B.1 General
B.1.1 Objective
33 The overarching objective of the shipborne PNT-DP is the resilient
provision of PNT data including associated integrity and status data.
34 In this context resilience is:
-
.1 the ability to detect and compensate against relevant failures and
malfunctions in data acquisition and processing to meet the specified
performance requirements on PNT data for accuracy and integrity with
respect to continuity and availability under nominal conditions; and
-
.2 the ability to detect, mitigate and compensate malfunctions and
failures based on supported redundancy in data acquisition and
processing to avoid loss or degradation in functionality of PNT-DP.
B.1.2 Functional Architecture
35 The architecture of PNT-DP is shown in figure 1. Depicting the
principal functions: pre-processing, main processing, and post-processing.
36 The pre-processing of input data:
39 The functional architecture of the shipborne PNT-DP supports the use of numerous
processing channels operated in parallel: .
-
1 to enable the application of different processing methods for PNT data
generation in relation to intended accuracy and integrity levels;
-
.2 to improve continuity and availability in PNT data processing and
provision by redundant system layout and/or implemented fall-back
option; and
-
.3 to enable reliable detection, mitigation and compensation of failures
and malfunctions in data input and processing.
40 The functional architecture of the shipborne PNT-DP is based on a modular
structure to support the adaption of shipborne data processing to:
-
.1 different performance requirements on PNT output data in relation to
navigational situation and nautical tasks in their spatial and temporal
context;
-
.2 differences in data input of PNT-DP depending on carriage
requirements, equipment levels, or both; and
-
.3 occurring changes of available/usable sensors, services, and other
data sources during operation.
B.1.3 Requirementsfootnote
41 The requirements on data output of PNT-DP are specified by:
Figure 5: Application Grades of PNT-DP (*provided with improved accuracy)
42 The following application grades of a PNT-DP (see figure 5) are used to define
different requirements on the amount and types of PNT data output:
-
.1 Grade I supports the description of position and movement of a single
onboard point (e.g. antenna location of a single GNSS receiver);
-
.2 Grade II ensures that horizontal attitude and movement of ship's hull
are unambiguously described;
-
.3 Grade III provides additional information for vertical position of a
single onboard point and depth; and
-
.4 Grade IV is prepared for the extended need on PNT data e.g. to monitor
or control ship's position and movement in three-dimensional space.
43 Depending on the supported application grade of an onboard PNT-DP, the following
PNT data is provided:
-
.1 Grade I: horizontal position (latitude, longitude), SOG, COG, and
time;
.2 Grade II: heading, rate of turn, STW and CTW in addition to Grade
Ifootnote;
.3 Grade III: altitude, and depth in addition to Grade II; and
.4 Grade IV: heave, pitch, and roll (and may be surge, sway, and yaw with
higher performance) in addition to Grade III.
44 Performance requirements on each set of PNT output data are described in terms of
accuracy and integrity, whereby several levels are specified to address the
diversity of operational as well as technical requirements (see figure 6).
Figure 6: Generic performance level for each PNT output data in relation to
accuracy and integrity
45 Numbers and thresholds of operational performance levels per PNT data type should
be compliant with existing performance standards and resolutions, e.g. A.1046(27), for horizontal positioning results into two operational
accuracy levels: A (better than 100 m) and B (better than 10 m) to 95% confidence;
A.915(22) specifies the future need for two additional operational accuracy levels:
C (better than 1 m) and D (better than 0.1 m).
46 In addition, the introduction of technical performance levels (A.1, A.2, B.1, B.2,
…) enables a graduated specification of task- and application-related requirements
on PNT data. Furthermore, it prepares a need-driven evaluation and indication of
accuracy.
47 Integrity data per each individual PNT output data should be provided to indicate
the further usability of data. The value of included integrity information depends
on applied principles of integrity evaluation in relation to a dedicated accuracy
level:
-
.1 None: Unavailable integrity evaluation;
-
.2 Low: Integrity evaluation based on plausibility and consistency checks
of data provided by single sensors, systems, services, or sources;
-
.3 Medium: Integrity evaluation based on consistency checks of data
provided by different sensors, systems, services, and sources with
uncorrelated error partsfootnote as far as possible; and
-
.4 High: Integrity evaluation based on estimated accuracy (protection
level).
