A review of system integration and current integrity monitoring methods for positioning in intelligent transport systems

Applications of intelligent transportation systems are continuously increasing. Since positioning is a key component in these systems, it is essential to ensure its reliability and robustness, and monitor its integrity so that the required levels of positioning accuracy, integrity, continuity and availability can be maintained. In challenging environments, such as urban areas, a single navigation system is often difﬁcult to fulﬁl the positioning requirements. Therefore, integrating different navigation sensors becomes intrinsic, which may include the global navigation satellite systems, the inertial navigation systems, the odometers and the light detection and ranging sensors. To bind the positioning errors within a pre-deﬁned integrity risk, the integrity monitoring is an essential step in the positioning service, which needs to be fulﬁlled for integrated vehicular navigation systems used in intelligent transportation systems. Developing such innovative integrity monitoring techniques requires knowledge of many relevant aspects including the structure, positioning methodology and different errors affecting the positioning solution of the individual and integrated systems. Moreover, knowledge is needed for the current mitigation techniques of these errors, for possible fault detection and exclusion algorithms and for computation of protection levels. This paper provides an overview and discussion of these aspects with a focus on intelligent transportation systems.


INTRODUCTION
The development and spread of many intelligent transportation systems (ITS) applications necessitate the use of effective integrity monitoring (IM) algorithms of positioning as a crucial component in these systems. Generally, ITS applications are classified into two categories; safety-of-life applications and liability-critical applications. If the undetected errors in navigation can cause life threat, the corresponding application is classified as safety-of-life. Examples are the emergency services management, collision alert, and advanced driver-assistance systems. On the other hand, if the undetected positioning errors can lead to undesirable economic and legal actions, the corresponding application is classified as liability-critical, such as the electronic toll collection and the pay-per-use insurance [1,2].
The To mitigate the NLOS effects, some studies proposed the use of 3D maps in urban areas to detect the NLOS signals by identifying the visible and blocked signals [3][4][5]. Other studies proposed the shadow-matching technique to estimate the user location by comparing the signal availability determined from FIGURE 1 Signal scenarios in urban environments including line of sight, no-line of sight, multipath and blocked signals the receiver and the signal predictions determined from the 3D maps [6,7]. In the same context, the integration of GNSS with a fish-eye camera, to distinguish the visible satellites from the hidden ones, was presented for example in [8,9]. In a different approach [10], presented a method to detect NLOS signals by using dual-polarization antennas based on the carrierto-noise ratio (C/N0) information. In addition, a consistency check technique was adopted in [11,12] to exclude the NLOS signals. Height aiding and C/N0 weighting were investigated in [11] to improve positioning. A vector tracking technique for NLOS detection was proposed in [13]. Additionally, a number of studies focused on the antenna and receiver design to mitigate the multipath interference effect [14,15]. Other studies investigated the use of weighting models considering the elevation angles and the C/N0 [16,17].
In the dense urban environment, GNSS frequently experience an outage due to observing an insufficient number of observations under bad measurement conditions. Therefore, to deliver continuous positioning solutions, GNSS is typically supported by other navigation systems such as the inertial navigation system (INS). In vehicular navigation, and due to cost restrictions, the low-cost micro-electro-mechanical system (MEMS) sensors are often used in the INS. In addition, the odometer sensors can be integrated with GNSS and INS to improve the positioning performance as they can provide the scalar vehicular speed, which is transformed to a velocity vector using the attitude derived from the INS. Such velocities can be integrated in time to give positioning change. The advantage of using self-contained systems, such as MEMS INS and odometer sensors, is that they are independent of the multipath and NLOS errors, light in weight, have low-cost and low-power consumption. Their main drawback, however, is the significant increase of the biases with time if kept unaided by another system [18].
Another navigation system that is used in ITS applications is the automotive light detection and ranging (LiDAR) sensor. It is becoming a popular positioning system, in particular for autonomous systems. In dense urban environments, when GNSS suffers from signal blockage and multipath, LiDAR can bridge positioning by extracting enough features from the surrounding environment [19]. Positional differences can then be derived by matching different scans. On the other hand, in the open-sky areas, which are favourable for GNSS with the presence of a good number of observations, LiDAR may struggle due to the lack of features in its range, which may result in failed extraction or matching processes. Therefore, LiDAR and GNSS can complement each other and provide INS and odometer sensors with continuous corrections.
To ensure positioning reliability, its integrity should be monitored. Integrity refers to the level of trust in the navigation system. Integrity has two tasks, the first is to detect and exclude system faults and the second is to check that the positional error (PE) does not exceed a threshold, called the alert limit (AL). If this happens, it should provide a warning to the user within a specified time called the time to alert. The probability of hazardous misleading information (HMI) should be taken into consideration, which is the probability of having a PE larger than the AL without raising an alert. It is selected according to the application at hand. Since positioning errors are not known in practice, the protection levels (PLs) are computed, which statistically defines the largest PE that may affect the position output without raising an alert, with a probability smaller than or equal to the permissible probability of HMI.
Over the past couple of decades, some studies proposed IM schemes for aviation. However, similar schemes that can be used for land applications of ITS to maintain the required levels of positioning accuracy, integrity, continuity and availability, are lacking and some groups are currently working on its development. In addition, IM algorithms for the integrated positioning systems are limited, and mostly only focus on the fault detection step. The integrity algorithms, which are suitable for ITS applications, will be reviewed in this article, in addition to discussing their limitations and the development needed.
This contribution gives an overview of the possible integrations of the different navigation systems, in addition to the current IM approaches, that are relevant to ITS. The paper is organized as follows: Section 2 briefly introduces the different navigation systems that can be used in ITS prior to delving into the integration process among them. Section 3 gives an overview of the integration process of these navigation systems and the algorithms needed to derive the integrated vehicular position. Subsequently, Sections 4 and 5 discuss the integrity concept, the different navigation parameters needed for a successful integrity process, the strategies used for IM, together with the current integrity algorithms relevant to ITS applications.

