7th Workshop on Planning, Perception and Navigation for Intelligent Vehicles. Autonomous Integrity Monitoring of Navigation Maps on board Vehicles

Transcription

1 7th Workhop on Plannng, Percepton and Navgaton for Intellgent Vehcle Autonomou Integrty Montorng of Navgaton Map on board Vehcle Speaker: Phlppe Bonnfat (Unverté de Technologe de Compègne, Heudayc UMR CNRS 753, France) Abtract: Th talk addree the problem of montorng navgaton ytem on board paenger vehcle by ung a Fault Detecton, Iolaton, and Adaptaton (FDIA) paradgm. The am to prevent malfuncton n ytem uch a advanced drvng atance ytem and autonomou drvng functon that ue data provded by the navgaton ytem. The ntegrty of the etmaton of the vehcle poton provded by the navgaton ytem contnuouly montored and aeed. The propoed approach ue an addtonal etmate of vehcle poton that ndependent of the navgaton ytem and baed on data from tandard vehcle enor. Frt, fault detecton cont n comparng the two etmate ung a equental tattcal tet to detect dcrepance depte the preence of noe. Second, fault olaton and adaptaton ntroduced to dentfy faulty etmate and to provde a correcton where neceary. The FDIA framework preented here utlze repeated trp along the ame road a a ource of redundancy. Relevant properte of th formalm are gven and verfed expermentally ung an equpped vehcle n rural and urban condton and wth varou map fault. Real reult how that equental FDIA performed well, even n dffcult GNSS condton. Bo: Phlppe Bonnfat a profeor n the Computer Scence and Engneerng department of the Unverté de Technologe de Compègne (UTC) n France. He obtaned h Ph.D. n automatc control and computer cence at the École Centrale de Nante n 997. Snce 998, he ha been wth Heudayc UMR 753, a jont reearch unt between UTC and CNRS. H reearch nteret are Intellgent Vehcle, hgh ntegrty potonng and map-matchng for moble robot navgaton n tructured outdoor envronment. The attached paper gong to be publhed n IEEE Tranacton on Intellgent Tranportaton Sytem.

2 Sequental FDIA for Autonomou Integrty Montorng of Navgaton Map on board Vehcle Clément Znoune,, Phlppe Bonnfat, Javer Ibañez-Guzmán Abtract Th paper addree the problem of Fault Detecton, Iolaton, and Adaptaton (FDIA) n navgaton ytem on board paenger vehcle. The am to prevent malfuncton n ytem uch a advanced drvng atance ytem and autonomou drvng functon that ue data provded by the navgaton ytem. The ntegrty of the etmaton of the vehcle poton provded by the navgaton ytem contnuouly montored and aeed. The propoed approach ue an addtonal etmate of vehcle poton that ndependent of the navgaton ytem and baed on data from tandard vehcle enor. Frt, fault detecton cont n comparng the two etmate ung a equental tattcal tet to detect dcrepance depte the preence of noe. Second, fault olaton and adaptaton ntroduced to dentfy faulty etmate and to provde a correcton where neceary. The FDIA framework preented here utlze repeated trp along the ame road a a ource of redundancy. Relevant properte of th formalm are gven and verfed expermentally ung an equpped vehcle n rural and urban condton and wth varou map fault. Reult how that equental FDIA performed well, even n dffcult GNSS condton. I. INTRODUCTION Among the nnovaton that are tranformng today paenger vehcle, navgaton map are an mportant component. Map were frt ntroduced a part of navgaton ytem ued to provde gudance nformaton to the drver. Now they are ued to provde context nformaton to nformatve Advanced Drvng Atance Sytem (ADAS) and ther ue ha been extended to actuatng ADAS []. Map are alo central component n the autonomou vehcle that are currently under development n the automotve ndutry []. Navgaton map are therefore playng an ncreangly gnfcant role n vehcle automaton and progrevely replacng the human drver a regard nferrng the current and future vehcle context. In recent year map have ometme been een by the ntellgent vehcle communty a a perfect ource of nformaton. Th aumpton orgnate from robotc-orented map that were made manually wth hgh accuracy, but th aumpton no longer vald when ung global map. The mperfecton of a global map may not matter very much when the map nterpreted by a human, but they can have erou conequence a the degree of automaton of the vehcle ncreae. Lke any other ource of nformaton, navgaton map mut be treated wth cauton. How well the navgaton map repreent the geometry of the road ha a drect mpact on the performance of ntellgent vehcle navgaton ytem. Knowledge of the geometry of the road ahead of the vehcle currently ued to mprove enor trackng (e.g., lane markng for lane-keepng functon, or a leadng vehcle for adaptve crue control applcaton) and Sorbonne Unverté, Unverté de Technologe de Compègne, CNRS Heudayc UMR 753, France. Renault S.A.S, France. Navgaton GNSS GNSS Proproceptve enor Smart front camera Navgaton Map Map Matchng Vehcle poton etmaton Electronc Horzon Navgaton etmate Senor etmate Integrty Montorng Clent ADAS Fgure. Framework for ntegrty montorng n a paenger vehcle. enable hazardou tuaton to be antcpated, by adaptng the vehcle peed (e.g., curve warnng ytem). Geometrc nformaton contaned n the navgaton map alo eental for ome element of hghly automated drvng, ncludng path plannng, decon makng and control functon [3]. Th paper preent a new method for detectng, olatng, and adaptng geometrcal error n map n order to avod dyfuncton n clent ytem. Fg. how the ytem archtecture ued n the propoed approach. In paenger vehcle condered n th work, the navgaton ytem provde context nformaton to clent ADAS. Becaue of ndutral contrant, navgaton ytem cannot be modfed for ntegrty montorng purpoe. A new Integrty Montorng functon (Fg. ) therefore added to montor ntegrty n real tme. The etmate of the vehcle poton provded by the navgaton functon contnuouly evaluated by comparng t to another poton etmate. Th enor etmate computed ndependently of the navgaton ytem, ung on-board vehcle enor, and a fault detected when thee two etmate dffer. One contrbuton of th work to ue Page equental tattcal tet to detect dcrepance between thee two etmate depte the noe reultng from the ue of tandard vehcle enor. When th tet detect a dcrepancy, ambguty ext on the etmate affected by the fault (.e. ether the navgaton, the ndependent etmate, or both can be faulty). Th paper alo develop a complete framework for overcomng th ambguty by makng ue of repeated vehcle trp. Ung a model of the effect of fault on etmate, fault olaton and adaptaton performed by comparng current and pat poton etmate. Structural properte of th formalm demontrate that fault olaton capablty mprove a the number of trp ncreae, and that adaptaton (.e. the dentfcaton of a fault-free etmate that can erve a a correcton) poble when fault are olated. Fnally, the propoed method teted ung real data provded by a tet vehcle n dfferent drvng condton (rural and urban area).

