and residual errors, which is regarded as Gaussian noise. $b_{ki}$ is a fault bias on the pseudorange ${\beta }_{ki}$, which might be caused by multipath interference, receiver fault, spoofing, and many other factors. For the fault free observation, $b_{ki}=0$.

Through Equation (1), the single differenced GNSS pseudoranges of ${\beta }_{pi}$ and ${\beta }_{qi}$ can be obtained

$$\Delta {\beta }_{pq}^i={\beta }_{pi}-{\beta }_{qi}=r_{pi}-r_{qi}-c(\delta t_p-\delta t_q)+{\epsilon }_{pq}^i+b_{pq}^i$$

(2)

where the common receiver-independent errors, i.e., satellite ephemeris and clock errors, ionosphere and troposphere errors, are eliminated and ${\epsilon }_{pq}^i={\epsilon }_{pi}^{}-{\epsilon }_{qi}^{}$, $b_{pq}^i=b_{pi}^{}-b_{qi}^{}$.

Then, the single differenced GNSS pseudoranges of satellite $S_i$ and satellite $S_j$ are used to calculate the double differenced GNSS pseudoranges as

$$\nabla {\beta }_{pq}^{ij}=\Delta {\beta }_{pq}^i-\Delta {\beta }_{pq}^j=(r_{pi}-r_{qi})-(r_{pj}-r_{qj})+{\epsilon }_{pq}^{ij}+b_{pq}^{ij}$$

(3)

where ${\epsilon }_{pq}^{ij}={\epsilon }_{pq}^i-{\epsilon }_{pq}^j$, $b_{pq}^{ij}=b_{pq}^i-b_{pq}^j$.

Note the baseline vector from UAV $U_p$ to UAV $U_q$ as $l_{pq}\in R^3$ with three dimension position in East-North-Up (ENU) coordinate system, and denote the line-of-sight vectors of from each UAV to the satellite as $r_{pt}\in R^3$ and $r_{qt}\in R^3$ in ENU coordinate system for $t\in \{i,j\}$. Since the altitude of a GNSS satellite is typically much larger than the baseline vector length, the line-of-sight vectors of each UAV to the satellite can be regarded as parallel. Thus, the normalized line-of-sight vector to the satellites can be obtained as

$$l_t=r_{pt}/\Vert r_{pt}\Vert or{r}_{qt}/\Vert r_{qt}\Vert$$

(4)

As shown in Figure 2, the single differenced geometric distance in Equation (3) can be obtained as

$$r_{pt}-r_{qt}=l_t•l_{pq},fort\in \{i,j\}$$

(5)

where $•$ is the scalar product between vectors.

Substituting Equation (5) into Equation (3) yields the double differenced GNSS pseudoranges,

$$\nabla {\beta }_{pq}^{ij}=(l_i-l_j)•l_{pq}+{\epsilon }_{pq}^{ij}+b_{pq}^{ij}$$

(6)

Note the number of common visible satellites for $U_p$ and $U_q$ as $N_{pq}$. Usually, the $N_{pq}$ satellite with the highest elevation angle is chosen as the reference satellite to obtain $N_{pq}-1$ double differenced GNSS pseudorange observations [35]. Note the reference satellite as $S_M$. Then, $N_{pq}-1$ equations are obtained as Equation 6 by setting $i=M$ and $j=1,\dots ,M-1,M+1,\dots ,N_{pq}$, i.e.,

$$\left[\begin{array}{c}\nabla {\beta }_{pq}^{M1}\\ \nabla {\beta }_{pq}^{M2}\\ ⋮\\ \nabla {\beta }_{pq}^{M{N}_{pq}}\end{array}\right]=\left[\begin{array}{c}{l}_M^T-l_1^T\\ l_M^T-l_2^T\\ ⋮\\ l_M^T-l_{N_{pq}}^T\end{array}\right]l_{pq}+\left[\begin{array}{c}{\epsilon }_{pq}^{M1}\\ {\epsilon }_{pq}^{M2}\\ ⋮\\ {\epsilon }_{pq}^{M{N}_{pq}}\end{array}\right]+\left[\begin{array}{c}{b}_{pq}^{M1}\\ b_{pq}^{M2}\\ ⋮\\ b_{pq}^{M{N}_{pq}}\end{array}\right]$$