NAVIGATION SYSTEMS
In this section, a brief description of the positioning systems used in ITS is given. Then, the main characteristics and vulnerabilities of each system will be overviewed.

GNSS
GNSS provides absolute positioning, where the code and phase measurement equations can be formulated as [20]: where p and L are the pseudorange code and carrier-phase measurements, respectively. G r is the geometric range and c is the speed of light. dt r and dt s denote the receiver and the satellite clock offsets, respectively. is the carrier wavelength. T and I represent the troposphere and ionosphere delays. d r and d s are the receiver and satellite code biases, respectively. r and s are the receiver and satellite phase biases. s r and s r are corrections applied to code and phase measurements, correspondingly, due to the phase center offsets and phase center variations. and are the code and phase noise, including multipath. N is the carrier-phase ambiguity and P W is the phase wind-up correction. The different GNSS algorithms that can be used in ITS, such as real-time kinematic (RTK) and precise point positioning (PPP) are reviewed extensively in the literature [20,21]. The GNSS vulnerabilities that need to be included in the IM threat model in ITS applications are described in [22] and will be later mentioned in Table 1.

Odometer
Odometers measure the rotation of the vehicle's wheel, which can be used continuously to calculate the vehicle's speed and travelled distance. The odometer speed (v od ) is proportional to the frequency of the sensor signal ( f s ), and can be calculated as [23]: where O v is the wheel's circumference, r v is the wheel's radius and N t is the number of teeth on the wheel. The use of odometers in navigation is based on the assumption that the wheel's revolutions can be converted to linear distance. However, some errors can affect the accuracy of this conversion [24][25][26]. These errors are summarized in the last part of this section in Table 1.

Inertial navigation system
An INS is a dead reckoning relative-positioning system that provides position changes with time. It consists of accelerometers and gyroscopes, which constitute the inertial sensor assembly (ISA). The ISA with the related electronics comprises the inertial measurement unit (IMU). The IMU with a computer, applying the mechanization and filtering algorithms, constitute the INS which can provide continuous navigational solutions. The errors affecting the INS navigation process were extensively described in the literature [18,[27][28][29][30]. These error sources are summarized in Table 1, and generally, they are classified into two groups; systematic errors and random errors. The random part is modelled by stochastic models employing the firstorder Gauss-Markov (GM), random-walk and autoregressive processes [31]. In most GNSS/INS integrations using a Kalman filter, the stochastic errors are modelled with a first-order GM process [32,33], which models a correlation that decays with time using a constant time length. The constant time is determined as the maximum time until reaching an insignificant autocorrelation determined from the autocorrelation analysis.
The integration between navigation systems in ITS applications requires understanding their different coordinate systems (frames) and their relationship. Basically, four frames are involved in the navigation process, namely; the earth centred earth fixed frame, the earth centred inertial (ECI) frame, the local-level frame (l-frame) and the body frame (b-frame). The detailed description of each system and the transformation among these systems can be found for instance in [30,34].
The IMU outputs come from the gyroscopes and accelerometers. The gyroscopes give a vector of rotation rates, which is interpreted as the rotation of the b-frame with respect to the ECI-frame as resolved in the b-frame. The accelerometers give the vector representing the specific forces in the three-body axes [18]. The mechanization process converts these IMU outputs to attitude, velocity and position information. For ITS applications, the output is often given in the l-frame. We thus consider the l-frame mechanization process in this paper. The mechanization process depends on the available aiding sources. For ITS applications, odometer sensors can aid the velocity continuously, and hence, the mechanization algorithm can be simplified. The process can be more accurate after eliminating several error sources in the low-cost IMU mechanization. This simple algorithm can be represented as [30,35]: where Δt is the time interval from epoch k − 1 to epoch k, shown in the superscript of the symbols. z is the rotation rate measured by the vertically aligned gyroscope. f x and f y denote  the specific forces obtained from the transversal and forward accelerometers, respectively. v e , v n and v u are the velocities in the local east, north and up directions. , and h denote the latitude, longitude and ellipsoidal height of the point, which are next transformed to the l-frame for consistency of the output. p, r and A are the pitch, roll and azimuth angles. v od and a od are the velocity and acceleration obtained from the odometer, and e is the Earth's rotation about its spin axis, which is taken ≈15.041 • h −1 [36]. R M and R N denote the radii of curvature in the meridian and prime vertical planes, respectively [37]. g denotes the gravity acceleration which can be computed as described in [38]. The rotation rates and specific forces should be corrected from the biases and scale factors before entering the mechanization process. To simplify the azimuth calculation, the vertical gyroscope is assumed aligned with the vertical axis of the l-frame. This assumption agrees with the actual situation in ITS applications.