48 As a result of preceding paragraphs, the performance of an individual PNT output
data (requirement as well as result of evaluation) should be defined by specified
accuracy and integrity levels.
49 Accuracy and integrity levels should be defined for all PNT data of the supported
application grade or a combination of them (see figure 7) to ensure that the
requirements on data output of a PNT-DP are comprehensively specified.
Figure 7: Composition of requirements on PNT/I output data (application grade II
as example)
50 Figure 8 illustrates the interdependencies between application grade and supported
performance levels in relation to current and future nautical tasks and applications
(exemplified).
Figure 8: Illustration of interdependencies between application grade, performance
level, and nautical tasks / applications
B.2 Pre-processing
B.2.1 Objective
51 The pre-processing prepares the input data for main processing and pre-evaluates
the feasibility of data processing methods supported by main processing under
current conditions.
B.2.2 Functional and methodical aspects
B.2.2.1 Evaluation of input data
52 Data streams received from input data-providing entities should be time-stamped
with the time of reception using system time of the PNT-DP. The system time should
be synchronized with a common time base by using the input data of an appropriate
source, preferably UTC.
53 Incoming data provided by sensors, systems and services should be evaluated with
respect to:
54 The evaluation of a data stream received from an input data-providing entity
should comprise the following methods:
-
.1 The correctness of transmitted input data should be checked with
respect to the rules of the protocol in use (completeness, parity,
etc.). Incorrect data should be excluded from further processing.
-
.2 It should be checked if the expected data update rate, as needed for
main processing, is met. If the determined update rate implies a latency
violation, the data should be marked accordingly.
55 The evaluation of data content should comprise the following methods:
-
.1 Parameters describing the characteristics of the input data-providing
entity should be analysed to identify which following processing steps
are applicable. Such parameters include performance parameters, such as
number and type of measurements (e.g. GPS/DGPS); and status parameter,
such as healthy/unhealthy.
-
.2 Data describing the performance of input data should be analysed to
identify the following processing steps that are applicable. Such
parameters include performance parameters like UERE, HPL; and time of
data validity, as available, with respect to latency limitations.
-
.3 Plausibility and consistency of data should be tested with respect to
appropriate value ranges and thresholds. Data failing those tests should
be marked accordingly. Data of former epochs may be used to detect
dynamic value ranges and thresholds.
56 Input data provided by sensors, systems, and services should be marked as invalid
if the data sources (e.g. sensors and services) have indicated that they are
invalid.
57 Input data provided by sensors, systems and services should be excluded from
further PNT data processing, if:
-
.1 data is indicated as invalid;
-
.2 the identified violation of latency, plausibility, or consistency
-
.1 is in an order which is intolerable for the accuracy level
intended in minimum by the PNT-DP; or
-
.2 cannot be managed by the PNT-DP in a sufficient manner to
avoid unintended degradations of PNT output data.
B.2.2.2 Temporal/spatial adjustment of input data
58 Input data which have passed the evaluation tests should be adjusted spatially and
temporally within a Consistent Common Reference System (CCRS), where required, to
meet the specified accuracy level.
59 The method for the time synchronization should provide a common timescale
referenced to the system time of the PNT-DP, preferably given in UTC. The resolution
of time synchronization shall not degrade that of input data.
60 The timescale used for time synchronization should also be used to trigger the
complete data processing: pre-processing, main processing, and post-processing. All
spatially-related information should use a CCRP. If CCRP transformation fails, this
should be indicated by corresponding status data.
B.2.2.3 Feasibility evaluation of main processing
61 The feasibility of main processing should be assessed in relation to individual
processing channels and their requirements on data input.
62 A method performing the feasibility evaluation in relation to an individual main
processing channel should include test procedures and thresholds reflecting its
requirements on data input.
63 The evaluation results should be provided by internal status data to control the
operation of each supported processing channel.