3 Th artcle organzed a follow. Secton II provde the theoretcal context and background of th work. Secton III tate the problem that addreed. Secton IV ntroduce our fault detecton method baed on Page tet. Secton V preent the propoed framework for fault olaton and adaptaton, and detal mportant nherent properte for ntellgent vehcle applcaton. Expermental evaluaton of the propoed method performed wth a tet vehcle and preented n Secton VI. Concluon of th work are dcued n Secton VII. II. BACKGROUND Th ecton provde defnton of the termnology ued, before decrbng work related to the evaluaton of the ntegrty of each component of the navgaton functon. A. Defnton The term fault, error, and falure may have dfferent meanng accordng to the applcaton doman. The followng defnton are ued n the context of th reearch and are baed on thoe gven n [4]: Fault: Error generatve proce. The preence of a fault may not lead to an error. An ncorrect repreentaton of the road network n the dgtal map of the navgaton ytem a fault that lead to an error only when the vehcle travel on the road where the fault preent. Error: A dcrepancy between a computed, oberved or meaured value and the true, pecfed, or theoretcally correct value. Falure: Intant n tme when a requred functon exceed the acceptable lmt or termnated. Integrty an mportant feature when navgaton functon rely on Informaton technologe. Integrty can be defned a the ablty of a ytem to provde uer wth accurate tmely, complete and unambguou nformaton and warnng when the ytem hould not be ued. B. Navgaton Sytem Integrty Montorng In ntellgent vehcle, the navgaton functon provde relevant contextual nformaton to clent ytem (ADAS or autonomou drvng functon) n real tme. Th mght be the dtance to the next nterecton, the curvature of the road ahead, or the current peed lmt. Th functon can be chematzed a havng three part, namely the localzaton ytem, the map-matchng proce and the navgaton map. Map-matchng cont n fndng, wthn the navgaton map, the road on whch the vehcle travellng, accordng to the poton calculated by the localzaton ytem. Localzaton n paenger vehcle manly baed on Global Navgaton Satellte Sytem (GNSS). A GNSS recever ue the tme-of-flght meaurement of electromagnetc gnal emtted by atellte whoe poton can be recontructed ung ephemer data. The gnal wll ometme be perturbed or reflected (.e. multpath), whch nduce error n the computaton of poton. The ntegrty rk are from the ue of faulty peudo-range n th proce. Clacal ntegrty evaluaton nvolve evaluatng the coherency of the atellte meaurement (fault detecton) and then computng a protecton level. Th Recever Autonomou Integrty Montorng (RAIM) [5]. It, however, aumed that there at mot one faulty meaurement at any one tme, whch an unrealtcally optmtc aumpton n complex envronment uch a urban area. Other approache extend RAIM prncple to a larger number of faulty meaurement, ung nterval-baed method and relaxed nterecton of contrant [6], [7] wth fat mplementaton for fault detecton [8], or an otropy-baed approach [9]. Terran elevaton model or buldng heght provded by a three-dmenonal navgaton map can alo be ued to determne the Non-Lne-Of-Sght (NLOS) atellte,.e. atellte that mut be gnored n the poton calculaton [0], [], []. The vehcle proproceptve enor (e.g., odometer, peedometer, gyrocope) are fnally ued to etmate the vehcle moton. However, nce potonal drft ncreae wth tme and dtance, th technque combned wth GNSS ung, for example, an extended Kalman flter [3], [4]. Integrty evaluaton of a navgaton map a rather dfferent problem whch, unlke RAIM approache, not metrc. A reference (.e. ground truth) navgaton map can be ued to evaluate the vehcle map (ubject map). In [5], fuzzy logc ued to compute an outler ndex that expree how a geographcal object belong to t pato-temporal neghbourhood. Th approach am at detectng fault a well a temporal change n map. Stude were done on large-cale databae, n partcular by crowdourcng geographcal nformaton, lke n the OpenStreetMap ntatve [6], [7], [8]. Method npred from the SLAM (Smultaneou Localzaton And Mappng) doman can alo be employed. The poton nformaton gven by the navgaton map treated a an obervaton analogou to obervaton from other enor [9]. To be condered a a ground truth, the reference navgaton map mut be created by an accurate, complete urvey. In the lterature ome work have ued alternatve ource of nformaton uch a aeral magery [], [], [] or the mnng of a large number of GNSS track [3] to create the reference map. Thee approache aume that any dparte between the reference and ubject map are due to fault n the ubject map, and do not addre the poblty of fault n the reference map (due to an offet n aeral magery or recent change n the road network) or n both map. Integrty evaluaton of the map matchng proce hghly dependent on the method ued for the choce of road canddate. Monte Carlo-baed approache uch a partcle flter can be ued when avalable computatonal reource allow. A et of partcle (each repreentng a poble vehcle poton) are pread over the whole road network. The populaton change over tme accordng to avalable meaurement (e.g., GNSS meaurement, DR etmaton) and fnally yeld a oluton [4], [5]. In [6], [7], the road canddate were repreented by a et of hypothee. A Bayean framework wa ued to chooe the mot lkely road. Evdence theory can alo be ued, nce t a convenent way to handle conflct n data fuon [8]. Fuzzy logc may alo be condered, to addre the complexty of the map-matchng problem and the large number of crtera nvolved n choong the road canddate. In [9], [30], the author ued a Sugeno fuzzy nference ytem to chooe the

4 road n the navgaton map baed on poton uncertanty, the dtance between the road and the vehcle poton etmate, and the angular dfference between the road drecton and the vehcle headng. The vehcle navgaton ytem uually provde a confdence ndex aocated wth the map-matched vehcle poton. Th correpond to the fnal core of the optmzaton proce employed n the map-matchng, accordng to a gven GNSS etmate and a gven navgaton map. However, th ndex hould not be taken a a meaure of the qualty of the navgaton map. In cae of a pare road network, the mapmatchng functon lkely to provde a hgh-confdence ndex depte an offet of the road n the navgaton map due to the low number of road canddate. The concept of uer-level ntegrty wa ntroduced n [3] to emphaze the necety of takng nto account every tep of the potonng proce (GNSS, navgaton map and mapmatchng) n the vehcle poton ntegrty montorng problem. The author preented a trategy baed on ucceve evaluaton of GNSS ntegrty, map complexty and map-matchng oluton ntegrty. However, th requre havng acce to the nternal data of every ub-functon n the navgaton ytem. In the approach preented here, functon are treated a black boxe due to ndutral contrant. It not poble for u to have acce to low-level data uch a the tme-of-flght meaurement, the complete navgaton map data or nternal varable of the map-matchng algorthm. Only hgh-level data avalable, uch a the calculated vehcle poton before and after mapmatchng, and the contextual nformaton related to the current vehcle poton. Conequently, ytem montorng approache can be approprate. Oberver-baed ytem montorng cont n comparng output wth etmaton of the output baed on the nput. The redual are gnal that reult from the dfference between etmate and actual output [3]. Thee are null when the ytem not affected by any fault. If a fault actvated, the redual are non-null. When fault are detected, the conequence they have on the ytem are oberved. A look-up table lnkng the dfferent fault to ther correpondng effect on the ytem would enable them to be dentfed unambguouly and therefore to be olated and excluded and/or corrected from the ytem to keep t operatng correctly or at a dfferent level of performance. Th knd of proce known a Fault Detecton, Iolaton, and Adaptaton (FDIA). Baed on the ytem model and the avalable meaurement, a logcal lnk between fault and redual value can be etablhed and ummarzed n a gnature matrx. A complete framework to detect multple fault n a ytem wa preented n [33]. The entvty of a et of redual determned ung a ytem model, and dagnoe to be appled are etablhed, baed on the oberved redual. In th paper we develop a mlar approach for an FDIA navgaton ytem. Some knd of proceng of the value of the redual eental when real gnal are ued. Becaue of the noe affectng them, dfferent change detecton tratege mut be appled. An extenve decrpton of the mathematcal tool avalable for gnal change detecton can be found n [34]. The approach preented n [35] ue an archtecture mlar to the navgaton ytem tuded n the preent work. It howed that detectng unexpected large dcrepance between etmated and meaured poton not uffcent, nce the noe aocated wth poor qualty enor create an exceve entvty to outler. A Cumulatve Sum (CUSUM) tet therefore mplemented to reduce the number of fale alarm. A. Montorng Sytem III. PROBLEM STATEMENT A ytemc dagram of the propoed ntegrty montorng ytem n a vehcle hown n Fg.. Relevant nformaton about the vehcle current and future road envronment ent to the clent ytem. Th nformaton repreent a et of context event encountered by the vehcle a t travel, and conequently known a an Electronc Horzon (EH) [36]. The black box aumpton that made regardng the navgaton ytem mean that the only avalable obervaton of the road geometry the map-matched poton etmate denoted a N. The purpoe of the method preented n th paper to provde an ndcaton of the ntegrty of the navgaton ytem (n partcular where road geometry fault are preent n the map) to the ytem that ue th nformaton. If a lo of ntegrty detected, a correcton can be provded to the clent ytem. To do o, an etmate of the vehcle poton ndependent of the navgaton ytem requred. Th etmated poton denoted a G n the fgure and computed ung an addtonal GNSS recever GNSS baed on a dfferent technology than GNSS. Vehcle proproceptve enor (e.g. odometer and a yaw rate gyrocope) can be employed to mprove t accuracy and avalablty. Th etmaton mght alo be affected by a fault. If the two etmate dffer, there an ambguty n the faulty etmate. Th ambguty cannot be reolved, owng to the low level of redundancy (the degree of freedom beng only one). The man dea behnd th framework to make ue of repeated vehcle trp to reolve th ambguty. The output Knowledge of fault (Fg. ) ha three poble value: Ue. The etmate provded by the navgaton functon to clent ytem not affected by any fault. Unknown. A fault ha been detected but ha not been olated. The poton etmate from the navgaton ytem pobly affected by a fault. Don t ue. A fault affect the current etmate from the navgaton ytem and the method provde a fault-free etmate to clent ytem through the output Correcton. Let u recall that the fault detecton tep merely declarng that at leat one of the etmate affected by a fault. The olaton tep determnng whch etmate() (are) affected by a fault. B. Spatal Samplng In our propoed approach, the ntegrty of the vehcle poton etmate from the navgaton ytem patally evaluated. Each locaton on the road network condered a an operatng pont of the ytem to be montored (.e. the navgaton ytem). For a gven locaton of the vehcle, the preence of a fault nvetgated ung all the etmate recorded at th locaton durng the coure of vehcle trp.