Automotive light detection and ranging
Automotive LiDAR sensors use the simple time-of-flight distance-measuring principle by measuring the signal travel time ΔT (go and return) and compute the range by multiplying it by the signal speed, such that R = cΔT ∕2. Unlike the RAdio detection and ranging system which uses microwaves, LiDAR uses ultra-violet or infrared beams within the visible light spectrum [39]. There are different LiDAR systems available for environment perception [40]. However, few systems can be used with vehicles in the different ITS applications. These systems comprise one or more light emitters (TX) in addition to one or more reflected light detectors (RX) to provide coverage for the required Field-of-View (FoV) and a large number of points in each frame (scan). LiDAR systems generate a large amount of data which can reach several GBits per second. In ITS applications, these data should be transferred to an electronic computing unit in real time. This is a challenging research task. The amount of data depends on the required range resolution, the number of frames per second, the FoV frame size and the laser pulse repetition frequency. Additional influencing factors are the number of avalanche photodiodes elements and analogue-to-digital converters sampling frequency [41].
Automotive LiDAR systems can work as aiding systems when being integrated with INS. This integration can provide navigational solutions (localization), and it mainly depends on scan matching, which can be classified into three main categories, namely; the point-based, the feature-based, and the mathematical property-based scan matching. The point-based scan matching depends on the direct searching and matching of the corresponding points in consecutive frames, using the Iterative Closest Point algorithm [42,43] and its derivatives. The feature-based scan matching depends on matching features from consecutive frames to get the positional change between these frames. The features used in this category are lines [44][45][46], corners [47], curbs [48], curvatures [49] and lane markers [50]. The most commonly used method is the line-based scan matching because of the frequent appearance of the lines in urban environments, and the computation efficiency of this method. The mathematical property-based scan matching can be based on the use of cross-correlation [51], histograms [52], normal distribution transforms [53] or Hough transformations [54].
In addition to the localization, the simultaneous localization and mapping (SLAM) utilizes digital maps in the process and provides localization and mapping at the same time. The vehicle pose states and the map states are estimated simultaneously, and maps are updated with the most recent measurements. SLAM is widely used in the robotics field [55,56].
In this article, the line-based scan matching is reviewed. The basic idea of this type of scan matching follows the definition of normal points in two consecutive frames. The normal point can be defined as the intersection between the extracted line and the perpendicular line from the used LiDAR equipment to this extracted line. This point can be characterized by two parameters; the polar range and the polar angle . The change of the location of this point between two frames can be used to calculate the change in position and heading between these frames. Figure 2 shows this process, where frames i and j are considered. In a 2D representation, X i and Y i represent the axes of the i-frame, whereas X j and Y j represent the axes of the j-frame. i and j are the polar ranges of the normal points of those frames, respectively, and i and j are the polar angles of the normal points of the i-frame and j-frame. Δx i and Δy i refer to the displacements between the two scans, resolved in the i-frame, in the X i and Y i directions. The term ΔA denotes the heading change between the two scans.
From Figure 2, noting the coordinates of the center of the j-frame (Δx i , Δy i ), its polar range j can be calculated as follows: and thus, the difference between the two polar ranges denoted as Δ L , can be obtained as: In addition, the heading change can be calculated as: Based on these relations, the algorithm can be divided into three main steps; line extraction, line matching and computation of the relative navigational solution. In the first step, the modified incremental split and merge algorithm can be applied for line detection, as described in [46]. In the second step, a search is conducted to find a match between extracted lines in two scans. This process can be achieved by predicting the polar range and polar angle of the normal point in the next scan, using the change in position and heading obtained from INS. Then, the prediction variance-covariance (VC) matrix is calculated and the search process is performed looking for the normal point in the current scan as described in [57]. In the third and final step, the relative navigational solution is computed. For u number of matched lines, the mathematical relationship joining the polar parameters and the relative navigational solution can be expressed as: which takes the parametric form, and thus, the least-squares (LS) estimation of the relative navigational solution with respect to the initial frame can be estimated. At least two non-collinear lines are required to calculate Δx i and Δy i , while one line is enough to calculate ΔA i .
Having now briefly reviewed the basic principles of the three navigation systems that can be used in ITS, namely; GNSS, Low-cost INS/odometers, and LiDAR, Table 1 summarizes the main characteristics of each one. As the outputs of the IMUs and odometers are processed together in the mechanization process to derive navigational solutions, they will be treated as one system here. The GNSS vulnerabilities that need to be included in the IM threat model in ITS applications were studied and discussed in [22] and summarized. The vulnerabilities that need to be considered in the IM process, in case of using the low-cost MEMS INS, odometer and automotive LiDAR sensors, are also given in Table 1 and will be discussed in detail in our future work.

