GNSS Integrity and RAIM: A Practical Introduction

Key Takeaways

• Accuracy tells you how close the solution may be; integrity tells you whether it can be trusted.
• RAIM uses redundant observations to detect or exclude faults, but it is only one part of an integrity framework.
• For a safety-related operation, the protection level must remain below the application alert limit.

Most GNSS projects begin with accuracy, RTK fix status, or PPP convergence time. These matter, but they cover only half of the problem. The other half is trust.

A receiver can report a smooth position while a faulty observation or slowly growing multipath bias pulls the solution away from the truth. In safety-related applications, the greater danger is often not the error itself, but an error that remains undetected.

1. What Are Integrity and RAIM?

Integrity is a performance property and, in safety-related systems, a requirement. It describes whether the system can warn the user when a position should no longer be trusted. RAIM, or Receiver Autonomous Integrity Monitoring, is one receiver-side method used to support that goal. It checks whether redundant satellite observations are consistent with the navigation solution.

Accuracy describes the expected position error. Integrity covers the risk of an undetected unacceptable error. Availability is different again: it describes how often the system can meet both the accuracy and integrity conditions for the intended operation.

2. Integrity: Defining the Trust Boundary

The Alert Limit (AL) is the largest position error an application will accept. The Protection Level (PL) is a statistical error bound calculated from geometry, measurement noise, error models, and assumed faults; it is commonly reported as HPL and VPL. Time to Alert (TTA) defines how quickly a warning must be issued.

The operating rule is simple: PL must remain below AL. If PL reaches or exceeds AL, the system should alert or degrade even when the displayed trajectory looks smooth. Hazardously Misleading Information (HMI) is the dangerous case in which the true error exceeds the allowed boundary but no timely warning is issued.

PL is not a measurement of the actual error. It is a conservative bound whose credibility depends on the noise model, fault hypotheses, prior fault probabilities, and integrity-risk allocation. An optimistic model can produce a small PL without producing real protection.

Figure 1. Integrity monitoring compares protection levels with application alert limits before deciding whether a position remains usable.

3. From Traditional RAIM to ARAIM

A three-dimensional GNSS solution needs at least four satellite measurements to estimate position and receiver clock offset. Additional observations provide redundancy. Traditional RAIM tests residual consistency; with sufficient geometry, Fault Detection and Exclusion (FDE) can remove a suspected observation. Five satellites may support basic detection and six may support exclusion in a simple single-fault model, but geometry and measurement quality still control availability.

Modern dual-frequency, multi-constellation systems need broader fault models. Advanced RAIM (ARAIM) commonly uses solution separation or Multi-Hypothesis Solution Separation (MHSS): an all-in-view solution is compared with subset solutions representing satellite and constellation fault hypotheses. This can cover multiple simultaneous faults and constellation-wide events, provided their probabilities and error bounds are defined by the integrity support assumptions.

More satellites improve geometry and subset availability, but do not remove the need for trustworthy inputs. ARAIM relies on assumptions such as nominal range-error bounds and prior satellite or constellation fault probabilities, often supplied through an Integrity Support Message or an equivalent service concept.

Figure 2. RAIM checks whether redundant observations agree; an inconsistent measurement may trigger fault detection or exclusion.

4. Where RAIM Stops

RAIM works best when one observation disagrees with the majority. Common-mode errors are harder: correlated multipath, ionospheric anomalies, spoofing, or slowly growing biases may move several measurements together without producing an obvious outlier. RAIM detects inconsistency; it does not repair poor signals.

High-precision RTK and PPP add carrier-phase failure modes that pseudorange RAIM does not fully cover. Integrity monitoring must also address cycle slips, C/N0 changes, correction age and continuity, and incorrect ambiguity fixing. A wrong integer fix can look precise and remain stable while being biased by decimeters or more. Ratio tests help validate ambiguities, but their thresholds and false-fix risk must be tied to the application's integrity budget.

Practical systems therefore combine receiver checks with SBAS, GBAS or PPP-RTK integrity data, inertial sensors, map constraints, spoofing monitors, and defined fallback behavior.

5. Quantitative Context

Alert limits and response times are set by the operation, not by GNSS alone. The values below are useful engineering references, not universal standards. Aviation values vary by approach service; road and UAV values are usually project-level safety targets.

The practical response also differs. An aircraft may discontinue an approach, a vehicle may slow down or transfer control, and a UAV may hover or abort landing. Integrity is therefore a positioning requirement and a system-control requirement at the same time.