(7)

With Equation (7), the double differenced pseudorange measurement formulation of a constellation (such as GPS constellation) can be rewritten as

$$z_{pq}^{GPS}=H_{pq}^{GPS}{l}_{pq}+{\epsilon }_{pq}^{GPS}+b_{pq}^{GPS}$$

(8)

where ${\epsilon }_{pq}^{GPS}\in R^{N_{pq}-1}$ is the measurement error of double differenced GPS pseudoranges, which follows a normal distribution with zero mean and covariance matrix ${\Sigma }_{pq}^{GPS}\in R^{(N_{pq}-1)\times (N_{pq}-1)}$.

Through Equation (8), the relative positioning solution ${\widehat{l}}_{pq}^{GPS}$ can be obtained using the weighted least squares method, while the relative positioning vector of other constellations can be obtained in the same way.

(2) UWB observations

To obtain the distance $z_{pq}^{UWB}$ between two UAVs, the time of flight of the UWB signal from the emitter UAV to the receiver UAV is estimated and then multiplied by the speed of light $c$. In this paper, a two-way ranging method is applied to obtain the UWB ranging observations [33], which can get centimeter-level error distances within a few hundred meters range.

In this work, UWB measurement is used as direct measurement of the baseline distance. In order to simplify the procedure for data fusing, the linearized UWB observations formula is utilized in a similar way to GNSS observations [34],

$$z_{pq}^{UWB}=H_{pq}^{UWB}{l}_{pq}+{\epsilon }_{pq}^{UWB}+b_{pq}^{UWB}$$

(9)

where ${\epsilon }_{pq}^{UWB}\in R^1$ is the measurement error of the UWB system, which is assumed to follow a normal distribution with zero mean and covariance matrix ${\Sigma }_{pq}^{UWB}\in R^{1\times 1}$. To be simplified, this work assumes the covariance matrix of UWB for each pair of UAVs to be independent and identically distributed. $H_{pq}^{UWB}\in R^{1\times 3}$ is the normalized line-of-sight vector from $U_p$ to $U_q$, which is estimated using the relative positioning solution ${\widehat{l}}_{pq}^{GPS}$ during the iteration in this paper. $b_{pq}^{UWB}\in R^1$ is the fault of UWB observation, which is assumed to be zero due to the simplify and robustness of the UWB system. Details about the UWB failure models will be further researched in the future.

(3) Observation fusing

Stacking Equations (8) and (9), the observation fusing of double differenced GPS pseudoranges and UWB ranging units can be obtained as

$$\left[\begin{array}{c}{z}_{pq}^{GPS}\\ z_{pq}^{UWB}\end{array}\right]=\left[\begin{array}{c}{H}_{pq}^{GPS}\\ H_{pq}^{UWB}\end{array}\right]l_{pq}+\left[\begin{array}{c}{\epsilon }_{pq}^{GPS}\\ {\epsilon }_{pq}^{UWB}\end{array}\right]+\left[\begin{array}{c}{b}_{pq}^{GPS}\\ 0\end{array}\right]$$

(10)

which can be rewritten as

$$z_{pq}^{}=H_{pq}^{}{l}_{pq}+{\epsilon }_{pq}^{}+b_{pq}^{}$$

(11)

where the random error ${\epsilon }_{pq}^{}$ follows a normal distribution with zero mean and a diagonal covariance matrix by assuming the independence between GPS and UWB measurements [31] as

$${\Sigma }_{pq}=\left[\begin{array}{cc}{\Sigma }_{pq}^{GPS}& 0\\ 0& {\Sigma }_{pq}^{UWB}\end{array}\right]$$

(12)

With the aid of UWB measurements, the over-determined integrated system can improve the integrity performance for multi-UAV relative navigation. Note that, as the sampling rate of UWB systems can be much higher than GNSS receiver, the UWB observations can be down-sampled to obtain the synchronous GNSS observations and UWB observations. Moreover, there might be a lever-arm between the GNSS antenna and the UWB antenna on a UAV, which is calibrated in real applications.

2.2.2. Fault Detection

As discussed above, the observations of GNSS are vulnerable to different kinds of faults, which would cause a relative position bias for each pair of UAVs, as shown in Figure 3. Thus, the annoying faults should be detected to avoid catastrophic consequences for multi-UAV systems.