64 The results of the feasibility evaluation enable an early indication of
performance degradation in relation to supported performance levels.
B.2.3 Results of pre-processing
65 Results of pre-processing should comprise:
-
.1 input data indicated as usable, time-stamped with a common time base,
preferably UTC, and spatially adjusted;
-
.2 metadata to describe characteristics of usable input data;
-
.3 internal status data describing the current status of pre-processing;
-
.4 internal status data for controlling of main processing; and
-
.5 internal integrity data as results of evaluation of input data
utilized by main processing.
B.3 Main processing
B.3.1 Objective
66 The main processing serves to improve PNT data provision by applying appropriate
methods for completion, refinement and/or integrity evaluation.
B.3.2 Functional and methodical aspects of PNT data generation
67 Within main processing, the pre-evaluated input data (from sensors, systems and
services,) should be used to feed at least one data processing channel.
68 The feasibility evaluation results of pre-processing (B.2.2.3), provided as
internal status data, should be used as a control parameter during main processing
to activate/deactivate individual processing channels.
69 Each processing channel should be specified by the set of supported methods
generating PNT data, integrity data, and status data.
70 Each processing channel should provide at least one, preferably several or all PNT
data types including associated integrity and status data.
71 Main processing should, if available, combine single or multiple data processing
channels, to increase the performance of accuracy, integrity, continuity,
availability, and resilience of PNT data provision. Methods should be provided to
manage changes in data input, e.g. changes in availability of external service data.
72 The main processing stage should generate status data on the mode and progress of
data processing for PNT data output.
B.3.2.1 Number and types of processing channels
73 A single processing channel should provide some or all intended PNT data and
associated integrity data (see channel 1 to 3 in figure 9).
74 The number of processing channels operated in parallel should ensure at least the
provision of all PNT output data in the designated application grade and the
supported accuracy and integrity levels.
75 The methods provided by an individual processing channel should at least ensure
that the intended PNT output data are provided with the intended accuracy and
integrity when the requirements on data input are met (nominal conditions).
Figure 9: Illustration of processing channels being operated parallel within main
processing
76 More than one processing channel should be supported for the provision of one type
of PNT data and associated integrity data (see figure 9),
-
.1 if different accuracy and integrity levels are supported by
application of different methods for data processing, or
-
.2 if an increase of reliability and resilience is aimed by parallel
processing of largely independent input data with the same methods.
77 Parallel processing channels should differ in used input data, or applied methods,
or both. These differences may result in measurable differences in PNT data output:
-
.1 The additional use of augmentation data should improve the accuracy of
PNT output data by application of corrections, or should enhance the
integrity evaluation with independent evaluation results, or should
serve both.
-
.2 If parallel processing channels are equipped with the same methods and
are fed with largely independent input data, the results of those
channels should cover the same types/set of PNT data. The PNT data can
be used alternatively for data output due to its independence and should
be used internally for integrity evaluation.
-
.3 Enhanced processing channels should combine multiple types of input
data to enable the application of effective methods during data
processing such as:
-
.1 self-correction (e.g. dual-frequency GNSS signal
processing to correct ionospheric path delays; noise
reduction by filtering);
-
.2 self-controlling (e.g. detection and exclusion of
outliers), self-evaluation (e.g. consistency tests or
estimation of protection level as overestimate of expected
inaccuracies); and/or
-
.3 self-management (e.g. failure compensation by
interpolation or extrapolation in a common model of
movement).
-
.4 The capability of enhanced processing channels can be increased if
redundancy in data input enables the simultaneous and coordinated use of
effective methods such as self-correction, self-controlling,
self-evaluation, and self-management.
78 The need for the provision of reliable and resilient PNT data requires that at
least a parallel processing channel should be implemented as a fall-back solution
for an enhanced processing channel, which is more sensitive to availability of data
input (Fall-back may not be available after loss of sensitive input data).
79 Ultimately, the number and types of parallel processing channels is determined by:
-
.1 the supported application grade as well as supported accuracy and
integrity levels of aimed PNT data output;
-
.2 arranging of data processing methods to single channels; and
-
.3 the aimed level of reliability and resilience of PNT data specifying
the residual need for fall-back solutions per application grade and
assigned accuracy and integrity levels.
