Source-linked AI summary
Integrity and Credibility in Navigation: From Error Characterization to Operational Assuran
Penggao Yan, Baoshan Song, Yuan Li, Ronghe Jin, Li-Ta Hsu
TL;DR
Navigation assessment must distinguish actual error from reported uncertainty and determine whether information is suitable for a specified operation. The paper compares integrity risk with the credibility of the uncertainty and risk claims supporting it, showing through three hypothetical scenarios that accuracy, credibility, and integrity judgments can diverge.
Problem
Navigation decisions often depend on information whose true positioning error is unavailable during operation, while safety-critical use must meet specified risk and warning requirements.
Source: §1 · p. 1, §2.2 · p. 3, §3.1 · p. 3Method
The paper compares integrity and credibility by distinguishing realized error from reported uncertainty and examining operational risk requirements, evidence usage, and modeling assumptions.
Source: §1 · p. 2, §2.1 · p. 2, §3.1 · p. 3Results
Three hypothetical cases show that poor accuracy can coexist with credible uncertainty and avoided hazardous unwarned use, contradicted uncertainty can occur without a hazardous event, and one hazardous event alone does not establish excessive population risk.
Source: §5 · p. 5Takeaways & Limitations
Navigation assessment should keep actual outcomes, the justification for uncertainty or risk claims, and suitability for the intended operation as distinct questions.
Source: §6 · p. 6A model-based risk estimate represents operational risk only when its error, dependence, fault, and probability assumptions represent the relevant operation.
Source: §3.2 · p. 3
Abstract
from arXiv · showhide
Navigation integrity and estimator credibility use error and uncertainty information to address different questions. This perspective distinguishes actual positioning error from reported statistical characterizations, formulates integrity as control of hazardous unwarned-use risk under the requirement of a specified operation, and describes credibility as the justification of an uncertainty or risk claim by its evidence usage and modeling process. Three hypothetical scenarios show how deteriorated accuracy, a contradicted uncertainty report, and a hazardous event can lead to different credibility and integrity judgments. The resulting assessment asks what happened, why the reported claim should be believed, and whether the information is sufficient for the intended operation.
1 Introduction
Navigation assessment must address more than estimated position or observed accuracy: operational use depends on risk requirements and on whether supporting uncertainty claims are justified. The paper distinguishes integrity from credibility and explains why neither can substitute for the other.
1 Introduction
- In safety-critical use, integrity concerns hazardous misleading use without a timely warning, not simply whether current or average position error is small.The risk requirement includes an allowable error tolerance, a limit on hazardous misleading use, and a warning deadline for the specified operation.Source: §1 · p. 1
- Because true positioning error is usually unavailable during operation, integrity monitoring infers or bounds risk from statistics and models whose relevance depends on how well they represent actual error and fault processes.Understated variance, omitted correlation or fault modes, and inappropriate tail assumptions can weaken the connection between a correctly executed calculation and the real operation.Source: §1 · pp. 1–2
- Credibility concerns whether uncertainty or risk reports are justified by their statistical support, evidence usage, and modeling assumptions; integrity concerns hazardous unwarned-use risk for a specified operation.The paper extends estimator credibility from self-assessed error statistics to uncertainty and navigation-risk reports.Source: §1 · p. 2
- The paper systematically compares the concepts’ objects, probability claims, supporting evidence, and roles in operational decisions, emphasizing that uncertainty coverage is not automatically an integrity protection bound.A large error or hazardous realization alone also does not establish that a credibility claim has failed.Source: §1 · p. 2
2 Positioning Error and Uncertainty Characterization
The section separates realized positioning error from reported statistical descriptions of error. Since true state is usually unavailable during operation, decisions must rely on reported uncertainty, error models, and monitoring information.
2.1 Position Estimate and Actual Error
- Realized positioning error is determined by the true state and the estimate, so it describes what actually happened rather than an estimator-produced uncertainty measure.It can be evaluated retrospectively when a sufficiently accurate reference is available, but the true state is usually not directly available during normal operation.Source: §2.1 · p. 2
2.2 Reported Error and Uncertainty Information
- Reported error information can characterize the error distribution through intended mean or second-moment statistics, probability regions, or bounds indexed by a nominal probability level.A radius r_t(α) may claim Pr(|e_t| ≤ r_t(α)) ≥ 1 − α; these reports are not the realized error itself.Source: §2.2 · pp. 2–3
- Because current error generally cannot be observed, task decisions use reported uncertainty, statistical error models, and monitoring information; safety-critical use must also meet specified operational risk and warning requirements.Source: §2.2 · p. 3
3 Navigation Integrity
Navigation integrity frames continued use as an operation-specific risk question: whether hazardous misleading information can remain available without an effective warning. Its model-based argument depends on assumptions representing the operation.