INTEGRATION OF NAVIGATION SYSTEMS IN ITS
Integrating INS and odometer with other navigation systems such as GNSS and LiDAR requires a good understanding of the nature of the sensor errors to be aided, which can be mitigated by proper modelling and estimation techniques. The most common estimation technique is the Kalman filter (KF) [63,64] in the extended form (EKF), that operates on the error states, since the measurement and dynamic models used are nonlinear. When integrating GNSS with INS/odometer, and LiDAR with INS/odometer, these error states are the differences between the INS/odometer states and the reference states, that is, either GNSS states or LiDAR states. The detailed equations implemented in the EKF can be found in [20].
There are three methods presented in the literature for the integration of the navigation systems; the loosely-coupled (LC), the tightly-coupled (TC), and the ultra-tightly-(or deeply-) coupled integrations [65][66][67]. The first two methods can be used for the integration of INS with GNSS or LiDAR, but the latter method is used in integrating INS with GNSS only as it is performed at the tracking loop level, which requires access to the GNSS hardware. Consequently, the focus here will be on the LC and TC integrations for GNSS/INS/odometer [30], and for LiDAR/INS/odometer combinations [68,69].
The main differences between the LC and TC schemes, in case of integrating GNSS with INS and odometer, are listed in Table 2.
, and h are the latitude, longitude and height errors, respectively. v e , v n and v u are the velocity errors in the east, north and up directions. A is the error in the azimuth angle. SF od denotes the velocity scale factor error from the odometer, and z is the gyroscope drift. b r and d r denote the receiver clock bias and clock drift for each constellation. I represents the unit matrix, and 0 represents the zero matrix. v od and z are the reciprocals of the autocorrelation times for v od and z , respectively, modelled using a first-order GM process. e 2 is squared of the datum first eccentricity. p andṗ are the pseudoranges and pseudorange rates. The subscripts G and N denote the solutions obtained by GNSS, and obtained/predicted by INS and odometer, respectively. The flow diagrams for integrating the INS and odometer with GNSS in the LC and TC schemes are shown in Figures 3 and 4, respectively.
The main differences between the LC and TC schemes, in case of integrating LiDAR with INS and odometer using the line-based scan matching, are listed in Table 3. Δx and Δy are the displacement errors in X i and Y i directions, respectively. v x and v y are the velocity errors in X i and Y i directions. v od and a od denote the errors in the odometer velocity and acceleration, respectively. ΔA is the error in heading change, and a od is the reciprocal of the autocorrelation time for a od modelled using a first-order GM process. In addition, the flow diagrams for integrating INS and odometer with LiDAR in the LC and TC schemes are illustrated in Figures 5 and 6, respectively.

INTEGRITY AND NAVIGATION PERFORMANCE
The integrity of the navigation system defines the level of trust in the system as mentioned above. It was firstly used in aeronautical applications [70][71][72] as one of the key performance parameters, which are defined in [73,74] and include in addition to integrity the following: -Accuracy, which defines the level of agreement between the estimated and the true positions. It can be measured by the 95% confidence interval, for instance, using the root mean square error, and it is computed assuming fault-free conditions and under standard system performance Continuity, which defines the capability of the navigation system to provide a position output and maintain the required accuracy level and integrity over the operational period of the system without interruption or raising an alert; and Availability, which is the time ratio when the navigation system output is usable, maintaining the accuracy, integrity and continuity requirements T is the line of sight unit vector between the receiver and satellite n

FIGURE 3
Loosely-coupled integration of GNSS, inertial navigation system and odometer