5 Navgaton Navgaton Map GNSS GNSS Proproceptve enor Smart front camera Map Matchng Vehcle poton etmaton Electronc Horzon N G Fault Detecton Correcton Fault Iolaton and Adaptaton Clent ADAS Knowledge of fault Don't Ue Unknown Ue Fgure. Structure of fault detecton olaton and adaptaton n a tandard paenger vehcle. 40m 5m 35m 0m P k Nk 5m G k m Error 0 30 (a) Sytematc error due to a fault n the navgaton map (the map dplayed n red). The faulty etmate of the vehcle poton provded by the navgaton functon at abca = are the ame S S Fgure 3. Illutraton of the notatonal conventon. The true (.e. real) road n grey and t centrelne n black. Here t patally ampled wth a 5-metre nterval. The yellow arrow repreent the true vehcle poe. The map n red. The vehcle poton a etmated by the navgaton (rep. by the vehcle enor) the red (rep. blue) cro. The method patally ampled wth repect to the curvlnear abca of the road. The vehcle curvlnear abca on a gven road the dtance along the carrageway wth repect to t orgn and wrtten R +, a hown n Fg. 3. Let K N denote the total number of trp made by the vehcle on a gven road. The true vehcle poton at abca of a gven road and at the k th trp wrtten Pk. Th can be encoded a a vector that contan the vehcle geographc coordnate, that to ay longtude, lattude and ellpodal heght. Ung the ame notatonal conventon, G k and N k are etmate of the vehcle poton P k provded by the enor and the navgaton repectvely. Whenever the vehcle at abca of a gven road for the k th tme, thee two etmate are recorded. Fault may affect the navgaton a well a the poton etmate from enor, and caue ther value to be gnfcantly dfferent from the ground truth (f a multpath affect a GNSS recever for example). In th cae, the etmate are ad to be faulty. Let u defne the fault f N k and f G k wth: f N k f G k def = { f N k P k 0 otherwe { def f G = k P k 0 otherwe Fg. 3 llutrate the notatonal conventon. Snce phycal quantte cannot be trctly equal, a threhold on the dtance between the etmate employed for mplementaton. Snce the true vehcle poton not meaurable drectly, the fault detecton and olaton are baed on a parwe comparon of etmate. () () (b) Non-ytematc fault n the navgaton functon. The mapmatchng chooe ether the rght or the wrong road from one trp to another. The navgaton etmate may or may not be faulty. Error on the faulty etmate are neverthele equal (here N and N3 ). Fgure 4. Navgaton ytem fault and error characterzaton C. Aumpton A fault an error generatve proce accordng to the defnton tated n Secton II-A. An error therefore the dcrepancy caued by the fault, and meaurable by an approprate external oberver. A faulty navgaton ytem (from the clent ADAS pont of vew) can reult from a navgaton map fault. Map fault caue ytematc error. Every tme the vehcle travere the area hown n Fg. 4a, the navgaton ytem wll provde the ame faulty poton etmate. A faulty tate of the navgaton ytem may not only be a conequence of map fault. Map-matchng may chooe a wrong road canddate becaue of a dffcult road confguraton uch a a juncton, a hown n Fg. 4b. In th tuaton the map-matchng may or may not chooe the rght road egment from one trp to another; fault are not ytematc. Neverthele, t wll be remarked that where there a fault, the reultng error alway the ame, nce the output of the navgaton etmate contraned by the map. Error by the navgaton ytem, when they occur, are therefore ytematc. In th work we do not addre the problem of determnng the reaon for an etmaton error made by the navgaton, becaue th would requre acce to the nternal varable of the ytem. The etmate of the vehcle poton from the on-board vehcle enor G depend manly on the GNSS etmaton. Gven a locaton on the road network, fault on a G etmate wll have two prncpal caue: frt, multpath (.e. atellte gnal reflecton on buldng, for ntance) and, econd, a 3

6 poor atellte confguraton. The magntude of the day-to-day multpath correlaton of a tatc recever typcally around 85% [37]. We have no knowledge of correlaton value for a movng recever, nce the recever moton mtgate the multpath effect. Moreover, a GNSS multpath error can repeat telf only at the ame place wth the ame atellte confguraton (the ground track repeat 3hr 56mn for GPS and 0 day for Galleo). Therefore, we beleve that a repetton of the ame multpath error and fault very unlkely from one trp to another. Error and fault due to poor atellte geometry (multpath ade) reult from the propagaton of peudo-range random meaurement error (dluton of precon), and therefore alo have weak correlaton between two vehcle trp. Error on G are aumed to be dfferent from one trp to another. The aumpton underlyng the FDIA framework can be ummarzed a follow: When travellng everal tme on a road, the vehcle follow the ame path wth mall devaton (whch can be compenated f neceary by lane markng meaurement from a front camera). Any fault affectng poton etmate from enor can caue error of any value. Error on faulty vehcle poton etmate from enor are dfferent from one trp to another at a gven abca. The navgaton map doe not change from one trp to another. Error on the vehcle poton etmate from the navgaton (when they occur due to a fault) are therefore alway the ame at a gven abca. Error on the vehcle poton etmate from enor and from the navgaton are ndependent of each other at a gven abca. Gven thee aumpton, we have: P = P +, {,..., K } (3) Where P the true vehcle poton, the curvlnear abca, the trp ndex and K the total number of trp made on the road. In the ecton below, the formalm developed from the ytem montorng pont of vew, puttng temporarly ade the applcaton to ntellgent vehcle. The etmate from enor and from the navgaton (G and N repectvely) are een a etmate of the ame phycal quantty P, whch n accordance wth the aumpton above. The curvlnear abca undertood a an operatng pont of the ytem to be montored and the vehcle trp are teraton of th ytem. IV. SEQUENTIAL FAULT DETECTION The frt tep n FDIA cont n detectng fault by comparng the two poton etmate N and G. Accordng to the aumpton tated prevouly, a gnfcant dcrepancy between the etmate ndcate that a fault affect at leat one of them. However, noe on etmate may caue nonfaulty etmate to be dfferent from each other and nduce fale alarm n the detecton proce. For th reaon, th ecton detal the mathematcal formulaton of a probabltc equental tet (called Page tet) and t applcaton to the detecton of dcrepance between poton etmate. Stattcal tet are an approprate tool for evaluatng the parameter of a probablty law baed on et of outcome. In our applcaton, we eek to detect a change n the mean of the probablty denty functon (PDF) of a et of oberved data, whle the tandard devaton of th PDF of the ame order of magntude a the expected mean gap. Page tet work equentally and epecally effcent for tream data. The problem therefore formulated a the detecton of a change n the mean of a random varable that repreent the dtance between the etmate from enor and from navgaton. Page tet (alo known a Page trend tet) cont n tattcally detectng a change n the mean of a random varable baed on a lkelhood rato of hypothee [34]. It alo dentfe the ample at whch the change n the mean occurred. Formulaton of th tet n the context of map fault detecton detaled n [38]. The random varable teted here the dtance between etmate G and N. Let u ee how the dtance gnal generated and decrbed n term of mean and tandard devaton. Let u conder the etmate N from the navgaton a the reult of a random proce baed on the true vehcle poton P n a frame R algned wth the road: Σ α = N = P + α (4) [ σ a ] R (5) where α a noe aumed to be zero-mean, wth a dagonal covarance matrx Σ α. Snce road are repreented n the navgaton map by zero-wdth poly-lne, the varance of the navgaton map-matched error normal to the road egment by defnton null. However, a map-matched poton error along the road egment ext, and σ a denote the longtudnal tandard devaton of the navgaton etmate. The etmate of the vehcle poton from enor G can be encoded a a two-dmenonal pont G = (x, y) T n the Eat- North plane R 0 locally tangent to Earth wth the covarance matrx Σ β of the etmaton error β provded by the localzaton ytem: G = P + β (6) [ ] σ Σ β = x σxy σxy σy (7) R 0 In order to make the dtance gnal ndependent of the road drecton, an otropc approach ued, and th cont n ung the outer crcle of the ellpod. It radu η = max (η ), η beng the egenvalue of Σ β. So, the covarance matrx expreed n R η I (wth I beng the dentty matrx). The vector L defned to be the dfference between the map-matched and etmated poton a tated by the followng equaton. L ha two ndependent component, namely lateral error d and longtudnal error e.