The core idea of fault detection for integrity monitoring is to check the consistency of the over-determined observations [36]. In this section, the residual-based snapshot method for multi-sensor integration system is applied to detect the fault for relative navigation [15]. Given the measurement model in Equation (11), the weighted least-squares solution for the estimation of $l_{pq}$ is given by

$${\widehat{l}}_{pq}=A_{pq}{z}_{pq}^{}$$

(13)

where $A_{pq}=(H_{pq}^T{\Sigma }_{pq}^{-1}{H}_{pq}^{}{)}^{-1}{H}_{pq}^T{\Sigma }_{pq}^{-1}$.

Then, the residual vector is defined as

$$\Delta z_{pq}^{}=z_{pq}^{}-H_{pq}^{}{\widehat{l}}_{pq}$$

(14)

Substituting Equation (13) into Equation (14), yields,

$$\Delta z_{pq}^{}=z_{pq}^{}-H_{pq}^{}{A}_{pq}{z}_{pq}^{}$$

(15)

Note $S_{pq}=I_{pq}-H_{pq}^{}{A}_{pq}$, where $I_{pq}$ is a $N_{pq}$

$N_{pq}$ by identity matrix, the residual vector above can be obtained as

$$\Delta z_{pq}^{}=S_{pq}(H_{pq}^{}{l}_{pq}+{\epsilon }_{pq}^{}+b_{pq}^{})=S_{pq}({\epsilon }_{pq}^{}+b_{pq}^{})$$

(16)

With Equation (16), the test statistic Sum of Squared Errors (SSE) of the integrity monitoring for relative navigation is given by

$$SS{E}_{pq}^{}=\Delta z_{pq}^T{\Sigma }_{pq}^{-1}\Delta z_{pq}^{}$$

(17)

When there is a fault in the observations, i.e., $b_{pq}^{}\ne 0$, the SSE follows a noncentral chi-squared distribution with $N_{pq}-3$ degrees of freedom, and noncentrality parameter ${\lambda }_{pq}^2=b_{pq}^T{\Sigma }_{pq}^{-1}{S}_{pq}{b}_{pq}^{}$. Similar to the existing RAIM method [37], the fault detection method is to use the centralized distribution to determine the detection threshold $T_{pq}$.

Given a fault alarm requirement $p_{fa}$, the detection threshold $T_{pq}=f_T(N_{pq},p_{fa})$ can be obtained offline by solving the following equation [37]

$$p_{fa}=\frac{1}{2^{(N_{pq}-3)/2}\mathsf{\Gamma }((N_{pq}-3)/2)}{\displaystyle {\int }_{T_{pq}}^{\infty }{x}^{\frac{N_{pq}-3}{2}-1}{e}^{-\frac{x}{2}}dx}$$

(18)

where $\mathsf{\Gamma }\left(\alpha \right)={\displaystyle {\int }_0^{\infty }{t}^{\alpha -1}{e}^{-t}dt}$ is the Gamma function, $e$ is the natural constant. The fault alarm $p_{fa}$ is set to $4\times {10}^{-6}$ as in [38].

Once the test statistic $SS{E}_{pq}^{}$ exceeds the threshold $T_{pq}$, the normalized observation residuals is considered to not obey the centralized distribution, that is, the pseudorange observation is faulty. If the fault does not exist, it is called a false alarm.

2.2.3. Fault Exclusion

The purpose of fault exclusion is to not immediately stop using relative navigation when a fault is detected, thereby improving the continuity of the system. If the fault detection warning is sent to the system, fault identification and exclusion are processed using a leverage-based fault identification method [39], and the index of the most likely fault can be calculated by

$${\mathrm{v}}_{pq}=\arg \underset{m\in [1,N_{pq}-1]}{\max }(\frac{{\left(S_{pq,m}^T{z}_{pq}^{}\right)}^2}{S_{pq,mm}^{}}-\ln S_{pq,mm}^{})$$

(19)

where $S_{pq,m}^{}$ and $S_{pq,mm}^{}$ is the $mth$ column vector and the $mth$ diagonal element of matrix $S_{pq}^{}$, respectively.

The fault detection and fault exclusion is processed alternately until no alert is raised by the fault detector or the system is unavailable for relative navigation.