FIGURE 4
Tightly-coupled integration of GNSS, inertial navigation system and odometer To assure positioning reliability, the position error (PE) should be bounded by a specified region around the true position, where the boundaries of these regions are defined by the ALs. The integrity process aims to guarantee that the PEs lie inside this region with probability equals to at least, (1 − P HMI ) where P HMI is the maximum allowed probability of HMI. At the same time, the integrity process aims to satisfy the continuity requirement by guaranteeing that the maximum probability of raising an alert and interrupting the operation, without a valid reason, is P FA , which is denoted as the probability of false alert (FA). P FA is a sub-allocation of the continuity requirement C 0 , that is, P FA < 1 − C 0 , where C 0 should also account for the probability of the justified alert in case of the PL exceeding the AL [75].
In aviation, where the integrity concept using SPP is quite mature, the region defined by the ALs is cylindrical, where the radius of the cylinder is the horizontal alert limit and its height is the vertical alert limit (see Figure 7a). On the other hand, in ITS applications, in most cases only the horizontal errors are of interest and the concerned directions are the along-track (AT) and the cross-track (CT) directions with the corresponding ALs denoted as AL AT and AL CT , respectively. Therefore, the region defined by the ALs is rectangular [76] (see Figure 7b). P HMI maybe different in both directions, such  3 The loosely-coupled and tightly-coupled light detection and ranging, inertial navigation system and odometer integration using the line-based scan matching KF transition matrix

Tightly-coupled light detection and ranging/inertial navigation system/odometer
that: P HMI AT + P HMI CT = P HMI (9) where P HMI AT and P HMI CT are the maximum allowed HMI probability in the AT and CT directions, respectively. Since in practice PE is not known in real-time processing, it is replaced by its statistical bound, that is, the PL. Thus, in order to verify the availability of system integrity, the following two conditions have to be satisfied: PL CT ≤ AL CT (11) where PL AT and PL CT are the PLs in the AT and CT directions, respectively, and AL AT and AL CT are the ALs in the AT and CT directions.
Meeting the required integrity requirements is the main goal of each integrity process, and to achieve this target, it is essential to identify, characterize and consider the probability of all error sources affecting the navigation solution that may lead to its failure, according to the sensor used and the work environment. Since statistical testing is typically applied, the probability distributions of the system errors have to be considered. For instance, in GNSS navigation, and according to the method used such as Loosely-coupled integration of light detection and ranging, inertial navigation system and odometer using the line-based scan matching

FIGURE 6
Tightly-coupled integration of light detection and ranging, inertial navigation system and odometer using the line-based scan matching RTK or PPP, the clock and ephemerides error, multipath error, FIGURE 7 (a) Cylindrical alert limit region in aviation and (b) rectangular alert limit region in intelligent transportation systems residual atmospheric errors and the noise can affect the navigational solution. These error sources then need to be overbounded considering the different ways in which the errors can be presented when processing the data. The computation of the convolution of all error sources, in case of using empirical distributions for the different error sources, will be complicated and prohibitive even for powerful computers to calculate the exact integrity risk. Therefore, the process necessitates replacing the probability distribution of the combined error sources, that is, their empirical distribution, by one distribution, the so-called the over-bounding distribution.
For safety reasons, the integrity risk computed based on this over-bounding distribution should always exceed the integrity risk computed using the empirical distribution of the combined FIGURE 8 Paired cumulative distribution function over-bounding strategy errors. Since the only finite variance distribution that is stable through convolution is the normal distribution, therefore, it is almost unavoidable to use normal distributions as the basis for the over-bounding distributions [77]. A number of overbounding strategies exist in the literature, such as the single cumulative distribution function (CDF) over-bound, the paired CDF over-bound, the moment over-bound, the excess-mass CDF over-bound, and the excess-mass probability distribution function over-bound [78]. As an example, Figure 8 shows the over-bounding strategy in the case of using the paired CDF over-bound.
In GNSS, IM is implemented either at the system level or at the user level. At the system level, space-based augmentation systems (SBAS) [79] or ground-based augmentation systems (GBAS) [80] while primarily provide real-time corrections that can improve the measurements accuracy, they determine and inform the user through their messages which satellites are faulty, such that the user does not use these satellites. In addition, they generate error bounds that bound the actual errors, to be used in the IM process. In aviation, SBAS and GBAS are efficient ways to guarantee the integrity for the positioning with an accuracy of a few meters. On the other hand, at the user level, the redundancy in GNSS signals can be exploited in IM by performing a consistency check of the observation residuals. This method is known as the receiver autonomous integrity monitoring (RAIM) [81,82]. So far, in aviation, only GNSS phasesmoothed code observations that meet the certification requirements are used, and only in non-precision approaches, with trials for some category I approaches. However, the accuracy obtained from code observations ranges between 1 and 10 m, which is not sufficient for ITS applications that need accuracy at the sub-m level. Therefore, carrier-phase observations need also to be used. Consequently, the traditional SPP used in aviation should be replaced by either RTK or PPP in ITS applications. In addition, successful ambiguity resolution in these methods in the harsh environments depends on the availability of observations from several GNSS systems as presented in [83,84], using observations from a number of frequencies and having a good satellite geometry. The need for ambiguity resolution in case of PPP was studied in [85], highlighting the need for fixed ambiguities in case of the accuracy requirement at a few centimetres. However, for the few decimetres accuracy needed for most ITS applications, float solutions could be sufficient.