7 [ d L = e ] = N G = α β (8) Under the hypothe of ndependent error, the gnal d and e have the followng varance: σ d = η σ e = η + σ a The mot relevant nformaton the lateral poton of the road n the navgaton map. The fault detecton therefore done by detectng mean change n the gnal d ung η. V. FAULT ISOLATION AND ADAPTATION METHOD Once a fault ha been detected, the problem now to olate the faulty etmate and perform adaptaton accordng to the aumpton made prevouly, ung the repetton of vehcle trp a a ource of redundancy. The adaptaton proce cont n provdng a non-faulty etmate to a clent ytem o that t can contnue to operate normally, even f the current etmate affected by a fault. Non-faulty etmate therefore need to be dentfed unambguouly. The concept of Set of Fault and Redual are defned frt. The mathematcal relatonhp between thee two concept then demontrated. Fnally, we how how a et of fault can be olated, baed on the obervaton of redual. A. Defnton ) Set of Fault: Let the et of fault e K be compoed of all f G k and f N k for the condered teraton K at a gven abca : } def = {f G, f N,, j {,..., K} (0) j e K The cardnalty of e K K. Each element of e K a boolean value o there are K poble et wrtten e K,n : { e K { } e K,n e K,n BK, n {,..., K} () Let u take an example wth K =. There are = 6 dfferent et. The cardnalty of each one = 4. For ntance, e,5 = { } mean { f G = 0 and f N = 0 and f G = and f N = 0 }. ) Redual Proceng: At a gven abca and at ytem teraton K, every avalable etmate at the current teraton compared to all the other and the reult tored n a redual vector RK. The element of R K are defned a: r G G j r N N j r G N j { def f G = G j 0 otherwe { def f G = Nj 0 otherwe { def f N = Nj 0 otherwe (9), j {,..., K}, > j (), j {,..., K} (3), j {,..., K}, > j (4) Equaton () and (4) are retrcted to > j to avod uele redundant redual. R K therefore compoed of C (K, ) boolean element, where C (K, ) tand for the number of - combnaton from a gven et of K element. We know that C (K, ) = K (K ) o the redual vector therefore contan K (K ) element. For example, at the econd teraton, the ze of R 6: R = [ r N G r G G r N G r N G r N N r N G (5) If, for example, the etmate are uch that G N[ = G = N ] then the redual vector R = ) Relatonhp Between Fault and Redual: Let and denote boolean or and excluve or operator repectvely. Propoton. The element of the redual vector are the reult of boolean operaton between the faulty tate of the etmate, accordng to the followng equaton: r G G = f j G f G,, j {,..., K}, > j (6) j r G Nj = f G f Nj,, j {,..., K} (7) r N Nj = f N f Nj,, j {,..., K}, > j (8) The demontraton of th propoton developed n [39]. Eq. (6), (7) and (8) of Propoton etablh a lnk between the avalable etmate (.e. G and N) and the fault whch affected them (.e. f G and f M ). The frt two equaton tell u that f there at leat one fault on the condered etmate, then the redual affected. In (8), the redual equal to one f there a ngle fault among the two etmate. It now poble to deduce the preence of fault baed on obervaton and comparon of the etmate. B. Fault Iolaton Prncple The fault detecton and olaton trategy nvolve ltng all the poble et of fault for a gven teraton K, and calculatng the correpondng theoretcal redual vector wth (6), (7) and (8). Th form the truth table for K. In parallel, avalable etmate are ued to compute the oberved redual vector baed on (), (3) and (4). Th vector, preent n the truth table, allow the correpondng et of fault to be determned. Fault affectng each etmate can fnally be deduced from th et. It wll be remarked that the truth table are vald for every operatng pont, o the upercrpt omtted n the table. Let u take the example gven n Secton V-A. At the frt ytem teraton at operatng pont, two etmate are avalable: G and N. The truth table for one teraton hown n Table I. It aumed n th example that G N oberved, therefore r G N =, accordng to (). Table I how that th redual can be due to three et of fault: e,, e,3 and e,4. After one ytem teraton, t can be concluded that there at leat one faulty etmate among G and N, but t not poble to determne whch one. The fault detected, but not olated. ]