3.1 Integrity as an Operational Risk Requirement
- Integrity risk is the probability that information remains declared available while actual error exceeds AL and the user is not effectively warned within TTA during the specified operation.AL is the task’s error tolerance, TTA the maximum permitted warning delay, and the risk is judged against the allowed requirement for that operation.Source: §3.1 · p. 3
3.2 Assumptions Underlying an Integrity Argument
- An integrity argument uses probability models to evaluate or bound unobservable actual risk, relying on nominal error models, dependence, fault hypotheses, and fault probabilities.Source: §3.2 · p. 3
- A model-based estimate is not automatically actual operational risk; its connection to the operation depends on whether the assumptions represent relevant errors, dependencies, faults, and their probabilities.Conservative Gaussian overbounds for heavy-tailed GNSS errors can inflate protection levels and reduce availability, while operation-level risk must account for temporal dependence [10],.Source: §3.2 · p. 3
- The integrity requirement states how small hazardous unwarned-use risk must be, while the integrity argument supplies a model-based route from observable information to that requirement.Source: §3.2 · pp. 3–4
4 Credibility
Credibility asks whether reported uncertainty and risk claims are justified by their evidence and modeling process. The section describes sources of credibility failure and diagnostics for assessing reported uncertainty.
4.1 Credibility of Uncertainty and Risk Characterizations
- Credibility concerns whether evidence and modeling adequately support statistical characterizations of positioning uncertainty or navigation risk.Examples include dispersion, coverage, and risk reports.Source: §4.1 · p. 4
4.2 Sources of Credibility Failure
- Credibility depends on whether evidence selection, combination, and weighting support the report; omitted dependence can understate combined uncertainty.Stale or selective evidence and inappropriate weighting can also weaken the evidence-to-claim inference.Source: §4.2 · p. 4
- Model inadequacy includes dispersion mismatch (NMM) and structural mismatch (SMM), which can produce different estimation-error effects and require different evidence and corrective actions.SMM may produce location shift, bias, or another systematic deviation [12].Source: §4.2 · p. 4
4.3 Representative Credibility Diagnostics
- NEES and NCI compare realized errors with reported second-moment information when reference truth is available; NIS tests innovations against an assumed model when truth is unavailable.NLL and the energy score assess calibration and sharpness, providing complementary evidence for uncertainty-report credibility.Source: §4.3 · pp. 4–5
5 Integrity and Credibility: Distinction and Relationship
Integrity concerns whether hazardous, unwarned navigation use meets the risk requirement for a specified operation; credibility concerns whether the claims supporting an integrity argument are justified. Three hypothetical scenarios illustrate how accuracy, credibility, and integrity can yield distinct judgments.
5 Integrity and Credibility: Distinction and Relationship
- Credibility supports the claims used in an integrity argument, while integrity judges whether resulting operational risk satisfies the specified operation’s requirement.A credible characterization can still indicate uncertainty or risk too high for continued use; an integrity claim’s assumptions may still need credibility assessment.Source: §5 · p. 5
- Poor accuracy can coexist with a credible uncertainty report and avoided hazardous unwarned use when an evidence-based protection decision withdraws information with a timely warning.The scenario describes deteriorating error and an enlarged uncertainty report.Source: §5 · p. 5
- An omitted sensor dependence can make reported covariance too small despite small current error, with independent validation contradicting the report even absent a hazardous event.Source: §5 · p. 5
- A hazardous event may expose unsupported assumptions or reflect modeled residual risk; one event alone does not establish that population risk exceeds IRreq.The scenario is a Hop: error exceeds AL for the prescribed duration without an effective warning within TTA.Source: §5 · p. 5
6 Conclusion
A complete safety-critical navigation assessment keeps realized performance, claim justification, and operational acceptability distinct.
6 Conclusion
- Assess what happened, why the uncertainty or risk claim is justified, and whether the information suffices for continued use in the specified operation.Source: §6 · p. 6