RECEIVER AUTONOMOUS INTEGRITY MONITORING ALGORITHMS FOR ITS
The RAIM algorithm, which relies on the redundancy of the observations, and therefore is suitable for GNSS, should be designed taking into consideration the different land environments involved in ITS applications. Many forms of RAIM GNSS-based algorithms exist in the literature. The main RAIM GNSS-based methods are presented and compared in [86,87], and the complexities and the existing research of the integrity process in urban environments are discussed in [86].
The classical RAIM algorithms were used with aviation applications for a long time. In the past decade, the method evolves into the advanced RAIM (ARAIM) GNSS-based algorithm [88][89][90][91][92] that offer multiple advantages over the traditional RAIM, which can be summarized as: ---ARAIM considers the possibility of multiple faults, whereas traditional RAIM only considers single faults -ARAIM includes proof of safety for the integrity process -ARAIM uses dual-frequency GNSS observations to eliminate the first-order ionospheric delays -It exploits the multi-constellation GNSS, instead of using only GPS As multi-band and multi-constellation GNSS observations are utilized in the RTK and PPP methods used in ITS, ARAIM is more suitable to be used. However, in the land environment, additional vulnerabilities such as NLOS effect, a more complicated multipath effect, spoofing, jamming and unintentional interference, exist in particular in the urban environment. The ARAIM baseline algorithm was developed applying the SPP technique, which is suitable for aviation. However, replacing SPP by either RTK or PPP, in ITS, requires further investigation of the additional vulnerabilities associated with the use of the PPP or RTK methods. In addition, mathematical modifications are required to adapt the traditional models to PPP or RTK. In this section, the traditional ARAIM LS snapshot algorithm will be first discussed as the basis for future developments. In the literature, this algorithm was applied to GNSS, but it can also be applied for LiDAR after a suitable modification as will be presented next. This algorithm can be useful in case of the LC integrations mentioned above, as the individual navigational solutions are obtained from the aiding system (GNSS or LiDAR) before being integrated with INS and odometer using KF. However, for the TC integrations, single KF-based processing is carried out integrating the different navigational systems, and therefore, new KF IM architectures are needed for this purpose. Thus, the KF IM architectures, existing in the literature, will be briefly discussed in this section as the basis for our future work in this field.

5.1
Least-squares-based snapshot advanced receiver autonomous integrity monitoring The ARAIM algorithm can be divided into three main steps. The first step is defining the threat model, that is, the alternative hypotheses (fault modes) to be considered, their total number, and the probability of each fault mode. The second step is the FDE process. In GNSS, the fault modes mainly refer to outliers in code observations or undetected cycle slips in the phase observations. For other sensors, in cases of difficulties of obtaining good threat models, signal-based, knowledge-based and hybrid/active approaches can be used to diagnose the faults and perform the FDE process [93,94]. The third step is the computation of the PLs (as the maximum statistical value for PE computed at the designed integrity risk since PE cannot be computed in real-time practice) and next check that PL<AL to declare the availability of IM and the navigation solution. These three steps were extensively studied before in case of using GNSS for aviation, but very limited work was carried out for ITS. The LS-snap shot algorithm used in aviation can serve as the basis for future development in IM for ITS applications that will use GNSS and also in its integration with other sensors. Herein, the same approach will be tailored for its application with LiDAR using the line-based scan matching. The main differences between GNSS and LiDAR, when applying this strategy, will be addressed.

Threat model
Ifx is the unknown vector, the observation equations of the navigation system can be linearized in the form: where y is the measurement vector, A is the design matrix and e is the measurement error vector. The first step is to compute the total number of alternative hypotheses to be considered. Note that we only have one null hypothesis, that is, the system being in a fault-free mode, whereas the total number of fault modes, that is, the number of alternative hypotheses N H a , for n observations can theoretically be: In practice, the maximum number of simultaneous observation faults (i.e. code outliers or phase cycle slips in GNSS) that can be monitored, N max fault , is calculated iteratively as follows [88]: where r is the number of simultaneous faults, P j is the fault probability of measurement j and P thres. is the integrity risk threshold coming from the unmonitored measurements fault. max(r ) should be less than/or equal the degrees of freedom (redundancy) in the system. Assuming that faulty measurements are independent, the probability of occurrence of each fault mode P H a can be expressed as: for the number of simultaneous faulty measurements. For GNSS, a complete list of system vulnerabilities using the RTK technique is given in [22], from which one can decide which vulnerabilities can cause a fault (e.g. large multipath or NLOS causes an outlier in a code observation), its impact and probability. When multiple faults affect a single observation, their effects can be combined into one term. So far, faults due to multipath, NLOS, and ambiguity resolution have not been covered within a complete framework. Therefore, they are not going to be addressed in this review article and will be addressed in future work. Similarly, vulnerabilities of other sensors and their associated threat model will be addressed in our future work. As an example, Table 4 shows the main differences between GNSS and LiDAR in this step.