8 Table I TRUTH TABLE FOR ONE ITERATION (K = ). THE FIRST RESIDUAL r G N = 0 APPEARS ONLY ONCE IN THE TABLE, AND SINCE THIS MAKES ISOLATION POSSIBLE, IT IS SHOWN IN GREEN. CONVERSELY, r G N = IS DUE TO MORE THAN ONE SET OF FAULTS AND IS SHOWN IN RED. THE RESIDUAL USED AS EXPLANATION EXAMPLE IS IN BOLD. Set of fault e K,n Redual f G f N r G N = f G f N e, e, 0 e,3 0 e,4 At the econd ytem teraton at the operatng pont, a new par of etmate avalable: G and N. The truth table for two ytem teraton calculated wth (6), (7) and (8) and hown n Table II. In th example and mlarly to Secton V-A, t aumed that G N = G = N oberved. Th lead to the redual R = [ ]. Table II how that th redual (n bold) excluvely due to the et of fault e,5. After the econd ytem teraton, fault olaton performed by concludng that { f G = 0 and f N = 0 and f G = and f N = 0 }. C. Condton of Iolablty By defnton, the truth table exhautve; the oberved redual vector necearly ncluded wthn t. However, ome et of fault nduce the ame redual vector, a hown by the red colour n Table I and II. In th cae, olaton not poble. Thee are called Advere et. At leat one more ytem teraton requred to perform olaton. Beng advere depend on the number of fault affectng the etmate, a tated n Propoton.: Propoton. A et of faulty tate advere f and only f t correpond to one of the followng condton: f N =, {,..., K} and!j {,..., K} uch that f Gj = 0 f G =, {,..., K} In other word, t not poble to olate fault f: ) Every etmate N faulty and there a ngle fault-free G. ) Every G faulty. The proof of th Propoton can be found n [40]. It wll be remarked n the example developed prevouly that after the frt ytem teraton (.e. K = ), the tuaton correponded to the econd condton of th propoton becaue f N = 0 and f G =. Th why fault olaton wa mpoble. However, after the econd teraton, the et choen for the example { f G = 0 and f N = 0 and f G = and f N = 0 } no longer correponded to ether of thee condton. Fault olaton had therefore become poble. Propoton fundamental for demontratng the nternal formalm properte. Thee are detaled and demontrated a follow. D. Formalm Properte Once the bae of the formalm are etablhed, we have the properte hown below n the lted propoton. Demontraton of thee properte can be found n [39]. Propoton 3. Guaranteed fault detecton: The formalm alway detect the preence of faulty etmate. In other word, each tme there a faulty etmate, the formalm detect t (but may not be able to olate the faulty etmate). Propoton 4. Iolaton convergence: The rato of the number of advere et of faulty tate to the total number of et tend to zero a the number of teraton ncreae. In other word, ncreang K mprove fault olaton capablte. Propoton 5. Conervaton of olablty: Once fault olaton performed, fault olaton wll be performed at any new teraton. Propoton 6. Adaptaton: If fault detecton and olaton are performed, then adaptaton poble. It hould be recalled that adaptaton cont n dentfyng a fault-free etmate once detecton and olaton have been performed. Propoton 7. Conervaton of adaptaton: If fault olaton acheved at the K th teraton, adaptaton poble at teraton K + whatever the fault affectng the new etmate. Thee propoton have mportant conequence for the applcaton of the method n ntellgent vehcle. Frt, Propoton 3 how that the preence of a fault among the avalable etmate alway detected by the method. Th mean that where there no fault, the method able to declare th fact wth certanty even at the frt ytem teraton, allowng clent ytem to functon. Integrty montorng therefore poble wth th method. Second, Propoton 4 how that a new teraton wll alway contrbute nformaton for fault olaton, whch jutfe multple ytem teraton. Thrd, accordng to Propoton 5 to 7, once a fault ha been olated, a faultfree etmated can be provded to clent ytem at any future teraton, allowng clent ytem to antcpate beng able to operate properly at any future teraton. E. Illutratve Example We now take the FDIA formalm propoed above and apply t to montorng the ntegrty of the navgaton vehcle poton etmate a ntroduced n Fg.. Ung a mple example, each tep decrbed n detal. The map contan an error and we how how the method perform fault detecton, olaton and adaptaton. In addton to detalng each tep of our propoed method, we llutrate the properte ntroduced n Secton V-D. In th example (depcted n Fg. 5), the real road traght, whle the map repreentaton of the road nclude a bend. Let u detal the propoed formalm at abca 5 m n the frt trp hown n Fg. 5a. The frt tme the vehcle at abca = 5, poton etmate are provded by the vehcle tate (G 5 ) and by the navgaton (N 5 ) functon. The oberved redual can be computed ung (3): G 5 N 5 r G 5 N 5 = Th redual found three tme n the truth table for one FDIA trp (Table I): the et of fault e 5,, e 5,3 and e 5,4 gve

9 Table II TRUTH TABLE FOR TWO ITERATIONS (K = ). RESIDUALS OCCURRING ONLY ONCE ARE IN GREEN, SINCE THEY MAKE ISOLATION POSSIBLE. CONVERSELY, RESIDUALS THAT ARE DUE TO MORE THAN ONE SET ON FAULTY STATES ARE IN RED. THE RESIDUAL USED AS EXPLANATION EXAMPLES IS IN BOLD. Set of fault e K,n Redual f G f N f G f N r N G r G G r N G r N G r N N r N G e, e, e, e, e, e, e, e,8 0 e, e, e, e, 0 0 e, e,4 0 e,5 0 0 e,6 0 5 N G (a) Frt trp (blue lne) S 5 N 5 N G 5 G (b) Second trp (purple lne) Fgure 5. A faulty map area. Crcular grey mark are for etmate where the method ha detected but not olated a fault. Green quare are for true etmate and red trangle are the faulty etmate. r GN =. The propoed method then detect a faulty etmate among G 5 and N 5 but not able to olate t. The ntegrty montorng ytem cannot pecfy the faultne of N 5, but mply end Knowledge of fault: Unknown to clent ytem, a hown by crcular grey mark n Fg. 5a. The econd tme the vehcle travere abca = 5 of the ame road (Fg. 5b), a new par of poton etmate become avalable: G 5 and N 5. The dmenon of the redual vector ncreae to 6. The element are calculated ung (), (3) and (4): N 5 G 5 r N 5 = G5 G 5 = G 5 r G 5 = 0 G5 N 5 G 5 r N 5 = G5 N 5 G 5 r N 5 = G5 N 5 = N 5 r N 5 N 5 = 0 G 5 N 5 r G 5 N 5 = Then R 5 = [ 0 0 ]. Table II the truth table for two trp. Followng the frt trp obervaton t known that f G 5 and f N 5 are not both null, and the frt four row of Table II may therefore be gnored. The oberved redual found only once n th table (caued S by the et of fault e 5,). Conequently, t can be concluded that f G 5 = 0, f N 5 =, f G 5 = 0 and f N 5 =. The ntegrty montorng ytem return the ntructon Knowledge of fault: don t ue the navgaton poton etmate (N 5 ) and provde a fault-free etmate ntead n the output Correcton (ether G 5 or G 5 ). On Fg. 5b, faulty (rep. true) etmate are repreented by red trangle (rep. green quare). From Propoton 7 we know that the ntegrty montorng ytem wll be able to perform adaptaton,.e. provde an error-free poton etmate for all future trp along th road, whatever the fault affectng the future etmate. F. Complete Fault Detecton, Iolaton and Adaptaton Method The FDIA framework ntroduced prevouly baed on the calculaton of a redual vector RK ( the vehcle curvlnear abca on the road and K the number of trp on th road). In practce, the element of RK are defned on the ba of comparon of the dtance between each par of avalable etmate N and G wth a threhold λ d, and denoted by r G G, r j G N j and r N Nj,, j {,..., K} whch we recall below: { ( ) r G f dt G G =, G j > λd j 0 otherwe (9), j {,..., K}, > j { ( ) r G f dt G N j =, Nj > λd 0 otherwe (), j {,..., K} { ( ) r N f dt N N j =, Nj > λd 0 otherwe (), j {,..., K}, > j Page tet ued here ntead of the dtance meaure for comparng G and N. Accordng to th new formulaton, the redual vector element r G K NK zero f Page tet gve the mean of the gnal d a zero. Recprocally, r G K NK one f the tet detect a mean change n d. The manner n whch the other redual element (r G G and r j N N j ) are calculated reman unchanged.