2.3. Protection Level Estimation for Relative Navigation

Protection level is originally used for evaluating the integrity performance in absolute navigation systems, which is a statistical error bound computed so as to guarantee that the probability of the absolute position error exceeding the said number is lower than the target integrity risk. In this paper, Relative Protection Level (RPL) is used because the integrity of this work is considered for relative navigation. RAL is defined as the relative error tolerance a system has, which cannot be exceeded without issuing a warning. To obtain the level of safety for relative navigation, RPL is estimated and compared with the required RAL in horizontal/vertical coordinate to evaluate the availability of the system. However, there is still no RAL indicator for multi-UAV systems, which will be further researched in the future.

Note that the fault hypothesis $H_{pq}^i$ for different fault models in $b_{pq}^{}$, and $H_{pq}^0$ is a fault free model. Then the allocated integrity risk under hypothesis $H_{pq}^i$ can be defined as [40]

$$I{R}_{pq}^i=p(\sqrt{\Vert {\widehat{l}}_{pq}-l_{pq}\Vert }>RPL|H_{pq}^i)p(SS{E}_{pq}<T_{pq}|H_{pq}^i)p(H_{pq}^i)$$

(20)

where integrity risk $I{R}_{pq}^i$ is a function of the probability of the relative position error exceeding the protection level to be estimated $p(\sqrt{\Vert {\widehat{l}}_{pq}-l_{pq}\Vert }>RPL|H_{pq}^i)$, the prior probability of hypothesis $H_{pq}^i$, hypothesis $p(H_{pq}^i)$, and the miss detection rate $p(SS{E}_{pq}<T_{pq}|H_{pq}^i)$. The integrity risk for each hypothesis including $H_{pq}^0$ is defined to accommodate all possible bias sizes. The final protection level for relative navigation is the maximum one among all hypotheses. In this paper, the risk for each hypothesis is set as $I{R}_{pq}^i={10}^{-7}$, $p(H_{pq}^i)={10}^{-4}$ [40].

The relative protection level can also be divided into Relative Horizontal Protection Level (RHPL) and Relative Vertical Protection Level (RVPL). However, an accurate relative protection level calculating in Equation (20) can be very complex and time consuming [41]. Thus, to simplify the process, the protection level is approximately estimated as [15]

$$RHP{L}_{pq}=\underset{m}{\max }(H_{slope}(m))T_{pq}+K(1-I{R}_{pq}^i/2p(H_{pq}^i))\sqrt{J_{11}^{}+J_{22}^{}}$$

(21)

$$RVP{L}_{pq}=\underset{m}{\max }(V_{slope}(m))T_{pq}+K(1-I{R}_{pq}^i/2p(H_{pq}^i))\sqrt{J_{33}}$$

(22)

where $K(•)$ is the inverse of the cumulative distribution function of a Gaussian random variable with zero mean and unit variance. $J_{11}^{}$, $J_{22}^{}$ and $J_{33}^{}$ are the diagonal elements of ${\left(H_{pq}^T{\Sigma }_{pq}^{-1}{H}_{pq}^{}\right)}^{-1}\in R_{}^{3\times 3}$, and the slope for RHPL and RVPL can be obtained as

$$H_{slope}(m)=\frac{\sqrt{A_{pq}{,}_{1m}^2+A_{pq}{,}_{2m}^2}}{\sqrt{S_{pq,mm}^{}}}$$

(23)

$$V_{slope}(m)=\frac{A_{pq}{,}_{3m}^{}}{\sqrt{S_{pq,mm}^{}}}$$

(24)

where $A_{pq}{,}_{1m}^{}$, $A_{pq}{,}_{2m}^{}$ and $A_{pq}{,}_{3m}^{}$ are the elements of matrix $A_{pq}$, respectively.

The RHPL (or RVPL) in Equation (21) (or Equation (22)) consists of two terms. The first term is the maximum slope value $\underset{m}{\max }(Slope(m))$ multiplied by the detection threshold $T_{pq}$, and the second term is the inverse of the cumulative error distribution. For a better visualization, the calculation of RPL aggregated from the two terms is shown in Figure 4.