FDE algorithms
A key element of RAIM is the FDE process. Utilizing the redundancy in the observations, the FDE checks the consistency of all possible combinations of observations to identify the faulty ones (outliers) that are inconsistent with the rest of the observations. Therefore, increasing the measurements redundancy enhances the power of FDE. This process can be performed either in the position domain or in the observation domain [76]. The alternative hypotheses H a (the faulty cases) are tested to detect any anomalies affecting the system. If anomalies are detected, the corresponding observations are excluded. This can be expressed as: where H 0 is the null hypothesis. C is a matrix identifying the tested observations (suspected to be faulty) and ∇ is the error vector. For n observations and z number of faults, C will be n x z matrix, and ∇ will be z x 1 vector containing the magnitude of each bias.
If the FDE process is performed in the position domain, the solution of each hypothesis is calculated as:    For each alternative hypothesis, the solution separation (SS) method can be applied, where the test statistic Δx a is computed as [89]: and its standard deviation ss,a q for the component q is com- where k FA q is the SS test threshold, which depends on the tested element as will be addressed in Table 5, and q denotes the AT or CT direction. The study in [95] shows that there could be a very small difference in the FDE outcome when it is applied in the position domain from that when being applied in the observation domain, due to changes in the size of the threshold zone of the projected faults in these domains. Therefore, the FDE process is complemented by its application in the observation domain [96,97]. The alternative hypotheses H a are tested against H 0 using the generalized likelihood ratio (GLR) test derived from the Neyman-Pearson principle [98]. A uniformly most powerful invariant test statistic using the GLR criterion, can be formed as [97]: whereê 0 is the residual vector using LS in case of the null hypothesis and can be computed, with its VC matrix Q̂e 0 , through the best linear unbiased estimation (BLUE) as:̂e The BLUE of ∇ can be calculated, with its VC matrix Q∇, as:∇ To accept the null hypothesis, the following condition should be satisfied: is the inverse CDF (quantile) of a central 2 distribution with df degrees of freedom and P FA 2 is the probability of false alert approximated as the continuity budget allocated to the 2 test. If the test fails, the null hypothesis is rejected and the faulty observations need to be identified and excluded. Consequently, the maximum value in the test statistics is chosen as the best candidate for exclusion. It is remarked that other testing statistics also exist. A comparison is given in [99].
Because of a slight possibility of a discrepancy between the outcome of the two tests (SS and the test applied in the observation domain, simply known as Chi-square test), one can apply the SS test first, and when all test statistics are below the thresholds, a confirmation check is performed in the observation domain. If this test passes, we proceed to the next step in IM, that is, compute the PLs, and if the confirmation check fails, an alert has to be declared and the PL cannot be computed. If one of the SS tests fails, fault exclusion should commence by choosing the best candidate to be excluded. The subset giving the maximum value of the normalized a T q Δx a ∕ ss,a q . is the best candidate for exclusion. After exclusion, all the previous steps have to be repeated again to ensure that the correct faulty observations are excluded until all the SS tests and the consistency check pass. Table 5 shows the main differences when applying the FDE algorithms described above in case of GNSS and LiDAR.

Computation of the protection level
When the FDE test passes in the previous step, the PL is computed. The effect of possible nominal biases on the solution should be considered and bounded by the PLs. Denoting the total effect of the nominal biases onx 0 andx a as b 0 and b a , respectively, and the maximum nominal bias in a measurement j by b j , the measurement biases are projected in the position domain as: Assuming the observation errors are normally distributed by the over-bounding distribution (cf. Section 4), the upper-values of PLs in the CT direction (PL CT ) and in the AT direction (PL AT ) can be computed as [5]: where 0 and a denote the standard deviations ofx 0 and x a , respectively. l CT and l AT are the allocation of P HMI in the CT and AT directions, respectively, where l CT + l AT = 1. A method to solve these equations using a half-interval search can be found in [88]. For sensors other than GNSS,for example, LiDAR, the same formulas can be used, where k FA H is replaced by k FA hor. The PL can be approximated for low-cost systems with limited computational power as follows: where The PL algorithms, in case of using INS and odometer with the RTK technique in the de-coupled mode, is expressed as [100,101]: where is the azimuth angle. AT and CT are the standard deviations of the solution in the AT and CT directions, respectively, which can be computed by applying the covariance propagation as described in detail in [101]. b IMU is the INS heading bias, which is assumed to increase linearly with time. b odo denotes the bias caused by the odometer speed. a T 1 = [1, 0], a T 2 = [0, 1], and S is the pseudo-inverse matrix used to map the observations space onto the unknowns space as mentioned earlier.