10 G 0 G 3 G G G 4 G 5 0 N Page' tet decon varable N N N 3 N 4 N 5 γ FDIA delayed Unknown Ue S Fgure 7. Tet vehcle (a) The vehcle at abca = 5. Page decon varable greater than 0 and lower than the threhold. The FDIA then delayed nce = 3. 0 N Page' tet decon varable γ 0 G 0 G N 3 G G N N 3 G 4 N 4 6 G 5 G N 5 N FDIA delayed Unknown Ue (b) Page decon varable exceed the threhold at = 6. FDIA run for abca 3 to 6 wth r G N =. Th reult n Knowledge of fault: Unknown. Fgure 6. Example of the ue of Page tet wth the FDIA framework. The road a recorded n the navgaton map the red poly-lne. The etmate from navgaton N are the red croe and the etmate from enor G are the blue croe. The vehcle travellng from left to rght, o t curvlnear abca denoted by the ax S. The decon varable ued n Page tet plotted on the mddle graph. The reult of FDIA wth Page tet hown n the lower part of the fgure. A hown n Secton IV, Page tet may requre a few ample before t able to gve defntve reult. Th hghlghted by the dtance-to-alert and dtance-to-recovery metrc. In uch a tuaton, the etmate are buffered untl Page tet provde a defntve output. The FDIA framework then run on each etmate, takng the reult of the tet a an nput. A an example, Fg. 6 how the progreon of Page tet a the vehcle advance, and llutrate the trategy employed here for the FDIA. We are lookng at the frt trp along th road. The method detaled tep by tep, a hown n th fgure. When the vehcle at abca = 0, the etmate from enor G 0 and N 0 are very cloe to each other. The Page tet decon varable equal zero, and therefore the etmate are condered to be equal. The FDIA framework run wth r G 0 N 0 = 0: th redual found only once S n the truth table o t not neceary to ue prevou trp, and the FDIA conclude that the etmate are fault-free. At abca =, the Page tet decon varable not null, but ha not yet reached the threhold γ. A dcrepancy between the etmate G and N lkely, but not yet detected. The etmate that correpond to abca = (.e. G and N ) are tored n the memory buffer untl the Page decon varable ether exceed the threhold or return to zero. When the vehcle reache abca =, the etmate G and N make the decon varable return to zero, whch ndcate that Page tet gve no dcrepancy for the two lat abca. The FDIA run at every abca n the memory buffer: at = wth r G K N K = 0, the FDIA conclude that there no fault affectng G and N ; at = wth r G K N K = 0, the FDIA conclude that there no fault affectng G and N. The memory buffer cleared. At = 3 to = 5, the etmate are uch that the decon varable not null o thee are buffered a hown by black mark on Fg. 6a. At abca = 6 the decon varable fnally exceed γ, and o Page tet now declare that a dcrepancy, tartng at = 3, detected. The FDIA then uccevely run at = 3, = 4, = 5 and = 6 wth r G 3 N 3 =, r G 4 N 4 =, r G 5 N 5 = and r G 6 N 6 = repectvely. Snce thee redual are advere and there are no prevou trp avalable, the FDIA output Unknown for the etmate, a hown by orange mark on Fg. 6b. The memory buffer empted and the decon varable et to zero for the followng evaluaton pont. A. Tet Vehcle VI. EXPERIMENTAL EVALUATION Experment were done n real condton ung the Renault Epace paenger vehcle hown n Fg. 7. The navgaton ytem ued n the vehcle fed by a tandard ngle frequency Ublox 6T GPS recever (correpondng to GNSS n Fg. ). The GNSS recever denoted by GNSS n Fg. a Ublox 4T GPS recever. The vehcle odometer, peed, rear wheel peed dfference and yaw rate are producton-tandard enor and are avalable on the vehcle CAN-bu. An extended Kalman flter ued to compute the poton etmate from enor G, baed on the vehcle enor and the Ublox 4T GPS recever [38].

11 Ue Don't ue Unknown Correct map TV FI Faulty map FV TI Fgure 8. Metrc employed for method evaluaton. The column are the output of the method and the lne are the actual tate of the navgaton map. Buldng An Ixea LandIn Inertal Navgaton Sytem (INS) tghtly coupled to a Novatel GPS recever provde poton etmate wth an error of le than m and condered a poton ground truth for the experment. B. Metrc We aw above that our propoed method ha three poble output tate that refer to the current navgaton etmate ntegrty, namely Ue, Unknown, Don t ue. The navgaton map can be correct or faulty. A et of metrc ntroduced a follow and llutrated n Fg. 8. Thee are evaluated wth repect to the number of vehcle trp o that the performance of our method can be evaluated precely. The overall effcency correpond to the number of relevant dagnoe made by the method, equal to the um of True Valdaton (TV) and True Iolaton (TI). A TV occur when a correct pont of the navgaton map ha been declared wth no fault. A Fale Valdaton (FV) occur when the method trut a faulty navgaton etmate. A Fale Iolaton (FI) occur when a correct navgaton etmate clafed a faulty by the method. The Overall Effcency Rate (OER) : OER def = T V + T I Ω Ω unknown () where Ω the number of navgaton pont evaluated by the method and Ω unknown the number of navgaton etmate for whch the method output Unknown. An OER cloe to one would ndcate that whenever the method provde an output dfferent from Unknown, th dagno relable. The output Unknown doe not provde nformaton on the ntegrty of the navgaton etmate from the pont of vew of clent ytem. From the applcatve pont of vew, th output hould occur a lttle a poble. The performance of the method n term of nformaton avalablty meaured by the Informaton Avalablty Rate (IAR): IAR def = Ω Ω unknown (3) Ω Th expected to converge to one a the number of trp ncreae. C. Urban Tet Track In th experment, the vehcle wa drven cloe to large buldng. The GPS recever wa perturbed by multpath effect 50m Fgure 9. GNSS track on the correct navgaton map. Clockwe (blue) and antclockwe (purple) caued by gnal reflectng off buldng. Thee meaurement are expected to be olated by the method. A hown n Fg. 9, over part of the crcut condton are good, and the devaton of the GPS meaurement le than the wdth of the road. It wll be remarked that for tetng the method, thee expermental condton are challengng. The length of each trp 00 m and the patal amplng ha been done along the map wth a 0 m perod, and the tolerance on the vehcle curvlnear abca λ = m. Hence, Ω = 0 pont on the navgaton map need to be evaluated at each trp. Th value vare by a few pont from one trp to another becaue data recordng were not tarted and topped rgorouly at the ame poton. The threhold on the dtance between the etmate mut be choen accordng to two crtera. Frt, t mut be a mall a poble to comply wth aumpton made a bae for the method. Second, t mut be greater than the tolerance on the vehcle abca λ, o that two etmate from navgaton that correpond to the ame abca are condered a equal by the method. Page tet therefore et to detect a dcrepancy of δ m = λ = m between the etmate wth the detecton threhold γ = 4.σ/δ m. Fault were generated randomly n fve dfferent map ung dedcated oftware. The performance of the complete FDIA method evaluated ung the metrc ntroduced prevouly and detaled n Fg. 0 and. Fg. 0 how the rato of correctly dentfed pont to the number of olated or valdated pont. At the frt vehcle trp the method cannot perform olaton. The OE then only compoed of TV. The OER at the frt trp therefore favoured by the abence of fale valdaton; the OER of fve of the ten tet therefore equal one. It wll be noted that the OER of map antclockwe epecally low at the frt trp (50%), but th not gnfcant nce t calculated ung only four pont. The OER tend to reman contant from the econd to the thrd trp wth medan equal to 84% and 83% repectvely. Fg. ummarze the rato of the number of valdated or olated pont to the number of pont condered Unknown. The IAR ncreae wth the number of trp for all the tet and exceed 90% at the thrd trp. The FDIA method therefore een to converge a tated by Propoton 4.