B.3.2.2 Methods to refine PNT data
80 An improvement to accuracy for several or all PNT data types by a processing
channel is achieved if one, or a combination of the following methods, is applied:
-
.1 methods applying augmentation data provided by recognized services and
external sources (if available and indicated as usable)
-
.1 to improve the accuracy of data by error correction (e.g.
GNSS range and range rate corrections);
-
.2 to exclude faulty or disturbed data taking into account
integrity evaluation results (e.g. health indicator of GNSS
signals provided by Beacon or SBAS); and
-
.3 to apply performance indicators provided for individual
data to control its influence on potential PNT data output
(e.g. weighting within data processing);
-
.2 methods utilizing redundancy in the database
-
.1 for self-determination of corrections and application
(e.g. dual-frequency signal processing to correct
ionospheric path delays);
-
.2 for self-reliant detection and exclusion of faulty data
(e.g. FDE by RAIM); and
-
.3 for self-determination of performance indicators for
used/derived data to weight its influence on potential PNT
data output; and
-
.3 methods utilizing redundancy in database for application of enhanced
algorithm such as
-
.1 equalization calculus based on an overdetermined set of
input data (e.g. 3-dimensional attitude determination with
GNSS); and
-
.2 filtering with adaptive and/or assisted measurement and
transition models (e.g. deeply coupled GNSS/INS
positioning).
81 Fall-back solutions should be provided by simultaneously operated processing
channel(s) providing the same PNT data with a lower accuracy level by application
of:
82 A redundant solution for a single processing channel should be supported by at
least one simultaneously operated processing channel providing independent PNT data
types with the same accuracy levels by applying:
-
.1 methods operating with different input data to ensure independency in
relation to data input-providing systems, services or sensors; and/or
-
.2 methods differing in error influences in relation to data input and
processing.
83 Both, fall-back and redundant solutions should provide an improved resilience of
PNT data provision by:
-
.1 using fall-back solutions with an acceptable limit of loss of data
accuracy; and
-
.2 using redundant solutions with respect to continuity and reliability
of PNT data provision in relation to each supported accuracy level.
B.3.2.3 Methods to evaluate PNT data
84 Integrity evaluation should be based on methods that test the plausibility or
consistency of potential PNT output data or methods to estimate the current size and
behaviour of its individual errors (e.g. noise), error budgets (e.g. ranging error),
or resulting errors (e.g. inaccuracy of SOG). An integrity evaluation should be
assigned to each processing channel in relation to the nominally designated PNT data
output (taking into account currently used data input).
85 Generally, the applied method of integrity evaluation determines the achieved
integrity level:
-
.1 Level None: Failed, unavailable or incomplete integrity evaluation by
the processing channel methods and should be regarded as having no
integrity.
-
.2 Level Low: The integrity evaluation of the processing channels,
dealing with the refinement or completion of data provided by single
sensors or measuring systems, should only be based on plausibility and
consistency tests in relation to models of the individual sensor and
system:
-
.1 Plausibility tests should prove if data types are within
an expected value range (e.g. ship's speed). The expected
value range should ultimately determine the detectability of
errors (e.g. indicated speed over ground is much higher than
ship's maximum speed).
-
.2 Simple consistency tests should prove, either that
successive data follows an expected time behaviour (e.g.
range and range rate), or that multiple outputs of data are
compliant within a common measurement model (e.g. position
and speed determined by different methods). Consistency
should be assumed if the difference between compared values
is smaller than a specified threshold describing the
tolerable relative error between both.
-
.3 Enhanced consistency tests should evaluate the expected
consistency between used input data and achieved processing
result, whereby thresholds used (e.g. in statistical
hypothesis tests) should be conditioned in relation to
accuracy requirements on output data.
-
.4 Enhanced consistency tests should be applied iteratively
with methods detecting and excluding most likely faulty
input data or intermediate processing results, if supported
redundancy of input data enables the application of such
tests. This is an appropriate method to improve accuracy and
integrity of output data (e.g. RAIM).