Kalman filter-based integrity algorithms
A number of studies discussed the integrity process using Kalman filter processing. [102] analysed the performance of GPS/INS integration running a number of sub-filters and assuming single satellite faults. For fault detection, the SS test statistics are calculated between the all-in-view filter (i.e. assuming no faults) and the sub-filters. The main problem of running these sub-filters is the increased computational burden especially with the increase in the number of visible satellites when using multi-constellations. In another study, [103] studied the GNSS/INS integration, and proposed the inclusion of the predicted state parameters with the use of code observations in the adjustment to improve the FDE capability and test reliability. The study in [104] presented a KF-based IM approach that provides a tight-bound on the integrity risk assuming the worstcase fault condition. The approach adopts a fault detection procedure in the observations domain. The KF predicted residual (vector of innovations) e k is computed, and its weighted norm r KF at epoch k is expressed as: where Q e k is the VC matrix of the vector of innovations. The cumulative KF test statistics R KF , to a certain chosen time length, is then computed using the test statistics at the previous epoch as follows: The detection Chi-squared threshold is derived using the weights and the independent random variables, which can be obtained for example by the use of singular value decompositions in the recursive form as described in [104]. Regarding the integrity risk bound, a batch LS method is used to calculate the worst-case fault vectors (i.e. of all time epochs). At each epoch, the fault vector is used as an input to a second KF to compute the mean of the estimate error vector, which is used to calculate the PLs. The main problem of this approach is the computational burden needed to implement a batch LS and a second KF. In a following work, [105] derived a sequential IM technique based on the sum of squared weighted norms for a sequence of KF innovations. The study developed a recursive approach to compute the worst-case failure mode slope (FMS) and determine an upper bound on the integrity risk. In addition, they utilized the sequential FMS approach for fault exclusion by extracting the sub-set solutions without the need to run parallel KFs.
In [106], another KF-based RAIM algorithm was presented. For fault detection, a LS-based method is used applying three test statistics. Firstly, the pseudorange and pseudorange rate residual vector is obtained as the difference between the output pseudoranges/pseudorange rates and their predicted values. The predicted pseudorange/pseudorange rate are obtained based on the filter predicted receiver position, the satellite position, predicted receiver clock bias and the predicted atmospheric errors. Next, this vector is modelled as the observation vector in a parametric form, and the three test statistics are performed for three epoch ranges [106].
A sequential PPP KF IM architecture was proposed in [107]. The estimated parameters in the filter include the position, clock biases, float ambiguities, tropospheric delay and multipath error. The method also requires running a bank of parallel KFs. To reduce the computational load, most modelled errors are computed only once based on the fault-free case. The approach assumes an optimal fault-free (all-in-view) estimator, which gives for each subset filter [107]: 2 ss,a = 2 0,KF − 2 a,KF .
where 2 0,KF and 2 a,KF are the error variances obtained from the fault-free filter and the tested subset filter, respectively. Hence, the SS standard deviation ss,a can be updated easily, and the PLs can be computed using Equations (30) and (31).
The study in [108] presented IMU/LiDAR integration to enable the integrity risk evaluation, while accounting for the incorrect associations between mapped and observed landmarks, and incorporating LiDAR return-light intensity measurements to better distinguish between landmarks. An analytical integrity risk bound, provided by [109] is used to consider all possible incorrect associations. The performance assessment showed a significant reduction in the integrity risk by applying the developed integration and incorporating LiDAR return-light intensity.

CONCLUSION
A reliable and robust IM is an essential task for ITS, in particular for safety-related applications such as autonomous driving. In open-sky environments, the precise GNSS-based positioning methods could be enough to satisfy the required navigation performance metrics (integrity, accuracy, continuity, and availability). In urban canyons, however, the large multipath and the poor satellite geometry with limited satellite visibility may hamper the achievement of this goal. Hence, the integration of GNSS with other positioning sensors such as INS, odometer and LiDAR sensors, becomes essential in such environments. The characteristics and vulnerabilities of each navigation system were briefly reviewed. In addition, the integration schemes between these sensors, for ITS applications were presented describing the merits, limitations and the basic mathematical model of each of them. The current integrity algorithms, that can be applied in ITS, were reviewed. The traditional ARAIM LS GNSS-based algorithm was discussed, and a similar algorithm with suitable modification to be applied with LiDAR was proposed. These LS algorithms are useful for the LC integrations and in case of using a single navigational system. In addition, the limited KF-based IM studies, available in the literature, were discussed. These studies can be useful in future work when applying the TC integrations, or the KF-based single system techniques (e.g. RTK and PPP).
The integrity main framework is discussed. However, while IM was comprehensively covered for GNSS in aviation, its methodology in the land environment applications is very limited. Moreover, the IM architectures for other sensors and the integrated systems, which can be applied in open-sky and urban environments, need to be developed. Therefore, future research will have more challenges, considering a large number of vulnerabilities of each sensor and when the sensors are combined, their FDE, PLs and the over bounding error distribution.