12 Overall Effcency Rate (OER) Map, antclockwe Map, antclockwe Map 3, antclockwe Map 4, antclockwe Map 5, antclockwe Map, clockwe Map, clockwe Map 3, clockwe Map 4, clockwe Map 5, clockwe Trp Fgure 0. Overall Effcency Rate Informaton Avalablty Rate (IAR) Map, antclockwe Map, antclockwe Map 3, antclockwe Map 4, antclockwe Map 5, antclockwe Map, clockwe Map, clockwe Map 3, clockwe Map 4, clockwe Map 5, clockwe Trp Fgure. Informaton Avalablty Rate. D. Rural Tet Track Here we look at how the method performed n an area where real map error were preent. The road had been modfed when a new motorway wa bult. A 08 Navteq navgaton map wa ued to run the FDIA method. Fg. how that th map contan three major fault, decrbed below from left to rght. The frt fault where the road now devate a t pae over the motorway. The econd where a completely new tretch of road ha been created, devatng gnfcantly from the old one. For thee two cae the confdence accorded to the etmate both from the enor and from navgaton are hgh. In a rural envronment, many atellte are n the recever lne-of-ght, whch ncreae the level of confdence and reduce the poton tandard devaton and Dluton of Precon. Moreover, the road network qute mple, o the map-matchng algorthm provde a hgh level of confdence even f the GNSS meaurement a few metre away from the road. The challenge therefore to determne precely the reaon for any dparty between etmate from enor and from navgaton, that to determne whch etmate affected by a fault. When the real road too far from the map road, the map-matchng confdence ndex uddenly decreae and 500m Area Area Area 3 Fgure. Rural tet track. The navgaton map ued n the experment n yellow, the correct map n grey n background. The vehcle goe from left to rght. The etmate from enor of the frt (rep. econd) trp n blue (rep. purple). the navgaton functon wtche to off-road mode and top provdng navgaton etmate. The FDIA method conequently top untl a new etmate provded by the navgaton ytem. The thrd fault where a new road now ext parallel to the old one. Even f the etmate from navgaton relatvely cloe to the true vehcle poton n th area, the method hould dentfy the fault. Fg. alo how the etmate from enor for the two trp ued n th experment. Fg. 3a how the reult of the FDIA appled to th dataet after the frt trp. The green tretche are where the method returned Ue and the black tretche are where the output wa Unknown. There no FI, nce the method cannot olate a fault at the frt trp, a decrbed above. It wll neverthele be noted that there no FV of 0% and the OER 00%. Th mean that the method correctly dentfed tuaton where etmate were not affected by fault and conequently provded the output Ue, and alo that t detected tuaton where at leat one fault affected the etmate and conequently provded the output Unknown to clent ytem. The IAR of th frt trp 77% whch correpond to the proporton of erroneou road n the navgaton map. The reult obtaned after the econd vehcle trp n th area are hown n Fg. 3b. Here agan, OER = 00 % whch mean that every etmate not declared Unknown at the econd trp wa correctly dentfed. Moreover, every pont travered durng the coure of two trp wa declared ether Ue or Don t ue, and o the Informaton Avalablty Rate equal 00%. Th experment how that the method performed well when ung real vehcle data and a real navgaton map wth fault. The abence of Fale Iolaton and partcularly Fale Valdaton, and the hgh Informaton Avalablty n thee condton ndcate that the FDIA framework a realtc opton for navgaton ntegrty montorng. E. Dcuon Thee reult, obtaned ung map fault that were ether njected or real, how that the olaton convergence property verfed, nce the number of pont for whch the method cannot perform olaton decreae and can reach zero. The

13 500m (a) Frt trp. framework detaled n th work fll th gap by makng ue of repeated vehcle trp. The framework baed on a parwe comparon of patally-ampled vehcle poton etmate between the current and pat vehcle trp that gve re to redual vector. We demontrate that under the aumpton made the propoed FDIA framework theoretcally alway able to perform fault detecton. However, dependng on the number of fault that affect the etmate and on the number of vehcle trp, t may not be poble to perform olaton, that, to determne wthout ambguty whch etmate() (are) affected by a fault. By defnng uch et of fault mathematcally, we demontrate that the fault olaton and adaptaton capablte of the method mprove a the number of vehcle trp ncreae. The propoed framework wa teted ung real enor data and navgaton map fault. Performance wa excellent n open ky area and promng n urban condton. Th hghlght the nteret of ung th FDIA approach n ntellgent vehcle. 500m (b) Second trp. Fgure 3. Reult of the FDIA for the rural tet track. The road ecton for whch the method output Ue are n green, thoe for whch the method output Don t ue are n red, and thoe for whch the method output Unknown are n black. The true navgaton map n the background n grey. nformaton avalablty rate ncreae and can reach one a the number of trp ncreae. Fault that are not correctly olated by the method (.e. Fale Valdaton and Fale Iolaton) reult manly from the trade-off between patal re-amplng tolerance of enor data and the comparon threhold ued for the computaton of redual. The degn of the method baed on everal aumpton (random fault n the oberver etmate, ytematc fault n the map, and ndependence between them). The reult confrm expermentally the valdty of thee aumpton. Fault n the oberver are eentally due to the addtonal GPS recever and can are from multpath. If at a gven abca, the ame multpath nduce the ame error on the recever computaton fx at two dfferent trp ued by the FDIA method, the frt aumpton volated. In th cae, the method fal to olate fault. Neverthele, th requre two condton to be fulflled: frt, the ame atellte geometry at the ame abca durng two dfferent trp, and, econd, the ame poton fx error after flterng. For thee reaon, we beleve that the volaton of the frt aumpton very unlkely. Th tuaton wa never encountered durng the coure of our experment. VII. CONCLUSIONS Th paper ntroduce a framework for montorng the ntegrty of navgaton map geometry by detectng and olatng fault on the etmate of the vehcle poton from the navgaton ytem. We howed that the context of ntellgent vehcle n whch th work take place lmt the qualty of the enor and the redundancy of the ource of nformaton. The FDIA REFERENCES [] J. Zegler, P. Bender, M. Schreber, H. Lategahn, T. Strau, C. Stller, T. Dang, U. Franke, N. Appenrodt, C. Keller, E. Kau, R. Herrtwch, C. Rabe, D. Pfeffer, F. Lndner, F. Sten, F. Erb, M. Enzweler, C. Knoppel, J. Hpp, M. Haue, M. Trepte, C. Brenk, A. Tamke, M. Ghanaat, M. Braun, A. Joo, H. Frtz, H. Mock, M. Hen, and E. Zeeb, Makng bertha drve, an autonomou journey on a htorc route, Intellgent Tranportaton Sytem Magazne, IEEE, vol. 6, no., pp. 8, Summer 4. [] A. Ekandaran, Handbook of Intellgent Vehcle, er. Handbook of Intellgent Vehcle. Sprnger,, no. vol.. [3] S. Durekovc and N. Smth, Archtecture of map-upported ADAS, n IEEE Intellgent Vehcle Sympoum (IV), june, pp. 7. [4] V. Popovc and B. Vac, Revew of hazard analy method and ther bac charactertc, FME Tran., vol. 36, no. 4, pp. 8 87, 08. [5] A. K. Brown, Recever autonomou ntegrty montorng ung a 4- atellte GPS contellaton, n Inttute of Navgaton, Techncal Meetng, vol., 987, pp [6] L. Jauln, M. Keffer, I. Braem, and E. Walter, Guaranteed nonlnear etmaton ung contrant propagaton on et, Internatonal Journal of Control, vol. 74, no. 8, pp , 0. [7] V. Drevelle and P. Bonnfat, Localzaton confdence doman va et nveron on hort-term trajectory, IEEE Tranacton on Robotc, vol. 9, no. 5, pp , 3. [8], Interval-baed fat fault detecton and dentfcaton appled to rado-navgaton multpath, Internatonal Journal of Adaptve Control and Sgnal Proceng, 5. [Onlne]. Avalable: http: //dx.do.org/0.00/ac.535 [9] J. Comen-Schortmann, M. Azaola-Saenz, M. A. Martnez-Olague, and M. Toledo-Lopez, Integrty n urban and road envronment and t ue n lablty crtcal applcaton, n IEEE/ION Poton, Locaton and Navgaton Sympoum, 08, pp [0] C. Pnana-Daz, R. Toledo-Moreo, D. Betalle, and A. Gomez-Skarmeta, GPS multpath detecton and excluon wth elevaton-enhanced map, n Intellgent Tranportaton Sytem, IEEE 4th Int. Conf. on,. [] S. Peyraud, D. Bétalle, S. Renault, M. Ortz, F. Mougel, D. Mezel, and F. Peyret, About non-lne-of-ght atellte detecton and excluon n a 3D map-aded localzaton algorthm, Senor, vol. 3, pp , 3. [] M. Obt, S. Bauer, P. Redorf, and G. Wanelk, Multpath detecton wth 3D dgtal map for robut mult-contellaton GNSS/INS vehcle localzaton n urban area, n IEEE Intellgent Veh. Symp. (IV),, pp [3] P. Bonnfat, P. Bouron, P. Crublle, and D. Mezel, Data fuon of four ABS enor and GPS for an enhanced localzaton of car-lke vehcle, n Robotc and Automaton, IEEE Int. Conf. on, 0. [4] O. Le Marchand, P. Bonnfat, J. Ibanez-Guzman, and D. Betalle, Vehcle localzaton ntegrty baed on trajectory montorng, n Intellgent Robot and Sytem, IEEE/RSJ Int. Conf. on, 09. [5] G. Grekou and Y. Fot, A fuzzy ndex for detectng patotemporal outler, GeoInformatca, vol. 6, pp ,.