-
.3 Level Medium: If the capability of simple, as well as enhanced
consistency tests should be increased, the tests should be performed
with data provided from different sensors and measuring systems with
largely uncorrelated error influences:
-
.1 If the degree of correlation in the error margin as well
as in the data itself is not taken into consideration, the
difference of compared values should not be considered as an
estimate of absolute accuracy.
-
.2 If the error margin of compared values is completely
uncorrelated, the difference between both values has to be
smaller than the sum of tolerable inaccuracies per
considered value. In this case the consistency test serves
the evaluation, if pre-specified accuracy levels are met.
Largely uncorrelated data may inherit partially correlated errors. These
errors remain undetected by consistency checks. If the thresholds used
during evaluation take the existing uncertainties into account the
consistency tests should continue as method to evaluate the fulfilment
of certain accuracy levels.
-
.4 Level High: The highest performance of integrity evaluation should
provide a reliable estimate of the inaccuracy of a single PNT data type.
This implicates the necessity to determine the absolute magnitude of
significant errors and resulting consequences for the accuracy limits of
single PNT output data.
86 As described in the previous paragraphs, each integrity evaluation method needs
pre-specified and/or instantaneously determined thresholds to enable the evaluation
processes.
87 Generally, integrity evaluation methods applied by a processing channel should be
able to adapt the used thresholds on the accuracy level of PNT data provision
currently supported.
88 As a minimum, a processing channel should provide integrity data in relation to
single PNT output data. It should also cover the results of integrity evaluation as
well as information on the supported level of integrity evaluation (applied method
and current feasibility).
B.3.2.4 Methods to complete PNT data
89 Hardware redundancy in sensors, systems, and services enables the application of
further methods dealing with alternative generation of standard PNT output data
(e.g. heading determination with data from 2 or 3 GNSS receivers) and/or the
provision of further data types for PNT output (e.g. torsion monitoring of ship's
hull).
90 Methods for alternative generation of standard PNT output data should only be
applied, if the resilience of PNT data provision is significantly increased. Aspects
of error correlation and propagation should be considered carefully, if methods are
being operated on the same database.
91 Any further methods may be applied to generate additional PNT output data, as long
as performance degradation of required PNT data provision is avoided. It is
recommended to facilitate those methods by implementing additional processing
channels.
B.3.2.5 Methods to provide status data
92 Status data should be considered as part of the potential PNT data output; to
report current usability of available sensors, systems, and services as well as the
feasibility and performance of supported data processing channels and methods.
93 Each processing channel should support the generation of status data at PNT data
output by application of own methods to describe or update the status based on:
B.3.3 Functional and methodical aspects of PNT data output selection
94 The selection of a PNT data output should be based on data provided by active
processing channels that are operated in parallel.
95 The supported combination of processing channels defines the specific method to be
applied for selecting the PNT output data including associated integrity and status
data.
96 The selection process should comprise:
-
.1 an evaluation of the results of each individual processing channel
regarding its intended performance level of PNT/I data provision;
-
.2 consistency checks between results of individual processing channels
on the basis of a common PNT data model; and
-
.3 the selection of a single set of PNT/I output data based on predefined
assessment rules (redundancy and degradation).
97 The method for performing the selection process requires an unambiguous
classification and ranking system of:
-
.1 intended results of each processing channel under normal operating
conditions; and
-
.2 degraded results of each processing channel in the case of disturbed
operating conditions (as results of degradations and/or breakdowns of
data input and processing),
in relation to its potential utilization for PNT data output. The method should
analyse associated integrity and status data as real-time indicator for the current
functionality and performance of each processing channel.
98 The classification of data performance should be based on accuracy and integrity
levels used for the specification of operational and technical requirements per
single type of PNT data (see section B.1.3).
99 For each type of PNT data the ranking system defines the relationship between
certain accuracy and integrity levels and "best"/"worst" PNT data output:
-
.1 If a certain accuracy and integrity level is only supported by a
single processing channel, the achieved integrity level should dominate
the selection, as illustrated in figure 10.