The estimated relative protection level is the position error that the algorithm guarantees will not be exceeded without being detected, which can be used to test the availability of the navigation system for multi-UAV relative navigation requirements. If the relative protection level in Equations (21) and (22) is larger than the required RAL or the number of common visible satellites for two UAVs is less than five, the not available message will be sent to the system.

3. Results

In this section, two separate simulated experiments derived from the real flight data are designed to verify the effectiveness of the proposed method in autonomous integrity monitoring for multi-UAV relative navigation. The first experiment is to evaluate the fault detection and exclusion performance of the proposed method, which is compared with the stand-alone GPS-based baseline method. The second experiment is to test the performance of relative protection level in real applications. Note that this work adopts GPS only for an example. The work can be easily extended to other constellations and multi-constellations.

3.1. Data and Experimental Setup

In order to illustrate the performance of the proposed integrity monitoring method for relative navigation, a real multi-UAV formation-keeping flight is conducted. In the experiments, three in-house quadrotor drones are used to set up the experiments, each of which carries a GPS receiver and a UWB module. The descriptions of the products are shown in

Table 1. Descriptions for the products in the experiments.

Product Name	Description	Value
UAV	Maximum Flight Time Maximum Speed Control Range	60 min 15 m/s 10,000 m
GPS Module	Single Point Positioning (RMSE) DGPS (RMSE) Dual Frequency RTK (RMSE) Raw Data Sampling Rate	3 m 0.9 m 1 cm 10 Hz
UWB Module	Center Frequency Maximum Ranging Distance Ranging Accuracy (RMSE) Raw Data Sampling Rate	4.3 GHz 100 m 10 cm 100 Hz

, where RMSE is short for root mean square error.

For safety concerns, these three drones in the experiments fly 4 km over an open lake along a rectangle trajectory during each sortie, and the total flight is composed of 10 sorties. During the flying process, the UAV formation is kept as an equilateral triangle with a constant side length. The constant side length changes from 10 to 100 m. The GPS receiver elevation mask angle is set to 15 degrees, as shown in Figure 5a. The dual frequency RTK technology is applied to provide positioning results up to centimeter-level accuracy, which can be regarded as the true position of the UAVs. Considering that the real GPS data with fault events are very difficult to obtain in practice, a manual fault event is added to the observations of the real data. The UWB observations are down-sampled to obtain the synchronous GPS observations and UWB observations, and the total amount of data for the experiments are ${10}^5$ samples of GPS and UWB observations.

To simulate a complex multi-UAV flight environment, some of the visible satellites are manually removed to verify the performance of the proposed algorithm under different receiving conditions. These experimental setups are used to verify the advantages of the proposed method from the perspective of geometric distribution and redundancy of the observations. Considering the influence of the geometric distribution and the redundancy on the performance results, the following three forms of conditions are designed as shown in Figure 5. Case I: Figure 5a shows the original satellite observations of the receiver, which consists of eight visible satellites. Case II: Figure 5b sets the receiver elevation mask angle to 30 degrees, which simulates a flying environment with more occlusion around. Case III: Figure 5c sets a 60 degree azimuth mask, which is dynamic and overlapping with the other two UAVs. Experimental results show that the UAVs cooperation can be used to significantly improve the integrity monitoring performance of relative navigation to compensate for partial occlusion.

3.2. Results of Fault Detection and Exclusion

To evaluate the performance of the proposed approach, the GPS stand-alone RAIM method (GSRM) is applied for a comparison in terms of fault detection and exclusion. The simulations randomly selected one visual satellite and added the fault bias on the pseudorange. The fault detection and exclusion results with different methods are shown in Figure 6, which shows that the proposed method performs better than the GSRM with a higher fault detection and exclusion rate under the conditions of the same fault.

In terms of fault detection in Figure 6a, the experimental results show that the relative ranging provided by the UWB can greatly improve the fault detection performance of the relative positioning of multi-UAV systems. The performance of my method in different cases shows that as the number of visible satellites increases or the geometric distribution becomes better, the performance of my method gradually increases. My method significantly outperforms the GSRM in terms of fault detection. The experimental results also show that by introducing UWB observations, even in Case II and Case III with less visible satellites and poor geometric distribution, my method’s performance is still much better than that of the GSRM method when the satellite observation is the best in Case I. For a better quantified comparison between these methods, the performance of detection rate on 10 m fault bias and Minimal Detectable Biases (MDBs) (taking into account that the detection power is 99%) [42] of these methods are shown in

Table 2. Performance of my method and GPS stand-alone RAIM method (GSRM) on different fault bias and 99% Minimal Detectable Biases (MDBs), in different cases.