14 [6] J.-F. Grre and G. Touya, Qualty aement of the french opentreetmap dataet, Tranacton n GIS, vol. 4, no. 4, pp , 0. [7] V. Noronha and M. F. Goodchld, Map accuracy and locaton expreon n tranportaton, realty and propect, Tranportaton Reearch Part C: Emergng Technologe, vol. 8, no. - 6, pp , 00. [8] M. Haklay, How good volunteered geographcal nformaton? a comparatve tudy of opentreetmap and ordnance urvey dataet, Envronment and plannng. B, Plannng & degn, vol. 37, no. 4, p. 68, 0. [9] C. Boucher and J.-C. Noyer, Automatc detecton of topologcal change for dgtal road map updatng, Intrumentaton and Meaurement, IEEE Tranacton on, vol. 6, no., pp , Nov. [] L. Deren, S. Hagang, and X. Png, Automatc change detecton of geo-patal data from magery, Geo-Spatal Informaton Scence, vol. 6, pp. 7, 03. [] N. de Freta, R. Dearden, F. Hutter, R. Morale-Menendez, J. Mutch, and D. Poole, Dagno by a water and a Mar explorer, Proceedng of the IEEE, vol. 9, no. 3, pp , mar 04. [] O. Pnk and C. Stller, Automated map generaton from aeral mage for prece vehcle localzaton, n Intellgent Tranportaton Sytem (ITSC), IEEE 3th Int. Conf. on, ept. 0, pp [3] G. Agamennon, J. Neto, and E. Nebot, Robut nference of prncpal road path for ntellgent tranportaton ytem, Intellgent Tranportaton Sytem, IEEE Tranacton on, vol., pp ,. [4] F. Gutafon, F. Gunnaron, N. Bergman, U. Forell, J. Janon, R. Karlon, and P.-J. Nordlund, Partcle flter for potonng, navgaton, and trackng, Sgnal Proceng, IEEE Tranacton on, vol. 50, no., pp , 0. [5] I. Szottka and M. Butenuth, Advanced partcle flterng for arborne vehcle trackng n urban area, Geocence and Remote Senng Letter, IEEE, vol., pp , 4. [6] C. Fouque and P. Bonnfat, Matchng raw GPS meaurement on a navgable map wthout computng a global poton, IEEE Tranacton on Intellgent Tranportaton Sytem, vol. 3, pp ,. [7] O. Mazhel, Ung recurve bayean etmaton for matchng GPS meaurement to mperfect road network data, n Intellgent Tranportaton Sytem (ITSC), IEEE 3th Int. Conf. on, 0, pp [8] G. Nareddne, F. Abdallah, and T. Denoeux, Map matchng algorthm ung nterval analy and dempter-hafer theory, n Intellgent Vehcle Sympoum, IEEE, June 09, pp [9] M. A. Quddu, W. Y. Ocheng, and R. B. Noland, Integrty of map-matchng algorthm, Tranportaton Reearch Part C: Emergng Technologe, vol. 4, no. 4, pp , 06. [30] W. Y. Ocheng, M. Quddu, and R. B. Noland, Map-matchng n complex urban road network, Revta Bralera de Cartografa, vol., 09. [3] N. R. Velaga, M. A. Quddu, A. L. Brtow, and Y. Zheng, Map-aded ntegrty montorng of a land vehcle navgaton ytem, Intellgent Tranportaton Sytem, IEEE Tran. on, vol. 3, pp ,. [3] S. X. Dng, Model-baed Fault Dagno Technque: Degn Scheme, Algorthm, and Tool. Sprnger, 08. [33] M. Kryander, F. Hentz, J. Roll, and E. Frk, Flexdx: A reconfgurable dagno framework, Engneerng Applcaton of Artfcal Intellgence, vol. 3, no. 8, pp , 0. [34] M. Baevlle and I. V. Nkforov, Detecton of Abrupt Change: Theory and Applcaton, E. Clff, Ed. Prentce-Hall, Inc, 993. [35] P. Sundvall and P. Jenfelt, Fault detecton for moble robot ung redundant potonng ytem, n Robotc and Automaton (ICRA). IEEE Int. Conf. on, may 06, pp [36] C. Re, D. Balzer, A. Bracht, S. Durekovc, and J. Löwenau, Ada protocol for advanced n-vehcle applcaton, n 5th World Congre on Intellgent Tranport Sytem, 08. [37] R. S. Radovanovc, Hgh accuracy deformaton montorng va multpath mtgaton by day-to-day correlaton analy, n 3th Internatonal Techncal Meetng of the SAT Dvon of the ION, September, 00, pp. 9. [38] C. Znoune, P. Bonnfat, and J. Ibanez-Guzman, A equental tet for autonomou localaton of map error for drvng atance ytem, n Intellgent Tranportaton Sytem (ITSC), IEEE 5th Int. Conf. on,, pp [39], Integrty montorng of navgaton ytem ung repettve journey, n Intellgent Vehcle Sympoum Proceedng, IEEE, June 4, pp [40] A. Montel and C. Znoune, Demontraton of the rule non olablty of et of faulty tate, Unverty of Technology of Compegne, Tech. Rep., Jan 4. Clément Znoune obtaned h Ph.D. n Computer Scence and Engneerng at the Unverté de Technologe de Compègne (UTC) n France n 4. He graduated a a mechancal engneer n 0 at UTC. In 0 he alo obtaned h mater of cence n autonomou vehcle dynamc and control at Cranfeld Unverty n the UK. In 4 he joned the team charged wth the development of autonomou vehcle at Renault S.A. n France. Phlppe Bonnfat a profeor n the Computer Scence and Engneerng department of the Unverté de Technologe de Compègne (UTC) n France. He obtaned h Ph.D. n automatc control and computer cence at the École Centrale de Nante n 997. Snce 998, he ha been wth Heudayc UMR 753, a jont reearch unt between UTC and CNRS. H reearch nteret are Intellgent Vehcle, hgh ntegrty potonng and map-matchng for moble robot navgaton n tructured outdoor envronment. Javer Ibañez-Guzmán (IEEE Member) obtaned h Ph.D. at the Unverty of Readng on a SERC- UK fellowhp, and h MSEE at the Unverty of Pennylvana (USA) a a Fulbrght cholar. In, he wa vtng cholar at the Unverty of Calforna, Berkeley (CITRIS), workng on connected vehcle applcaton. He currently a member of the techncal taff at Renault S.A., carryng out work on autonomou vehcle navgaton technologe and drvng atance ytem. Formerly he wa enor centt at a natonal reearch nttute n Sngapore, where he pearheaded work on autonomou ground vehcle operatng n untructured envronment. Dr. Ibañez-Guzmán ha everal publcaton and patent n the robotc and automotve doman. He ha uccefully uperved a number of Ph.D. tudent. He a C.Eng. (UK) and Fellow of the Inttute of Engneerng Technology (UK).