-
.2 If a certain accuracy and integrity level is supported by more than
one channel,
-
.1 under nominal operation conditions the selection of data
should follow the configured prioritization; and
-
.2 in case of performance degradations the selection should
be in compliance with the prioritization, as illustrated in
figure 7.
-
.3 If the same accuracy/integrity level is met by two or more processing
channels, the priority should be given to the results of the processing
channels operated under nominal conditions.
Figure 10: Ranking list for safety-relevant PNT data
100 The selection process should ensure that PNT data and related integrity data are
associated by selecting data provided by the same or assigned processing channel.
101 The selection process should be considered as failed,
-
.1 if the pre-processing detects the unfeasibility of data processing for
all supported processing channels; or
-
.2 if none of the processing channels provide any type of PNT data with
an increase of accuracy and/or integrity.
102 A failed selection process should be indicated by status data marking the current
output data as unusable. For this purpose status data provided by pre-processing
should be taken into account and updated.
103 The selection process should include methods ensuring that the status reporting
of the PNT-DP to connected navigational systems is presented to the bridge-team.
104 External status communication should be restricted to the PNT-DP output data only
and should comprise at least of status indications in case of changes of the
operational status of the PNT-DP with impacts on:
-
.1 the available processed "best" data types;
-
.2 the current accuracy and integrity (operational and technical level);
and
-
.3 the PNT-DP system status, which may include information on unusable or
degraded input data to support failure detection by the operator.
B.3.4 Results of main processing
105 The results of main processing are:
-
.1 the selected PNT data for output;
-
.2 associated integrity data;
-
.3 metadata to describe the characteristics of selected output data (e.g.
source and processing identifier);
-
.4 status data describing the current status of main processing;
-
.5 internal status data for controlling of post-processing; and
-
.6 internal integrity data contributing to integrity data at output of
PNT-DP.
106 PNT data currently determined by the main processing may be fed back into
pre-processing to support the evaluation of the subsequent sensor, system and
service data.
B.4 Post-processing
B.4.1 Objective
107 The post-processing checks completeness of selected PNT output data (PNT data,
integrity data, and status data) from main processing and generates output data
streams.
B.4.2 Functional and methodical aspects
B.4.2.1 Completeness check of PNT output data
108 The PNT integrity and status data, which has been selected by main processing for
output, should be checked using the following methods:
-
.1 check of completeness and timeliness of selected output data in
accordance with the nominal configuration of the PNT-DP (application
grade, accuracy and integrity level, update intervals, intended status
reporting);
-
.2 check if the required update interval is achieved per output data of
PNT-DP; and
-
.3 check of availability of output data in relation to supported message
formats.
109 The results of applied checks should be used to update/complete the status data
for output.
B.4.2.2 Generation of output data streams
110 Standard messages should be used to provide the selected PNT data output.
Proprietary message formats may be used to provide additional data; if used, their
format specification should be disclosed.
111 The provision of individual messages is repeated to provide the last valid data
set of included PNT data in the following situations:
112 Each of the composed messages should contain PNT system time, preferably UTC.
113 A source indication for provided PNT data should be included.
114 If PNT output data streams are provided to external applications, they should, as
far as possible, conform to existing maritime interface standards based on the IEC
61162 series.
115 An important benefit of PNT-DP is the provision of integrity data associated with
the PNT data at output. Therefore, the messages at output should support the
provision of additional integrity data, whereby:
-
.1 the integrity data per provided PNT data type should include a
reference to the supported accuracy and integrity level;
-
.2 additional metadata may flag the used integrity method; and
-
.3 the provided integrity data should include the result of the integrity
evaluation process performed. Such data should contain at least
parameters of error distribution.
B.4.3 Results of post-processing
116 Results of post-processing should comprise:
-
.1 messages carrying the selected PNT data together with associated
integrity data in a specified message format. Both enable the subsequent
connected equipment to identify whether the provided data is usable for
its dedicated nautical application (e.g. automated track-control); and
-
.2 status messages reflecting the health status of the entire PNT-DP.