	Detection Rate for 10 m Fault Bias			99% MDBs			Exclusion Rate for 15 m Fault Bias
	Case I	Case II	Case III	Case I	Case II	Case III	Case I	Case II	Case III
My method	100%	99.37%	98.71%	5.95 m	8.93 m	10.42 m	97.86%	97.23%	92.92%
GSRM	91.48%	82.14%	70.93%	12.4 m	15.38 m	16.86 m	91.49%	75.09%	50.54%

.

In terms of fault exclusion in Figure 6b and Table 2, my method also shows great potential for multi-UAV collaborative navigation applications. As the fault exclusion is proposed to not immediately stop using relative navigation when a fault is detected, my method can improve the continuity of the navigation system, when compared with the GSRM. From the performance improvements of my method compared with the GSRM, the effect of UWB observations is more important in the cases with fewer visible satellites or worse geometric distribution. For example, in Case III, the fault exclusion performance of the GSRM is the worst due to the partial occlusion. However, with the aid of the UWB observations, which provide an accurate relative navigation measurement, the performance of my method is quite improved. Moreover, the fault exclusion results of my method in Case III are a little better than that of the GSRM in Case I. At the same time, the curves of fault exclusion rates of my method are much denser than that of the GSRM, which indicates that my method is less sensitive to the number of visible satellites, when compared with the GSRM.

3.3. Results of Relative Protection Level

In the experiments, to test the relative navigation performance of multi-UAV systems, the RPL is estimated for relative position context. The experimental results show that a significant decrease in RPL is obtained by my method to improve the availability of the system, when compared with the GSRM. Figure 7 shows a comparison of my method and the GSRM in terms of RPL estimation in different cases. Specifically, the RHPL and the RVPL are estimated and compared separately. The average RPLs are also shown in

Table 3. The average RPLs in different cases.

	Case I		Case II		Case III
	Avg. RHPL (m)	Avg. RVPL (m)	Avg. RHPL (m)	Avg. RVPL (m)	Avg. RHPL (m)	Avg. RVPL (m)
My method	7.30	9.68	7.37	9.75	8.33	14.03
GSRM	10.23	11.02	11.26	11.98	15.90	17.99

. For example, the average RHPLs of my method are 7.30 m, 7.37 m, and 8.33 m in the three experimental cases, respectively, while the average RHPLs of the GSRM are 10.23 m, 11.26 m, and 15.90 m in the same cases, respectively. The results show that my method obtains a more significant RHPL decrease than the GSRM by 28.6%, 34.5%, and 47.6% in the three experimental cases, respectively. Similarly, my method achieves a larger decrease in RVPL than the GSRM by 12.2%, 18.6%, and 22.0% in the three experimental cases, respectively. My experimental results show that as the geometric distribution becomes worse in different cases, UWB provides a greater impact on the improvement of the RPL performance. Moreover, compared with RVPLs, the performance improvements in RHPL are more significant. One possible reason is that high-precision UWB observations have brought significant improvements to the geometric distribution in the horizontal direction. Although better RPL results are obtained by the proposed method, there is still no integrity indicator for multi-UAV systems. Thus, one cannot yet use RAL to evaluate the performance in practical applications. The work will be further researched in the future.

4. Conclusions

To improve the reliability of relative navigation for multi-UAV systems, a novel autonomous integrity monitoring method is proposed, which fuses double differenced GNSS pseudoranges and UWB ranging units to improve the performance on fault detection and exclusion while obtaining a smaller RPL. Results on different experimental cases show great potential for my method in multi-UAV applications. Specifically, compared to the conventional GRSM, my method achieves a fault detection rate increasing by 8–27%, a fault exclusion rate increasing by 6–42%, and a RPL decreasing by 12–47% under the experimental cases.

However, the limitation of the proposed method is that it does not make full use of all of the inter-UAV measurements in a multi-UAV system. Additionally, in contrast to the area of civil aviation, the integrity performance indicators for multiple UAVs have not been determined in practical applications. These works will be further investigated in the future.